shadow1ng/fscan · warning

%s: %w [minidump_privilege_name_convert_failed]

Error message

%s: %w [minidump_privilege_name_convert_failed]

What it means

Thrown by ProcessManager.elevatePrivileges when syscall.UTF16PtrFromString fails to convert the constant string "SeDebugPrivilege" to a UTF-16 pointer. This only fails if the string contains an interior NUL byte, which the hardcoded literal never does, so in practice this error indicates a library build/patch anomaly rather than a user-actionable condition.

Source

Thrown at plugins/local/minidump.go:368

// elevatePrivileges 提升权限
func (pm *ProcessManager) elevatePrivileges() error {
	handle, err := pm.getCurrentProcess()
	if err != nil {
		return err
	}

	var token syscall.Token
	err = syscall.OpenProcessToken(handle, syscall.TOKEN_ADJUST_PRIVILEGES|syscall.TOKEN_QUERY, &token)
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_open_process_token_failed"), err)
	}
	defer func() { _ = token.Close() }()

	var tokenPrivileges TOKEN_PRIVILEGES

	privilegeName, err := syscall.UTF16PtrFromString("SeDebugPrivilege")
	if err != nil {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_privilege_name_convert_failed"), err)
	}

	lookupPrivilegeValue := pm.advapi32.MustFindProc("LookupPrivilegeValueW")
	ret, _, err := lookupPrivilegeValue.Call(
		0,
		uintptr(unsafe.Pointer(privilegeName)),
		uintptr(unsafe.Pointer(&tokenPrivileges.Privileges[0].Luid)),
	)
	if ret == 0 {
		return fmt.Errorf("%s: %w", i18n.GetText("minidump_lookup_privilege_failed"), err)
	}

	tokenPrivileges.PrivilegeCount = 1
	tokenPrivileges.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED

	adjustTokenPrivileges := pm.advapi32.MustFindProc("AdjustTokenPrivileges")
	ret, _, err = adjustTokenPrivileges.Call(
		uintptr(token),

View on GitHub (pinned to 95cc12e753)

Solutions

1. Inspect the built source for modifications to the "SeDebugPrivilege" literal and restore the original constant.
2. If using a fork, diff against upstream plugins/local/minidump.go to find injected changes.
3. Rebuild the library from a clean upstream checkout.

if err != nil && strings.Contains(err.Error(), "minidump_privilege_name_convert_failed") {
    // library/build anomaly — rebuild from clean upstream source
}

When it happens

Trigger: elevatePrivileges (from tryDirectDump/tryComsvcsDump) reaching the UTF16PtrFromString call — reachable only if the privilege-name constant was modified (e.g. by a fork or build-time injection) to contain a NUL byte.

Common situations: Custom forks or code-generation patches that alter the hardcoded privilege name; essentially never seen with the stock library.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• %s [minidump_current_process_failed]
• minidump_admin_required
• minidump_all_methods_failed
• %s [minidump_process_not_found: %s]
• %s: %w [minidump_open_process_token_failed]

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/7ba382e5ce5cc417. Report an issue: GitHub.