go-delve/delve · error

could not get process list

Error message

could not get process list: %v

What it means

waitForSearchProcess polls the Windows process list (CreateToolhelp32Snapshot) to find a newly spawned process whose name matches a prefix — used for follow-exec style flows. If the snapshot cannot even be created, this error wraps the failure. A process snapshot fails when the caller lacks rights or the system is under resource pressure.

Solutions

1. Run Delve with sufficient rights (elevated) so process enumeration is allowed.
2. Check EDR/AV policies that may block CreateToolhelp32Snapshot.
3. Retry after a short delay if the failure was transient (snapshot creation can fail under load).
4. Check the wrapped Win32 error in %v for the exact cause (access denied vs. out of memory).

Example fix

// before
restricted> dlv attach <pfx-search>
// could not get process list: Access is denied.
// after
elevated> tasklist   // verify enumeration works
elevated> dlv attach <pfx-search>

// powershell: confirm the account can enumerate processes
tasklist /v /fo csv > $null; if ($LASTEXITCODE -ne 0) { Write-Error "cannot enumerate processes" }

for i := 0; i < 3; i++ {
    t, err := dbg.Attach(pid, nil)
    if err == nil { _ = t; break }
    if !strings.Contains(err.Error(), "could not get process list") { break }
    time.Sleep(100 * time.Millisecond)
}

When it happens

Trigger: Calling the attach/launch path that searches for a process by name prefix, and CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) returns an error (e.g. ERROR_ACCESS_DENIED on hardened systems).

Common situations: Running under restricted service accounts where process enumeration is blocked; EDR/AV blocking toolhelp snapshots; transient Win32 failures under heavy process churn.

Related errors

• could not acquire debug privilege (AdjustTokenPrivileges)
• could not acquire debug privilege (LookupPrivilegeValue)
• could not acquire debug privilege (OpenCurrentProcessToken)
• also
• bad size returned by _VirtualQueryEx

AI-assisted analysis of go-delve/delve@a23773e6c3 (2026-08-31). Data as JSON: /api/errors/512ae403437a4db6. Report an issue: GitHub.

Appendix: source

Thrown at pkg/proc/native/proc_windows.go:227

	var tp sys.Tokenprivileges
	tp.PrivilegeCount = 1
	tp.Privileges[0].Luid = luid
	tp.Privileges[0].Attributes = sys.SE_PRIVILEGE_ENABLED

	err = sys.AdjustTokenPrivileges(token, false, &tp, 0, nil, nil)
	if err != nil {
		return fmt.Errorf("could not acquire debug privilege (AdjustTokenPrivileges): %v", err)
	}

	return nil
}

func waitForSearchProcess(pfx string, seen map[int]struct{}) (int, error) {
	log := logflags.DebuggerLogger()
	handle, err := sys.CreateToolhelp32Snapshot(sys.TH32CS_SNAPPROCESS, 0)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)
	}
	defer sys.CloseHandle(handle)

	var entry sys.ProcessEntry32
	entry.Size = uint32(unsafe.Sizeof(entry))
	err = sys.Process32First(handle, &entry)
	if err != nil {
		return 0, fmt.Errorf("could not get process list: %v", err)
	}

	for err = sys.Process32First(handle, &entry); err == nil; err = sys.Process32Next(handle, &entry) {
		if _, isseen := seen[int(entry.ProcessID)]; isseen {
			continue
		}
		seen[int(entry.ProcessID)] = struct{}{}

		hProcess, err := sys.OpenProcess(sys.PROCESS_QUERY_INFORMATION|sys.PROCESS_VM_READ, false, entry.ProcessID)
		if err != nil {

View on GitHub (pinned to a23773e6c3)