https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/ Structural and Behavioral Patterns for Software Diagnostics, Forensics and Prognostics Tue, 05 May 2026 20:49:21 +0000 http://wordpress.org/?v=2.3.3 https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-108488 Software Generalist » Blog Archive » Reading Notebook: 07-December-09 Tue, 08 Dec 2009 10:21:10 +0000 https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-108488 [...] Undocumented MSRPC (p. 391) - there is an empirical technique to find LRPC server endpoint: http://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/ [...] […] Undocumented MSRPC (p. 391) - there is an empirical technique to find LRPC server endpoint: http://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/ […]

]]> https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-33916 Dmitry Vostokov Sat, 12 Jul 2008 00:41:31 +0000 https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-33916 I call it "documented" because when I discovered it in one e-mail from MS support engineer I thought that publishing it would violate my MS source code agreement :-) Now it is publicly documented I call it “documented” because when I discovered it in one e-mail from MS support engineer I thought that publishing it would violate my MS source code agreement Now it is publicly documented

]]> https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-33907 Koby Kahane Fri, 11 Jul 2008 23:06:09 +0000 https://www.dumpanalysis.org/blog/index.php/2008/07/11/in-search-of-lost-pid/#comment-33907 I'd hardly call the post on the NT Debugging blog having the technique "documented." It would be more appropriate for the next version of Windbg to ship a debugger extension that extracts this information for COM calls in place of the long defunct SIEExtPub's !sr2 extension, or to have the public symbols for ole32.dll contain type information for the class members of the IRpcChannelBuffer implementation, to make extracting local COM call information more straightforward than peering through a undocumented channel buffer implementation's data members. I’d hardly call the post on the NT Debugging blog having the technique “documented.”
It would be more appropriate for the next version of Windbg to ship a debugger extension that extracts this information for COM calls in place of the long defunct SIEExtPub’s !sr2 extension, or to have the public symbols for ole32.dll contain type information for the class members of the IRpcChannelBuffer implementation, to make extracting local COM call information more straightforward than peering through a undocumented channel buffer implementation’s data members.

]]>