What causes "%s [minidump_process_not_found: %s]" in shadow1ng/fscan?

Verify the process is running with `tasklist /FI "IMAGENAME eq name.exe"` and use the exact image name shown (usually with .exe).

shadow1ng/fscan · error

%s [minidump_process_not_found: %s]

Error message

%s [minidump_process_not_found: %s]

What it means

Thrown by ProcessManager.findProcessInSnapshot when iterating a Windows toolhelp32 process snapshot (proc32Next loop) and no entry matches the requested process name. The library throws it because a dump can only target an existing process; it returns PID 0 plus this error instead of a bogus handle. It means the lookup completed successfully but found zero matching processes.

Source

Thrown at plugins/local/minidump.go:347

			return 0, fmt.Errorf("%s: %w", i18n.GetText("minidump_process_name_convert_failed"), err)
		}

		ret, _, _ = lstrcmpi.Call(
			uintptr(unsafe.Pointer(namePtr)),
			uintptr(unsafe.Pointer(&pe32.szExeFile[0])),
		)

		if ret == 0 {
			return pe32.th32ProcessID, nil
		}

		ret, _, _ = proc32Next.Call(snapshot, uintptr(unsafe.Pointer(&pe32)))
		if ret == 0 {
			break
		}
	}

	return 0, fmt.Errorf("%s", i18n.Tr("minidump_process_not_found", name))
}

// elevatePrivileges 提升权限
func (pm *ProcessManager) elevatePrivileges() error {
	handle, err := pm.getCurrentProcess()
	if err != nil {
		return err
	}

	var token syscall.Token
	err = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_open_process_token_failed"), err)
	}
	defer func() { _ = token.Close() }()

	var tokenPrivileges TOKEN_PRIVILEGES

View on GitHub (pinned to 95cc12e753)

Solutions

Verify the process is running with `tasklist /FI "IMAGENAME eq name.exe"` and use the exact image name shown (usually with .exe).
Retry the lookup after confirming the process is started — the snapshot is taken at call time, so a process started after the call requires a new call.
If matching by name is unreliable, use a PID-based path (openProcess) instead of name lookup.

Example fix

// before
pid, err := pm.findProcess("lsass")
// after
pid, err := pm.findProcess("lsass.exe") // exact image name as shown in tasklist

Defensive patterns

Strategy: validation

Validate before calling

// confirm the process exists before calling findProcess
out, err := exec.Command("tasklist", "/FI", "IMAGENAME eq target.exe").Output()
if err != nil || !strings.Contains(strings.ToLower(string(out)), "target.exe") {
    return fmt.Errorf("target.exe is not running")
}

Try / catch

pid, err := pm.findProcess("target.exe")
if err != nil && strings.Contains(err.Error(), "minidump_process_not_found") {
    // handle: target absent — start it or abort
}

Prevention

Always use the exact image name from tasklist (typically with .exe).
Confirm the target is running immediately before dumping; snapshots are point-in-time.
Prefer PID-based openProcess when the PID is already known.

When it happens

Trigger: Calling findProcess(name) (via findProcessInSnapshot) with a name that matches no process in the current toolhelp32 snapshot: the process is not running, the name is misspelled, or the name includes/excludes the .exe extension inconsistently with what the snapshot reports.

Common situations: Targeting a process that already exited; typos like 'lsass' vs 'lsass.exe'; using the full path instead of the image name; on non-English or stripped systems where the expected service process differs.

Understand the failure class

Background: "Not found" and "does not exist" errors: why "Task not found", "No such folder", and "Can't find" fire when a lookup comes back empty — this error's family across 14 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/5edeb60c7d62fc21. Report an issue: GitHub.