shadow1ng/fscan · error

minidump_all_methods_failed

Error message

minidump_all_methods_failed

What it means

The MiniDump plugin tries several lsass dump techniques in sequence (direct dump, then regsave, etc.). If every method fails, Scan() writes the 'minidump_all_failed' marker and returns a failed Result whose Error is the localized 'minidump_all_methods_failed' sentinel. The real causes are hidden in the per-method output written to the Result's Output string.

Source

Thrown at plugins/local/minidump.go:133

		}
	} else {
		output.WriteString(i18n.GetText("minidump_av_skip_direct") + "\n")
	}

	// 方式2：comsvcs.dll（系统签名DLL，部分杀软不拦截）
	output.WriteString(i18n.GetText("minidump_try_comsvcs") + "\n")
	if ok := p.tryComsvcsDump(pm, &output, session); ok {
		return &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}
	}

	// 方式3：reg save 导出注册表 hive（离线破解，不碰 LSASS）
	output.WriteString(i18n.GetText("minidump_try_regsave") + "\n")
	if ok := p.tryRegSave(&output, session); ok {
		return &plugins.Result{Success: true, Type: plugins.ResultTypeService, Output: output.String()}
	}

	output.WriteString(i18n.GetText("minidump_all_failed") + "\n")
	return &plugins.Result{Success: false, Output: output.String(), Error: errors.New(i18n.GetText("minidump_all_methods_failed"))}
}

func (p *MiniDumpPlugin) tryDirectDump(ctx context.Context, pm *ProcessManager, output *strings.Builder, session *common.ScanSession) bool {
	pid, err := pm.findProcess("lsass.exe")
	if err != nil {
		output.WriteString(i18n.Tr("minidump_find_lsass_failed", err) + "\n")
		return false
	}

	if privErr := pm.elevatePrivileges(); privErr != nil {
		output.WriteString(i18n.Tr("minidump_privilege_failed", privErr) + "\n")
		return false
	}

	outputPath := filepath.Join(".", fmt.Sprintf("lsass-%d.dmp", pid))
	dumpCtx, cancel := context.WithTimeout(ctx, 15*time.Second)
	defer cancel()

View on GitHub (pinned to 95cc12e753)

Solutions

1. Read the full Result.Output — each method appends a specific failure reason (find lsass failed, dump write failed, etc.) — and fix that root cause.
2. Add an exclusion for the tool in the EDR/antivirus or run from a trusted path.
3. Check if lsass runs as PPL (registry LSA Protection); PPL blocks user-mode dumps and requires kernel-level techniques.
4. Ensure the output directory is writable and has space, then retry the scan.
5. Confirm the process is elevated — without admin all methods will fail.

Example fix

// before
res := plugin.Scan(ctx, session)
if !res.Success {
    log.Println(res.Error)
}
// after
res := plugin.Scan(ctx, session)
if !res.Success {
    log.Printf("%v\n detail: %s", res.Error, res.Output) // per-method reasons
}

// preconditions before scanning
// 1) elevated process, 2) writable output dir, 3) lsass present
if _, err := os.Stat(fmt.Sprintf("\\\\.\\pipe\\lsass")); err != nil {
    // cannot even probe; likely blocked by EDR
}

res := plugin.Scan(ctx, session)
if !res.Success {
    // Output carries per-method failure reasons; log all of them
    for _, line := range strings.Split(res.Output, "\n") {
        log.Println(line)
    }
}

When it happens

Trigger: Scan() falls through all dump strategies: tryDirectDump fails (lsass not found, dump file write fails, antivirus blocks it), and tryRegSave also fails, reaching the final errors.New(i18n.GetText("minidump_all_methods_failed")).

Common situations: EDR/antivirus blocking lsass access (common with Defender, CrowdStrike); lsass.exe running as PPL (Protected Process Light) on modern Windows; sysmon/secure output directory unwritable; non-English/renamed lsass on hardened hosts.

Related errors

• minidump_admin_required
• %s [minidump_process_not_found: %s]
• %s (LastError: %d) [minidump_write_dump_failed]
• %s: %v (LastError: %d) [minidump_open_process_failed]
• %s: %v (LastError: %d) [file_create_failed]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c6b82f2f1578f354. Report an issue: GitHub.