Skip to content

Instantly share code, notes, and snippets.

@tyranid
Created June 26, 2022 21:42
Show Gist options
  • Save tyranid/522c2cce70122289c7139bff413e240a to your computer and use it in GitHub Desktop.
Save tyranid/522c2cce70122289c7139bff413e240a to your computer and use it in GitHub Desktop.
This is a simple script to get the RPC servers and listening endpoints for a process by ID.
# This is a simple script to get the RPC servers and listening endpoints for a process by ID.
Import-Module NtObjectManager
function Get-RpcKey {
param($Obj)
"$($Obj.InterfaceId)_$($Obj.InterfaceVersion)"
}
function Get-RpcProcess {
param(
[Parameter(Mandatory)]
[int]$ProcessId
)
try {
$rpc = Get-RpcServer -ProcessId $ProcessId
$eps = Get-RpcEndpoint -ProcessId $ProcessId
$ht = [System.Collections.Generic.HashSet[string]]::new()
$eps | % { $ht.Add($(Get-RpcKey $_)) | Out-Null }
[PSCustomObject]@{
Servers = $rpc | ? { $(Get-RpcKey $_) -in $ht }
Endpoints = $eps.BindingString | Sort-Object -Unique
}
} catch {
Write-Error $_
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment