Wireshark-dev: Re: [Wireshark-dev] How does a RPC runtime transfers the functionparameters into

From: "Na Peng"<pengna.vip@xxxxxxxxx>
Date: Thu, 11 Dec 2008 10:33:36 +0800
Title: Mail
pengweiwen,Wireshark-dev,你好
 
 
2008-12-11
----- Original Message -----
From: pengweiwen
Sent: 2008-09-27, 11:44:29
Subject: [Wireshark-dev] How does a RPC runtime transfers the functionparameters into a network octet stream

hi,everyone
 
    I`m trying to dissect the MAPI(also called ExchangeRPC) PDUs and have encountered this problem,what is the order in which a RPC client or server transfers a remote procedure actual paramters into a network octets stream?
    
    As I known, a RPC request/response PDU consists of a common header,a PDU body and the other parts.The PDU body contains the input parameters  required by a RPC and maybe include some output parameters required by this Remote Procedure Call, but in which order , the rpc runtime transfers these parameters into a PDU body.
    
    For example, a remote procedure of EcDoRpcExt2 was declared in Exchange protocol specification as following:
    long __stdcall EcDoRpcExt2(
        [in,out,ref] CXH *pcxh,
        [in,out] unsigned long *pulFlags,
        [in,size_is(cbIn)],
        [in] unsigned long cbIn,
        [out,length_is(*pcbOut),size_is(*pcbOut)] unsigned char rgbOut[],
        [in,out] BIG_RANGE_ULONG *pcbOut,
        [in ,size_is(cbAuxIn)] unsigned char rgbAuxIn[],
        [in] unsigned long cbAuxIn,
        [out,length_is(*pcbAuxOut),size_is (*pcbAuxOut)] unsigned char rgbAuxOut[],
        [in,out] SMALL_RANGE_ULONG *pcbAuxOut,
        [out] unsigned long *pulTransTime
    )
    What`s the order, in which these parameters(now,i don`t ensure whether  out parameters are serialized into a request PDU body) are transfered into a request PDU body, isn`t the formal parameter declaration order ,the opposite order or the others?
 
    I have read the Transfer syntax NDR section in DCE-RPC[C706] specification, but I can't get the answer.
 
    Who can help me? any reply is appreciated!
 
    Thanks very very much in advance!
 
Rube Peng,pww007@xxxxxxxxx
2008-09-26