XTLS/Xray-core · error

GetProcAddress of {udpTableFunc} failed

Error message

GetProcAddress of {udpTableFunc} failed

What it means

Same as the TCP case but for the UDP export (GetExtendedUdpTable): iphlpapi.dll loaded, yet GetProcAddress failed for udpTableFunc. Both TCP and UDP table functions are resolved together in initWin32API, so a failure here aborts all process lookup on Windows.

Source

Thrown at common/net/find_process_windows.go:47

	once    sync.Once
	initErr error
)

func initWin32API() error {
	h, err := windows.LoadLibrary("iphlpapi.dll")
	if err != nil {
		return errors.New("LoadLibrary iphlpapi.dll failed").Base(err)
	}

	getExTCPTable, err = windows.GetProcAddress(h, tcpTableFunc)
	if err != nil {
		return errors.New("GetProcAddress of ", tcpTableFunc, " failed").Base(err)
	}

	getExUDPTable, err = windows.GetProcAddress(h, udpTableFunc)
	if err != nil {
		return errors.New("GetProcAddress of ", udpTableFunc, " failed").Base(err)
	}

	return nil
}

func FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {
	once.Do(func() {
		initErr = initWin32API()
	})
	if initErr != nil {
		return 0, "", "", initErr
	}
	isLocal, err := IsLocal(net.ParseIP(srcIP))
	if err != nil {
		return 0, "", "", errors.New("failed to determine if address is local: ", err)
	}
	if !isLocal {
		return 0, "", "", ErrNotLocal

View on GitHub (pinned to 7d214f8b09)

Solutions

1. Ensure no iphlpapi.dll in the app directory shadows System32
2. Verify exports of the loaded DLL include GetExtendedUdpTable
3. Repair system files via sfc /scannow / DISM
4. Fall back to non-process routing if the environment cannot provide a genuine iphlpapi.dll

func isGetProcAddressUdp(err error) bool {
    return err != nil && strings.Contains(err.Error(), "GetProcAddress of") && strings.Contains(err.Error(), "Udp")
}

if err != nil && isGetProcAddressUdp(err) {
    // same class as TCP variant; permanent for the process, disable process rules
}

When it happens

Trigger: Shadowed or proxied iphlpapi.dll missing the GetExtendedUdpTable export; stripped-down Windows container images; EDR hooking DLLs with incomplete export forwarding.

Common situations: Same class as the TCP variant: DLL hijack countermeasures, hooking engines, corrupted system files. Usually both GetProcAddress errors appear across runs depending on which fails first.

Related errors

• GetProcAddress of {tcpTableFunc} failed
• LoadLibrary iphlpapi.dll failed
• failed to determine if address is local: {err}
• invalid IP address
• not found

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/a9738db7a3bd8240. Report an issue: GitHub.