创建: 2021-11-15 20:36
http://scz.617.cn:8/windows/202111152036.txt

windbg有个rpcexts.dll，在windbg帮助里搜"RPC Debugging"可以看到它的用法。其原始目的是对RPC调试提供帮助，比如在RPC Server中获取RPC Client的PID。

需要事先在组策略中进行配置

gpedit.msc
  Computer Configuration
    Administrative Templates
      System
        Remote Procedure Call
          Maintain RPC Troubleshooting State Information
            Enabled
            Full

重启OS使之生效。后续所有操作要求"Enabling RPC State Information"。

> !rpcexts.help
  !IF                - Dumps an RPC Interface
  !addrvect          - Dumps the address vector at the given location
  !ama               - Displays the ALPC message attributes
  !asyncmsg          - Dumps NDR_ASYNC_MESSAGE
  !asyncrpc          - Dumps RPC_ASYNC_STATE
  !authinfo          - Dumps CLIENT_AUTH_INFO
  !copacket          - Dumps CO packet
  !dict              - Dumps SDICT
  !dict2             - Dumps SDICT2
  !eeinfo            - Prints the extended error info chain
  !eerecord          - Prints the extended error info record given
  !error             - Translates an error value into the error message
  !fwscan            - Searches for a string pattern in the RpcFw log
  !getcallinfo       - Searches the system for call info
  !getclientcallinfo - Searches the system for client call info
  !getdbgcell        - Gets info for the specified cell
  !getendpointinfo   - Searches the system for endpoint info
  !getthreadinfo     - Searches the system for thread info
  !getvalidateerror  - Dumps error code for the failed VALIDATE
  !help              - Displays information on available extension commands
  !listcalls         - Dumps addresses, associations, and calls active within
                       the RPC_SERVER at address
  !lpcaddr           - Dumps LRPC_ADDRESS
  !lpcbh             - Dumps LRPC_BINDING_HANDLE
  !lpcca             - Dumps LRPC_CASSOCIATION
  !lpcccall          - Dumps LRPC_CCALL
  !lpcsa             - Dumps LRPC_SASSOCIATION
  !lpcscall          - Dumps LRPC_SCALL
  !mode              - Switches the extensions to debug one of these 3 modes
                       (rpcrt4, msrpc, rhttpaa). Default is rpcrt4
  !obj               - Dumps an RPC Object
  !overlap           - Dumps object associated with OVERLAPPED pointer
  !pasync            - Dumps RPC_ASYNC_STATE
  !pipedesc          - Dumps NDR_PIPE_DESC
  !pipemsg           - Dumps NDR_PIPE_MESSAGE
  !pipestate         - Dumps NDR_PIPE_STATE
  !protocols         - Dumps PnP protocols map & related objects
  !queue             - Dumps QUEUE
  !rpcheap           - Dumps rpc heap on checked builds
  !rpcmsg            - Dumps RPC_MESSAGE
  !rpcreadstack      - Reads an RPC client side stack and retrieves the call
                       info
  !rpcsvr            - Dumps RPC_SERVER
  !rpctime           - Displays current system time
  !rpcverbosestack   - Toggles the state of the verbose spew when reading the
                       stack
  !rpcverifier       - Dumps the RPC verifier settings
  !scan              - Dumps the event log
  !secinfo           - Dumps security provider/package info
  !sizes             - Prints sizes of the data structures
  !stackmatch        - Matches stack symbols and target addresses
  !stubmsg           - Dumps MIDL_STUB_MESSAGE
  !thread            - Dumps the RPCRT4 thread object
  !traceasynccall    - Traces an LRPC call chain starting with a given
                       RPC_ASYNC_STATE object
  !tracesynccall     - Traces an LRPC call chain starting with a given thread
  !trans             - Dumps most NT RPC transport objects
  !transinfo         - Dumps TRANS_INFO
  !version           - Prints version information for the current rpc extension
                       library
!help <cmd> will give more information for a particular command
> !rpcexts.help rpcmsg
!rpcmsg <address>
   address - the address of the RPC_MESSAGE struct
Dumps RPC_MESSAGE

前面的命令列表看上去很诱人。但根据《Advanced Windows Debugging》第8章的说法，绝大部分命令依赖Private PDB，而我们只有Public PDB，后者只支持极其有限的几条命令，比如

!getcallinfo       - Searches the system for call info
!getclientcallinfo - Searches the system for client call info
!getdbgcell        - Gets info for the specified cell
!getendpointinfo   - Searches the system for endpoint info
!getthreadinfo     - Searches the system for thread info

遗憾的是，这几条只依赖Public PDB的扩展命令在Win10上也几乎不工作了，只有!getendpointinfo还能输出有效信息。

为什么Win10中rpcexts.dll不灵了？

有两个重要的布尔型全局变量

RPCRT4!g_fClientSideDebugInfoEnabled
RPCRT4!g_fServerSideDebugInfoEnabled

XP源码中LRPC_CCALL::SendReceive会检查上述两个全局变量，若为真则调用CCALL::SetDebugClientCallInformation。用IDA看Win10的rpcrt4.dll，查看上述两变量的交叉引用，注意到函数

RPCRT4!ReadPolicySettings

顾名思义，读组策略中的设置，这部分与早期Windows相符。但是，Win10中只有OSF_CCALL::FastSendReceive还会调用CCALL::SetDebugClientCallInformation，已经没有其他的*_CCALL::*SendReceive调用CCALL::SetDebugClientCallInformation。换句话说，Win10不再保存为rpcexts.dll所用的RPC调试信息，组策略设置形同虚设。Win10从根上废了这条技术路线。