Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for the service application.
I know that I can use Process Explorer to get the name of the server's ALPC handle under
\RPC Control, and I guess that this handle could be used to create a binding string which would allow my client to connect to the server. This should hopefully solve the connection part.
However, how should I go on about defining the actual RPC interface for my client to get code executed on the server? I would first need to identify remote procedures and the arguments that they take, and then code a proper client. My guess is that I should write an idl file that somehow fits with the service, and then compile it using midl compiler with an appropriate configuration. Is this the best strategy or would someone with more experience suggest something else? What are the most efficient techniques or tools to enumerate and reverse engineer RPC interfaces? Is reversing even necessary? Does anyone has some experience they could share about this?