AlpcMonitor

A utility for monitoring Advanced Local Procedure Calls (ALPC) for IPC on Windows.

• Can view raw RPC data (Decrypted - No encryption is applied in the kernel even with RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
• Can filter on all fields using complex logical expressions (&&, ||, ()), parsed via the Shunting-yard algorithm
• Can view & filter on usermode & kernelmode callstacks of ALPC packets.
• Given an RPC SEND message (i.e. calling a remote function), can try to trace the remote function's RVA & VA for easier debugging.

Build Instructions

1. Clone the repository:

git clone https://github.com/kfirtaizi/AlpcMonitor
cd AlpcMonitor

2. Update WDK & KMDF paths in driver's CMakeLists

All below should be valid paths on the machine you're building on:
WDK_ROOT, WDK_VERSION, WDF_VERSION, WDK_INCLUDE_PATH, KMDF_INCLUDE_PATH, WDK_LIB_PATH, KMDF_LIB_PATH

3. Create build files with CMake:

mkdir build && cd build
cmake -A x64 ..

4. Compile the code:

# Build for Debug
cmake --build . --config Debug

# Or build for Release
cmake --build . --config Release

Binaries are located in:

• build/gui/Debug/
• build/driver/Debug/

Install Instructions

Driver

Disable Secure Boot -> bcdedit /set testsigning on -> Reboot
sc.exe create alpcmonitor binpath="<path-to-ALPCMonitor.sys>" type=kernel
sc.exe start alpcmonitor

• In case of errors running the driver refer to Troubleshooting

GUI

• Run as admin for full set of functionalities

Tested on

• Windows 11 24H2 (Build 26100.4652)
• Let me know if breaks on other versions!

---

Troubleshooting

Error 577: "Windows cannot verify the digital signature for this file"

To fix, create your own test certificate, sign the driver with it, and then explicitly trust that certificate on the target machine.

1. On your Development PC (where you built the driver)

Run these commands in PowerShell as admin in ALPCMonitor.sys's directory to create a certificate and sign the .sys file.

# Create a certificate and export the necessary files
$cert = New-SelfSignedCertificate -Subject "CN=AlpcMonitor Test Cert" -Type CodeSigningCert
Export-Certificate -Cert $cert -FilePath "ALPCMonitor.cer"
$pfx_pwd = ConvertTo-SecureString "password" -AsPlainText -Force
Export-PfxCertificate -Cert $cert -FilePath "ALPCMonitor.pfx" -Password $pfx_pwd

# Sign the driver binary (requires signtool.exe from the WDK)
signtool sign /f "ALPCMonitor.pfx" /p "password" /fd SHA256 "ALPCMonitor.sys"

2. On the Target PC (where you install the driver)

1. Copy the signed ALPCMonitor.sys and the ALPCMonitor.cer file to the machine.
2. certutil -addstore "Root" "C:\Path\On\Target\Machine\ALPCMonitor.cer"
3. Proceed with the normal driver installation using sc.exe. The sc start alpcmonitor command should now succeed.