PPL-Aware ALPC Port Enumerator

A Windows userland tool for enumerating and classifying Advanced Local Procedure Call (ALPC) ports, including those owned by PPL (Protected Process Light) processes where standard handle duplication fails.

Standard enumeration tools often skip protected or access-denied ports entirely, creating blind spots. This tool dynamically resolves the ALPC Port object-type index and falls back to NtQueryInformationProcess to accurately classify ports that reject standard duplication requests.

Real-World Use Cases

This tool eliminates blind spots in standard Windows IPC enumeration for two primary audiences:

• Threat Hunting & DFIR: Malware communicating over ALPC may hook or deny PROCESS_DUP_HANDLE access to hide its activity. Standard tools silently drop these ports. This tool catches the failure and queries the PS_PROTECTION structure instead. If a process denies access but returns a Type and Signer of 0 (None), it is not a legitimate Windows PPL process, this is highly anomalous and should be flagged for immediate investigation.
• Vulnerability Research: Accurately mapping the undocumented RPC/ALPC attack surface requires absolute precision. Relying on handle duplication alone guarantees missing the highest-privileged (and most valuable) targets on the system.

Execution Summary & Raw Data

During testing on a live Windows system, the tool walked 58,916 open handles and isolated 2,618 ALPC ports:

• 52 Protected Ports
• 260 Named Ports
• 346 Path-Named Ports
• 1,960 Anonymous Ports

Raw Output: The complete, unfiltered output of this run is available in alpc_enumerator_output.txt.

Note on Anonymous Ports: Console printing for anonymous ports is disabled by default in main.cpp to prevent bloating the terminal output with thousands of entries. If you require real-time output for anonymous ports, uncomment checkEntriesVectorForPrint(anonEntries, "Anonymous"); at line ~451 before compiling.

Kernel Verification

To prove the userland enumeration is accurate, the tool's output has been manually verified against the Windows kernel debugger (WinDbg). Object addresses and PPL signer levels match kernel truth exactly.

• See VERIFICATION.md for the side-by-side proof.
• See alpc_verification_log.txt for the raw WinDbg session log.

Build & Run

1. Open main.cpp in Visual Studio or compile via MSVC.
2. Build in Release mode (x64).
3. Run as Administrator (requires SeDebugPrivilege).

Technical Approach

Instead of hardcoding the ALPC object-type index (which breaks across Windows builds), the tool creates a throwaway ALPC port and queries its type dynamically to isolate the correct index for the host system (e.g., Index 46). When standard handle duplication fails, it decodes PS_PROTECTION to extract the exact Type and Signer needed to classify ports without relying on access rights.

For full technical breakdown, here is the medium writup link: https://medium.com/@sphinx_321/userland-alpc-enumeration-dynamic-ppl-aware-approach-283541194102

Stay Updated

This tool is part of my ongoing research into ALPC/RPC and Windows internals. I will be publishing further findings and releasing companion tools in the near future. If you found this useful, consider following me on GitHub or my socials below to be notified of future drops.

License

MIT