shadow1ng/fscan · error

local_pe_not_specified

Error message

local_pe_not_specified

What it means

WinLogonPlugin.Scan (Winlogon shell/userinit hijack plugin) requires a local PE file path in session.Config.WinPEFile because the Winlogon registry values must reference an executable. If the field is empty, Scan returns a failed Result with the localized "local_pe_not_specified" message before any registry modification. This is required-input validation.

Source

Thrown at plugins/local/winlogon.go:29

	"strings"

	"github.com/shadow1ng/fscan/common"
	"github.com/shadow1ng/fscan/common/i18n"
	"github.com/shadow1ng/fscan/plugins"
)

type WinLogonPlugin struct {
	plugins.BasePlugin
}

func NewWinLogonPlugin() *WinLogonPlugin {
	return &WinLogonPlugin{BasePlugin: plugins.NewBasePlugin("winlogon")}
}

func (p *WinLogonPlugin) Scan(ctx context.Context, info *common.HostInfo, session *common.ScanSession) *plugins.Result {
	pePath := session.Config.WinPEFile
	if pePath == "" {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.GetText("local_pe_not_specified"))}
	}
	if _, err := os.Stat(pePath); err != nil {
		return &plugins.Result{Success: false, Error: fmt.Errorf("%s", i18n.Tr("local_pe_not_found", pePath))}
	}

	absPath, _ := filepath.Abs(pePath)
	key := `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon`

	entries := []struct {
		name  string
		value string
		desc  string
	}{
		{"Userinit", fmt.Sprintf(`C:\Windows\system32\userinit.exe,%s`, absPath), i18n.GetText("winlogon_userinit_append")},
		{"Shell", fmt.Sprintf(`explorer.exe,%s`, absPath), i18n.GetText("winlogon_shell_append")},
	}

	var output strings.Builder

View on GitHub (pinned to 95cc12e753)

Solutions

1. Set the config option that populates session.Config.WinPEFile (e.g., --winpe-file <path>) before running the winlogon plugin.
2. Confirm the active config file/profile actually contains the key.
3. When calling Scan programmatically, assign the absolute PE path to session.Config.WinPEFile first.

Example fix

// before
// WinPEFile empty -> local_pe_not_specified
// after
session.Config.WinPEFile = "C:\\tools\\payload.exe"  // then run with plugin winlogon

// Ensure WinPEFile is configured before the winlogon plugin runs
if session.Config.WinPEFile == "" {
    return errors.New("winlogon requires session.Config.WinPEFile to be set")
}

result := plugin.Scan(ctx, host, session)
if result != nil && !result.Success && result.Error.Error() == i18n.GetText("local_pe_not_specified") {
    // prompt/abort: the local PE path option is mandatory for winlogon
}

When it happens

Trigger: Scan is invoked while session.Config.WinPEFile == "" — the winlogon plugin was enabled without the local PE path being set in the scan configuration.

Common situations: Forgot the --winpe-file flag when enabling winlogon, config file from another profile lacking the key, or a version change renamed the config field so the old key is ignored.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• local_pe_not_specified
• local_pe_not_specified
• local_pe_not_found
• local_pe_not_found
• local_pe_not_found

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/cb5a5c6941e298c1. Report an issue: GitHub.