What causes "local_pe_not_found" in shadow1ng/fscan?

Run Test-Path on the scanning machine and fix the path in the config.

local_pe_not_found

Error message

local_pe_not_found

What it means

WinIFEOPlugin.Scan checks that the configured PE path actually exists via os.Stat before writing IFEO registry values. When Stat fails, Scan returns a failed Result with the localized "local_pe_not_found" message including the path. This prevents creating a Debugger hijack entry pointing at a nonexistent executable.

Source

Thrown at plugins/local/winifeo.go:32

	"github.com/shadow1ng/fscan/common/i18n"
	"github.com/shadow1ng/fscan/plugins"
)

type WinIFEOPlugin struct {
	plugins.BasePlugin
}

func NewWinIFEOPlugin() *WinIFEOPlugin {
	return &WinIFEOPlugin{BasePlugin: plugins.NewBasePlugin("winifeo")}
}

func (p *WinIFEOPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	pePath := session.Config.WinPEFile
	if pePath == "" {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.GetText("local_pe_not_specified"))}
	}
	if _, err := os.Stat(pePath); err != nil {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.Tr("local_pe_not_found", pePath))}
	}

	absPath, _ := filepath.Abs(pePath)

	// 劫持目标：不常用但系统存在的程序
	targets := []struct {
		exe  string
		desc string
	}{
		{"sethc.exe", i18n.GetText("winifeo_sticky_keys")},
		{"utilman.exe", i18n.GetText("winifeo_accessibility")},
		{"narrator.exe", i18n.GetText("winifeo_narrator")},
	}

	var output strings.Builder
	var successCount int

	for _, t := range targets {

View on GitHub (pinned to 95cc12e753)

Solutions

Run Test-Path <pePath> on the scanning machine and fix the path in the config.
Switch to an absolute local path (avoid UNC/network shares unless verified reachable).
Check antivirus quarantine logs and restore/exclude the PE if it was removed.
Verify read permission on the file and parent directories for the user running the tool.

Example fix

// before
session.Config.WinPEFile = "C:\\tools\\payl0ad.exe" // typo -> os.Stat fails
// after
p := "C:\\tools\\payload.exe"
if _, err := os.Stat(p); err != nil {
    log.Fatalf("fix WinPEFile: %v", err)
}
session.Config.WinPEFile = p

Defensive patterns

Strategy: validation

Validate before calling

// Verify the IFEO payload exists locally before running
if _, err := os.Stat(session.Config.WinPEFile); err != nil {
    return fmt.Errorf("check WinPEFile path %q: %w", session.Config.WinPEFile, err)
}

Try / catch

result := plugin.Scan(ctx, host, session)
if result != nil && !result.Success && strings.Contains(result.Error.Error(), i18n.GetText("local_pe_not_found")) {
    // fix path (typos, quarantine, UNC reachability) and retry
}

Prevention

Avoid UNC/network paths; copy the PE to a local absolute path first.
Check antivirus quarantine when a previously-working path suddenly fails.
Verify with Test-Path immediately before each scan run.

When it happens

Trigger: os.Stat(pePath) errors for a non-empty WinPEFile: wrong path, file moved/deleted, relative path broken by CWD, permission denied, or path on an unavailable drive.

Common situations: Path copied from docs or another machine without adjusting the drive, UNC path not reachable from the scanning host, antivirus quarantine, or case/typo mistakes in the executable name.

Understand the failure class

Background: "File not found" and ENOENT errors: why libraries can't find a file that should exist — this error's family across 50 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/4e64b6df3660ff44. Report an issue: GitHub.