GitHub - talha-nazeef-ahmed/ALPC-Enumerator: A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes. · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

talha-nazeef-ahmed

ALPC-Enumerator

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star<br>15

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>12 Commits<br>12 Commits

LICENSE

LICENSE

README.md

README.md

VERIFICATION.md

VERIFICATION.md

alpc_enumerator_output.txt

alpc_enumerator_output.txt

alpc_verification_log.txt

alpc_verification_log.txt

main.cpp

main.cpp

View all files

Repository files navigation

PPL-Aware ALPC Port Enumerator

A Windows userland tool for enumerating and classifying Advanced Local Procedure Call (ALPC) ports, including those owned by PPL (Protected Process Light) processes where standard handle duplication fails.

Standard enumeration tools often skip protected or access-denied ports entirely, creating blind spots. This tool dynamically resolves the ALPC Port object-type index and falls back to NtQueryInformationProcess to accurately classify ports that reject standard duplication requests.

Real-World Use Cases

This tool eliminates blind spots in standard Windows IPC enumeration for two primary audiences:

Threat Hunting & DFIR: Malware communicating over ALPC may hook or deny PROCESS_DUP_HANDLE access to hide its activity. Standard tools silently drop these ports. This tool catches the failure and queries the PS_PROTECTION structure instead. If a process denies access but returns a Type and Signer of 0 (None), it is not a legitimate Windows PPL process, this is highly anomalous and should be flagged for immediate investigation.

Vulnerability Research: Accurately mapping the undocumented RPC/ALPC attack surface requires absolute precision. Relying on handle duplication alone guarantees missing the highest-privileged (and most valuable) targets on the system.

Execution Summary & Raw Data

During testing on a live Windows system, the tool walked 58,916 open handles and isolated 2,618 ALPC ports :

52 Protected Ports

260 Named Ports

346 Path-Named Ports

1,960 Anonymous Ports

Raw Output: The complete, unfiltered output of this run is available in alpc_enumerator_output.txt.

Note on Anonymous Ports: Console printing for anonymous ports is disabled by default in main.cpp to prevent bloating the terminal output with thousands of entries. If you require real-time output for anonymous ports, uncomment checkEntriesVectorForPrint(anonEntries, "Anonymous"); at line ~451 before compiling.

Kernel Verification

To prove the userland enumeration is accurate, the tool's output has been manually verified against the Windows kernel debugger (WinDbg). Object addresses and PPL signer levels match kernel truth exactly.

See VERIFICATION.md for the side-by-side proof.

See alpc_verification_log.txt for the raw WinDbg session log.

Build & Run

Open main.cpp in Visual Studio or compile via MSVC.

Build in Release mode (x64).

Run as Administrator (requires SeDebugPrivilege).

Technical Approach

Instead of hardcoding the ALPC object-type index (which breaks across Windows builds), the tool creates a throwaway ALPC port and queries its type dynamically to isolate the correct index for the host system (e.g., Index 46). When standard handle duplication fails, it decodes PS_PROTECTION to extract the exact Type and Signer needed to classify ports without relying on access rights.

For full technical breakdown, here is the medium writup link: https://medium.com/@sphinx_321/userland-alpc-enumeration-dynamic-ppl-aware-approach-283541194102

License

MIT

About<br>A Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.<br>Topics<br>alpcdfirpplred-team-toolsred-teaming-toolsreverse-engineeringrpcvulnerability-researchwindowswindows-internals<br>Resources<br>Readme<br>MIT license<br>Activity<br>Stars<br>15 stars<br>Watchers<br>0 watching<br>Forks<br>1 fork<br>Report repository

Releases

Packages

Contributors

Languages

You can’t perform that action at this time.