shadow1ng/fscan · error

: [minidump_adjust_token_failed]

Error message

%s: %w [minidump_adjust_token_failed]

What it means

Thrown by ProcessManager.elevatePrivileges when advapi32!AdjustTokenPrivileges returns 0, meaning the API call itself failed (as opposed to returning success with a not-adjusted result). The SeDebugPrivilege could not be applied to the process token, so subsequent process-opening with elevated access may fail. The Win32 error is wrapped via %w.

Solutions

1. Start the tool from an elevated administrator prompt so the token actually holds SeDebugPrivilege.
2. Check the wrapped Win32 error (ERROR_NOT_ALL_ASSIGNED means the privilege is not held — elevation is required).
3. Verify with `whoami /priv` that SeDebugPrivilege is present and enabled for the running account.

Example fix

// before
C:\> tool.exe --dump lsass.exe
// after
C:\> (elevated PowerShell) tool.exe --dump lsass.exe

// check SeDebugPrivilege is held before attempting dump
out, _ := exec.Command("whoami", "/priv").Output()
if !strings.Contains(string(out), "SeDebugPrivilege") {
    return fmt.Errorf("run elevated: SeDebugPrivilege not held")
}

if err != nil && strings.Contains(err.Error(), "minidump_adjust_token_failed") {
    // ERROR_NOT_ALL_ASSIGNED means elevation required — relaunch elevated and retry
}

When it happens

Trigger: elevatePrivileges (from tryDirectDump/tryComsvcsDump) calling AdjustTokenPrivileges with TOKEN_ADJUST_PRIVILEGES on a token that cannot be adjusted — token restricted by policy, integrity level too low, or handle opened without sufficient rights.

Common situations: Running as a standard (non-admin) user where SeDebugPrivilege is not held and cannot be enabled; AppLocker/sandbox policies stripping privileges; running from a low-integrity process.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• : [minidump_open_process_token_failed]
• minidump_admin_required
• : [minidump_lookup_privilege_failed]
• cannot find DC for
• GSSAPI bind

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c517424fc8ab3265. Report an issue: GitHub.

Appendix: source

Thrown at plugins/local/minidump.go:392

		uintptr(unsafe.Pointer(privilegeName)),
		uintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_lookup_privilege_failed"), err)
	}

	tokenPrivileges.PrivilegeCount = 1
	tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED

	adjustTokenPrivileges := pm.advapi32.MustFindProc("AdjustTokenPrivileges")
	ret, _, err = adjustTokenPrivileges.Call(
		uintptr(token),
		0,
		uintptr(unsafe.Pointer(&tokenPrivileges)),
		0, 0, 0,
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_adjust_token_failed"), err)
	}

	return nil
}

// getCurrentProcess 获取当前进程句柄
func (pm *ProcessManager) getCurrentProcess() (syscall.Handle, error) {
	proc := pm.kernel32.MustFindProc("GetCurrentProcess")
	handle, _, _ := proc.Call()
	if handle == 0 {
		return 0, fmt.Errorf("%s", i18n.GetText("minidump_current_process_failed"))
	}
	return syscall.Handle(handle), nil
}

// dumpProcessWithTimeout 带超时的转储进程内存
func (pm *ProcessManager) dumpProcessWithTimeout(ctx context.Context, pid uint32, outputPath string) error {
	resultChan := make(chan error, 1)

View on GitHub (pinned to 95cc12e753)