shadow1ng/fscan · error

%s: %w [minidump_process_name_convert_failed]

Error message

%s: %w [minidump_process_name_convert_failed]

What it means

Wrap inside ProcessManager.findProcessInSnapshot: converting the target process name to a UTF-16 pointer via syscall.UTF16PtrFromString failed (typically an invalid NUL character in the name), so the snapshot walk cannot compare process names. It is an input-encoding error, distinct from the FindProc failures for lstrcmpiW/Process32NextW around it.

Source

Thrown at plugins/local/minidump.go:329

	if err != nil {
		return 0, fmt.Errorf("%s: %w", i18n.Tr("minidump_find_proc_failed", "Process32NextW"), err)
	}

	lstrcmpi, err := pm.kernel32.FindProc("lstrcmpiW")
	if err != nil {
		return 0, fmt.Errorf("%s: %w", i18n.Tr("minidump_find_proc_failed", "lstrcmpiW"), err)
	}

	ret, _, _ := proc32First.Call(snapshot, uintptr(unsafe.Pointer(&pe32)))
	if ret == 0 {
		//nolint:errorlint // Windows LastError不应该wrapped
		return 0, fmt.Errorf(i18n.GetText("minidump_first_process_failed")+" (LastError: %d)", windows.GetLastError())
	}

	for {
		namePtr, err := syscall.UTF16PtrFromString(name)
		if err != nil {
			return 0, fmt.Errorf("%s: %w", i18n.GetText("minidump_process_name_convert_failed"), err)
		}

		ret, _, _ = lstrcmpi.Call(
			uintptr(unsafe.Pointer(namePtr)),
			uintptr(unsafe.Pointer(&pe32.szExeFile[0])),
		)

		if ret == 0 {
			return pe32.th32ProcessID, nil
		}

		ret, _, _ = proc32Next.Call(snapshot, uintptr(unsafe.Pointer(&pe32)))
		if ret == 0 {
			break
		}
	}

	return 0, fmt.Errorf("%s", i18n.Tr("minidump_process_not_found", name))

View on GitHub (pinned to 95cc12e753)

Solutions

1. Sanitize the process name — remove NUL/unexpected control characters
2. Re-specify the target process name (e.g. lsass.exe) cleanly

When it happens

Trigger: Thrown at plugins/local/minidump.go:329 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/83b340d05aded684. Report an issue: GitHub.