NtAlpcSendWaitReceivePort

Prototype

NTSTATUS NtAlpcSendWaitReceivePort(
  HANDLE                   PortHandle,
  ULONG                    Flags,
  PPORT_MESSAGE            SendMessage,
  PALPC_MESSAGE_ATTRIBUTES SendMessageAttributes,
  PPORT_MESSAGE            ReceiveMessage,
  PSIZE_T                  BufferLength,
  PALPC_MESSAGE_ATTRIBUTES ReceiveMessageAttributes,
  PLARGE_INTEGER           Timeout
);

Arguments

Syscall IDs by Windows version

Syscall stub

4C 8B D1            mov r10, rcx
B8 8E 00 00 00      mov eax, 0x8E
F6 04 25 08 03 FE 7F 01   test byte ptr [0x7FFE0308], 1
75 03               jne short +3
0F 05               syscall
C3                  ret
CD 2E               int 2Eh
C3                  ret

Undocumented notes

`NtAlpcSendWaitReceivePort` is the workhorse of ALPC: every RPC call over the `ncalrpc` transport ultimately becomes one or more invocations of this syscall. It implements four high-level patterns — send-only, receive-only, request/reply (synchronous), and reply/wait-next (server loop) — selected by Flags and which of SendMessage/ReceiveMessage are non-NULL. The `PORT_MESSAGE` header is followed by an optional `ALPC_MESSAGE_ATTRIBUTES` block that may carry duplicated handles, a security context blob, or a shared section view — these are the same attributes that make ALPC such a juicy LPE target.

Common malware usage

Two distinct abuse patterns: 1. **LPE exploitation**: every ALPC LPE chain ends in a crafted `SendMessage` that triggers a vulnerable code path on the server side. CVE-2018-8440 sent a forged `ALPC_MESSAGE_ATTRIBUTE_HANDLE` to the Task Scheduler ALPC port; CVE-2019-1322 (SVCMOVER) abused services.exe over ALPC; multiple PrintNightmare PoCs reach the Print Spooler ALPC endpoint via this syscall. 2. **Stealth IPC C2**: red-team frameworks occasionally build implant↔implant channels on top of an unnamed ALPC port (created with `NtAlpcCreatePort` then connected via `NtAlpcConnectPort`) because ALPC is invisible to Sysmon network telemetry. Throughput is small but enough for command-and-control.

Detection opportunities

Per-call detection is impractical — this syscall fires millions of times an hour on a busy host. Useful angles: ETW `Microsoft-Windows-Kernel-ALPC` (when enabled) attributes messages to port name and PID; large `ALPC_MESSAGE_ATTRIBUTE_HANDLE` payloads from non-privileged processes to system services are suspicious; correlation with `Microsoft-Windows-RPC` ETW (which sits *above* ALPC) gives the RPC interface UUID being invoked — an unexpected UUID from a non-Microsoft binary is the strongest signal. The historical ALPC LPE bugs were all caught post-disclosure by hunting for handle attributes pointing at SYSTEM-owned objects from user-context senders.

Direct syscall examples

; Direct syscall stub for NtAlpcSendWaitReceivePort (SSN 0x8E on Win11 24H2)
NtAlpcSendWaitReceivePort PROC
    mov  r10, rcx          ; PortHandle
    mov  eax, 8Eh          ; SSN — version-sensitive
    syscall
    ret
NtAlpcSendWaitReceivePort ENDP

// Minimal ALPC server pump — receive, dispatch, reply.
#include <windows.h>
#include <winternl.h>

typedef NTSTATUS (NTAPI *pNtAlpcSendWaitReceivePort)(
    HANDLE, ULONG, PVOID, PVOID, PVOID, PSIZE_T, PVOID, PLARGE_INTEGER);

void ServerPump(HANDLE hPort) {
    pNtAlpcSendWaitReceivePort fn = (pNtAlpcSendWaitReceivePort)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtAlpcSendWaitReceivePort");
    BYTE recv[0x1000]; SIZE_T cb;
    BYTE reply[0x1000];
    for (;;) {
        cb = sizeof(recv);
        // Pure receive: SendMessage = NULL.
        if (fn(hPort, 0, NULL, NULL, recv, &cb, NULL, NULL) != 0) break;
        // ... build reply in 'reply' ...
        // Send reply, wait for next request: ALPC_MSGFLG_RELEASE_MESSAGE = 0x10000.
        cb = sizeof(recv);
        fn(hPort, 0x10000, reply, NULL, recv, &cb, NULL, NULL);
    }
}

// Synchronous request/reply on an already-connected ALPC port.
#include <windows.h>
#include <winternl.h>
#define ALPC_MSGFLG_SYNC_REQUEST 0x20000

typedef NTSTATUS (NTAPI *pNtAlpcSendWaitReceivePort)(
    HANDLE, ULONG, PVOID, PVOID, PVOID, PSIZE_T, PVOID, PLARGE_INTEGER);

NTSTATUS Call(HANDLE hPort, PVOID req, SIZE_T reqLen, PVOID rsp, PSIZE_T rspLen) {
    pNtAlpcSendWaitReceivePort fn = (pNtAlpcSendWaitReceivePort)GetProcAddress(
        GetModuleHandleA("ntdll.dll"), "NtAlpcSendWaitReceivePort");
    LARGE_INTEGER to; to.QuadPart = -5LL * 10000000LL; // 5 s
    return fn(hPort, ALPC_MSGFLG_SYNC_REQUEST, req, NULL, rsp, rspLen, NULL, &to);
}

MITRE ATT&CK mappings

• T1068Exploitation for Privilege Escalationmitre ↗
• T1559Inter-Process Communicationmitre ↗
• T1106Native APImitre ↗