Topic created on: October 26, 2008 06:24 CDT by nickycoder .

Hi,

This is a query regarding MSRPC interfaces and identifying its idl information when mida and !getrpc fails.

I would like to ask the forum on available options if I fail in identifying the function pointers and idl info using mida in ida and !getrpc module in immunity debugger (if rpc interfaces and their opnums are present).

I hit such a challenge while reversing netapi32.dll recently. I was able to get the rpc interfaces using mida but not the opnums or function pointers(so no idl info ). Then I tried it in immunity debugger and found that it didnt give me any information. So I checked the "getrpc script" itself and found that the offsets it was trying to fetch (which is the transfer syntax) had no information other than the rpc interface address [ no dispatch table info or "Interpreter Info"]. So thats why getrpc failed to give any valuable information. [more details attached below]


1. Is there any other way to find the rpc info from a dll or exe and also its function pointers and idl information.
2. Is the logic of finding rpc interface same as !getrpc where it tries to find "\x04\x5d\x88\x8a"[transfer syntax] in the module and offset set to "-18" from the current location of "\x04\x5d\x88\x8a".

------------------
[Details of rpc in raw format]
[offset + codeaddr is 0x5b8642f8, codeaddr is the module base; copied from getrpc script; Thanks to jms]

(offset + codeaddr =>     "Length")
(offset + codeaddr+4=>    "Interface UUID: (uuid, major, minor))
(offset + codeaddr+0x18=> "Transfer syntax")
(offset + codeaddr+0x2c=> "Dispatch Table")
(offset + codeaddr+0x30=> "RpcProtseqEndpointCount")
(offset + codeaddr+0x34=> "RpcProtseqEndpoint")
(offset + codeaddr+0x38=> "Default Manager")
(offset + codeaddr+0x3c=> "Interpreter Info")
(offset + codeaddr+0x40=> "Flags")

.text:5B8642F0  00 00 00 00 00 00 00 00  44 00 00 00 C8 4F 32 4B
.text:5B864300  70 16 D3 01 12 78 5A 47  BF 6E E1 88 03 00 00 00
.text:5B864310  04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60
.text:5B864320  02 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00
.text:5B864330  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00



Any ideas or information regarding this is very appreciable!!!