Windows 10 Windows 10 1809 RPC call fail

[alexhongkong]

Hello,
I am upgrading win10 build 1803 to 1809 LTSC. And I have a program which use MS_EVEN (RPC) update the eventlog of Windows Server 2008. However, the update eventlog process get fail after I change to 1809 LTSC. I also try in build 1809 Pro version and the same problem occur.

I have checked the tcp messages of those cases:

In 1803:

After client send out a EVEN:ElfrRegisterEventSourceA request, a response is recevied.

In 1809:

After client send out a EVEN:ElfrRegisterEventSourceA request, a MSRPC: c/o Fault (Error: 0x00006f7 RPC_X_BAD_STUB_DATA – Data Parse fail) is received.


After I compare the EVEN:ElfrRegisterEventSourceA request, I found that the different is the PRC_String content.

In 1803, the ModuleName(RPC_STRING) byte pattern is :
Msg Len(2Byte)+Max Len(2Byte)+Pointer(4Byte)+Max Len(2Byte)+"0000"(2Byte)+Message(21Byte)+"00"(1Byte)

In 1809, the RPC_STRING byte pattern is :
Msg Len(2Byte)+Max Len(2Byte)+Pointer(4Byte)+Max Len(2Byte)+"00000000000000"(6Byte)+Msg Len(2Byte)+"0000"(2Byte)+Message(21Byte)+"00"(1Byte)


I tested this problem in following combinations:

1. Windows 10 build 1803 connect to Windows Server 2008 -- success
2. Windows 10 build 1809 LTSC connect to Windows Server 2008 -- fail
3. Windows 10 build 1809 LTSC connect to Windows 10 build 1809 LTSC -- success
4. Windows 10 build 1809 LTSC connect to Windows Server 2016 -- fail
5. Windows 10 build 1809 Pro connect to Windows Server 2008 -- fail

Please help to check how can I use build 1809 LTSC connect to Windows Server 2008 with MS-EVEN.

Thank you.

More...