Example of using NtObjectManager to parse RPC server method

These commands demonstrate how you can extract RPC server information from Windows binary. This data is embed inside of any Windows RPC server binary and includes general information about the RPC server and the methods it exposes(including parameter counts and type/struct info).

Run all these commands in a PowerShell window.

Install NtObjectManager

In a PowerShell window, install NtObjectManager:

Install-Module NtObjectManager -Scope CurrentUser

Optional: Enable function symbol resolution (will resolve RPC methods to a name):

Set-GlobalSymbolResolver -DbgHelpPath "C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll"

Parse the RPC server info from a binary

$rpc_servers = Get-RpcServer -Path C:\Windows\System32\services.exe

Show basic info about the RPC servers contained in the binary

$rpc_servers

Output:

Name         UUID                                 Ver Procs EPs Service Running
----         ----                                 --- ----- --- ------- -------
services.exe a2c45f7c-7d32-46ad-96f5-adafb486be74 1.0 3     0           False
services.exe 367abb81-9844-35f1-ad32-98f038001003 2.0 69    1           False

Display procedure details

PS C:\> $ms_scmr = $rpc_servers[1]
PS C:\> $ms_scmr.ProcedureCount
69
PS C:\> $ms_scmr.Procedures[0]


Name                     : Proc0
Params                   : {FC_BIND_CONTEXT - NdrContextHandleTypeReference - IsIn, IsOut, IsSimpleRef}
ReturnValue              : FC_LONG - NdrSimpleTypeReference - IsOut, IsReturn, IsBasetype
Handle                   : FC_POINTER - NdrPointerTypeReference - IsIn, IsOut
RpcFlags                 : 0
ProcNum                  : 0
StackSize                : 16
HasAsyncHandle           : False
DispatchFunction         : 140701720362432
DispatchOffset           : 179648
InterpreterFlags         : HasReturn, HasExtensions
ConstantClientBufferSize : 56
ConstantServerBufferSize : 64



PS C:\> $ms_scmr.Procedures[0].Params


Attributes      : IsIn, IsOut, IsSimpleRef
Type            : FC_BIND_CONTEXT - NdrContextHandleTypeReference
ServerAllocSize : 0
Offset          : 0
Name            : p0
IsIn            : True
IsOut           : True
IsInOut         : True
IsSimpleRef     : True
IsPipe          : False


# Display the parameters. Note that this includes the number of parameters as well as type information.
PS C:\> $ms_scmr.Procedures[1].Params


Attributes      : IsIn
Type            : FC_BIND_CONTEXT - NdrContextHandleTypeReference
ServerAllocSize : 0
Offset          : 0
Name            : p0
IsIn            : True
IsOut           : False
IsInOut         : False
IsSimpleRef     : False
IsPipe          : False

Attributes      : IsIn, IsBasetype
Type            : FC_LONG - NdrSimpleTypeReference
ServerAllocSize : 0
Offset          : 8
Name            : p1
IsIn            : True
IsOut           : False
IsInOut         : False
IsSimpleRef     : False
IsPipe          : False

Attributes      : MustFree, IsOut, IsSimpleRef
Type            : FC_STRUCT - NdrSimpleStructureTypeReference
ServerAllocSize : 32
Offset          : 16
Name            : p2
IsIn            : False
IsOut           : True
IsInOut         : False
IsSimpleRef     : True
IsPipe          : False

Generate an IDL for the RPC server

$ms_scmr | Format-RpcServer

You can add the -RemoveComments parameter as well to clean up some of the IDL (removes some context, though).