Note: names and purposes of some of the interfaces described in the three following sections have been documented by Microsoft France technical departments.
The first RPC interface is the DCE RPC endpoint portmapper interface [70]:
e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0: epmp
Table 4.3. epmp operations
| Interface | Operation number | Operation name |
|---|---|---|
| e1af8308-5d1f-11c9-91a4-08002b14a0fa v3.0: epmp | ||
| 0x00 | ept_insert | |
| 0x01 | ept_delete | |
| 0x02 | ept_lookup | |
| 0x03 | ept_map | |
| 0x04 | ept_lookup_handle_free | |
| 0x05 | ept_inq_object | |
| 0x06 | ept_mgmt_delete | |
| 0x07 | ept_map_auth | |
| 0x08 | ept_map_auth_async |
The ept_map_auth and ept_map_auth_async operations are apparently specific to Microsoft implementation of the epmapper interface.
The second RPC interface is used by local processes to reach the local endpoint mapper:
0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1: localepmp
Table 4.4. localepmp operations
| Interface | Operation number | Operation name |
|---|---|---|
| 0b0a6584-9e0f-11cf-a3cf-00805f68cb1b v1.1: localepmp | ||
| 0x00 | OpenEndpointMapper | |
| 0x01 | AllocateReservedIPPort | |
| 0x02 | ept_insert_ex | |
| 0x03 | ept_delete_ex | |
| > Windows XP SP2 | 0x04 | SetRestrictRemoteClients |
| 0x05 | ResetWithNoAuthException |
Starting with Windows XP, a new RPC interface is available, DbgIdl, to help debugging of RPC services:
1d55b526-c137-46c5-ab79-638f2a68e869 v1.0: DbgIdl
Table 4.5. DbgIdl operations
| Interface | Operation number | Operation name |
|---|---|---|
| 1d55b526-c137-46c5-ab79-638f2a68e869 v1.0: DbgIdl | ||
| 0x00 | GetCellByDebugCellID | |
| 0x01 | OpenRPCDebugCallInfoEnumeration | |
| 0x02 | GetNextRPCDebugCallInfo | |
| 0x03 | FinishRPCDebugCallInfoEnumeration | |
| 0x04 | OpenRPCDebugEndpointInfoEnumeration | |
| 0x05 | GetNextRPCDebugEndpointInfo | |
| 0x06 | FinishRPCDebugEndpointInfoEnumeration | |
| 0x07 | OpenRPCDebugThreadInfoEnumeration | |
| 0x08 | GetNextRPCDebugThreadInfo | |
| 0x09 | FinishRPCDebugThreadInfoEnumeration | |
| 0x0a | OpenRPCDebugClientCallInfoEnumeration | |
| 0x0b | GetNextRPCDebugClientCallInfo | |
| 0x0c | FinishRPCDebugClientCallInfoEnumeration |
To use the DbgIdl interface, the sytem hosting RPC services must be configured to maintain RPC troubleshooting state information. The RPC Troubleshooting State Information GPO must be enabled, typically in the LGPO using gpedit.msc.
The dbgrpc.exe program, available in the Microsoft Debugging tools package, can then be used, either locally or remotely to debug RPC services. More information about the usage of dbgrpc.exe is available in the RPC Debugging section of the Microsoft Debugging Tools package documentation [72].
The FwIdl interface was introduced in Windows Vista:
Z:\WINDOWS> ifids -p ncalrpc -e epmapper vista Interfaces: 12 [...] 64fe0b7f-9ef5-4553-a7db-9a1975777554 v1.0