RpcView

RpcView is an open-source tool to explore and decompile all RPC functionalities present on a Microsoft system.

You can download the last automatically built release

Warning: you have to install "Microsoft Visual C++ 2019 Redistributable" to use RpcView.

How to add a new RPC runtime

Basically you have two possibilities to support a new RPC runtime (rpcrt4.dll) version:

• The easy way: just edit the RpcInternals.h file in the corresponding RpcCore directories (32 and 64-bit versions) to add your runtime version in the RPC_CORE_RUNTIME_VERSION table.
• The best way: reverse the rpcrt4.dll to define the required structures used by RpcView, e.g. RPC_SERVER, RPC_INTERFACE and RPC_ADDRESS.

Currently, the supported versions are organized as follows:

• RpcCore1 for Windows XP
• RpcCore2 for Windows 7
• RpcCore3 for Windows 8
• RpcCore4 for Windows 8.1 and 10

Compilation

Required elements to compiled the project:

• Visual Studio (currently Visual Studio 2019 Community)
• CMake (currently 3.13.2)
• Qt5 (currently 5.15.2)

Before running CMake you have to set the CMAKE_PREFIX_PATH environment variable with the Qt full path, for instance (x64):

set CMAKE_PREFIX_PATH=C:\Qt\5.15.2\msvc2019_64\

Before running CMake to produce the project solution you have to create the build directories:

• RpcView/Build/x64 for 64-bit targets
• RpcView/Build/x86 for 32-bit targets.

Here is an example to generate the x64 solution with Visual Studio 2019 from the RpcView/Build/x64 directory:

cmake../../-Ax64--Buildingfor:VisualStudio162019--SelectingWindowsSDKversion10.0.17763.0totargetWindows10.0.19041.--TheCcompileridentificationisMSVC19.28.29334.0--TheCXXcompileridentificationisMSVC19.28.29334.0--CheckforworkingCcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x64/cl.exe--CheckforworkingCcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x64/cl.exe--works--DetectingCcompilerABIinfo--DetectingCcompilerABIinfo-done--DetectingCcompilefeatures--DetectingCcompilefeatures-done--CheckforworkingCXXcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x64/cl.exe--CheckforworkingCXXcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x64/cl.exe--works--DetectingCXXcompilerABIinfo--DetectingCXXcompilerABIinfo-done--DetectingCXXcompilefeatures--DetectingCXXcompilefeatures-done[RpcView][RpcDecompiler][RpcCore1_32bits][RpcCore2_32bits][RpcCore2_64bits][RpcCore3_32bits][RpcCore3_64bits][RpcCore4_32bits][RpcCore4_64bits]--Configuringdone--Generatingdone--Buildfileshavebeenwrittento:C:/Dev/RpcView/Build/x64

To produce the Win32 solution:

set CMAKE_PREFIX_PATH=C:\Qt\5.15.2\msvc2019

Then from the RpcView/Build/x86 directory:

cmake../../-Awin32--Buildingfor:VisualStudio162019--SelectingWindowsSDKversion10.0.17763.0totargetWindows10.0.19041.--TheCcompileridentificationisMSVC19.28.29334.0--TheCXXcompileridentificationisMSVC19.28.29334.0--CheckforworkingCcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x86/cl.exe--CheckforworkingCcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x86/cl.exe--works--DetectingCcompilerABIinfo--DetectingCcompilerABIinfo-done--DetectingCcompilefeatures--DetectingCcompilefeatures-done--CheckforworkingCXXcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x86/cl.exe--CheckforworkingCXXcompiler:C:/ProgramFiles (x86)/MicrosoftVisualStudio/2019/Community/VC/Tools/MSVC/14.28.29333/bin/Hostx64/x86/cl.exe--works--DetectingCXXcompilerABIinfo--DetectingCXXcompilerABIinfo-done--DetectingCXXcompilefeatures--DetectingCXXcompilefeatures-done[RpcView][RpcDecompiler][RpcCore1_32bits][RpcCore2_32bits][RpcCore3_32bits][RpcCore4_32bits]--Configuringdone--Generatingdone--Buildfileshavebeenwrittento:C:/Dev/RpcView/Build/x86

Now you can compile the solution with Visual Studio or CMAKE:

cmake--build.--configRelease

RpcView32 binaries are produced in the RpcView/Build/bin/x86 directory and RpcView64 ones in the RpcView/Build/bin/x64

Acknowledgements

• Jeremy
• Julien
• Yoanne
• Bruno