shadow1ng/fscan · error

local_pe_not_specified

Error message

local_pe_not_specified

What it means

WinServicePlugin.Scan requires the path of a local PE file in session.Config.WinPEFile to correlate against Windows service ImagePath entries. When that field is empty, the plugin returns this localized error and does not query services. It is a required-input precondition check.

Source

Thrown at plugins/local/winservice.go:31

	"github.com/shadow1ng/fscan/common"
	"github.com/shadow1ng/fscan/common/i18n"
	"github.com/shadow1ng/fscan/plugins"
)

type WinServicePlugin struct {
	plugins.BasePlugin
}

func NewWinServicePlugin() *WinServicePlugin {
	return &WinServicePlugin{
		BasePlugin: plugins.NewBasePlugin("winservice"),
	}
}

func (p *WinServicePlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	pePath := session.Config.WinPEFile
	if pePath == "" {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.GetText("local_pe_not_specified"))}
	}
	if _, err := os.Stat(pePath); err != nil {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.Tr("local_pe_not_found", pePath))}
	}

	absPath, _ := filepath.Abs(pePath)
	baseName := strings.TrimSuffix(filepath.Base(absPath), filepath.Ext(absPath))

	services := []struct {
		name    string
		display string
		start   string
	}{
		{fmt.Sprintf("WinDefendUpdate_%s", baseName), "Windows Defender Update Service", "auto"},
		{fmt.Sprintf("SysHealthMon_%s", baseName), "System Health Monitor", "delayed-auto"},
	}

	var output strings.Builder

View on GitHub (pinned to 95cc12e753)

Solutions

1. Set session.Config.WinPEFile to the PE path before calling Scan.
2. Ensure the CLI/config layer maps the PE-file option into Config.WinPEFile.
3. Validate required config fields before dispatching to local plugins.

Example fix

// before
cfg := &common.Config{} // WinPEFile ""
p.Scan(ctx, host, &common.ScanSession{Config: cfg})
// after
cfg := &common.Config{WinPEFile: "/opt/samples/svc.exe"}
p.Scan(ctx, host, &common.ScanSession{Config: cfg})

if cfg.WinPEFile == "" {
    return errors.New("winservice plugin requires Config.WinPEFile")
}

func hasWinPE(c *common.Config) bool { return c != nil && strings.TrimSpace(c.WinPEFile) != "" }

When it happens

Trigger: Calling Scan with Config.WinPEFile unset/empty — e.g. the winservice plugin was selected but the PE-file option was not provided on the command line or in the constructed Config struct.

Common situations: Missing CLI flag for the local PE file; programmatically built ScanSession omitting WinPEFile; config file lacking the win-pe-file field; a flag-parsing regression that drops the value.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• local_pe_not_specified
• local_pe_not_specified
• local_pe_not_found
• local_pe_not_specified
• local_pe_not_specified

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/41cc6a8354acbab2. Report an issue: GitHub.