shadow1ng/fscan · error

%s: %w [minidump_lookup_privilege_failed]

Error message

%s: %w [minidump_lookup_privilege_failed]

What it means

Thrown by ProcessManager.elevatePrivileges when advapi32!LookupPrivilegeValueW returns 0, i.e. Windows could not resolve the LUID for the SeDebugPrivilege name on the local system. The LUID is required to build the TOKEN_PRIVILEGES structure used by AdjustTokenPrivileges, so elevation aborts. The Win32 error is wrapped via %w.

Source

Thrown at plugins/local/minidump.go:378

		return fmt.Errorf("%s: %w", i18n.GetText("minidump_open_process_token_failed"), err)
	}
	defer func() { _ = token.Close() }()

	var tokenPrivileges TOKEN_PRIVILEGES

	privilegeName, err := syscall.UTF16PtrFromString("SeDebugPrivilege")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_privilege_name_convert_failed"), err)
	}

	lookupPrivilegeValue := pm.advapi32.MustFindProc("LookupPrivilegeValueW")
	ret, _, err := lookupPrivilegeValue.Call(
		0,
		uintptr(unsafe.Pointer(privilegeName)),
		uintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_lookup_privilege_failed"), err)
	}

	tokenPrivileges.PrivilegeCount = 1
	tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED

	adjustTokenPrivileges := pm.advapi32.MustFindProc("AdjustTokenPrivileges")
	ret, _, err = adjustTokenPrivileges.Call(
		uintptr(token),
		0,
		uintptr(unsafe.Pointer(&tokenPrivileges)),
		0, 0, 0,
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_adjust_token_failed"), err)
	}

	return nil
}

View on GitHub (pinned to 95cc12e753)

Solutions

1. Run on a standard Windows installation — verify with `secedit /export` or LsaEnumeratePrivileges that SeDebugPrivilege exists.
2. Check the wrapped Win32 error (e.g. ERROR_NO_SUCH_PRIVILEGE) to confirm the resolution failure and address system integrity (sfc /scannow).
3. If running under Wine or an emulation layer, use real Windows for minidump operations.

if err != nil && strings.Contains(err.Error(), "minidump_lookup_privilege_failed") {
    // inspect wrapped Win32 error; verify SeDebugPrivilege exists on this system
}

When it happens

Trigger: elevatePrivileges (from tryDirectDump/tryComsvcsDump) calling LookupPrivilegeValueW with system name 0 and "SeDebugPrivilege" when the local privilege name cannot be resolved — corrupted localization of privilege names, or an invalid/modified privilege string.

Common situations: Heavily customized or stripped Windows images where privilege name resolution fails; running under a non-Windows compatibility layer (Wine) with incomplete advapi32 support.

Understand the failure class

Background: 'Could not be found', 'does not exist', 'not found in database': the resource-not-found family when an ID, slug, key, or URI lookup comes back empty — this error's family across 20 libraries.

Related errors

• minidump_admin_required
• %s: %w [minidump_open_process_token_failed]
• %s: %w [minidump_adjust_token_failed]
• minidump_all_methods_failed
• %s [minidump_process_not_found: %s]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c64ce618ab87ad42. Report an issue: GitHub.