XTLS/Xray-core · error

GetProcAddress of {tcpTableFunc} failed

Error message

GetProcAddress of {tcpTableFunc} failed

What it means

iphlplpapi.dll loaded but GetProcAddress could not find the TCP-table export (GetExtendedTcpTable). The function name resolved is a constant (tcpTableFunc). This indicates a DLL version mismatch — e.g. a replaced/injected iphlpapi.dll missing standard exports — since GetExtendedTcpTable has existed since Windows XP SP2.

Source

Thrown at common/net/find_process_windows.go:42

)

var (
	getExTCPTable uintptr
	getExUDPTable uintptr

	once    sync.Once
	initErr error
)

func initWin32API() error {
	h, err := windows.LoadLibrary("iphlpapi.dll")
	if err != nil {
		return errors.New("LoadLibrary iphlpapi.dll failed").Base(err)
	}

	getExTCPTable, err = windows.GetProcAddress(h, tcpTableFunc)
	if err != nil {
		return errors.New("GetProcAddress of ", tcpTableFunc, " failed").Base(err)
	}

	getExUDPTable, err = windows.GetProcAddress(h, udpTableFunc)
	if err != nil {
		return errors.New("GetProcAddress of ", udpTableFunc, " failed").Base(err)
	}

	return nil
}

func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {
	once.Do(func() {
		initErr = initWin32API()
	})
	if initErr != nil {
		return 0, "", "", initErr
	}
	isLocal, err := IsLocal(net.ParseIP(srcIP))

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Check for a stray iphlpapi.dll next to the executable and remove it — System32 must win
2. Dump exports (dumpbin /exports or link /dump) of both candidate DLLs to confirm which is loaded
3. Restore the genuine DLL from the Windows component store (DISM /Online /Cleanup-Image /RestoreHealth)
4. Whitelist the binary in AV/EDR hooking engines that proxy system DLLs

func isGetProcAddressTcp(err error) bool {
    return err != nil && strings.Contains(err.Error(), "GetProcAddress of") && strings.Contains(err.Error(), "Tcp")
}

if err != nil && isGetProcAddressTcp(err) {
    // shadowed/hooked iphlpapi.dll; permanent — disable process rules and alert ops
}

When it happens

Trigger: A third-party iphlpapi.dll earlier on the DLL search path (application directory) shadowing the system one; security software hooking the DLL with a broken proxy; ancient or stripped Windows images.

Common situations: DLL search-order hijacking countermeasures gone wrong; apps shipping their own iphlpapi.dll; sandboxed environments that stub system DLLs.

Related errors

• GetProcAddress of {udpTableFunc} failed
• LoadLibrary iphlpapi.dll failed
• failed to determine if address is local: {err}
• invalid IP address
• not found

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/6fff43b20c8d71cf. Report an issue: GitHub.