What causes "%s: %w [minidump_open_process_token_failed]" in shadow1ng/fscan?

Re-run the tool from an elevated (Run as administrator) shell so the process token is openable and adjustable.

%s: %w [minidump_open_process_token_failed]

Error message

%s: %w [minidump_open_process_token_failed]

What it means

Thrown by ProcessManager.elevatePrivileges when syscall.OpenProcessToken fails to open the current process token with TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY. This is the first step of enabling SeDebugPrivilege before dumping; without a token handle the privilege cannot be adjusted. The underlying Windows error is wrapped via %w.

Source

Thrown at plugins/local/minidump.go:360

		if ret == 0 {
			break
		}
	}

	return 0, fmt.Errorf("%s", i18n.Tr("minidump_process_not_found", name))
}

// elevatePrivileges 提升权限
func (pm *ProcessManager) elevatePrivileges() error {
	handle, err := pm.getCurrentProcess()
	if err != nil {
		return err
	}

	var token syscall.Token
	err = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_open_process_token_failed"), err)
	}
	defer func() { _ = token.Close() }()

	var tokenPrivileges TOKEN_PRIVILEGES

	privilegeName, err := syscall.UTF16PtrFromString("SeDebugPrivilege")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_privilege_name_convert_failed"), err)
	}

	lookupPrivilegeValue := pm.advapi32.MustFindProc("LookupPrivilegeValueW")
	ret, _, err := lookupPrivilegeValue.Call(
		0,
		uintptr(unsafe.Pointer(privilegeName)),
		uintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_lookup_privilege_failed"), err)

View on GitHub (pinned to 95cc12e753)

Solutions

Re-run the tool from an elevated (Run as administrator) shell so the process token is openable and adjustable.
Check the wrapped cause (%w) for the concrete Win32 error (e.g. ERROR_ACCESS_DENIED) and address it accordingly.
Exclude the binary from EDR/AV interference or run on an unrestricted account.

Example fix

// before
cmd := exec.Command("tool.exe")
cmd.Run()
// after — ensure elevation before calling dump paths
if !windows.CurrentProcessToken().IsElevated() { /* relaunch with ShellExecute "runas" or require admin */ }

Defensive patterns

Strategy: try-catch

Validate before calling

// verify the process token is openable/elevated before dumping
token := windows.CurrentProcessToken()
elevated, err := token.IsElevated()
if err != nil || !elevated {
    return fmt.Errorf("must run elevated for minidump")
}

Try / catch

err := pm.dumpProcess(...)
if err != nil && strings.Contains(err.Error(), "minidump_open_process_token_failed") {
    // inspect wrapped Win32 cause; require elevation and retry once elevated
}

Prevention

Launch the tool from an administrator prompt.
Avoid restricted service accounts, sandboxes, and containers for dump operations.
Check EDR/AV policies that hook OpenProcessToken.

When it happens

Trigger: elevatePrivileges (called from tryDirectDump or tryComsvcsDump) runs while the calling process cannot open its own token — e.g. running under a heavily restricted token, a sandbox, or when malware/EDR blocks token operations.

Common situations: Running inside a restricted service account or containerized/jailed environment; EDR hooking OpenProcessToken; corrupted user profile/token after account issues.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/c12d60ce21ac7cd5. Report an issue: GitHub.