shadow1ng/fscan · warning

%s [minidump_current_process_failed]

Error message

%s [minidump_current_process_failed]

What it means

Thrown by ProcessManager.getCurrentProcess when kernel32!GetCurrentProcess returns a zero handle. GetCurrentProcess always returns a valid pseudo-handle (-1) on real Windows, so this is a defensive guard against an impossible condition — a zero value indicates a broken syscall bridge or non-Windows environment rather than any user mistake.

Source

Thrown at plugins/local/minidump.go:403

	ret, _, err = adjustTokenPrivileges.Call(
		uintptr(token),
		0,
		uintptr(unsafe.Pointer(&tokenPrivileges)),
		0, 0, 0,
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_adjust_token_failed"), err)
	}

	return nil
}

// getCurrentProcess 获取当前进程句柄
func (pm *ProcessManager) getCurrentProcess() (syscall.Handle, error) {
	proc := pm.kernel32.MustFindProc("GetCurrentProcess")
	handle, _, _ := proc.Call()
	if handle == 0 {
		return 0, fmt.Errorf("%s", i18n.GetText("minidump_current_process_failed"))
	}
	return syscall.Handle(handle), nil
}

// dumpProcessWithTimeout 带超时的转储进程内存
func (pm *ProcessManager) dumpProcessWithTimeout(ctx context.Context, pid uint32, outputPath string) error {
	resultChan := make(chan error, 1)

	go func() {
		resultChan <- pm.dumpProcess(pid, outputPath)
	}()

	select {
	case err := <-resultChan:
		return err
	case <-ctx.Done():
		return fmt.Errorf("%s", i18n.GetText("minidump_timeout"))
	}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Run the tool on genuine Windows — check runtime.GOOS before invoking dump paths.
2. If under Wine, retry on native Windows; kernel32 pseudo-handle behavior is not guaranteed there.
3. Verify binary integrity (rebuild from source) if the binary may have been patched.

if runtime.GOOS != "windows" {
    return errors.New("minidump requires native Windows")
}

if err != nil && strings.Contains(err.Error(), "minidump_current_process_failed") {
    // impossible on genuine Windows — check environment (Wine/emulation) and rebuild
}

When it happens

Trigger: elevatePrivileges calls getCurrentProcess and the kernel32 proc.Call returns 0 — only realistic under Wine/CrossOver with a broken kernel32 shim, or if the binary was tampered with.

Common situations: Running the tool on Linux/macOS under Wine; corrupted system files; testing harnesses stubbing kernel32.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• %s: %w [minidump_privilege_name_convert_failed]
• minidump_admin_required
• minidump_all_methods_failed
• %s [minidump_process_not_found: %s]
• %s: %w [minidump_open_process_token_failed]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/a6ef67e00f36dd3a. Report an issue: GitHub.