trailofbits/rpcinvestigatorWindows RPC interface discovery and analysis tool with visual endpoint enumeration, PE parsing, symbol resolution, real-time ETW sniffing, and on-the-fly client code generation for security auditing.
Please read our blog post announcement.
RPC Investigator (RPCI) is a .NET/C# Windows Forms UI application that provides an advanced discovery and analysis interface to Windows RPC endpoints. The tool provides a visual interface around the existing core RPC capabilities of the NtApiDotNet platform, including:
Beyond these core features, RPCI provides additional capabilities:
There are several workflows that the RPC Investigator supports:
In this example, we'll be inspecting the Windows Task Scheduler RPC service, which is used to manage and execute scheduled tasks. We'll find the service, generate client code, and then customize the client to interact with one of the exposed procedures.
First, load the Windows services list by clicking File -> Load From Service. This opens a new service list window:
Find the Schedule service, which is the Windows Task Scheduler, select the service and click Go.
You will be prompted prior to RPCI loading all associated RPC DLLs. Click Yes to continue. Once loaded, you will see a list of all RPC servers discovered across all modules loaded in the service process. The Windows Task Scheduler RPC server has an Interface ID of 86D35949-83C9-4044-B424-DB363231FD0C. Find the row within the list that has this Interface ID, which should have a running service named Task Scheduler, right-click on the row and select New Client.
The left portion of the client window shows RPC server metadata and command line output from the client code. The right side shows two tabs:
In this example we'll be calling the SchRpcHighestVersion procedure. This method accepts a single argument, out int version, which, after calling the procedure, will contain the highest Task Scheduler protocol version supported by the RPC interface. The high 16-bits are the major version and the low 16-bits are the minor version.
To call this procedure:
In the Client Code window, find the Run method, which is the main entry point for the RPC client.
Edit the Run method body to call the procedure:
public async Task<bool> Run()
{
int version;
int status = SchRpcHighestVersion(out version);
if (status == 0) {
long major = (version & 0xffff0000) >> 16;
long minor = version & 0x0000ffff;
Console.WriteLine("highest supported RPC version: {0}.{1}", major, minor);
} else {
Console.WriteLine("call to SchRpcHighestVersion failed with error: {0:X}", status);
}
return true;
}
After adding this code, run the client by clicking the Run button. This will compile the C# code and then execute the Run method.
If compilation is successful, you will see something similar to the following in the Output box:
> Run() output:
highest supported RPC version: 1.6
The Rpc Investigator has several configuration settings.
| Setting | Description | Default |
|---|---|---|
| dbghelp.dll | File location of the dbghelp.dll module | Find latest version within installed Windows Kits. |
| Symbol Path | Path to Windows symbols, which can be a symbol server or local directory | Default public Windows Server: srv*c:\symbols*https://msdl.microsoft.com/download/symbols |
| Trace Level | The logging trace level | info |
The configuration settings can be modified within the application through the Edit -> Settings menu.
After its initial release, RPC Investigator was converted from a .NET Framework application to a .NET 7 application. If you run into build issues, make sure Visual Studio is up-to-date. Wiping all build output folders prior to building from the .NET Framework version is a good idea.
Also, due to the move from the insecure BinaryFormatter class to protobuf-net, RPC libraries generated with the .NET framework version are incompatible with the .NET version.
If you're experiencing random crashes in RPC Investigator, you might find a solution in asking your administrator to tweak your EDR. We have found that some EDRs do not behave sanely with JIT'ed languages.
In some cases RPC Investigator is detected as malicious by EDRs, including some false positives on Virus Total. This is a known issue. That's because RPC Investigator contains NtObjectManager - a package created by James Forshaw that's known to be detected (false positive) by a lot of EDRs, including Windows Defender.
Because Windows RPC has been a popular research topic for well over a decade, there are too many related resources and research efforts to name here. We've listed a few below that we encountered while building this tool:
If you're unfamiliar with RPC internals or need a technical refresher, we would recommend one of the authoritative sources on the topic - Alex Ionescu's 2014 SyScan talk in Singapore, All about the RPC, LRPC, ALPC, and LPC in your PC.