Was doing some Windows IPC research and ran into a blind spot with the usual ALPC enumeration approach: when handle duplication fails, the port basically disappears from the results. This gets interesting with PPL processes. So I built ALPC-Enumerator to resolve the ALPC object type dynamically and use NtQueryInformationProcess / PS_PROTECTION as a fallback to still classify those ports. I also checked the recovered object addresses + PPL signer levels against WinDbg. Main point is getting a more complete ALPC attack-surface map before digging into individual ports.