{"record":{"id":"a9738db7a3bd8240","repo":"XTLS/Xray-core","slug":"getprocaddress-of-udptablefunc-failed","errorCode":null,"errorMessage":"GetProcAddress of {udpTableFunc} failed","messagePattern":"GetProcAddress of (.+?) failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_windows.go","lineNumber":47,"sourceCode":"\n\tonce    sync.Once\n\tinitErr error\n)\n\nfunc initWin32API() error {\n\th, err := windows.LoadLibrary(\"iphlpapi.dll\")\n\tif err != nil {\n\t\treturn errors.New(\"LoadLibrary iphlpapi.dll failed\").Base(err)\n\t}\n\n\tgetExTCPTable, err = windows.GetProcAddress(h, tcpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", tcpTableFunc, \" failed\").Base(err)\n\t}\n\n\tgetExUDPTable, err = windows.GetProcAddress(h, udpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", udpTableFunc, \" failed\").Base(err)\n\t}\n\n\treturn nil\n}\n\nfunc FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {\n\tonce.Do(func() {\n\t\tinitErr = initWin32API()\n\t})\n\tif initErr != nil {\n\t\treturn 0, \"\", \"\", initErr\n\t}\n\tisLocal, err := IsLocal(net.ParseIP(srcIP))\n\tif err != nil {\n\t\treturn 0, \"\", \"\", errors.New(\"failed to determine if address is local: \", err)\n\t}\n\tif !isLocal {\n\t\treturn 0, \"\", \"\", ErrNotLocal","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_windows.go#L29-L65","documentation":"Same as the TCP case but for the UDP export (GetExtendedUdpTable): iphlpapi.dll loaded, yet GetProcAddress failed for udpTableFunc. Both TCP and UDP table functions are resolved together in initWin32API, so a failure here aborts all process lookup on Windows.","triggerScenarios":"Shadowed or proxied iphlpapi.dll missing the GetExtendedUdpTable export; stripped-down Windows container images; EDR hooking DLLs with incomplete export forwarding.","commonSituations":"Same class as the TCP variant: DLL hijack countermeasures, hooking engines, corrupted system files. Usually both GetProcAddress errors appear across runs depending on which fails first.","solutions":["Ensure no iphlpapi.dll in the app directory shadows System32","Verify exports of the loaded DLL include GetExtendedUdpTable","Repair system files via sfc /scannow / DISM","Fall back to non-process routing if the environment cannot provide a genuine iphlpapi.dll"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":"func isGetProcAddressUdp(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"GetProcAddress of\") && strings.Contains(err.Error(), \"Udp\")\n}","tryCatchPattern":"if err != nil && isGetProcAddressUdp(err) {\n    // same class as TCP variant; permanent for the process, disable process rules\n}","preventionTips":["Verify both GetExtendedTcpTable and GetExtendedUdpTable exports exist in the deployed DLL","Treat any GetProcAddress failure as a tampering signal and investigate the DLL search path"],"tags":["windows","dll","iphlpapi","getprocaddress","dll-hijacking"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}