Viewing messages being sent over ALPC Port?

Question

I am trying to figure out the messages being used on a specific ALPC port in Windows 7, and since it doesn't seem like there is any place where the ports messages are documented only the actual ports themselves, I would like to listen in to certain ports an view the messages being sent to the port.

Does anyone have any idea how this can be done?

Have you tried kernel logging with the [ALPC](http://msdn.microsoft.com/en-us/library/windows/desktop/aa964738(v=vs.85).aspx) class? — Eric Brown, Feb 06 '14 at 21:22
That is what I am going to do. It seems to be the only way to do so. — user1632018, Feb 10 '14 at 16:08

score 3 · Accepted Answer · answered Feb 10 '14 at 17:39

3

ALPC calls are intended to be fast, so there's not a lot of interception points. Your best bets are:

Enable ETW kernel logging and monitor the message flows with the ALPC class (strongly recommended)
Hack around with the Detours library. I don't recommend this, as it's a global solution, and doesn't let you look at specific ports. If you need to deploy the solution, it's even worse.

answered Feb 10 '14 at 17:39

Eric Brown

13,774
7
30
71

Thanks Eric, I am going with your first recommendation. – user1632018 Feb 10 '14 at 17:55

Viewing messages being sent over ALPC Port?

1 Answers1