go-delve/delve · error

could not get process list: %v

Error message

could not get process list: %v

What it means

waitForSearchProcess polls the Windows process list (CreateToolhelp32Snapshot) to find a newly spawned process whose name matches a prefix — used for follow-exec style flows. If the snapshot cannot even be created, this error wraps the failure. A process snapshot fails when the caller lacks rights or the system is under resource pressure.

Source

Thrown at pkg/proc/native/proc_windows.go:227

	var tp sys.Tokenprivileges
	tp.PrivilegeCount = 1
	tp.Privileges[0].Luid = luid
	tp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED

	err = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (AdjustTokenPrivileges): %v", err)
	}

	return nil
}

func waitForSearchProcess(pfx string, seen map[int]struct{}) (int, error) {
	log := logflags.DebuggerLogger()
	handle, err := sys.CreateToolhelp32Snapshot(sys.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)
	}
	defer sys.CloseHandle(handle)

	var entry sys.ProcessEntry32
	entry.Size = uint32(unsafe.Sizeof(entry))
	err = sys.Process32First(handle, &entry)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)
	}

	for err = sys.Process32First(handle, &entry); err == nil; err = sys.Process32Next(handle, &entry) {
		if _, isseen := seen[int(entry.ProcessID)]; isseen {
			continue
		}
		seen[int(entry.ProcessID)] = struct{}{}

		hProcess, err := sys.OpenProcess(sys.PROCESS_QUERY_INFORMATION|sys.PROCESS_VM_READ, false, entry.ProcessID)
		if err != nil {

View on GitHub (pinned to a23773e6c3)

Solutions

1. Run Delve with sufficient rights (elevated) so process enumeration is allowed.
2. Check EDR/AV policies that may block CreateToolhelp32Snapshot.
3. Retry after a short delay if the failure was transient (snapshot creation can fail under load).
4. Check the wrapped Win32 error in %v for the exact cause (access denied vs. out of memory).

Example fix

// before
restricted> dlv attach <pfx-search>
// could not get process list: Access is denied.
// after
elevated> tasklist   // verify enumeration works
elevated> dlv attach <pfx-search>

// powershell: confirm the account can enumerate processes
tasklist /v /fo csv > $null; if ($LASTEXITCODE -ne 0) { Write-Error "cannot enumerate processes" }

for i := 0; i < 3; i++ {
    t, err := dbg.Attach(pid, nil)
    if err == nil { _ = t; break }
    if !strings.Contains(err.Error(), "could not get process list") { break }
    time.Sleep(100 * time.Millisecond)
}

When it happens

Trigger: Calling the attach/launch path that searches for a process by name prefix, and CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) returns an error (e.g. ERROR_ACCESS_DENIED on hardened systems).

Common situations: Running under restricted service accounts where process enumeration is blocked; EDR/AV blocking toolhelp snapshots; transient Win32 failures under heavy process churn.

Related errors

• %v also %v
• could not acquire debug privilege (OpenCurrentProcessToken):
• could not acquire debug privilege (LookupPrivilegeValue): %
• could not acquire debug privilege (AdjustTokenPrivileges): %
• lldb backend not supported on Windows

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/512ae403437a4db6. Report an issue: GitHub.