A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #29084  by Vrtule
 Mon Aug 22, 2016 2:04 pm
Hello,

recently, I looked into iphlpapi.dll a little bit and I found out (not surprisingly) that it uses RPC quite a lot. Does anybody know the other end of the RPC calls? I am especially interestend in the ICMP stuff.

Thanks in advance
 #29130  by Vrtule
 Sun Aug 28, 2016 6:20 pm
Thanks for the suggestions, especially for RPCView. It actually turned out that there is no RPC on the ICMP path, at least not in iphlpapi.dll. IcmpXSendEcho leads to an IOCTL targetted at \Device\nsiProxy. So, my bad.