Timeline for at the rpcrt4!NdrClientCall2 function - how does it know which pipe to use in order to transfer data to another process?
Current License: CC BY-SA 3.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 12, 2016 at 0:13 | vote | accept | 0xAK | ||
| Feb 2, 2015 at 19:09 | comment | added | blabb | rpc_client_interface , rpc_serever_interface , and null for param one are documented in _midl_stub_message documentaion RpcInterfaceInformation For a nonobject RPC interface on the server-side, it points to an RPC server interface structure. On the client-side, it points to an RPC client interface structure. It is null for an object interface. | |
| Feb 1, 2015 at 15:40 | comment | added | Jason Geffner | We all started out as an "RE-Beginner" at some point ;) | |
| Feb 1, 2015 at 15:31 | comment | added | 0xAK | i guess there is noting compared to real experience. Thanks a ton | |
| Feb 1, 2015 at 15:28 | comment | added | Jason Geffner |
With regard to NDR_PROC_HEADER, I found this in ReactOS's code.
|
|
| Feb 1, 2015 at 15:24 | comment | added | Jason Geffner |
With regard to RPC_CLIENT_INTERFACE, I actually relied on previous research I had done (see page 27 in Exporting Non-Exportable RSA Keys). When I did the initial research, I think I determined this by either by looking at the documented RPC structures and noticing the name RPC_CLIENT_INTERFACE, or by finding this in ReactOS's code.
|
|
| Feb 1, 2015 at 6:59 | comment | added | 0xAK | The same question goes for the "NDR_PROC_HEADER" | |
| Feb 1, 2015 at 6:35 | comment | added | 0xAK | Yes this was exactly what i was looking for. Just for future reference.. how did you figure out the Struct parameters type? How did you know that MIDL_STUB_DESC.RpcInterfaceInformation is of type The msdn just says it points to a ** RPC client interface structure ** and i couldnt see anywhere on the msdn the "RPC_CLIENT_INTERFACE". Where did you find that? And by the way thanks for the awesome answer | |
| Jan 31, 2015 at 1:05 | history | edited | Jason Geffner | CC BY-SA 3.0 |
deleted 5 characters in body
|
| Jan 31, 2015 at 0:50 | comment | added | Jason Geffner | I've updated my answer above to answer that question. | |
| Jan 31, 2015 at 0:49 | history | edited | Jason Geffner | CC BY-SA 3.0 |
Added RPC server function information
|
| Jan 30, 2015 at 23:44 | comment | added | 0xAK | Or better yet, where is the place i should place a BreakPoint at? | |
| Jan 30, 2015 at 23:00 | comment | added | 0xAK | Alright, this thought me a lot! thanks for that. But for the second part of my question, Is there a way to know what is the -final- called procedure? What you eventually found was the exported Initialization function which calls RpcServerUseProtseqEpW(), this is not the real function which is called. or am i missing something? | |
| Jan 30, 2015 at 21:40 | vote | accept | 0xAK | ||
| Jul 12, 2016 at 0:13 | |||||
| Jan 29, 2015 at 15:20 | history | edited | Jason Geffner | CC BY-SA 3.0 |
deleted 10 characters in body
|
| Jan 29, 2015 at 15:09 | history | answered | Jason Geffner | CC BY-SA 3.0 |