4.8.2. RPC interfaces supported by the rpcss service

Note: names and purposes of some of the interfaces described in the three following sections have been documented by Microsoft France technical departments.

The first RPC interface is the DCE RPC endpoint portmapper interface [70]:

e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0: epmp

Table 4.3. epmp operations

InterfaceOperation numberOperation name
e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0: epmp  
 0x00ept_insert
 0x01ept_delete
 0x02ept_lookup
 0x03ept_map
 0x04ept_lookup_handle_free
 0x05ept_inq_object
 0x06ept_mgmt_delete
 0x07ept_map_auth
 0x08ept_map_auth_async

The ept_map_auth and ept_map_auth_async operations are apparently specific to Microsoft implementation of the epmapper interface.

The second RPC interface is used by local processes to reach the local endpoint mapper:

0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1: localepmp

Table 4.4. localepmp operations

InterfaceOperation numberOperation name
0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1: localepmp  
 0x00OpenEndpointMapper
 0x01AllocateReservedIPPort
 0x02ept_insert_ex
 0x03ept_delete_ex
> Windows XP SP20x04SetRestrictRemoteClients
 0x05ResetWithNoAuthException

Starting with Windows XP, a new RPC interface is available, DbgIdl, to help debugging of RPC services:

1d55b526-c137-46c5-ab79-638f2a68e869 v1.0: DbgIdl 

Table 4.5. DbgIdl operations

InterfaceOperation numberOperation name
1d55b526-c137-46c5-ab79-638f2a68e869 v1.0: DbgIdl  
 0x00GetCellByDebugCellID
 0x01OpenRPCDebugCallInfoEnumeration
 0x02GetNextRPCDebugCallInfo
 0x03FinishRPCDebugCallInfoEnumeration
 0x04OpenRPCDebugEndpointInfoEnumeration
 0x05GetNextRPCDebugEndpointInfo
 0x06FinishRPCDebugEndpointInfoEnumeration
 0x07OpenRPCDebugThreadInfoEnumeration
 0x08GetNextRPCDebugThreadInfo
 0x09FinishRPCDebugThreadInfoEnumeration
 0x0aOpenRPCDebugClientCallInfoEnumeration
 0x0bGetNextRPCDebugClientCallInfo
 0x0cFinishRPCDebugClientCallInfoEnumeration

To use the DbgIdl interface, the sytem hosting RPC services must be configured to maintain RPC troubleshooting state information. The RPC Troubleshooting State Information GPO must be enabled, typically in the LGPO using gpedit.msc.

The dbgrpc.exe program, available in the Microsoft Debugging tools package, can then be used, either locally or remotely to debug RPC services. More information about the usage of dbgrpc.exe is available in the RPC Debugging section of the Microsoft Debugging Tools package documentation [72].

The FwIdl interface was introduced in Windows Vista:

Z:\WINDOWS> ifids -p ncalrpc -e epmapper vista
Interfaces: 12

[...]

  64fe0b7f-9ef5-4553-a7db-9a1975777554 v1.0

Table 4.6. FwIdl operations

InterfaceOperation numberOperation name
64fe0b7f-9ef5-4553-a7db-9a1975777554 v1.0: FwIdl  
 0x00FwConnectToManager
 0x01FwSubscribeForNewRulesNotification
 0x02FwInterfaceRegistered
 0x03FwPortRegistered
 0x04FwPortUnregistered