shadow1ng/fscan · error

%s: %w [minidump_find_proc_failed: %s]

Error message

%s: %w [minidump_find_proc_failed: %s]

What it means

Wrap of a kernel32 lookup failure in ProcessManager.createProcessSnapshot: FindProc could not locate the CreateToolhelp32Snapshot export in kernel32.dll, so no process snapshot can be taken on the Windows target. The i18n minidump_find_proc_failed message names the missing API and %w preserves the underlying syscall lookup error.

Source

Thrown at plugins/local/minidump.go:288

// ProcessManager 方法实现

// findProcess 查找进程
func (pm *ProcessManager) findProcess(name string) (uint32, error) {
	snapshot, err := pm.createProcessSnapshot()
	if err != nil {
		return 0, err
	}
	defer pm.closeHandle(snapshot)

	return pm.findProcessInSnapshot(snapshot, name)
}

// createProcessSnapshot 创建进程快照
func (pm *ProcessManager) createProcessSnapshot() (uintptr, error) {
	proc, err := pm.kernel32.FindProc("CreateToolhelp32Snapshot")
	if err != nil {
		return 0, fmt.Errorf("%s: %w", i18n.Tr("minidump_find_proc_failed", "CreateToolhelp32Snapshot"), err)
	}

	handle, _, err := proc.Call(uintptr(TH32CS_SNAPPROCESS), 0)
	if handle == uintptr(INVALID_HANDLE_VALUE) {
		lastError := windows.GetLastError()
		//nolint:errorlint // Windows LastError不应该wrapped
		return 0, fmt.Errorf(i18n.GetText("minidump_snapshot_create_failed")+": %v (LastError: %d)", err, lastError)
	}
	return handle, nil
}

// findProcessInSnapshot 在快照中查找进程
func (pm *ProcessManager) findProcessInSnapshot(snapshot uintptr, name string) (uint32, error) {
	var pe32 PROCESSENTRY32
	pe32.dwSize = uint32(unsafe.Sizeof(pe32))

	proc32First, err := pm.kernel32.FindProc("Process32FirstW")
	if err != nil {

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the Windows version supports CreateToolhelp32Snapshot (very old builds may not)
2. Check that the loaded kernel32 is genuine and unhooked
3. Fall back to another process-discovery method (e.g. enumerate via WMI-like paths)

When it happens

Trigger: Thrown at plugins/local/minidump.go:288 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/9c2649044758b359. Report an issue: GitHub.