{"record":{"id":"b489233f28ba7e81","repo":"XTLS/Xray-core","slug":"loadlibrary-iphlpapi-dll-failed","errorCode":null,"errorMessage":"LoadLibrary iphlpapi.dll failed","messagePattern":"LoadLibrary iphlpapi\\.dll failed","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/net/find_process_windows.go","lineNumber":37,"sourceCode":"const (\n\ttcpTableFunc    = \"GetExtendedTcpTable\"\n\ttcpTablePidConn = 4\n\tudpTableFunc    = \"GetExtendedUdpTable\"\n\tudpTablePid     = 1\n)\n\nvar (\n\tgetExTCPTable uintptr\n\tgetExUDPTable uintptr\n\n\tonce    sync.Once\n\tinitErr error\n)\n\nfunc initWin32API() error {\n\th, err := windows.LoadLibrary(\"iphlpapi.dll\")\n\tif err != nil {\n\t\treturn errors.New(\"LoadLibrary iphlpapi.dll failed\").Base(err)\n\t}\n\n\tgetExTCPTable, err = windows.GetProcAddress(h, tcpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", tcpTableFunc, \" failed\").Base(err)\n\t}\n\n\tgetExUDPTable, err = windows.GetProcAddress(h, udpTableFunc)\n\tif err != nil {\n\t\treturn errors.New(\"GetProcAddress of \", udpTableFunc, \" failed\").Base(err)\n\t}\n\n\treturn nil\n}\n\nfunc FindProcess(network, srcIP string, srcPort uint16, destIP string, destPort uint16) (PID int, Name string, AbsolutePath string, err error) {\n\tonce.Do(func() {\n\t\tinitErr = initWin32API()","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/common/net/find_process_windows.go#L19-L55","documentation":"The Windows FindProcess lazily initializes its win32 bindings (sync.Once) and windows.LoadLibrary(\"iphlpapi.dll\") failed; the OS error is chained via Base. iphlpapi.dll ships with every Windows install, so failure means the process environment cannot load it — broken install, DLL search-path hijack block, or a stripped Windows container.","triggerScenarios":"Running in Windows Server Core / Nano Server images where iphlpapi.dll was removed; AppLocker/WDAC policies blocking DLL loads from the search path; a corrupt system image. The error surfaces on the first FindProcess call and is cached in initErr for all later calls.","commonSituations":"See trigger scenarios.","solutions":["Read the chained Windows error code (module not found vs access denied) to pick the fix","Verify with 'rundll32 iphlpapi.dll,GetIfEntry' or check C:\\Windows\\System32\\iphlpapi.dll exists","Repair the Windows image (sfc /scannow, DISM RestoreHealth) if the DLL is missing/corrupt","Adjust AppLocker/WDAC rules to allow loading iphlpapi.dll, or run outside the restricted policy","Disable process-based routing rules if the environment legitimately lacks the DLL"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// Windows: verify the DLL is loadable before relying on process rules\nh, err := windows.LoadLibrary(\"iphlpapi.dll\")\nif err != nil {\n    // every FindProcess call will fail with the cached initErr\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"LoadLibrary iphlpapi.dll failed\") {\n    // permanent for this process (sync.Once caches initErr); disable process rules\n}","preventionTips":["Health-check DLL availability at startup and disable process rules proactively","Note initErr is cached by sync.Once: retrying FindProcess never re-attempts the load","Keep System32 intact in server-core images used for Xray"],"tags":["windows","dll","iphlpapi","process-lookup","applocker"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}