{"record":{"id":"2725973cb0aa87a0","repo":"XTLS/Xray-core","slug":"syscall-error-err","errorCode":null,"errorMessage":"syscall error: {err}","messagePattern":"syscall error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_windows.go","lineNumber":216,"sourceCode":"\t\tip:       ip,\n\t\tipSize:   ipSize,\n\t\tpid:      pid,\n\t\ttcpState: tcpState,\n\t}\n}\n\nfunc getTransportTable(fn uintptr, family int, class int) ([]byte, error) {\n\tfor size, buf := uint32(8), make([]byte, 8); ; {\n\t\tptr := unsafe.Pointer(&buf[0])\n\t\terr, _, _ := syscall.Syscall6(fn, 6, uintptr(ptr), uintptr(unsafe.Pointer(&size)), 0, uintptr(family), uintptr(class), 0)\n\n\t\tswitch err {\n\t\tcase 0:\n\t\t\treturn buf, nil\n\t\tcase uintptr(syscall.ERROR_INSUFFICIENT_BUFFER):\n\t\t\tbuf = make([]byte, size)\n\t\tdefault:\n\t\t\treturn nil, errors.New(\"syscall error: \", int(err))\n\t\t}\n\t}\n}\n\nfunc readNativeUint32(b []byte) uint32 {\n\treturn *(*uint32)(unsafe.Pointer(&b[0]))\n}\n\nfunc getExecPathFromPID(pid uint32) (string, error) {\n\t// kernel process starts with a colon in order to distinguish with normal processes\n\tswitch pid {\n\tcase 0:\n\t\t// reserved pid for system idle process\n\t\treturn \":System Idle Process\", nil\n\tcase 4:\n\t\t// reserved pid for windows kernel image\n\t\treturn \":System\", nil\n\t}","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_windows.go#L198-L234","documentation":"Returned by getTransportTable when the Win32 GetExtendedTcpTable/GetExtendedUDPTable syscall invoked via syscall.Syscall6 fails with an error code other than 0 and ERROR_INSUFFICIENT_BUFFER. The numeric Windows error code is embedded in the message.","triggerScenarios":"The underlying Windows API returns e.g. ERROR_INVALID_PARAMETER (87) from a wrong family/class combination, or ERROR_NOT_ENOUGH_MEMORY if the realloc loop cannot satisfy the requested buffer size on a busy socket table.","commonSituations":"Passing an unexpected family/class argument (invalid network type or family), severe memory pressure, or Windows API behavior differences across versions. Rare in practice; the retry loop already handles the common insufficient-buffer case.","solutions":["Decode the numeric code in the message against the Windows System Error Codes (e.g. 87 = ERROR_INVALID_PARAMETER) to identify the cause","Verify the network ('tcp'/'udp') and address family passed to the lookup are valid combinations","If memory-related, reduce concurrent process-lookup calls or snapshot less frequently"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"allowed := map[string]bool{\"tcp\": true, \"udp\": true}\nif !allowed[network] { return errors.New(\"bad network for lookup\") }","typeGuard":null,"tryCatchPattern":"if err != nil {\n    code := parseTrailingInt(err.Error()) // extract Windows error code\n    log.Warn(\"transport table syscall failed: code=\", code)\n    return 0, err\n}","preventionTips":["Decode the embedded Windows error code","Only use supported tcp/udp + AF_INET/AF_INET6 combinations"],"tags":["windows","syscall","network","process-lookup"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}