HIMEM.SYS

Decode WCF Net.Pipe Handles

2016-12-28 16:13:25 +0000 ·

When using the net.pipe protocol, WCF will not generate NT named pipe objects that bear the exact name you specified (e.g. you won’t find any object/handle by the name of ‘net.pip://+/Whatever’), but rather something like \BaseNamedObjects\net.pipe:E... where everything after the “E” is essentially a base 64 encoded version of your original URI.

More details are available here.

To easily decode those strings, you can use PowerShell.

Example: List all net.pipe handles (using Sysinternals handle.exe):

PS> handle.exe net.pipe

SMSvcHost.exe      pid: 21448  type: Section        3B4: \BaseNamedObjects\net.pipe:EbmV0LnBpcGU6Ly8rLzM1RDAxOEJFLTk4MDQtNENCMi1BODM3LUE3MjRGNUZEMDBERS8=
vstest.discoveryengine.x86.exe pid: 17648  type: Section        39C: \Sessions\1\BaseNamedObjects\net.pipe:EbmV0LnBpcGU6Ly8rL1ZTVEVTVC5ESVNDT1ZFUllFTkdJTkUvMTc2NDgv
vstest.discoveryengine.x86.exe pid: 12672  type: Section        3A8: \Sessions\1\BaseNamedObjects\net.pipe:EbmV0LnBpcGU6Ly8rL1ZTVEVTVC5ESVNDT1ZFUllFTkdJTkUvMTI2NzIv
myapp.exe          pid: 21555  type: Section        322: \BaseNamedObjects\net.pipe:EbmV0LnBpcGU6Ly8rL1dIQVRFVkVS

Considering the object for myapp.exe, the base 64 value is bmV0LnBpcGU6Ly8rL1dIQVRFVkVS:

PS> [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("bmV0LnBpcGU6Ly8rL1dIQVRFVkVS"))
net.pipe://+/WHATEVER








  • About
  • Contact
  • Search
  • Powered by Jekyll and based on the Trio theme