shadow1ng/fscan · error

Keylogging failed: %w

Error message

Keylogging failed: %w

What it means

After the platform dispatch, startKeylogging wraps any error from the platform-specific keylogging goroutine with the localized keylogger_failed_plain prefix ("Keylogging failed"). It is a generic wrapper: the wrapped %w cause carries the real reason (device access denied, missing input devices, X11/wayland restrictions, unsupported platform, etc.).

Source

Thrown at plugins/local/keylogger.go:116

// startKeylogging 启动键盘记录
func (p *KeyloggerPlugin) startKeylogging(ctx context.Context, outputFile string, session *common.ScanSession) error {

	// 根据平台启动相应的键盘记录
	var err error
	switch runtime.GOOS {
	case "windows":
		err = p.startWindowsKeylogging(ctx)
	case "linux":
		err = p.startLinuxKeylogging(ctx)
	case "darwin":
		err = p.startDarwinKeylogging(ctx)
	default:
		err = fmt.Errorf("%s", i18n.Tr("unsupported_platform", runtime.GOOS))
	}

	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("keylogger_failed_plain"), err)
	}

	// 保存到文件
	if err := p.saveKeysToFile(outputFile, session); err != nil {
		session.LogError(i18n.Tr("keylogger_save_failed", err))
	}

	return nil
}

// checkOutputFilePermissions 检查输出文件权限
func (p *KeyloggerPlugin) checkOutputFilePermissions(outputFile string) error {
	file, err := os.OpenFile(outputFile, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.Tr("output_file_create_failed", outputFile), err)
	}
	_ = file.Close()
	return nil

View on GitHub (pinned to 95cc12e753)

Solutions

1. Inspect the wrapped cause (%w) in the error chain — fix that underlying issue, not this message.
2. On Linux, run with read access to /dev/input (root or input group membership).
3. On macOS, grant the process Accessibility and Input Monitoring permissions.
4. On headless/Wayland environments, use a supported capture path or skip keylogging.

Example fix

// before
$ ./agent --plugin keylogger            # as unprivileged user -> permission denied
// after
$ sudo ./agent --plugin keylogger       # or: sudo usermod -aG input $USER

if runtime.GOOS == "linux" {
    if f, err := os.OpenFile("/dev/input/event0", os.O_RDONLY, 0); err != nil {
        return fmt.Errorf("no input device access: %w", err)
    } else { f.Close() }
}

res := plugin.Scan(ctx, cfg)
if !res.Success && strings.Contains(res.Error.Error(), "Keylogging failed") {
    log.Printf("keylogger underlying cause: %v", errors.Unwrap(res.Error))
}

When it happens

Trigger: startWindowsKeylogging/startLinuxKeylogging/startDarwinKeylogging returned an error — e.g. Linux lacking /dev/input access or running without an X session, macOS lacking accessibility permissions, or the unsupported-platform error itself.

Common situations: Linux agent not run as root so /dev/input/event* is unreadable; macOS process lacking Accessibility/Input Monitoring permission; headless servers with no display to capture; Wayland sessions where X11 hooks do not work.

Understand the failure class

Background: "unsupported platform" / "not supported on this platform" errors: what they mean and how to fix them — this error's family across 47 libraries.

Related errors

• Unsupported platform: {{.Arg1}}
• unsupported_platform
• failed to get response about exploit: %s
• %w: %v
• smb_probe_failed: %w

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/8c325527b621578c. Report an issue: GitHub.