shadow1ng/fscan · error

%s (LastError: %d) [minidump_write_dump_failed]

Error message

%s (LastError: %d) [minidump_write_dump_failed]

What it means

Thrown by ProcessManager.dumpProcess when MiniDumpWriteDump returns 0 (call failed). The Windows last error code is embedded in the message (deliberately not wrapped, per the nolint comment, since it is not a Go error value). Common last errors are 5 (ERROR_ACCESS_DENIED), 6 (invalid handle), or disk errors while writing the dump file.

Source

Thrown at plugins/local/minidump.go:483

		uintptr(dumpType),
		0, 0, 0,
	)

	if ret == 0 {
		// 尝试使用较小的转储类型作为后备
		fallbackDumpType := MiniDumpWithDataSegs | MiniDumpWithPrivateReadWriteMemory | MiniDumpWithHandleData

		ret, _, _ = miniDumpWriteDump.Call(
			processHandle,
			uintptr(pid),
			fileHandle,
			uintptr(fallbackDumpType),
			0, 0, 0,
		)

		if ret == 0 {
			//nolint:errorlint // Windows LastError不应该wrapped
			return fmt.Errorf(i18n.GetText("minidump_write_dump_failed")+" (LastError: %d)", windows.GetLastError())
		}
	}

	return nil
}

// openProcess 打开进程
func (pm *ProcessManager) openProcess(pid uint32) (uintptr, error) {
	proc, err := pm.kernel32.FindProc("OpenProcess")
	if err != nil {
		return 0, fmt.Errorf("%s: %w", i18n.Tr("minidump_find_proc_failed", "OpenProcess"), err)
	}

	handle, _, callErr := proc.Call(uintptr(PROCESS_ALL_ACCESS), 0, uintptr(pid))
	if handle == 0 {
		lastError := windows.GetLastError()
		//nolint:errorlint // Windows LastError不应该wrapped
		return 0, fmt.Errorf(i18n.GetText("minidump_open_process_failed")+": %v (LastError: %d)", callErr, lastError)

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Decode the printed LastError: 5 → run elevated / target is protected; 6 → check the process handle and output file handle.
  2. Run as administrator with SeDebugPrivilege enabled (see elevatePrivileges) before dumping.
  3. Write the dump to a writable local path and verify free disk space; exclude the output directory from antivirus/EDR interference.
  4. If the target is a protected process (LSA Protection), use an alternate dump vector such as the comsvcs path the library already offers (tryComsvcsDump).

Example fix

// before
pm.dumpProcess(pid, "\\\\server\\share\\dump.dmp") // slow/networked path
// after
pm.dumpProcess(pid, "C:\\Temp\\dump.dmp") // local writable path, run elevated
Defensive patterns

Strategy: fallback

Validate before calling

// preflight: writable local output dir and free space
if fi, err := os.Stat(filepath.Dir(outPath)); err != nil || !fi.IsDir() {
    return errors.New("output directory not writable")
}

Try / catch

err := pm.dumpProcess(pid, outPath)
if err != nil && strings.Contains(err.Error(), "minidump_write_dump_failed") {
    // parse LastError; on access-denied (5) retry elevated or fall back to tryComsvcsDump
}

Prevention

When it happens

Trigger: dumpProcess invoking MiniDumpWriteDump on an opened process handle when access is denied (protected process, insufficient SeDebugPrivilege), the handle lacks required rights, or the output file cannot be written (disk full, permissions, antivirus blocking the dump file).

Common situations: Dumping protected processes (e.g. lsass on modern Windows with RunAsPPL) without appropriate rights; running non-elevated; target output path on a full or read-only volume; EDR deleting/blocking .dmp writes.

Understand the failure class

Background: "failed to write file", "Could not save figure", "Error saving remote file" — file write failed: causes and fixes across languages and libraries — this error's family across 38 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/d4df8b8bf527f374. Report an issue: GitHub.