# Rpc Interface Analysis

> >

- **Type:** Skill
- **Install:** `agentstack add skill-marcosd4h-deepextractruntime-rpc-interface-analysis`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [marcosd4h](https://agentstack.voostack.com/s/marcosd4h)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/rpc-interface-analysis

## Install

```sh
agentstack add skill-marcosd4h-deepextractruntime-rpc-interface-analysis
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# RPC Interface Analysis

## Purpose

Query and analyze RPC (Remote Procedure Call) interfaces registered in Windows
system binaries.  Uses a pre-built index of NtApiDotNet-extracted RPC data that
maps every binary to its interfaces, procedure names, endpoint protocols,
service associations, and NDR complex types.  Optionally enriches with C#
client stub parameter signatures and procedure semantic classification.

## When to Use

- Enumerate RPC interfaces in a module or system-wide
- Map the RPC attack surface ranked by risk tier
- Audit RPC handler security (missing impersonation, missing auth)
- Trace RPC handler data flow to dangerous sinks
- Analyze blast-radius of co-hosted interfaces in shared processes
- View typed parameter signatures from C# client stubs
- Build client-server topology graphs

## When NOT to Use

- General function explanation -- use **re-analyst**
- COM interface reconstruction -- use **com-interface-reconstruction**
- Non-RPC attack surface mapping -- use **map-attack-surface**

## Data Sources

- **RPC index** (`helpers/rpc_index.py`): Singleton loaded from
  `config/assets/rpc_data/rpc_servers.json` (binary-keyed; contains
  interface metadata, endpoints, file info, and procedure lists per binary).
- **C# client stubs** (`config/assets/rpc_data/rpc_clients_26200_7840/*.cs`): 414
  auto-generated client stubs with typed procedure signatures.
- **Per-module analysis DB**: Decompiled code for RPC handler functions.

## Scripts

### `resolve_rpc_interface.py` (Start Here)

List all RPC interfaces for a module with full metadata and optional stub
signatures. Use `--workspace` to discover which workspace modules implement
RPC interfaces.

```bash
python .claude/skills/rpc-interface-analysis/scripts/resolve_rpc_interface.py appinfo.dll
python .claude/skills/rpc-interface-analysis/scripts/resolve_rpc_interface.py appinfo.dll --json
python .claude/skills/rpc-interface-analysis/scripts/resolve_rpc_interface.py spoolsv.exe --with-stubs --json
python .claude/skills/rpc-interface-analysis/scripts/resolve_rpc_interface.py --workspace --json
```

### `map_rpc_surface.py`

Risk-ranked RPC attack surface, per module or system-wide.  Includes optional
blast-radius analysis. Use `--system-wide` to rank the full RPC index. This
script does **not** support `--workspace` -- to discover which workspace modules
implement RPC interfaces, use `resolve_rpc_interface.py --workspace` above.

```bash
python .claude/skills/rpc-interface-analysis/scripts/map_rpc_surface.py appinfo.dll --json
python .claude/skills/rpc-interface-analysis/scripts/map_rpc_surface.py --system-wide --top 20
python .claude/skills/rpc-interface-analysis/scripts/map_rpc_surface.py --system-wide --with-blast-radius --json
```

### `audit_rpc_security.py`

RPC-specific security audit combining index data with decompiled code.

```bash
python .claude/skills/rpc-interface-analysis/scripts/audit_rpc_security.py  --json
```

### `trace_rpc_chain.py`

Trace an RPC handler's data flow from NDR dispatch to dangerous sinks.

```bash
python .claude/skills/rpc-interface-analysis/scripts/trace_rpc_chain.py  --function  --json
```

### `find_rpc_clients.py`

Find all modules that implement or consume a given RPC interface UUID.
Falls back to C# stub data when no runtime clients are present.

```bash
python .claude/skills/rpc-interface-analysis/scripts/find_rpc_clients.py  --json
```

### `rpc_topology.py`

Build a system-wide or per-module RPC client-server topology graph combining
pipe name extraction, ALPC endpoints, stub metadata, and service grouping.

```bash
python .claude/skills/rpc-interface-analysis/scripts/rpc_topology.py --json
python .claude/skills/rpc-interface-analysis/scripts/rpc_topology.py spoolsv.exe --json
python .claude/skills/rpc-interface-analysis/scripts/rpc_topology.py --top 20 --json
```

## Direct Helper Module Access

- `helpers.rpc_index.get_rpc_index()` -- cached singleton RPC index
- `helpers.rpc_index.RpcIndex.compute_blast_radius(uuid)` -- co-hosted interfaces
- `helpers.rpc_index.RpcIndex.cross_reference_strings(strings)` -- string-to-RPC matching
- `helpers.rpc_index.RpcIndex.get_procedure_signatures(uuid)` -- stub signatures
- `helpers.rpc_stub_parser.parse_stub_file(path)` -- parse a single stub

## Workflows

### Module RPC Enumeration

1. Run `resolve_rpc_interface.py ` to list all interfaces.
2. Run `map_rpc_surface.py ` to rank by risk.

### RPC Security Audit

1. Run `resolve_rpc_interface.py ` for interface context.
2. Run `audit_rpc_security.py ` to check security patterns.
3. Run `trace_rpc_chain.py  --function ` for high-risk handlers.

### System-Wide Surface

1. Run `map_rpc_surface.py --system-wide --top 30` for global ranking.

### Blast-Radius Analysis

1. Run `map_rpc_surface.py --system-wide --with-blast-radius --json` for
   co-hosted interface impact across all services.

### Client-Server Topology

1. Run `rpc_topology.py --json` for the full system topology.

## Integration with Other Skills

| Task | Recommended Skill |
|------|------------------|
| Decompiled code for RPC handlers | decompiled-code-extractor |
| Entry point ranking including RPC | map-attack-surface |
| Cross-module call graph with RPC edges | callgraph-tracer |
| Taint analysis through RPC handlers | taint-analysis |

## Performance

| Operation | Typical Time | Notes |
|-----------|-------------|-------|
| RPC index load | ~1-2s | Cached after first load |
| Stub directory parse (414 files) | ~3-5s | Only when `load_stubs` is true |
| Per-module interface resolve | ]` to
inspect RPC index state and module attribution. Use `--edges` to verify
cross-module RPC edge injection counts.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [marcosd4h](https://github.com/marcosd4h)
- **Source:** [marcosd4h/DeepExtractRuntime](https://github.com/marcosd4h/DeepExtractRuntime)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-marcosd4h-deepextractruntime-rpc-interface-analysis
- Seller: https://agentstack.voostack.com/s/marcosd4h
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.