shadow1ng/fscan · error

%s: %w [minidump_adjust_token_failed]

Error message

%s: %w [minidump_adjust_token_failed]

What it means

Thrown by ProcessManager.elevatePrivileges when advapi32!AdjustTokenPrivileges returns 0, meaning the API call itself failed (as opposed to returning success with a not-adjusted result). The SeDebugPrivilege could not be applied to the process token, so subsequent process-opening with elevated access may fail. The Win32 error is wrapped via %w.

Source

Thrown at plugins/local/minidump.go:392

		uintptr(unsafe.Pointer(privilegeName)),
		uintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_lookup_privilege_failed"), err)
	}

	tokenPrivileges.PrivilegeCount = 1
	tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED

	adjustTokenPrivileges := pm.advapi32.MustFindProc("AdjustTokenPrivileges")
	ret, _, err = adjustTokenPrivileges.Call(
		uintptr(token),
		0,
		uintptr(unsafe.Pointer(&tokenPrivileges)),
		0, 0, 0,
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_adjust_token_failed"), err)
	}

	return nil
}

// getCurrentProcess 获取当前进程句柄
func (pm *ProcessManager) getCurrentProcess() (syscall.Handle, error) {
	proc := pm.kernel32.MustFindProc("GetCurrentProcess")
	handle, _, _ := proc.Call()
	if handle == 0 {
		return 0, fmt.Errorf("%s", i18n.GetText("minidump_current_process_failed"))
	}
	return syscall.Handle(handle), nil
}

// dumpProcessWithTimeout 带超时的转储进程内存
func (pm *ProcessManager) dumpProcessWithTimeout(ctx context.Context, pid uint32, outputPath string) error {
	resultChan := make(chan error, 1)

View on GitHub (pinned to 95cc12e753)

Solutions

1. Start the tool from an elevated administrator prompt so the token actually holds SeDebugPrivilege.
2. Check the wrapped Win32 error (ERROR_NOT_ALL_ASSIGNED means the privilege is not held — elevation is required).
3. Verify with `whoami /priv` that SeDebugPrivilege is present and enabled for the running account.

Example fix

// before
C:\> tool.exe --dump lsass.exe
// after
C:\> (elevated PowerShell) tool.exe --dump lsass.exe

// check SeDebugPrivilege is held before attempting dump
out, _ := exec.Command("whoami", "/priv").Output()
if !strings.Contains(string(out), "SeDebugPrivilege") {
    return fmt.Errorf("run elevated: SeDebugPrivilege not held")
}

if err != nil && strings.Contains(err.Error(), "minidump_adjust_token_failed") {
    // ERROR_NOT_ALL_ASSIGNED means elevation required — relaunch elevated and retry
}

When it happens

Trigger: elevatePrivileges (from tryDirectDump/tryComsvcsDump) calling AdjustTokenPrivileges with TOKEN_ADJUST_PRIVILEGES on a token that cannot be adjusted — token restricted by policy, integrity level too low, or handle opened without sufficient rights.

Common situations: Running as a standard (non-admin) user where SeDebugPrivilege is not held and cannot be enabled; AppLocker/sandbox policies stripping privileges; running from a low-integrity process.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• %s: %w [minidump_open_process_token_failed]
• minidump_admin_required
• %s: %w [minidump_lookup_privilege_failed]
• minidump_all_methods_failed
• %s [minidump_process_not_found: %s]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c517424fc8ab3265. Report an issue: GitHub.