Reverse Engineering rpcss.dll: Hunting for the ROT's Hidden Structure

Part IV(?) of the "Inside the Running Object Table" series When I started this research, I assumed finding the internal layout of the Running Object Table would be straightforward. Microsoft documents IRunningObjectTable at the API level — surely the implementation couldn't be far behind. I was wrong. What followed was a Ghidra session that turned up something far more interesting than I expected. Where does the ROT actually live? First surprise: there is no rpcss.exe on disk. What Windows Task