How can I enumerate and hook into a Windows 10 RPC interface?

Question

Suppose that I have a certain Windows service that I know exposes a local RPC interface. I want to create a client program that calls into these procedures; however, I do not have the source code for the service application.

I know that I can use Process Explorer to get the name of the server's ALPC handle under \RPC Control, and I guess that this handle could be used to create a binding string which would allow my client to connect to the server. This should hopefully solve the connection part.

However, how should I go on about defining the actual RPC interface for my client to get code executed on the server? I would first need to identify remote procedures and the arguments that they take, and then code a proper client. My guess is that I should write an idl file that somehow fits with the service, and then compile it using midl compiler with an appropriate configuration. Is this the best strategy or would someone with more experience suggest something else? What are the most efficient techniques or tools to enumerate and reverse engineer RPC interfaces? Is reversing even necessary? Does anyone has some experience they could share about this?

Answer 1

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). Note that mIDA doesn't work with most recent version (64 bit version) of IDA but requires 32 bit version (6.95 is the latest version).

This plugin can be used to :

* Navigate to RPC functions in IDA
* Analyze RPC function arguments
* Understand RPC structures
* Reconstruct an IDL definition file

The IDL code generated by mIDA can be, most of the time, recompiled with the MIDL compiler from Microsoft (midl.exe).

mIDA is freely distributed to the community by Tenable in the hope it will be useful to you and help research engineers to work more effectively on RPC programs. However, Tenable does not provide support for this tool and offers no guarantee regarding its use or output. Please read the end-user license agreement before using this program.

Answer 2

What I found that fits my requirements is a free open source tool called RpcView, which can enumerate endpoints and interfaces from a selected process, list its corresponding procedures with their respective addresses in the process' address space, and decompile interfaces into idl files. It also works on x64.

One small detail is that by default it seems to refresh the process list every second, which causes it to lag quite harshly. To solve the problem I just had to set the refresh rate to manual from the options menu.

Answer 3

You can use rpc_toolkit/pe_rpc_if_scraper to statically parse interfaces in a binary file. Run the following command in Python: python pe_rpc_scraper.py <binary>

Then you will get the output json file like the following:

{
  "RPC-Server.exe": {
    "d6b1ad2b-b550-4729-b6c2-1651f58480c3": {
      "number_of_functions": 2,
      "functions_pointers": [
        "0x1400016f0",
        "0x1400017c0"
      ],
      "function_names": [
        "func1",
        "func2"
      ],
      "role": "server",
      "flags": "0x6000000",
      "interface_address": "0x14001d220"
    }
  }
}