Full Transcript
Loading transcript…
SyScan'14 Singapore: All About The Rpc, Lrpc, Alpc, And Lpc In Your Pc By Alex Ionescu
Watch with subtitles, summary & AI chat
Add the free Subkun extension — works directly on YouTube.
- Watch
- Subtitles
- Summary
- Ask AI
Developers and security researchers interested in Windows internals and exploit development.
TL;DR
This video explains the Local Procedure Call (LPC) and its evolution to Advanced LPC (ALPC) in Windows. These undocumented inter-process communication mechanisms are crucial for RPC and COM, making them a significant security target.
Key Takeaways
- LPC, introduced in Windows NT, was an early mechanism for inter-process communication and kernel-user mode interaction, designed for efficiency.
- Developers typically avoid undocumented LPC, opting for named pipes or RPC, with RPC historically relying on named pipes due to LPC's limitations.
- Vista introduced ALPC, adding asynchronicity, cancelability, and atomicity, leading Microsoft to adopt it as the default for RPC.
- Modern Windows heavily relies on COM and DCOM, which use RPC internally, meaning most applications indirectly utilize ALPC.
- Every process on Windows likely has an ALPC connection, creating a significant attack surface, especially when interacting with high-privilege processes.
- Exploiting bugs in the ALPC runtime, rather than specific servers, offers a more powerful way to gain system-level control from any context.
- ALPC servers and clients communicate via named ports, using APIs like NtAlpcSendWaitReceivePort for message exchange and NtAlpcConnectPort for establishing connections.
- ALPC servers can validate client connection requests, examining information like process ID and security tokens to decide whether to accept or reject a connection.
In This Video
- 00:00Introduction to LPC and RPC
The talk covers LPC, LRPC, ALPC, and LPC in PCs. It begins with the speaker's background in reverse engineering.
- 01:00Evolution of LPC to ALPC
LPC, an early inter-process communication mechanism, was undocumented. Developers used alternatives like named pipes or RPC.
- 02:50ALPC: Asynchronous and Enhanced LPC
Vista introduced ALPC, adding asynchronicity, cancelability, and atomicity. RPC and COM now default to using ALPC.
- 04:34Security Implications of ALPC
Bugs in RPC, COM, or ALPC runtime can lead to system compromise. Even sandboxed applications use ALPC.
- 05:58Security Through Obscurity in ALPC
ALPC's undocumented nature leads to less rigorous security checks by developers. The talk will detail ALPC communication.
- 06:27ALPC Client-Server Communication
ALPC communication resembles BSD sockets. Servers create ports, and clients connect using specific APIs like NtAlpcConnectPort.
- 09:36Accepting ALPC Connections
Servers use NtAlpcAcceptConnectPort to accept or reject client connections. Clients receive a status indicating success or failure.
Questions & Answers
What is LPC and when was it introduced in Windows?
LPC, or Local Procedure Call, was introduced in Windows NT from the very beginning. It allowed two processes to communicate with each other or the kernel to communicate with user mode.
Why did Microsoft replace LPC with ALPC in Vista?
In Windows Vista, LPC was replaced with ALPC (Advanced Local Procedure Call) or Asynchronous LPC. ALPC introduced asynchronicity, cancelability, and atomicity guarantees, making it more efficient.
How does ALPC relate to RPC and COM in modern Windows?
Microsoft's RPC team switched to using ALPC by default, meaning applications using RPC are now using ALPC. COM and Distributed COM also use RPC internally, so interacting with COM objects means you're using ALPC.
What is the security implication of ALPC being undocumented?
Because ALPC is undocumented, developers may not implement thorough parameter checking, creating potential security vulnerabilities. Bugs in ALPC can allow attackers to gain system privileges from a sandboxed environment.
How does a client connect to an ALPC server port?
A client calls NtlpcConnectPort, providing the port name and attributes. The client can also specify an initial connection message, which the server can use to validate the connection request.
What information does an ALPC server receive about a connecting client?
Upon a connection request, the ALPC server receives the client's PID, TID, CID, token, and other information. This allows the server to decide whether to accept or reject the connection.
Key Terms
- LPC (Local Procedure Call) — An early Windows mechanism allowing inter-process communication, including between user mode and the kernel.
- RPC (Remote Procedure Call) — A Microsoft interface based on a DCERPC standard, used for communication between processes, which now utilizes ALPC internally.
- COM (Component Object Model) — A Microsoft technology for creating reusable software components, enabling communication within and between processes.
- ALPC (Advanced Local Procedure Call) — An enhanced, asynchronous version of LPC introduced in Windows Vista, offering improved performance and security features.