rpc-interface-analysis

Index and analyze Windows RPC interfaces across binaries to map endpoints, procedures, and protocols.

17|3|Updated Feb 22, 2026
One-click install
npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill rpc-interface-analysis
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: rpc-interface-analysis
Source: https://github.com/marcosd4h/DeepExtractRuntime/tree/main/skills/rpc-interface-analysis
Command: npx skills add https://github.com/marcosd4h/DeepExtractRuntime --skill rpc-interface-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

RPC interfaces in Windows binaries form a broad attack surface that is hard to assess without an integrated view of interfaces, procedures, endpoints, and topology. This skill centralizes RPC interface discovery and analysis to help security engineers, incident responders, and developers quickly enumerate interfaces, assess exposure, and trace data flows across modules.

Core Features & Use Cases

  • Enumerate RPC interfaces for a module or system-wide
  • Map procedures, endpoints, protocols, and service associations
  • Compute blast-radius and client-server topology
  • Optionally enrich results with C# client stub signatures and security audits

Quick Start

Run resolve_rpc_interface.py <module> to list interfaces and procedures, with optional --with-stubs to include C# signatures.

Frequently Asked Questions about rpc-interface-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate RPC interfaces across Windows binaries?

To enumerate RPC interfaces across Windows binaries, run resolve_rpc_interface.py with the target module name. This indexes endpoints and procedures, optionally enriching results with C# client stub signatures using the --with-stubs flag.

What is RPC interface topology analysis and when do I need it?

RPC interface topology analysis maps client-server relationships and procedure endpoints across Windows modules. You need it when assessing security exposure, tracing data flows, or computing blast-radius for incident response and system-wide audits.

Can I analyze RPC interfaces system-wide or only per-module?

You can analyze RPC interfaces both per-module and system-wide. The skill applies module-level or system-wide audits to assess blast-radius, map endpoints, and trace protocol associations across all indexed Windows binaries.

Does this tool generate C# client stub signatures for RPC procedures?

Yes, the tool optionally enriches RPC analysis results with C# client stub signatures. Include the --with-stubs flag when running resolve_rpc_interface.py to generate these signatures alongside interface and procedure mappings.

What's the best way to assess RPC blast-radius on Windows?

Assess RPC blast-radius on Windows by indexing interfaces system-wide to compute client-server topology and protocol exposure. This skill centralizes endpoint discovery, allowing security engineers to quickly evaluate attack surface across modules.

Do I need a pre-built RPC index to analyze Windows binaries?

Yes, the skill relies on a pre-built RPC index and per-module analysis data to resolve interfaces, procedures, and classifications. Ensure this index is generated before running system-wide or module-level security audits.