Skip to content

Instantly share code, notes, and snippets.

@tyranid
Created June 26, 2022 21:42
Embed
What would you like to do?
This is a simple script to get the RPC servers and listening endpoints for a process by ID.
# This is a simple script to get the RPC servers and listening endpoints for a process by ID.
Import-Module NtObjectManager
function Get-RpcKey {
param($Obj)
"$($Obj.InterfaceId)_$($Obj.InterfaceVersion)"
}
function Get-RpcProcess {
param(
[Parameter(Mandatory)]
[int]$ProcessId
)
try {
$rpc = Get-RpcServer -ProcessId $ProcessId
$eps = Get-RpcEndpoint -ProcessId $ProcessId
$ht = [System.Collections.Generic.HashSet[string]]::new()
$eps | % { $ht.Add($(Get-RpcKey $_)) | Out-Null }
[PSCustomObject]@{
Servers = $rpc | ? { $(Get-RpcKey $_) -in $ht }
Endpoints = $eps.BindingString | Sort-Object -Unique
}
} catch {
Write-Error $_
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment