none
Windows 10 1809 RPC call fail RRS feed

  • 问题

  • Hello,
    I am upgrading win10 build 1803 to 1809 LTSC. And I have a program which use MS_EVEN (RPC) update the eventlog of Windows Server 2008. However, the update eventlog process get fail after I change to 1809 LTSC. I also try in build 1809 Pro version and the same problem occur.

    I have checked the tcp messages of those cases:

    In 1803:

    After client send out a EVEN:ElfrRegisterEventSourceA request, a response is recevied.

    In 1809:

    After client send out a EVEN:ElfrRegisterEventSourceA request, a MSRPC: c/o Fault (Error: 0x00006f7 RPC_X_BAD_STUB_DATA – Data Parse fail) is received.

    After I compare the EVEN:ElfrRegisterEventSourceA request, I found that the different is the PRC_String content.

    In 1803, the ModuleName(RPC_STRING) byte pattern is :
    Msg Len(2Byte)+Max Len(2Byte)+Pointer(4Byte)+Max Len(2Byte)+"0000"(2Byte)+Message(21Byte)+"00"(1Byte)

    In 1809, the RPC_STRING byte pattern is :
    Msg Len(2Byte)+Max Len(2Byte)+Pointer(4Byte)+Max Len(2Byte)+"00000000000000"(6Byte)+Msg Len(2Byte)+"0000"(2Byte)+Message(21Byte)+"00"(1Byte)

    I tested this problem in following combinations:

    1. Windows 10 build 1803 connect to Windows Server 2008 -- success
    2. Windows 10 build 1809 LTSC connect to Windows Server 2008 -- fail
    3. Windows 10 build 1809 LTSC connect to Windows 10 build 1809 LTSC -- success
    4. Windows 10 build 1809 LTSC connect to Windows Server 2016 -- fail
    5. Windows 10 build 1809 Pro connect to Windows Server 2008 -- fail

    Please help to check how can I use build 1809 LTSC connect to Windows Server 2008 with MS-EVEN.

    Thank you.

    2019年7月30日 3:57