shadow1ng/fscan · error

%s: %w [minidump_load_named_dll_failed: %s]

Error message

%s: %w [minidump_load_named_dll_failed: %s]

What it means

Raised in MiniDumpPlugin.loadSystemDLLs when syscall.LoadDLL('kernel32.dll') fails on Windows — the loader could not resolve the module, so the Win32 API calls needed for process snapshotting and MiniDumpWriteDump are unavailable.

Source

Thrown at plugins/local/minidump.go:222

	}
	return false
}

func (p *MiniDumpPlugin) reportSuccess(output *strings.Builder, path, method string, session *common.ScanSession) bool {
	fi, err := os.Stat(path)
	if err != nil || fi.Size() == 0 {
		return false
	}
	output.WriteString(i18n.Tr("minidump_method_success", method, path, fi.Size()) + "\n")
	session.LogSuccess(i18n.Tr("minidump_success", path, fi.Size()))
	return true
}

// loadSystemDLLs 加载系统DLL
func (p *MiniDumpPlugin) loadSystemDLLs() error {
	kernel32, err := syscall.LoadDLL("kernel32.dll")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.Tr("minidump_load_named_dll_failed", "kernel32.dll"), err)
	}

	dbghelp, err := syscall.LoadDLL("Dbghelp.dll")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.Tr("minidump_load_named_dll_failed", "Dbghelp.dll"), err)
	}

	advapi32, err := syscall.LoadDLL("advapi32.dll")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.Tr("minidump_load_named_dll_failed", "advapi32.dll"), err)
	}

	p.kernel32 = kernel32
	p.dbghelp = dbghelp
	p.advapi32 = advapi32

	return nil
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Verify the process runs on a full Windows host, not a stripped container
2. Check bitness matching (32-bit vs 64-bit process vs DLL)
3. Skip minidump and use a different credential-capture technique

When it happens

Trigger: Thrown at plugins/local/minidump.go:222 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/9b8bb937164e6e6f. Report an issue: GitHub.