{"record":{"id":"6fff43b20c8d71cf","repo":"XTLS/Xray-core","slug":"getprocaddress-of-tcptablefunc-failed","errorCode":null,"errorMessage":"GetProcAddress of {tcpTableFunc} failed","messagePattern":"GetProcAddress of (.+?) failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_windows.go","lineNumber":42,"sourceCode":")\n\nvar (\n\tgetExTCPTable uintptr\n\tgetExUDPTable uintptr\n\n\tonce    sync.Once\n\tinitErr error\n)\n\nfunc initWin32API() error {\n\th, err := windows.LoadLibrary(\"iphlpapi.dll\")\n\tif err != nil {\n\t\treturn errors.New(\"LoadLibrary iphlpapi.dll failed\").Base(err)\n\t}\n\n\tgetExTCPTable, err = windows.GetProcAddress(h, tcpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", tcpTableFunc, \" failed\").Base(err)\n\t}\n\n\tgetExUDPTable, err = windows.GetProcAddress(h, udpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", udpTableFunc, \" failed\").Base(err)\n\t}\n\n\treturn nil\n}\n\nfunc FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {\n\tonce.Do(func() {\n\t\tinitErr = initWin32API()\n\t})\n\tif initErr != nil {\n\t\treturn 0, \"\", \"\", initErr\n\t}\n\tisLocal, err := IsLocal(net.ParseIP(srcIP))","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_windows.go#L24-L60","documentation":"iphlplpapi.dll loaded but GetProcAddress could not find the TCP-table export (GetExtendedTcpTable). The function name resolved is a constant (tcpTableFunc). This indicates a DLL version mismatch — e.g. a replaced/injected iphlpapi.dll missing standard exports — since GetExtendedTcpTable has existed since Windows XP SP2.","triggerScenarios":"A third-party iphlpapi.dll earlier on the DLL search path (application directory) shadowing the system one; security software hooking the DLL with a broken proxy; ancient or stripped Windows images.","commonSituations":"DLL search-order hijacking countermeasures gone wrong; apps shipping their own iphlpapi.dll; sandboxed environments that stub system DLLs.","solutions":["Check for a stray iphlpapi.dll next to the executable and remove it — System32 must win","Dump exports (dumpbin /exports or link /dump) of both candidate DLLs to confirm which is loaded","Restore the genuine DLL from the Windows component store (DISM /Online /Cleanup-Image /RestoreHealth)","Whitelist the binary in AV/EDR hooking engines that proxy system DLLs"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":"func isGetProcAddressTcp(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"GetProcAddress of\") && strings.Contains(err.Error(), \"Tcp\")\n}","tryCatchPattern":"if err != nil && isGetProcAddressTcp(err) {\n    // shadowed/hooked iphlpapi.dll; permanent — disable process rules and alert ops\n}","preventionTips":["Never ship a private iphlpapi.dll beside the binary","Check the app directory for stray system DLLs during deployment validation"],"tags":["windows","dll","iphlpapi","getprocaddress","dll-hijacking"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}