In Search of Lost CID
Paraphrasing the title of Marcel Proust’s “In Search of Lost Time” 6-volume classic we can say there is timeless empirical knowledge. One is target CID (Client ID, PID:TID) for RPC calls. We just need to search for even 16-bit numbers and compare them with the list of available PIDs. The example can be found on ntdebugging blog:
Tracking Down a Multi-Process Deadlock
Actually the second dword after PID can contain even 16-bit TID number as can be seen from another example:
1: kd> kv
ChildEBP RetAddr Args to Child
[...]
00faf828 7778c38b 00faf8f0 00faf9f0 06413b54 ole32!CRpcChannelBuffer::SwitchAptAndDispatchCall+0x112
00faf908 776c0565 06413b54 00fafa00 00faf9f0 ole32!CRpcChannelBuffer::SendReceive2+0xd3
00faf974 776c04fa 06413b54 00fafa00 00faf9f0 ole32!CAptRpcChnl::SendReceive+0xab
00faf9c8 77ce247f 06413b54 00fafa00 00faf9f0 ole32!CCtxComChnl::SendReceive+0×1a9
00faf9e4 77ce252f 03213bdc 00fafa2c 0600016e RPCRT4!NdrProxySendReceive+0×43
00fafdcc 77ce25a6 763050e8 76306bba 00fafe04 RPCRT4!NdrClientCall2+0×206
00fafdec 77c64f87 0000000c 00000005 00fafe3c RPCRT4!ObjectStublessClient+0×8b
00fafdfc 7784ba75 03213bdc 03235858 03235850 RPCRT4!ObjectStubless+0xf
[…]
1: kd> dpp 06413b54 l8
06413b54 77672418 7778bcdf ole32!CRpcChannelBuffer::QueryInterface
06413b58 776723e8 777267f5 ole32!CRpcChannelBuffer::QueryInterface
06413b5c 00000003
06413b60 00000002
06413b64 0743fde8 0316f080
06413b68 07676528 031d5ad0
06413b6c 064c9c80 064c9d00
06413b70 078843c0 00000000
1: kd> dd 064c9c80 l4
064c9c80 064c9d00 064c9c00 00003108 00001dac ; PID TID
I have been using this technique for a long time and only now see it documented.
- Dmitry Vostokov @ DumpAnalysis.org -
July 11th, 2008 at 11:06 pm
I’d hardly call the post on the NT Debugging blog having the technique “documented.”
It would be more appropriate for the next version of Windbg to ship a debugger extension that extracts this information for COM calls in place of the long defunct SIEExtPub’s !sr2 extension, or to have the public symbols for ole32.dll contain type information for the class members of the IRpcChannelBuffer implementation, to make extracting local COM call information more straightforward than peering through a undocumented channel buffer implementation’s data members.
July 12th, 2008 at 12:41 am
I call it “documented” because when I discovered it in one e-mail from MS support engineer I thought that publishing it would violate my MS source code agreement
Now it is publicly documented
December 8th, 2009 at 10:21 am
[…] Undocumented MSRPC (p. 391) - there is an empirical technique to find LRPC server endpoint: http://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/ […]