windows-server-2003/com/rpc/runtime/exts/rpcdbg.cxx

//+-------------------------------------------------------------------------
//
//  Microsoft Windows
//
//  Copyright (C) Microsoft Corporation, 1994 - 2001
//
//  File:       rpcdbg.cxx
//
//--------------------------------------------------------------------------

/*++

Module Name:

    rpcdbg.cxx

Abstract:



Author:

    Jeff Roberts (jroberts)  13-May-1996

Revision History:

     13-May-1996     jroberts           Created this module.

    Mazhar Mohammed (mazharm) 3-20-97 - changed it all for async RPC,
                                        added some cool stuff
                                        single dll for ntsd and kd

    KamenM                  Dec 99      Added debugging support and multiple
                                        ntsd-through-kd sessions support

    GrigoriK                Mar 2001    Added support for type info.

--*/

#define KDEXT_64BIT

#include <stddef.h>
#include <limits.h>

#define DG_LOGGING
#define private public
#define protected public
#include <sysinc.h>
#include <wincrypt.h>
#include <rpc.h>
#include <rpcndr.h>
#include <ndrp.h>
#include <wdbgexts.h>
#include <rpcdcep.h>
#include <rpcerrp.h>
#define SECURITY_WIN32
#include <rpcssp.h>
#include <authz.h>
#include <align.h>
#include <util.hxx>
#include <rpcuuid.hxx>
#include <interlck.hxx>
#include <mutex.hxx>
#include <CompFlag.hxx>
#include <sdict.hxx>
#include <sdict2.hxx>
#include <rpctrans.hxx>
#include <CellDef.hxx>
#include <CellHeap.hxx>
#include <EEInfo.h>
#include <EEInfo.hxx>
#include <SWMR.hxx>
#include <bcache.hxx>
#include <threads.hxx>
#include <queue.hxx>
#include <gc.hxx>
#include <handle.hxx>
#include <binding.hxx>
#include <osfpcket.hxx>
#include <bitset.hxx>
#include <secclnt.hxx>
#include <CompFlag.hxx>
#include <ProtBind.hxx>
#include <osfclnt.hxx>
#include <hndlsvr.hxx>
#include <osfsvr.hxx>
#include <rpccfg.h>
#include <epmap.h>
#include <delaytab.hxx>
#include <memory.hxx>
#include <dgpkt.hxx>
#include <locks.hxx>
#include <dgclnt.hxx>
#include <delaytab.hxx>
#include <hashtabl.hxx>
#include <dgsvr.hxx>
#include <lpcpack.hxx>
#include <lpcsvr.hxx>
#include <lpcclnt.hxx>
#include <ntverp.h>

#include "rpcexts.hxx"

HANDLE ProcessHandle = 0;
BOOL fKD = 0;

// is debuggee a CHK build?
BOOL ChkTarget;

EXT_API_VERSION        ApiVersion = { VER_PRODUCTVERSION_W >> 8,
                                      VER_PRODUCTVERSION_W & 0xff,
                                      EXT_API_VERSION_NUMBER64, 0 };
WINDBG_EXTENSION_APIS  ExtensionApis;
USHORT                 SavedMajorVersion;
USHORT                 SavedMinorVersion;
BOOL                   bDebuggingChecked;

int AddressSize = 0;

BOOL bUnextend = FALSE;

VOID
WinDbgExtensionDllInit(
    PWINDBG_EXTENSION_APIS64 lpExtensionApis,
    USHORT MajorVersion,
    USHORT MinorVersion
    )
{
    KDDEBUGGER_DATA64 KdDebuggerData;

    ExtensionApis = *lpExtensionApis ;
    SavedMajorVersion = MajorVersion;
    SavedMinorVersion = MinorVersion;
    ChkTarget = SavedMajorVersion == 0x0c ? TRUE : FALSE;

    KdDebuggerData.Header.OwnerTag = KDBG_TAG;
    KdDebuggerData.Header.Size = sizeof( KdDebuggerData );

    if (Ioctl( IG_GET_DEBUGGER_DATA, &KdDebuggerData, sizeof( KdDebuggerData ) ))
        {
        fKD = 1;
        }

    if (IsPtr64())
        {
        AddressSize = 8;
        bUnextend = FALSE;
        }
    else
        {
        AddressSize = 4;
        bUnextend = TRUE;
        }
}

// By default we use the type information in extensins.
// This flag can be reset with !rpcexts.typeinfo off which will
// disable the use of type information.  !typeinfo on will
// enable it.
BOOL fUseTypeInfo = TRUE;

// If not set, the _NOSPEW macros will not print debugger spew.
// It is set to FALSE after the spew is printed by one of thise macros.
BOOL fSpew = TRUE;

char *
BoolString(
    BOOL Value
    )
{
    switch (Value)
        {
        case TRUE:  return "True";
        case FALSE: return "False";
        default:    return "?????";
        }
}

ULONG GetTypeSize(PUCHAR TypeName)
    {
    SYM_DUMP_PARAM Sym = {
        sizeof (SYM_DUMP_PARAM),
        TypeName, 
        DBG_DUMP_NO_PRINT, 0,
        NULL,
        NULL,
        NULL,
        NULL
    };

    return Ioctl(IG_GET_TYPE_SIZE, &Sym, Sym.size);
    }

ULONG64 GetVar(PCSTR VarName) {
    ULONG64 Var = 0;
    ULONG64 VarAddr = GetExpression(VarName);

    if (!VarAddr)
        {
        dprintf("Failure to get address of %s\n", VarName);
        return NULL;
        }

    if (ReadPtrUnextend(VarAddr, &Var))
        return NULL;

    return Var;
}

void do_dcebinding  (ULONG64 qwAddr);
void do_dgep        (ULONG64 qwAddr);
void do_dgsc        (ULONG64 qwAddr);
void do_dgsn        (ULONG64 qwAddr);
void do_osfbh       (ULONG64 qwAddr);
void do_osfca       (ULONG64 qwAddr);
void do_osfcconn    (ULONG64 qwAddr);
void do_osfccall    (ULONG64 qwAddr);
void do_osfaddr     (ULONG64 qwAddr);
void do_osfsconn    (ULONG64 qwAddr);
void do_osfscall    (ULONG64 qwAddr);
void do_osfsa       (ULONG64 qwAddr);
void do_rpcsvr      (ULONG64 qwAddr);
void do_lpcaddr     (ULONG64 qwAddr);
void do_lpcsa       (ULONG64 qwAddr);
void do_lpcscall    (ULONG64 qwAddr);
void do_lpcccall    (ULONG64 qwAddr);
void do_lpcbh       (ULONG64 qwAddr);
void do_lpcca       (ULONG64 qwAddr);
void do_rpcmem      (ULONG64 qwAddr, long lDisplay, long lVerbose);
void do_rpcmsg      (ULONG64 qwAddr);
void do_pasync      (ULONG64 qwAddr);
void do_authinfo    (ULONG64 qwAddr);
void do_error       (ULONG64 qwAddr);
void do_dict        (ULONG64 qwAddr);
void do_dict2       (ULONG64 qwAddr);
void do_queue       (ULONG64 qwAddr);
void do_stubmsg     (ULONG64 qwAddr);
void do_thread      (ULONG64 qwAddr);
void do_copacket    (ULONG64 qwAddr);
void do_obj         (ULONG64 qwAddr);
void do_transinfo   (ULONG64 qwAddr);
void do_lpcpacket   (ULONG64 qwAddr);
void do_IF          (ULONG64 qwAddr);
void do_assoctable  (ULONG64 qwAddr);
void do_eerecord    (ULONG64 qwAddr);
void do_eeinfo      (ULONG64 qwAddr);
void do_dgaddr      (ULONG64 qwAddr);
void do_dgca        (ULONG64 qwAddr);
void do_dgbh        (ULONG64 qwAddr);
void do_dgag        (ULONG64 qwAddr);
void do_dgcn        (ULONG64 qwAddr);
void do_typeinfo    (ULONG64 qwAddr);
void do_pipestate   (ULONG64 qwAddr);
void do_pipedesc    (ULONG64 qwAddr);
void do_pipearg     (ULONG64 qwAddr);
void do_pipemsg     (ULONG64 qwAddr);
void do_dgpe        (ULONG64 qwAddr);
void do_dgcc        (ULONG64 qwAddr);
void do_packet      (ULONG64 qwAddr);
void do_packet_header (ULONG64 qwAddr);
void do_trans       (ULONG64 qwAddr);
void do_dgpkt       (ULONG64 qwAddr);
void do_dgpkthdr    (ULONG64 qwAddr);
void do_asyncdcom   (ULONG64 qwAddr);
void do_asyncmsg    (ULONG64 qwAddr);
void do_asyncrpc    (ULONG64 qwAddr);
void do_listcalls   (ULONG64 qwAddr);

MY_DECLARE_API( assoctable )
MY_DECLARE_API( dgep )
MY_DECLARE_API( dgca )
MY_DECLARE_API( dgcn )
MY_DECLARE_API( dgsn )
MY_DECLARE_API( dgsc )
MY_DECLARE_API( osfbh )
MY_DECLARE_API( osfca )
MY_DECLARE_API( osfaddr )
MY_DECLARE_API( osfscall )
MY_DECLARE_API( osfsconn )
MY_DECLARE_API( dcebinding )
MY_DECLARE_API( osfccall )
MY_DECLARE_API( osfcconn )
MY_DECLARE_API( osfsa )
MY_DECLARE_API( rpcmsg )
MY_DECLARE_API( lpcaddr )
MY_DECLARE_API( lpcsa );
MY_DECLARE_API( lpcscall );
MY_DECLARE_API( lpcccall );
MY_DECLARE_API( lpcbh );
MY_DECLARE_API( lpcca );
MY_DECLARE_API( pasync);
MY_DECLARE_API( authinfo );
MY_DECLARE_API( error );
MY_DECLARE_API( dict );
MY_DECLARE_API( dict2 );
MY_DECLARE_API( queue );
MY_DECLARE_API( stubmsg );
MY_DECLARE_API( thread );
MY_DECLARE_API( copacket );
MY_DECLARE_API( obj );
MY_DECLARE_API( transinfo );
MY_DECLARE_API( lpcpacket );
MY_DECLARE_API( IF );
MY_DECLARE_API( eerecord );
MY_DECLARE_API( eeinfo );
MY_DECLARE_API( dgcc );
MY_DECLARE_API( dgpe );
MY_DECLARE_API( pipestate );
MY_DECLARE_API( pipedesc );
MY_DECLARE_API( pipearg );
MY_DECLARE_API( pipemsg );
MY_DECLARE_API( dgpkt );
MY_DECLARE_API( dgpkthdr );
MY_DECLARE_API( asyncdcom );
MY_DECLARE_API( asyncmsg );
MY_DECLARE_API( asyncrpc );

// define our own operators new and delete, so that we do not have to include the crt

void * __cdecl
::operator new(size_t dwBytes)
{
    void *p;
    p = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, dwBytes);
    return (p);
}


void __cdecl
::operator delete (void *p)
{
    HeapFree(GetProcessHeap(), 0, p);
}

// Returns 1 on failure.
BOOL ReadPtrUnextend(ULONG64 Addr, PULONG64 pVal) {

    *pVal = 0;

    if (!ReadPointer(Addr, pVal))
        return 1;

    if (bUnextend)
      *pVal = (ULONG64) (ULONG) *pVal;

    return 0;
}

BOOL
GetData(IN ULONG64 qwAddress, IN LPVOID ptr, IN ULONG size)
{
    BOOL b;
    ULONG BytesRead = 0;

    b = ReadMemory(qwAddress, ptr, size, &BytesRead );

    if (!b || BytesRead != size )
        {
        return FALSE;
        }
    return TRUE;
}

#define MAX_MESSAGE_BLOCK_SIZE 1024
#define BLOCK_SIZE 16

RPC_CHAR *
ReadProcessRpcChar(
    ULONG64 qwAddr
    )
{
    char block[BLOCK_SIZE];
    RPC_CHAR *RpcBlock  = (RPC_CHAR *)block;

    RPC_CHAR *RpcString = (RPC_CHAR *) new char[MAX_MESSAGE_BLOCK_SIZE];
    if (RpcString == NULL) {
        dprintf("couldn't allocate %d memory\n", MAX_MESSAGE_BLOCK_SIZE);
        return (NULL);
    }

    int length = 0;
    int i = 0;
    BOOL b;
    BOOL end = FALSE;

    if (qwAddr == NULL) {
        delete [] RpcString;
        return (NULL);
    }

    for (length = 0; length < MAX_MESSAGE_BLOCK_SIZE/2; ) {
        b = GetData(qwAddr, block, BLOCK_SIZE);
        if (b == FALSE) {
            dprintf("couldn't read address %I64xx\n", qwAddr);
            delete [] RpcString;
            return (NULL);
        }
        for (i = 0; i < BLOCK_SIZE/2; i++) {
            if (RpcBlock[i] == L'\0') {
                end = TRUE;
            }
            RpcString[length] = RpcBlock[i];
            length++;
        }
        if (end == TRUE) {
            break;
        }
        qwAddr += BLOCK_SIZE;
    }
   
    return (RpcString);
}

long
myatol(char *string)
{
    int  i         = 0;
    BOOL minus     = FALSE;
    long number    = 0;
    long tmpnumber = 0 ;
    long chknum = LONG_MAX;

    if (string[0] == '-') {
        minus = TRUE;
        i++;
    }
    else
    if (string[0] == '+') {
        i++;
    }
    for (; string[i] != '\0'; i++) {
        if ((string[i] >= '0')&&(string[i] <= '9')) {
            tmpnumber = string[i] - '0';
            if (number != 0)
                {
                chknum = LONG_MAX/number;
                }
            if (chknum > 11) {
                number = number*10 + tmpnumber;
            }
        }
        else
            return 0;
    }
    if (minus == TRUE) {
        number = 0 - number;
    }
    return number;
}

PCHAR
MapSymbol(ULONG64 qwAddr)
{
    static CHAR Name[256];
    ULONG64 Displacement;

    GetSymbol(qwAddr, Name, &Displacement);

    if (strcmp(Name, "") != 0) {
        if (Displacement)
            strcat(Name, "+");

        PCHAR p = strchr(Name, '\0');

        if (Displacement)
          _ui64toa(Displacement, p, 16);

        return(Name);
    }
    else {
        return NULL;
    }
}

// checks if the uuid is null, prints the uuid
void
PrintUuidLocal(UUID *Uuid)
{
    unsigned long PAPI * Vector;

    Vector = (unsigned long PAPI *) Uuid;
    if (    (Vector[0] == 0)
         && (Vector[1] == 0)
         && (Vector[2] == 0)
         && (Vector[3] == 0))
    {
        dprintf("(Null Uuid)");
    }
    else
    {
        dprintf("%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x",
                Uuid->Data1, Uuid->Data2, Uuid->Data3, Uuid->Data4[0], Uuid->Data4[1],
                Uuid->Data4[2], Uuid->Data4[3], Uuid->Data4[4], Uuid->Data4[5],
                Uuid->Data4[6], Uuid->Data4[7] );
    }
    return;
}

// prints the uuid at a given address within the process
void
PrintUuid(ULONG64 Uuid)
{
    UUID UuidStore;

    GetData(Uuid, &UuidStore, sizeof(UUID));

    PrintUuidLocal(&UuidStore);
}

// Returns a string for the symbol that matches the value at
// address dwAddr, or "".
PCHAR SymbolAtAddress(ULONG64 Addr)
{
    CHAR Symbol[128];
    ULONG64 Displacement = 0;
    static CHAR Name[256];
    ULONG64 Val;

    if (ReadPtrUnextend(Addr, &Val))
        return "";

    GetSymbol(Val, Symbol, &Displacement);

    if (strcmp(Symbol, "") != 0) {
        sprintf(Name, "%s+%x", Symbol, Displacement);
        return Name;
    }
    else
        return "";
}

// Returns a string for the symbol that matches the value at
// address dwAddr, without the offset, or "".
PCHAR SymbolAtAddressNoOffset(ULONG64 Addr)
{
    CHAR Symbol[128];
    ULONG64 Displacement = 0;
    static CHAR Name[256];
    ULONG64 Val;

    if (ReadPtrUnextend(Addr, &Val))
        return "";

    GetSymbol(Val, Symbol, &Displacement);

    if (strcmp(Symbol, "") != 0) {
        strcpy(Name, Symbol);
        return Name;
    }
    else
        return "";
}

void
do_securitycontext (
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    if (qwAddr == 0)
        {
        return;
        }

    do_authinfo(qwAddr);

    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, AuthContextId,
    "     AuthContextId           ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, Flags,
    "     Flags                   ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, ContextAttributes,
    "     ContextAttributes       ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, fFullyConstructed,
    "     fFullyConstructed       ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, DontForgetToDelete,
    "     DontForgetToDelete      ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, fDatagram,
    "     fDatagram               ", tmp1);

    ULONG64 SecurityContext;
    GET_ADDRESS_OF(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, SecurityContext, SecurityContext, tmp2);
    ULONG64 dwUpper, dwLower;
    GET_MEMBER(SecurityContext, _SecHandle, RPCRT4!_SecHandle, dwUpper, dwUpper);
    GET_MEMBER(SecurityContext, _SecHandle, RPCRT4!_SecHandle, dwLower, dwLower);
    dprintf(
    "     SecurityContext(0x%I64x, 0x%I64x) - 0x%I64x\n", dwUpper, dwLower, SecurityContext);

    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, MaxHeaderLength,
    "     MaxHeaderLength         ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, MaxSignatureLength,
    "     MaxSignatureLength      ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, cbBlockSize,
    "     cbBlockSize             ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, RpcSecurityInterface,
    "     RpcSecurityInterface    ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, SECURITY_CONTEXT, RPCRT4!SECURITY_CONTEXT, FailedContext,
    "     FailedContext           ", tmp1);
}

VOID
do_sizes(
    )
{
    PRINT_RPC_TYPE_SIZE(ASSOCIATION_HANDLE);
    dprintf("BIND_NAK_PICKLE_BUFFER_OFFSET - 0x%x\n", BIND_NAK_PICKLE_BUFFER_OFFSET);
    PRINT_RPC_TYPE_SIZE(BINDING_HANDLE);
    PRINT_RPC_TYPE_SIZE(BITSET);
    PRINT_RPC_TYPE_SIZE(CALL);
    PRINT_RPC_TYPE_SIZE(CCALL);
    PRINT_RPC_TYPE_SIZE(CLIENT_AUTH_INFO);
    PRINT_RPC_TYPE_SIZE(CLIENT_ID);
    PRINT_RPC_TYPE_SIZE(DCE_BINDING);
    PRINT_RPC_TYPE_SIZE(DCE_SECURITY_INFO);
    PRINT_RPC_TYPE_SIZE(EVENT);
    PRINT_RPC_TYPE_SIZE(GENERIC_OBJECT);
    PRINT_RPC_TYPE_SIZE(INTERLOCKED_INTEGER);
    PRINT_RPC_TYPE_SIZE(LOADABLE_TRANSPORT);
    PRINT_RPC_TYPE_SIZE(LRPC_ADDRESS);
    PRINT_RPC_TYPE_SIZE(LRPC_BIND_EXCHANGE);
    PRINT_RPC_TYPE_SIZE(LRPC_BINDING_HANDLE);
    PRINT_RPC_TYPE_SIZE(LRPC_CASSOCIATION);
    PRINT_RPC_TYPE_SIZE(LRPC_CCALL);
    PRINT_RPC_TYPE_SIZE(LRPC_MESSAGE);
    PRINT_RPC_TYPE_SIZE(LRPC_FAULT_MESSAGE);
    PRINT_RPC_TYPE_SIZE(LRPC_FAULT2_MESSAGE);
    PRINT_RPC_TYPE_SIZE(LRPC_RPC_HEADER);
    PRINT_RPC_TYPE_SIZE(LRPC_SASSOCIATION);
    PRINT_RPC_TYPE_SIZE(LRPC_SCALL);
    PRINT_RPC_TYPE_SIZE(LRPC_SERVER);
    dprintf("MAX_BIND_NAK - 0x%x\n", MAX_BIND_NAK);
    dprintf("MAXIMUM_FAULT_MESSAGE - 0x%x\n", MAXIMUM_FAULT_MESSAGE);
    dprintf("MAXIMUM_MESSAGE_BUFFER - 0x%x\n", MAXIMUM_MESSAGE_BUFFER);
    PRINT_RPC_TYPE_SIZE(MESSAGE_OBJECT);
    PRINT_RPC_TYPE_SIZE(MUTEX);
    PRINT_RPC_TYPE_SIZE(OSF_ADDRESS);
    PRINT_RPC_TYPE_SIZE(OSF_ASSOCIATION);
    PRINT_RPC_TYPE_SIZE(OSF_BINDING);
    PRINT_RPC_TYPE_SIZE(OSF_BINDING_HANDLE);
    PRINT_RPC_TYPE_SIZE(OSF_CASSOCIATION);
    PRINT_RPC_TYPE_SIZE(OSF_CCALL);
    PRINT_RPC_TYPE_SIZE(OSF_CCONNECTION);
    PRINT_RPC_TYPE_SIZE(OSF_SBINDING);
    PRINT_RPC_TYPE_SIZE(OSF_SCALL);
    PRINT_RPC_TYPE_SIZE(OSF_SCONNECTION);
    dprintf("PORT_MAXIMUM_MESSAGE_LENGTH - 0x%x\n", PORT_MAXIMUM_MESSAGE_LENGTH);
    PRINT_RPC_TYPE_SIZE(PORT_MESSAGE);
    PRINT_RPC_TYPE_SIZE(QUEUE);
    PRINT_RPC_TYPE_SIZE(RPC_ADDRESS);
    PRINT_RPC_TYPE_SIZE(RPC_APC_INFO);
    PRINT_RPC_TYPE_SIZE(RPC_CLIENT_INTERFACE);
    PRINT_RPC_TYPE_SIZE(RPC_CLIENT_PROCESS_IDENTIFIER);
    PRINT_RPC_TYPE_SIZE(rpcconn_alter_context);
    PRINT_RPC_TYPE_SIZE(rpcconn_alter_context_resp);
    PRINT_RPC_TYPE_SIZE(rpcconn_bind);
    PRINT_RPC_TYPE_SIZE(rpcconn_bind_ack);
    PRINT_RPC_TYPE_SIZE(rpcconn_common);
    PRINT_RPC_TYPE_SIZE(rpcconn_fault);
    PRINT_RPC_TYPE_SIZE(rpcconn_request);
    PRINT_RPC_TYPE_SIZE(rpcconn_response);
    PRINT_RPC_TYPE_SIZE(RPC_INTERFACE);
    PRINT_RPC_TYPE_SIZE(RPC_INTERFACE_MANAGER);
#if DBG
    PRINT_RPC_TYPE_SIZE(RPC_MEMORY_BLOCK);
#endif
    PRINT_RPC_TYPE_SIZE(RPC_MESSAGE);
    PRINT_RPC_TYPE_SIZE(RPC_SERVER);
    PRINT_RPC_TYPE_SIZE(RPC_SERVER_INTERFACE);
    PRINT_RPC_TYPE_SIZE(RPC_SYNTAX_IDENTIFIER);
    PRINT_RPC_TYPE_SIZE(RPC_UUID);
    PRINT_RPC_TYPE_SIZE(SCALL);
    PRINT_RPC_TYPE_SIZE(SECURITY_CONTEXT);
    PRINT_RPC_TYPE_SIZE(sec_trailer);
    PRINT_RPC_TYPE_SIZE(SIMPLE_DICT);
    PRINT_RPC_TYPE_SIZE(SIMPLE_DICT2);
    PRINT_RPC_TYPE_SIZE(THREAD);
    PRINT_RPC_TYPE_SIZE(TRANS_INFO);
}

DECLARE_API( sizes )
{
   do_sizes();
}

char *
GetError (DWORD dwError)
{
    DWORD   dwFlag = FORMAT_MESSAGE_FROM_SYSTEM;
    static CHAR   szErrorMessage[1024];
    static HANDLE  hSource = NULL;

    if ((dwError >= 2100) && (dwError < 6000))
    {
        if (hSource == NULL)
            {
            hSource = LoadLibrary("netmsg.dll");
            }

        if (hSource == NULL)
        {
            sprintf (szErrorMessage,
                      "Unable to load netmsg.dll. Error %d occured.\n",
                      dwError);
            return(szErrorMessage);
        }

        dwFlag = FORMAT_MESSAGE_FROM_HMODULE;
    }

    if (!FormatMessage (dwFlag,
                        hSource,
                        dwError,
                        0,
                        szErrorMessage,
                        1024,
                        NULL))
       {
        sprintf (szErrorMessage,
                  "An unknown error occured: 0x%x \n",
                  dwError);
       }

    return(szErrorMessage);
}

VOID
do_error (
    ULONG64 Error
    )
{
    dprintf("%x: %s\n", (unsigned long)Error, GetError((unsigned long) Error));
}

VOID
do_IF (
    ULONG64 rpcif
    )
{
    ULONG64 tmp0;
    ULONG64 tmp1;
    ULONG tmp2;
    dprintf("RPC_INTERFACE at 0x%I64x\n\n", rpcif);

    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Server, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerEpv, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerFlag, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, ManagerCount, tmp0);
    GET_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NullManagerActiveCallCount, tmp0, tmp2);
    PRINT_MEMBER_WITH_LABEL(tmp0, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "NullManagerActiveCallCount", tmp1);
    GET_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, AutoListenCallCount, tmp0, tmp2);
    PRINT_MEMBER_WITH_LABEL(tmp0, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "AutoListenCallCount", tmp1);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Flags, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, MaxCalls, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, CallbackFn, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, PipeInterfaceFlag, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, fReplace, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, fBindingsExported, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, UuidVector, tmp0);
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, SequenceNumber, tmp0);
#if DBG
    PRINT_MEMBER(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Strict, tmp0);
#endif
    PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, RpcInterfaceInformation, tmp2);
    PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, InterfaceManagerDictionary, tmp2);
    PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, Annotation, tmp2);
    PRINT_ADDRESS_OF(rpcif, RPC_INTERFACE, RPCRT4!RPC_INTERFACE, NsEntries, tmp2);
}

VOID
do_obj (
    ULONG64 qwAddr
    )
{
    BOOL b;

    ULONG64 MagicValue;
    ULONG64 ObjectType;

    if (ReadPtrUnextend(qwAddr+AddressSize, &MagicValue)) {
        dprintf("Bad or deleted object at %p\n", qwAddr);
        return;
    }

    if(ReadPtrUnextend(qwAddr+AddressSize+4, &ObjectType)) {
        dprintf("Bad or deleted object at %p\n", qwAddr);
        return;
    }

    if ((ULONG)MagicValue != MAGICLONG) {
        dprintf("Bad or deleted object at %p\n", qwAddr);
        return;
    }

    switch (((ULONG)ObjectType) & (~OBJECT_DELETED))
        {
        case DG_CALLBACK_TYPE:
            dprintf("this is a DG_CLIENT_CALLBACK object\n");
            break;
        case DG_CCALL_TYPE:
            {
            dprintf("Dumping DG_CCALL...\n");
            do_dgcc(qwAddr);
            break;
            }
        case DG_SCALL_TYPE:
            {
            dprintf("Dumping DG_SCALL...\n");
            do_dgsc(qwAddr);
            break;
            }
        case DG_BINDING_HANDLE_TYPE:
            {
            dprintf("dumping DG_BINDING_HANDLE...\n");
            do_dgbh(qwAddr);
            break;
            }
        case DG_CCONNECTION_TYPE:
            {
            dprintf("Dumping DG_CCONNECTION...\n");
            do_dgcn(qwAddr);
            break;
            }
        case DG_SCONNECTION_TYPE:
            {
            dprintf("Dumping DG_SCONNECTION...\n");
            do_dgsn(qwAddr);
            break;
            }
        case DG_ADDRESS_TYPE:
            {
            dprintf("dumping DG_ADDRESS\n");
            do_dgaddr(qwAddr);
            break;
            }
        case DG_CASSOCIATION_TYPE:
            {
            dprintf("a DG_CASSOCIATION\n");
            do_dgca(qwAddr);
            break;
            }
        case DG_SASSOCIATION_TYPE:
            {
            dprintf("a datagram ASSOCIATION_GROUP\n");
            do_dgag(qwAddr);
            break;
            }
        case OSF_BINDING_HANDLE_TYPE:
            dprintf("Dumping OSF_BINDING_HANDLE...\n");
            do_osfbh(qwAddr);
            break;
        case OSF_CCALL_TYPE:
            dprintf("Dumping OSF_CCALL...\n");
            do_osfccall(qwAddr);
            break;
        case OSF_SCALL_TYPE:
            dprintf("Dumping OSF_SCALL...\n");
            do_osfscall(qwAddr);
            break;
        case OSF_CCONNECTION_TYPE:
            dprintf("Dumping OSF_CCONNECTION...\n");
            do_osfcconn(qwAddr);
            break;
        case OSF_SCONNECTION_TYPE:
            dprintf("Dumping OSF_SCONNECTION...\n");
            do_osfsconn(qwAddr);
            break;
        case OSF_CASSOCIATION_TYPE:
            dprintf("Dumping OSF_CASSOCIATION...\n");
            do_osfca(qwAddr);
            break;
        case OSF_ASSOCIATION_TYPE:
            dprintf("Dumping OSF_ASSOCIATION...\n");
            do_osfsa(qwAddr);
            break;
        case OSF_ADDRESS_TYPE:
            dprintf("Dumping OSF_ADDRESS...\n");
            do_osfaddr(qwAddr);
            break;
        case LRPC_CCALL_TYPE:
            dprintf("Dumping LRPC_CCALL ...\n");
            do_lpcccall(qwAddr);
            break;
        case LRPC_SCALL_TYPE:
            dprintf("Dumping LRPC_SCALL ...\n");
            do_lpcscall(qwAddr);
            break;
        case LRPC_CASSOCIATION_TYPE:
            dprintf("Dumping LRPC_CASSOCIATION...\n");
            do_lpcca(qwAddr);
            break;
        case LRPC_SASSOCIATION_TYPE:
            dprintf("Dumping LRPC_SASSOCIATION...\n");
            do_lpcsa(qwAddr);
            break;
        case LRPC_BINDING_HANDLE_TYPE:
            dprintf("Dumping LRPC_BINDING_HANDLE...\n");
            do_lpcbh(qwAddr);
            break;
        case LRPC_ADDRESS_TYPE:
            dprintf("Dumping LRPC_ADDRESS...\n");
            do_lpcaddr(qwAddr);
            break;
        default:
            dprintf("The RPC object type is 0x%lx and I don't recognize it.\n", (ObjectType) & ~(OBJECT_DELETED));
        }
}

void
do_secinfo (
    )
{
    ULONG64 List;
    ULONG64 ProviderList;
    int NumberOfPackages;
    int LoadedProviders;
    int AvailableProviders;
    int i, Index;
    BOOL b;
    ULONG64 qwAddr;
    ULONG tmp;

    LoadedProviders = (int) GetVar("RPCRT4!LoadedProviders");

    dprintf("LoadedProviders = %d\n", LoadedProviders);

    AvailableProviders = (int) GetVar("RPCRT4!AvailableProviders");

    dprintf("AvailableProviders = %d\n", AvailableProviders);

    ProviderList = GetVar("RPCRT4!ProviderList");

    dprintf("ProviderList = 0x%I64x\n", ProviderList);

    List = ProviderList;

    for (i = 0; i < LoadedProviders; i ++)
        {
        ULONG64 Count;
        ULONG64 SecurityPackages;

        GET_MEMBER(List, SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO, Count, Count);

        NumberOfPackages = (int)Count;

        GET_MEMBER(List, SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO, SecurityPackages, SecurityPackages);

        dprintf("Provider: %d\n", i);
        for (Index = 0;Index < NumberOfPackages;Index++)
            {
            ULONG64 SecurityPackageInfo = SecurityPackages + Index * AddressSize;
            ULONG64 wRPCID;
            ULONG64 PackageInfoAddr;

            GET_ADDRESS_OF(SecurityPackageInfo, SECURITY_PACKAGE_INFO, RPCRT4!SECURITY_PACKAGE_INFO, PackageInfo, PackageInfoAddr, tmp);
            GET_MEMBER(PackageInfoAddr, _SecPkgInfoA, RPCRT4!_SecPkgInfoA, wRPCID, wRPCID);

            dprintf("PackageId :%d\n", (ULONG) wRPCID);
            }
        dprintf("\n");
        List+=GET_TYPE_SIZE(SECURITY_PROVIDER_INFO, RPCRT4!SECURITY_PROVIDER_INFO);
        } //For over all packages in one provider(dll)
}

DECLARE_API( secinfo )
{
   do_secinfo();
}

VOID
do_authinfo(
    ULONG64 authInfo
    )
{
    RPC_CHAR *ServerPrincipalName;
    ULONG64 tmp1;
    ULONG tmp2;

    if (authInfo == 0)
        {
        return;
        }

    ULONG64 ServerPrincipalNameAddr;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ServerPrincipalName, ServerPrincipalNameAddr);

    ServerPrincipalName = ReadProcessRpcChar(ServerPrincipalNameAddr);
    if (ServerPrincipalName) {
        dprintf("     ServerPrincipalName      - %ws (Address: 0x%I64x)\n", ServerPrincipalName, ServerPrincipalNameAddr);
        delete ServerPrincipalName;
    }

    ULONG64 AuthenticationLevel;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthenticationLevel, AuthenticationLevel);

    switch ((ULONG)AuthenticationLevel) {
        case RPC_C_AUTHN_LEVEL_DEFAULT:
            dprintf("     AuthenticationLevel      - default\n");
            break;
        case RPC_C_AUTHN_LEVEL_NONE:
            dprintf("     AuthenticationLevel      - none\n");
            break;
        case RPC_C_AUTHN_LEVEL_CONNECT:
            dprintf("     AuthenticationLevel      - connect\n");
            break;
        case RPC_C_AUTHN_LEVEL_CALL:
            dprintf("     AuthenticationLevel      - call\n");
            break;
        case RPC_C_AUTHN_LEVEL_PKT:
            dprintf("     AuthenticationLevel      - pkt\n");
            break;
        case RPC_C_AUTHN_LEVEL_PKT_INTEGRITY:
            dprintf("     AuthenticationLevel      - pkt integrity\n");
            break;
        case RPC_C_AUTHN_LEVEL_PKT_PRIVACY:
            dprintf("     AuthenticationLevel      - pkt privacy\n");
            break;
        default:
            dprintf("     AuthenticationLevel      - %ul\n", (ULONG)AuthenticationLevel);
            break;
    }

    ULONG64 AuthenticationService;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthenticationService, AuthenticationService);

    switch ((ULONG)AuthenticationService) {
        case RPC_C_AUTHN_NONE:
            dprintf("     AuthenticationService    - none\n");
            break;
        case RPC_C_AUTHN_DCE_PRIVATE:
            dprintf("     AuthenticationService    - DCE private\n");
            break;
        case RPC_C_AUTHN_DCE_PUBLIC:
            dprintf("     AuthenticationService    - DCE public\n");
            break;
        case RPC_C_AUTHN_DEC_PUBLIC:
            dprintf("     AuthenticationService    - DEC public\n");
            break;
        case RPC_C_AUTHN_WINNT:
            dprintf("     AuthenticationService    - WINNT\n");
            break;
        case RPC_C_AUTHN_DEFAULT:
            dprintf("     AuthenticationService    - default\n");
            break;
        default:
            dprintf("     AuthenticationService    - %ul\n", (ULONG)AuthenticationService);
            break;
    }

    ULONG64 AuthIdentity;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthIdentity, AuthIdentity);

    dprintf("     AuthIdentity             - %08x\n", (ULONG)AuthIdentity);

    ULONG64 AuthorizationService;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, AuthorizationService, AuthorizationService);

    switch ((ULONG)AuthorizationService) {
        case RPC_C_AUTHZ_NONE:
            dprintf("     AuthorizationService     - none\n");
            break;
        case RPC_C_AUTHZ_NAME:
            dprintf("     AuthorizationService     - name\n");
            break;
        case RPC_C_AUTHZ_DCE:
            dprintf("     AuthorizationService     - DCE\n");
            break;
        default:
            dprintf("     AuthorizationService     - %ul\n", (ULONG)AuthorizationService);
            break;
    }

    ULONG64 IdentityTracking;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, IdentityTracking, IdentityTracking);

    switch ((ULONG)IdentityTracking)
        {
        case RPC_C_QOS_IDENTITY_STATIC:
            dprintf("     IdentityTracking         - Static\n");
            break;
        case RPC_C_QOS_IDENTITY_DYNAMIC:
            dprintf("     IdentityTracking         - Dynamic\n");
            break;
        default:
            dprintf("     IdentityTracking         - %08x\n", (ULONG)IdentityTracking);
            break;
        }

    ULONG64 ImpersonationType;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ImpersonationType, ImpersonationType);

    switch ((ULONG)ImpersonationType)
        {
        case RPC_C_IMP_LEVEL_ANONYMOUS:
            dprintf("     ImpersonationType        - Anonymous\n");
            break;
        case RPC_C_IMP_LEVEL_IDENTIFY:
            dprintf("     ImpersonationType        - Identify\n");
            break;
        case RPC_C_IMP_LEVEL_IMPERSONATE:
            dprintf("     ImpersonationType        - Impersonate\n");
            break;
        case RPC_C_IMP_LEVEL_DELEGATE:
            dprintf("     ImpersonationType        - Delegate\n");
            break;
        default:
            dprintf("     ImpersonationType        - %08x\n", (ULONG)ImpersonationType);
            break;
        }

    ULONG64 Capabilities;
    GET_MEMBER(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, Capabilities, Capabilities);

    switch ((ULONG)Capabilities)
        {
        case RPC_C_QOS_CAPABILITIES_DEFAULT:
            dprintf("     Capabilities             - Default\n");
            break;
        case RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH:
            dprintf("     Capabilities             - Mutual Auth\n");
            break;
        default:
            dprintf("     Capabilities             - %08x\n", (ULONG)Capabilities);
            break;
        }

    ULONG64 ModifiedId, LowPart, HighPart;
    GET_ADDRESS_OF(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, ModifiedId, ModifiedId, tmp2);
    GET_MEMBER(ModifiedId, _LUID, RPCRT4!_LUID, LowPart, LowPart);
    GET_MEMBER(ModifiedId, _LUID, RPCRT4!_LUID, HighPart, HighPart);
    dprintf("     ModifiedId               - %08x, %08x\n", (ULONG)LowPart, (ULONG)HighPart);

    PRINT_MEMBER_WITH_LABEL(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, DefaultLogonId, "     DefaultLogonId          ", tmp1);
    PRINT_MEMBER_WITH_LABEL(authInfo, CLIENT_AUTH_INFO, RPCRT4!CLIENT_AUTH_INFO, Credentials, "     Credentials             ", tmp1);

    if (ServerPrincipalName) {
        delete[] ServerPrincipalName;
    }
}

void do_dict (
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 cDictSize;
    ULONG64 cDictSlots;
    GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSize, cDictSize);
    GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSlots, cDictSlots);

    if ((ULONG)cDictSize > (ULONG)cDictSlots)
        {
        dprintf("Bad dictionary\t\t- %I64p\n", qwAddr);
        return;
        }

    ULONG64 DictSlots;
    GET_MEMBER(qwAddr, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, DictSlots, DictSlots);

    dprintf("\n");
    dprintf("Printing %d items in dictionary: %I64p with %d slots\n\n", (ULONG)cDictSize, qwAddr, (ULONG)cDictSlots);

    int i;

    for (i = 0; i < MIN((int)cDictSize, MAX_ITEMS_IN_DICTIONARY); i++) {
        ULONG64 DictSlot;

        if (!ReadPtrUnextend(DictSlots + i * AddressSize, &DictSlot)) {
            dprintf ("(%d): 0x%I64x\n", i, DictSlot);
        }
        else {
            dprintf ("Could not read dict entry at 0x%I64x\n", DictSlots + i * AddressSize);
	}
   
        dprintf("\n");
    }
}

void do_dict2 (
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 DictKeys;
    ULONG64 DictItems;
    GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, DictKeys, DictKeys);
    GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, DictItems, DictItems);

    ULONG64 cDictSlots;
    GET_MEMBER(qwAddr, SIMPLE_DICT2, RPCRT4!SIMPLE_DICT2, cDictSlots, cDictSlots);

    dprintf("\n");

    dprintf("Printing dictionary at %I64p with %d slots\n\n", qwAddr, (ULONG) cDictSlots);

    int i;

    for (i = 0; i < MIN((int)cDictSlots, MAX_ITEMS_IN_DICTIONARY); i++)
        {
        ULONG64 DictKey;

        if (!ReadPtrUnextend(DictKeys + i * AddressSize, &DictKey))
            {
            if (DictKey != 0)
                {
                ULONG64 DictItem;
                if (!ReadPtrUnextend(DictItems + i * AddressSize, &DictItem))
		    {
                    dprintf ("(Key: 0x%I64p): 0x%I64p\n", DictKey, DictItem);
                    dprintf("\n");
                    }
                }
            }
        }
}

void
do_queue (
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    int i;

    ULONG64 EndOfQueue;
    ULONG64 QueueSlots;
    GET_MEMBER(qwAddr, QUEUE, RPCRT4!QUEUE, EndOfQueue, EndOfQueue);
    GET_MEMBER(qwAddr, QUEUE, RPCRT4!QUEUE, QueueSlots, QueueSlots);

    dprintf("\n");
    dprintf("Printing %d items in queue at %I64p\n", (ULONG)EndOfQueue, qwAddr);

    dprintf("TAIL:\n");
    for (i = 0; i < (int)EndOfQueue; i++)
        {
        ULONG64 QueueSlot;
        if (!ReadPtrUnextend(QueueSlots + i * AddressSize, &QueueSlot))
            {
            ULONG64 Buffer;
            GET_MEMBER(QueueSlot, QUEUE_ITEM, RPCRT4!QUEUE_ITEM, Buffer, Buffer);

            dprintf ("(%d): %I64p\n", i, Buffer);
            dprintf("\n");
            }
	}
    dprintf("HEAD:\n");
}


void do_thread (
    ULONG64 Addr
    )
{
    ULONG64 RpcThread;
    ULONG64 tmp;
    ULONG offset;

    GET_MEMBER(Addr, TEB, TEB, ReservedForNtRpc, RpcThread);

    dprintf("RPC TLS at 0x%I64x\n\n", RpcThread);

    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, HandleToThread, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SavedProcedure, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SavedParameter, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ActiveCall, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, Context, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, CancelTimeout, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, SecurityContext, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ExtendedStatus, tmp);
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, ThreadEEInfo, tmp);

    GET_OFFSET_OF(THREAD, RPCRT4!THREAD, ThreadEvent, &offset);
    dprintf("ThreadEvent at - 0x%I64x\n", RpcThread + offset);
 
    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, Flags, tmp);

    GET_OFFSET_OF(THREAD, RPCRT4!THREAD, BufferCache, &offset);
    dprintf("buffer cache array at - 0x%I64x\n", RpcThread + offset);

    PRINT_MEMBER(RpcThread, THREAD, RPCRT4!THREAD, fAsync, tmp);
    
    dprintf("\n");
}

char *osf_ptype[]  =
{
    "rpc_request",
    "bad packet",
    "rpc_response",
    "rpc_fault",
    "bad packet",
    "bad packet",
    "bad packet",
    "bad packet",
    "bad packet",
    "bad packet",
    "bad packet",
    "rpc_bind",
    "rpc_bind_ack",
    "rpc_bind_nak",
    "rpc_alter_context",
    "rpc_alter_context_resp",
    "rpc_auth_3",
    "rpc_shutdown",
    "rpc_cancel",
    "rpc_orphaned"
};

void do_copacket (
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 StubData;

    //
    // Dump the common header first
    //
    dprintf("\n");

    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, rpc_vers, tmp1);
    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, rpc_vers_minor, tmp1);

    ULONG64 PTYPE;
    GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, PTYPE, PTYPE);
    dprintf ("PTYPE - 0x%x, %s\n",
             (ULONG)PTYPE, osf_ptype[(ULONG)PTYPE]);

    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, pfc_flags, tmp1);
    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, drep, tmp1);
    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, frag_length, tmp1);
    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, auth_length, tmp1);
    PRINT_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, call_id, tmp1);

    //
    // Dump the packet specific stuff
    //
    switch ((ULONG)PTYPE)
        {
        case rpc_request:

            PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, alloc_hint, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, p_cont_id, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_request, RPCRT4!rpcconn_request, opnum, tmp1);

            ULONG64 pfc_flags;
            GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, pfc_flags, pfc_flags);

            if ((ULONG)pfc_flags & PFC_OBJECT_UUID)
                {
                dprintf("UUID -\n");
                ULONG64 UUID = qwAddr;
                UUID += GET_TYPE_SIZE(rpcconn_common, RPCRT4!rpcconn_common);
                PrintUuid(UUID);
                dprintf("\n");

                StubData = qwAddr;
                StubData += GET_TYPE_SIZE(rpcconn_request, RPCRT4!rpcconn_request);
                StubData += GET_TYPE_SIZE(UUID, RPCRT4!UUID);
                dprintf ("Stub Data - 0x%I64x\n", StubData);
                }
            else
                {
                StubData = qwAddr;
                StubData += GET_TYPE_SIZE(rpcconn_request, RPCRT4!rpcconn_request);
                dprintf ("Stub Data - 0x%I64x\n", StubData);
                }
            break;

        case rpc_response:
            PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, alloc_hint, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, p_cont_id, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, alert_count, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_response, RPCRT4!rpcconn_response, reserved, tmp1);

            StubData = qwAddr;
            StubData += GET_TYPE_SIZE(rpcconn_response, RPCRT4!rpcconn_response);

            dprintf ("Stub Data - 0x%I64x\n", StubData);
            break;

        case rpc_fault:
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, alloc_hint, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, p_cont_id, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, alert_count, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, reserved, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, status, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_fault, RPCRT4!rpcconn_fault, reserved2, tmp1);
            break;

        case rpc_bind:
        case rpc_alter_context:
            PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, max_xmit_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, max_recv_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind, RPCRT4!rpcconn_bind, assoc_group_id, tmp1);
            break;

        case rpc_bind_ack:
            PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, max_xmit_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, max_recv_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, assoc_group_id, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind_ack, RPCRT4!rpcconn_bind_ack, sec_addr_length, tmp1);
            break;

        case rpc_bind_nak:
            PRINT_MEMBER(qwAddr, rpcconn_bind_nak, RPCRT4!rpcconn_bind_nak, provider_reject_reason, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_bind_nak, RPCRT4!rpcconn_bind_nak, versions, tmp1);
            break;

        case rpc_alter_context_resp:
            PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, max_xmit_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, max_recv_frag, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, assoc_group_id, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, sec_addr_length, tmp1);
            PRINT_MEMBER(qwAddr, rpcconn_alter_context_resp, RPCRT4!rpcconn_alter_context_resp, pad, tmp1);
            break;

        case rpc_auth_3:
        case rpc_shutdown:
        case rpc_cancel:
        case rpc_orphaned:
            break;

        default:
            dprintf ("Bad Packet\n");
            break;
        }

    //
    // Dump the security trailer
    //
    ULONG64 auth_length;
    ULONG64 frag_length;
    GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, auth_length, auth_length);
    GET_MEMBER(qwAddr, rpcconn_common, RPCRT4!rpcconn_common, frag_length, frag_length);

    if ((ULONG)auth_length)
        {
        ULONG64 SecurityTrailer = qwAddr;
        SecurityTrailer += frag_length-auth_length-GET_TYPE_SIZE(sec_trailer, RPCRT4!sec_trailer);
        dprintf("\nSecurity trailer: 0x%I64x\n", SecurityTrailer);

        PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_type, tmp1);
        PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_level, tmp1);
        PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_pad_length, tmp1);
        PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_reserved, tmp1);
        PRINT_MEMBER(SecurityTrailer, sec_trailer, RPCRT4!sec_trailer, auth_context_id, tmp1);
        dprintf ("trailer - 0x%I64x\n", SecurityTrailer+1);
        }
}

char *lpc_ptype[]  =
{
"LRPC_MSG_BIND",
"LRPC_MSG_REQUEST",
"LRPC_MSG_RESPONSE",
"LRPC_MSG_CALLBACK",
"LRPC_MSG_FAULT",
"LRPC_MSG_CLOSE",
"LRPC_MSG_ACK",
"LRPC_BIND_ACK",
"LRPC_MSG_COPY",
"LRPC_MSG_PUSH",
"LRPC_MSG_CANCEL",
"LRPC_MSG_BIND_BACK",
"LRPC_ASYNC_REQUEST",
"LRPC_PARTIAL_REQUEST",
"LRPC_CLIENT_SEND_MORE",
"LRPC_SERVER_SEND_MORE",
"LRPC_MSG_FAULT2"
};

VOID
do_lpcpacket(
    ULONG64 qwAddr
    )
{
    if (fUseTypeInfo) {
        ULONG64 LpcHeader;
        ULONG64 RpcHeader;
        ULONG64 Buffer;
        ULONG64 tmp1;
        ULONG tmp2;

        GET_ADDRESS_OF(qwAddr, LRPC_RPC_MESSAGE, RPCRT4!LRPC_RPC_MESSAGE, LpcHeader, LpcHeader, tmp2);
        GET_ADDRESS_OF(qwAddr, LRPC_RPC_MESSAGE, RPCRT4!LRPC_RPC_MESSAGE, RpcHeader, RpcHeader, tmp2);

        dprintf("\n");

        //
        // dump the LPC header
        //
        PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, u1, "&u1\t\t\t", tmp2);
        PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, u2, "&u2\t\t\t", tmp2);
        PRINT_ADDRESS_OF_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, ClientId, "&CLIENT_ID\t\t", tmp2);
        PRINT_MEMBER_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, MessageId, "MessageId\t\t", tmp1);
        PRINT_MEMBER_WITH_LABEL(LpcHeader, _PORT_MESSAGE, RPCRT4!_PORT_MESSAGE, CallbackId, "CallbackId\t\t", tmp1);

        //
        // dump the LRPC header
        //
        ULONG64 MessageType;
        GET_MEMBER(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, MessageType, MessageType);
        dprintf("MessageType\t\t - %s\n", lpc_ptype[(long)MessageType]);
        PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, PresentContext, "PresentationContext\t", tmp1);
        PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, Flags, "Flags\t\t\t", tmp1);
        PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, ProcedureNumber, "ProcedureNumber\t\t", tmp1);
        PRINT_MEMBER_WITH_LABEL(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, CallId, "CallId\t\t\t", tmp1);

        ULONG64 ObjectUuid;
        GET_ADDRESS_OF(RpcHeader, _LRPC_RPC_HEADER, RPCRT4!_LRPC_RPC_HEADER, ObjectUuid, ObjectUuid, tmp2);
        dprintf("ObjectUuid\t\t - ");
        PrintUuid(ObjectUuid);

        dprintf("\n\n");
    }
    else {
        BOOL b;
        char block[sizeof(LRPC_RPC_MESSAGE)];
        LRPC_RPC_MESSAGE *m = (LRPC_RPC_MESSAGE *)block;

        b = GetData(qwAddr, block, sizeof(LRPC_RPC_MESSAGE));
        if ( !b ) {
          dprintf("couldn't read address %p\n", qwAddr);
          return;
        }

        dprintf("\n");
        //
        // dump the LPC header
        //
        dprintf("DataLength\t\t- 0x%x\n", (long) m->LpcHeader.u1.s1.DataLength);
        dprintf("TotalLength\t\t- 0x%x\n", (long) m->LpcHeader.u1.s1.TotalLength);
        dprintf("Type\t\t\t- 0x%x\n", (long) m->LpcHeader.u2.s2.Type);
        dprintf("DataInfoOffset\t\t- 0x%x\n", (long) m->LpcHeader.u2.s2.DataInfoOffset);
        dprintf("CLIENT_ID: \t\t- Process(0x%x), Thread(0x%x)\n",
                m->LpcHeader.ClientId.UniqueProcess, m->LpcHeader.ClientId.UniqueThread);
        dprintf("MessageId\t\t- 0x%x\n", m->LpcHeader.MessageId);
        dprintf("CallbackId\t\t- 0x%x\n", m->LpcHeader.CallbackId);

        //
        // dump the LRPC header
        //
        dprintf("MessageType\t\t- %s\n", lpc_ptype[(long) m->RpcHeader.MessageType]);
        dprintf("PresentationContext\t- 0x%x\n", (long) m->RpcHeader.PresentContext);
        dprintf("Flags\t\t\t- 0x%x\n", (unsigned long) m->RpcHeader.Flags);
        dprintf("ProcedureNumber\t\t- 0x%x\n", (long) m->RpcHeader.ProcedureNumber);
        dprintf("CallId\t\t\t- 0x%x\n", (long) m->RpcHeader.CallId);
        dprintf("ObjectUuid\t\t- ");
        PrintUuidLocal((UUID *) &(m->RpcHeader.ObjectUuid));

        dprintf("\nStubData\t\t- 0x%x\n", m+1);
        dprintf("\n");
    }
}

VOID
do_bh(
    ULONG64 qwAddr
    )
{
    RPC_CHAR *EntryName;

    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 EntryNameAddr;
    ULONG64 ObjectUuidAddr;

    GET_ADDRESS_OF(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EntryName, EntryNameAddr, tmp2);
    GET_ADDRESS_OF(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, ObjectUuid, ObjectUuidAddr, tmp2);

    dprintf("\n");

    PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, Timeout, tmp1);

    dprintf("ObjectUuid\t\t- ");
    PrintUuid(ObjectUuidAddr); dprintf("\n");

    PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, NullObjectUuidFlag, tmp1);
    PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EntryNameSyntax, tmp1);

    EntryName = ReadProcessRpcChar(EntryNameAddr);
    if (EntryName) {
        dprintf("EntryName\t\t- %ws (Address: 0x%x)\n", EntryName ? EntryName : L"(null)", EntryNameAddr);
        delete EntryName;
    }

    PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, EpLookupHandle, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, BindingMutex, "&BindingMutex(MUTEX)", tmp2);
    PRINT_MEMBER(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, pvTransportOptions, tmp1);
    PRINT_ADDRESS_OF(qwAddr, BINDING_HANDLE, RPCRT4!BINDING_HANDLE, ClientAuthInfo, tmp2);

    do_authinfo(qwAddr+tmp2);
}

VOID
do_osfbh(
    ULONG64 qwAddr
    )
{
    BOOL b;
 
    ULONG64 tmp1;
    ULONG tmp2;

    do_bh(qwAddr);

    PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, Association, tmp1);
    PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, DceBinding, tmp1);

    do_dcebinding(tmp1);

    PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, TransInfo, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, RecursiveCalls, "&RecursiveCalls(OSF_ACTIVE_ENTRY_DICT)", tmp2);
    PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, ReferenceCount, tmp1);
    PRINT_MEMBER(qwAddr, OSF_BINDING_HANDLE, RPCRT4!OSF_BINDING_HANDLE, pToken, tmp1);

    dprintf("\n");
}

VOID
do_osfca(
    ULONG64 qwAddr
    )
{
    BOOL b;
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, DceBinding, "DceBinding(DCE_BINDING)", tmp1);
    do_dcebinding(tmp1);

    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, BindHandleCount, tmp1);
    PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, Bindings, tmp2);
    PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, ActiveConnections, tmp2);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssocGroupId, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, TransInfo, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, SecondaryEndpoint, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, Key, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, OpenConnectionCount, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, CallIdCounter, tmp1);
    PRINT_ADDRESS_OF(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssociationMutex, tmp2);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, AssociationValid, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, FailureCount, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, fMultiplex, tmp1);
    PRINT_MEMBER(qwAddr, OSF_CASSOCIATION, RPCRT4!OSF_CASSOCIATION, SavedDrep, tmp1);

    dprintf("\n");
}

VOID
do_dcebinding(
    ULONG64 qwAddr
    )
{
    RPC_STATUS RpcStatus;
    BOOL b;

    ULONG tmp2;

    ULONG64 RpcProtocolSequenceAddr;
    ULONG64 NetworkAddressAddr;
    ULONG64 EndpointAddr;
    ULONG64 OptionsAddr;
    ULONG64 ObjectUuidAddr;

    RPC_CHAR *RpcProtocolSequence;
    RPC_CHAR *NetworkAddress;
    RPC_CHAR *Endpoint;
    RPC_CHAR *Options;

    GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, RpcProtocolSequence, RpcProtocolSequenceAddr);
    GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, NetworkAddress, NetworkAddressAddr);
    GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, Endpoint, EndpointAddr);
    GET_MEMBER(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, Options, OptionsAddr);
    GET_ADDRESS_OF(qwAddr, DCE_BINDING, RPCRT4!DCE_BINDING, ObjectUuid, ObjectUuidAddr, tmp2);

    dprintf("\tObjectUuid:\t");
    PrintUuid(ObjectUuidAddr); dprintf("\n");

    RpcProtocolSequence = ReadProcessRpcChar( RpcProtocolSequenceAddr);
    if (RpcProtocolSequence) {
        dprintf("\tprotseq: \t\"%ws\"\t(Address: %p)\n", RpcProtocolSequence, RpcProtocolSequenceAddr);
        delete RpcProtocolSequence;
    }

    NetworkAddress = ReadProcessRpcChar( NetworkAddressAddr);
    if (NetworkAddress) {
        dprintf("\tNetworkAddress:\t\"%ws\"\t(Address: %p)\n", NetworkAddress, NetworkAddressAddr);
        delete NetworkAddress;
    }

    Endpoint = ReadProcessRpcChar( EndpointAddr);
    if (Endpoint) {
        dprintf("\tEndpoint:\t\"%ws\" \t(Address: %p)\n", Endpoint, EndpointAddr);
        delete Endpoint;
    }

    Options = ReadProcessRpcChar( OptionsAddr);
    if (Options) {
        dprintf("\tOptions:\t\"%ws\" \t(Address: %p)\n", Options, OptionsAddr);
        delete Options;
    }

    dprintf("\n");
}

VOID
do_osfcconn(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, Association, "pAssociation(OSF_CASSOCIATION)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CurrentCall, "CurrentCall (OSF_CCALL)\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnectionKey, "ConnectionKey\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, State, "State\t\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, MaxFrag, "MaxFrag\t\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ThreadId, "ThreadId\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CachedCCall, "CachedCCall\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CachedCCallAvailable, "CachedCCallAvailable\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, MaxSavedHeaderSize, "MaxSavedHeaderSize\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, SavedHeaderSize, "SavedHeaderSize\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, SavedHeader, "SavedHeader\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, AdditionalLegNeeded, "AdditionalLegNeeded\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, LastTimeUsed, "LastTimeUsed\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, TokenLength, "TokenLength\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, AdditionalSpaceForSecurity, "AdditionalSpaceForSecurity\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fIdle, "fIdle\t\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fExclusive, "fExclusive\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, fConnectionAborted, "fConnectionAborted\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, RefCount, "RefCount\t\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, Bindings, "&Bindings(BITSET)\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, CallQueue, "&CallQueue\t\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnMutex, "&ConnMutex\t\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ActiveCalls, "&ActiveCalls\t\t\t\t", tmp2);

    ULONG64 ClientSecurityContext;
    GET_ADDRESS_OF(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ClientSecurityContext, ClientSecurityContext, tmp2);
    dprintf("&ClientSecurityContext(CSECURITY_CONTEXT)- 0x%I64x\n", ClientSecurityContext);
    do_securitycontext(ClientSecurityContext);


    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ClientInfo, "ClientInfo (RPC_CONNECTION_TRANSPORT)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ComTimeout, "ComTimeout\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, u, "ConnSendContext\t\t\t\t", tmp1);


    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, DceSecurityInfo, "&DceSecurityInfo(DCE_SECURITY_INFO)\t", tmp2);

    ULONG64 DceSecurityInfo;
    GET_ADDRESS_OF(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, DceSecurityInfo, DceSecurityInfo, tmp2);
    PRINT_MEMBER_WITH_LABEL(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, SendSequenceNumber, "     SendSequenceNumber\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, ReceiveSequenceNumber, "     ReceiveSequenceNumber\t", tmp1);

    ULONG64 AssociationUuid;
    GET_ADDRESS_OF(DceSecurityInfo, _DCE_SECURITY_INFO, RPCRT4!_DCE_SECURITY_INFO, AssociationUuid, AssociationUuid, tmp2);
    dprintf("     AssociationUuid\t\t - ");
    PrintUuid(AssociationUuid);
    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, BufferToFree, "BufferToFree\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION, ConnectionReady, "ConnectionReady\t\t\t", tmp1);

    dprintf("\n");

    ULONG64 TransConnection = qwAddr;
    TransConnection += GET_TYPE_SIZE(OSF_CCONNECTION, RPCRT4!OSF_CCONNECTION);

    dprintf("TransConnection\t\t\t - 0x%I64x\n", TransConnection);

    do_trans(TransConnection);
}

struct CallStateMap {
    OSF_CCALL_STATE State;
    char *StateString;
};

struct CallStateMap CCall_States[] =
{
    NeedOpenAndBind, "NeedOpenAndBind",
    NeedAlterContext, "NeedAlterContext",
    WaitingForAlterContext, "WaitingForAlterContext",
    SendingFirstBuffer, "SendingFirstBuffer",
    SendingMoreData, "SendingMoreData",
    WaitingForReply, "WaitingForReply",
    InCallbackRequest, "InCallbackRequest",
    InCallbackReply, "InCallbackReply",
    Receiving, "Receiving",
    Aborted, "Aborted",
    Complete, "Complete",
};

char *
GetCallState (
    OSF_CCALL_STATE State
    )
{
    int i;

    for (i = 0; i < sizeof(CCall_States)/sizeof(CallStateMap); i++)
        {
        if (State == CCall_States[i].State)
            {
            return CCall_States[i].StateString;
            }
        }

    return "Unknown State";
}

VOID
do_osfccall(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, AsyncStatus, "AsyncStatus\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CachedAPCInfo, "pCachedAPCInfo\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, pAsync, "pAsync\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallingThread, "CallingThread\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, NotificationIssued, "NotificationIssued\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, Connection, "Connection\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, BindingHandle, "BindingHandle\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, Bindings, "Binding\t\t\t", tmp1);

    ULONG64 CurrentState;
    GET_MEMBER(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentState, CurrentState);
    dprintf("CurrentState\t\t - 0x%x, %s\n",
            (ULONG)CurrentState, GetCallState((OSF_CCALL_STATE)CurrentState));

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentBuffer, "CurrentBuffer\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentOffset, "CurrentOffset\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CurrentBufferLength, "CurrentBufferLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallId, "CallId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RcvBufferLength, "RcvBufferLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, FirstSend, "FirstSend\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, DispatchTableCallback, "DispatchTableCallback\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaximumFragmentLength, "MaximumFragmentLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaxSecuritySize, "MaxSecuritySize\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, MaxDataLength, "MaxDataLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ReservedForSecurity, "ReservedForSecurity\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SecBufferLength, "SecBufferLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, HeaderSize, "HeaderSize\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SavedHeaderSize, "SavedHeaderSize\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SavedHeader, "SavedHeader\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, LastBuffer, "LastBuffer\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ProcNum, "ProcNum\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, SyncEvent, "SyncEvent\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, ActualBufferLength, "ActualBufferLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, NeededLength, "NeededLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallSendContext, "CallSendContext\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RefCount, "RefCount\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, RecursiveCallsKey, "RecursiveCallsKeyF\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallStack, "CallStack\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fCallCancelled, "fCallCancelled\t\t", tmp1);

    ULONG64 CancelState;
    GET_MEMBER(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CancelState, CancelState);

    switch ((ULONG)CancelState)
        {
        case CANCEL_NOTREGISTERED:
            dprintf("fEnableCancels\t\t - CANCEL_NOTREGISTERED\n");
            break;

        case CANCEL_INFINITE:
            dprintf("fEnableCancels\t\t - CANCEL_INFINITE\n");
            break;

        case CANCEL_NOTINFINITE:
            dprintf("fEnableCancels\t\t - CANCEL_NOTINFINITE\n");
            break;
        }

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, CallMutex, "&CallMutex\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, BufferQueue, "&BufferQueue\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, InReply, "InReply\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fChoked, "fChoked\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_CCALL, RPCRT4!OSF_CCALL, fPeerChoked, "fPeerChoked\t\t", tmp1);

    dprintf("\n");
}

VOID
do_rpcaddr(
    ULONG64 qwAddr
    )
{
    RPC_CHAR *Endpoint;
    RPC_CHAR *RpcProtocolSequence;

    ULONG64 EndpointAddr;
    ULONG64 RpcProtocolSequenceAddr;

    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    GET_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, Endpoint, EndpointAddr);
    GET_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, RpcProtocolSequence, RpcProtocolSequenceAddr);

    Endpoint = ReadProcessRpcChar(EndpointAddr);
    if (Endpoint != NULL) {
        dprintf("Endpoint - \"%ws\"\n", Endpoint);
        delete Endpoint;
    }

    RpcProtocolSequence = ReadProcessRpcChar(RpcProtocolSequenceAddr);
    if (RpcProtocolSequence != NULL) {
        dprintf("RpcProtocolSequence - \"%ws\"\n", RpcProtocolSequence);
        delete RpcProtocolSequence;
    }

    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, StaticEndpointFlag, tmp1);
    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, ActiveCallCount, tmp1);

    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, EndpointFlags, tmp1);
    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, NICFlags, tmp1);

    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, Server, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, AddressMutex, "AddressMutex at", tmp2);
    PRINT_MEMBER(qwAddr, RPC_ADDRESS, RPCRT4!RPC_ADDRESS, DictKey, tmp1);

    delete Endpoint;
    delete RpcProtocolSequence;
}

VOID
do_osfaddr(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 TransAddr = qwAddr;

    do_rpcaddr(qwAddr);

    dprintf("\n");

    PRINT_ADDRESS_OF(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, Associations, tmp2);
    PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, SetupAddressOccurred, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, TransInfo, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, ServerInfo, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, ServerListeningFlag, tmp1);

    TransAddr += GET_TYPE_SIZE(OSF_ADDRESS, RPCRT4!OSF_ADDRESS);

    dprintf("\n");

    dprintf("TransAddr 0x%I64x\n", TransAddr);

    do_trans(TransAddr);
}

VOID
do_osfsconn(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    ULONG64 AuthInfo;
    GET_ADDRESS_OF(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthInfo, AuthInfo, tmp2);
    dprintf("&AuthInfo(CLIENT_AUTH_INFO)\t - 0x%p\n", AuthInfo);
    do_authinfo(AuthInfo );

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Association, "Association(OSF_ASSOCIATION)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Address, "Address(OSF_ADDRESS)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, MaxFrag, "MaxFrag\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, DataRep, "DataRep\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthContextId, "AuthContextId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SecurityContextAltered, "SecurityContextAltered\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, RpcSecurityBeingUsed, "RpcSecurityBeingUsed\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CurrentSecurityContext, "pCurrentSecurityContext(SSECURITY_CONTEXT)", tmp1);

    do_authinfo(tmp1);

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SecurityContextDict, "&SecurityContextDict(SSECURITY_CONTEXT_DICT)", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AdditionalSpaceForSecurity, "AdditionalSpaceForSecurity\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SavedHeaderSize, "SavedHeaderSize\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, SavedHeader, "pSavedHeader(VOID)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CurrentCallId, "CurrentCallId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CachedSCallAvailable, "CachedSCallAvailable\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, AuthContinueNeeded, "AuthContinueNeeded\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, InitSecurityInfo, "&InitSecurityInfo\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CallDict, "&CallDict\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, Bindings, "&Bindings(OSF_SBINDING_DICT)\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ConnMutex, "&ConnMutex\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, CachedSCall, "CachedSCall\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ServerInfo, "ServerInfo\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, ConnectionClosedFlag, "ConnectionClosedFlag\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, DceSecurityInfo, "&DceSecurityInfo\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fExclusive, "fExclusive\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fDontFlush, "fDontFlush\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION, fFirstCall, "fFirstCall\t\t\t", tmp1);

    dprintf("\n");

    ULONG64 TransConnection = qwAddr;
    TransConnection += GET_TYPE_SIZE(OSF_SCONNECTION, RPCRT4!OSF_SCONNECTION);

    dprintf("TransConnection\t\t\t - 0x%I64x\n", TransConnection);

    do_trans(TransConnection);
}

char *SCall_States[] =
{
    "NewRequest",
    "CallCancelled",
    "CallAborted",
    "CallCompleted",
    "ReceivedCallback",
    "ReceivedCallbackReply",
    "ReceivedFault"
};

VOID
do_osfscall(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, AsyncStatus, "AsyncStatus\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CachedAPCInfo, "pCachedAPCInfo\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, pAsync, "pAsync\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallingThread, "CallingThread\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, NotificationIssued, "NotificationIssued\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBinding, "CurrentBinding\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Connection, "Connection\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Address, "Address\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallId, "CallId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallStack, "CallStack\t\t", tmp1);

    ULONG64 ObjectUuid;
    GET_ADDRESS_OF(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ObjectUuid, ObjectUuid, tmp2);
    dprintf("ObjectUuid\t\t - ");
    PrintUuid(ObjectUuid); dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ObjectUuidSpecified, "ObjectUuidSpecified\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBuffer, "CurrentBuffer\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentBufferLength, "CurrentBufferLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentOffset, "CurrentOffset\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstFrag, "FirstFrag\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstSend, "FirstSend\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fPipeCall, "fPipeCall\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fCallDispatched, "fCallDispatched\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchBuffer, "DispatchBuffer\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, LastBuffer, "LastBuffer\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SendContext, "SendContext\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchBufferOffset, "DispatchBufferOffset\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ProcNum, "ProcNum\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, AllocHint, "AllocHint\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SavedHeaderSize, "SavedHeaderSize\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SavedHeader, "SavedHeader\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, RcvBufferLength, "RcvBufferLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, NeededLength, "NeededLength\t\t", tmp1);

    ULONG64 CurrentState;
    GET_MEMBER(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CurrentState, CurrentState);
    dprintf("CurrentState\t\t - 0x%x, %s\n", (ULONG)CurrentState, SCall_States[(ULONG)CurrentState]);

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallMutex, "&CallMutex\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, SyncEvent, "&SyncEvent\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, BufferQueue, "&BufferQueue\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, Thread, "Thread\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CallOrphaned, "CallOrphaned\t\t", tmp1);

    ULONG64 RefCount;
    GET_MEMBER(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, RefCount, RefCount);
    dprintf("RefCount\t\t - 0x%x\n", (ULONG)RefCount);

    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, MaxSecuritySize, "MaxSecuritySize\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstCallRpcMessage, "&FirstCallRpcMessage\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, FirstCallRuntimeInfo, "&FirstCallRuntimeInfo\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, MaximumFragmentLength, "MaximumFragmentLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, ActualBufferLength, "ActualBufferLength\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fChoked, "fChoked\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fPeerChoked, "fPeerChoked\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, DispatchFlags, "DispatchFlags\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fSecurityFailure, "fSecurityFailure\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, CancelPending, "CancelPending\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_SCALL, RPCRT4!OSF_SCALL, fChoked, "fChoked\t\t\t", tmp1);

    dprintf("\n");
}

VOID
do_osfsa(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, CtxCollection, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationID, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, ConnectionCount, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationGroupId, tmp1);
    PRINT_MEMBER(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, AssociationDictKey, tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, Address, "pAddress(OSF_ADDRESS)", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, OSF_ASSOCIATION, RPCRT4!OSF_ASSOCIATION, ClientProcess, "&ClientProcess(RPC_CLIENT_PROCESS_IDENTIFIER)", tmp2);

    dprintf("\n");
}


DECLARE_API( rpcsvr )
{
    ULONG64 qwAddr;
    BOOL fArgSpecified = FALSE;
    ULONG64 ServerAddress;

    LPSTR lpArgumentString = (LPSTR)args;

    if (0 == strtok(lpArgumentString))
        {
        lpArgumentString = "rpcrt4!GlobalRpcServer";
        fArgSpecified = TRUE;
        }

    qwAddr = GetExpression(lpArgumentString);

    if ( !qwAddr )
        {
        dprintf("Error: can't evaluate '%s'\n", lpArgumentString);
        return;
        }

    if (fArgSpecified)
        {
        if (ReadPtrUnextend(qwAddr, &ServerAddress))
            {
            dprintf("couldn't read memory at address 0x%I64x\n", qwAddr);
            return;
            }
        }
    else
        ServerAddress = qwAddr;

    do_rpcsvr(ServerAddress);
}


VOID
do_rpcsvr(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp0;
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, pRpcForwardFunction, "pRpcForwardFunction(RPC_FORWARD_FUNCTION)", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcInterfaceDictionary, "&RpcInterfaceDictionary(RPC_SIMPLE_DICT)", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ServerMutex, "&ServerMutex(MUTEX)", tmp2);

    GET_ADDRESS_OF(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, AvailableCallCount, tmp1, tmp2);
    PRINT_MEMBER_WITH_LABEL(tmp1, INTERLOCKED_INTEGER, RPCRT4!INTERLOCKED_INTEGER, Integer, "AvailableCallCount", tmp0);

    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ServerListeningFlag, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcAddressDictionary, "&RpcAddressDictionary(RPC_SIMPLE_DICT)", tmp2);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ListeningThreadFlag, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, StopListeningEvent, "&StopListeningEvent(EVENT)", tmp2);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, MaximumConcurrentCalls, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, MinimumCallThreads, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, IncomingRpcCount, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, OutgoingRpcCount, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ReceivedPacketCount, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, SentPacketCount, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, AuthenticationDictionary, "&AuthenticationDictionary(RPC_SIMPLE_DICT)", tmp2);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, WaitingThreadFlag, tmp1);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ThreadCache, tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, ThreadCacheMutex, "&ThreadCacheMutex(MUTEX)", tmp2);
    PRINT_MEMBER(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, fAccountForMaxCalls, tmp1);

    dprintf("\n");
}

struct SizeTable {
    int Size;
    int Count;
};

struct SizeTable *Stats = NULL;
int MaxSize = 1048*10;
int CurrentSize = 0;

void
AddToStats (
    int Size
    )
{
    int i;

    for (i = 0; i < CurrentSize; i++)
        {
        if (Stats[i].Size == Size)
            {
            Stats[i].Count++;
            return;
            }
        }

    Stats[CurrentSize].Size = Size;
    Stats[CurrentSize].Count = 1;
    CurrentSize++;
}

int __cdecl compare( const void *arg1, const void *arg2 )
{
   return  ((struct SizeTable *) arg2)->Count - ((struct SizeTable *) arg1)->Count;
}

void
PrintStats (
    )
{
    int i;
    int Total = 0;

    qsort(&Stats[0], CurrentSize, sizeof(SizeTable), compare);

    dprintf("\n\nSummary:\n");
    for (i = 0; i < CurrentSize; i++)
        {
        dprintf("Size: %08x Count: %d\n",
                Stats[i].Size,
                Stats[i].Count
                );
        Total += Stats[i].Count;
        }

    dprintf("Total Count: %d\n", Total);
}

VOID
do_rpcmem(
    ULONG64 qwAddr,
    long Count,
    long Verbose,
    BOOL Summary,
    long Size
    )
{
    BOOL b;
    BOOL forwards = TRUE;
    BOOL doAll    = FALSE;
    DWORD t;

    ULONG64 tmp1;
    ULONG tmp2;

    unsigned Data[16];

    unsigned char RearGuardBlock[4];

#if DBG
    if (Count < 0) {
        forwards = FALSE;
    }
    else
    if (Count == 0) {
        doAll = TRUE;
    }

    if (Stats == NULL)
        {
        Stats = (struct SizeTable *) RpcpFarAllocate(MaxSize * sizeof(struct SizeTable));
        if (Stats == NULL)
            {
            return;
            }
        }

    RpcpMemorySet(Stats, 0, MaxSize);

    dprintf("\n");

    do
        {
        if ((CheckControlC)())
            {
            return;
            }

        ULONG64 size;
        GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, size, size);

        AddToStats((int)size);

        if ((Size == 0 || Size == (long) size) && !Summary)
            {
            ULONG64 rearguard;
            GET_ADDRESS_OF(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, rearguard, rearguard, tmp2);

            dprintf("-------- size (%08x) block: 0x%I64x contains: %s",
                (ULONG)size,
                qwAddr,
                SymbolAtAddressNoOffset(rearguard)
                );

            if (Verbose)
                {
                b = GetData(rearguard,
                        Data,
                        min((ULONG)size, sizeof(Data)));
                if ( !b )
                    {
                    dprintf("can't read block data at 0x%I64x\n", rearguard);
                    return;
                    }

                for (t = 0; t < min(((ULONG)size)/4, sizeof(Data)/4); t++)
                    {
                    if (t % 4 == 0)
                        {
                        dprintf("\n%I64p  ",
                                rearguard + t*4);
                        }
                    dprintf("%08x ", Data[t]);
                    }
                }
            dprintf("\n");

            }

        ULONG64 frontguardAddr;
        ULONG64 rearguardAddr;
        GET_ADDRESS_OF(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, frontguard, frontguardAddr, tmp2);
        GET_ADDRESS_OF(qwAddr+size, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, rearguard, rearguardAddr, tmp2);
        unsigned char frontguardVal[4];
        unsigned char rearguardVal[4];
        GetData(frontguardAddr, frontguardVal, sizeof(frontguardVal));
        GetData(rearguardAddr, rearguardVal, sizeof(rearguardVal));

        if ( (frontguardVal[0] != RPC_GUARD) ||
             (frontguardVal[1] != RPC_GUARD) ||
             (frontguardVal[2] != RPC_GUARD) ||
             (frontguardVal[3] != RPC_GUARD) )
            {
            dprintf("     RPC: BAD FRONTGUARD %x-%x-%x-%x\n", frontguardVal[0], frontguardVal[1], frontguardVal[2], frontguardVal[3]);
            }

        if ( (rearguardVal[0] != RPC_GUARD) ||
             (rearguardVal[1] != RPC_GUARD) ||
             (rearguardVal[2] != RPC_GUARD) ||
             (rearguardVal[3] != RPC_GUARD) )
            {
            dprintf("     RPC: BAD REARGUARD %x-%x-%x-%x\n", rearguardVal[0], rearguardVal[1], rearguardVal[2], rearguardVal[3]);
            }

        ULONG64 next;
        ULONG64 previous;
        GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, next, next);
        GET_MEMBER(qwAddr, RPC_MEMORY_BLOCK, RPCRT4!RPC_MEMORY_BLOCK, previous, previous);

        if (forwards == TRUE)
            {
            qwAddr =  next;
            Count--;
            }
        else
            {
            qwAddr =  previous;
            Count++;
            }

        }
    while (qwAddr && (Count || doAll) );

    PrintStats();

#endif
    dprintf("\n");
}

VOID
do_rpcmsg(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, Handle, "Handle(RPC_BINDING_HANDLE)            ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, DataRepresentation, "DataRepresentation                    ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, Buffer, "pBuffer(void)                         ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, BufferLength, "BufferLength                          ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ProcNum, "ProcNum                               ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, TransferSyntax, "TransferSyntax(RPC_SYNTAX_IDENTIFIER) ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, RpcInterfaceInformation, "pRpcInterfaceInformation(void)        ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ReservedForRuntime, "pReservedForRuntime(void)             ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ManagerEpv, "pManagerEpv(RPC_MGR_EPV)              ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, ImportContext, "pImportContext(void)                  ", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_MESSAGE, RPCRT4!RPC_MESSAGE, RpcFlags, "RpcFlags                              ", tmp1);

    dprintf("\n");
}

VOID
do_transinfo(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;
    ULONG64 LoadableTrans;

    GET_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, LoadableTrans, LoadableTrans);

    dprintf("\n");

    PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, pTransportInterface, tmp1);
    PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, LoadableTrans, tmp1);
    PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ThreadsStarted, tmp1);
    PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, NumThreads, tmp1);
    PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ProcessCallsFunc, tmp1);
    PRINT_MEMBER(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, LoadedDll, tmp1);
    PRINT_ADDRESS_OF(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, ProtseqDict, tmp2);
    PRINT_ADDRESS_OF(LoadableTrans, LOADABLE_TRANSPORT, RPCRT4!LOADABLE_TRANSPORT, DllName, tmp2);
    PRINT_MEMBER(qwAddr, TRANS_INFO, RPCRT4!TRANS_INFO, RpcProtocolSequence, tmp1);

    dprintf("\n");
}

DECLARE_API( help )
{
    LPSTR lpArgumentString = (LPSTR)args;

    if (lpArgumentString[0] == '\0') {
        dprintf( "\n");
        dprintf( "rpcdbg help:\n\n");
        dprintf( "\n");
        dprintf( "!obj      <address>  - Dumps an RPC object \n");
        dprintf( "\n");
        dprintf( "!sizes - Prints sizes of the data structures\n");
        dprintf( "!error - Translates and error value into the error message\n");
        dprintf( "!symbol    (<address>|<symbol name>) - Returns symbol name/address\n");
        dprintf( "!rpcheap [-a <address>][-d <num display>] - Dumps RPC_MEMORY_BLOCK linked list\n");
        dprintf( "\n");
        dprintf( "!pasync     <address>  - Dumps RPC_ASYNC_STATE\n");
        dprintf( "!rpcmsg     <address>  - Dumps RPC_MESSAGE\n");
        dprintf( "!stubmsg    <address>  - Dumps MIDL_STUB_MESSAGE\n");
        dprintf( "!authinfo    <address> - Dumps CLIENT_AUTH_INFO\n");
        dprintf( "!rpcsvr    <address>   - Dumps RPC_SERVER \n");
        dprintf( "!secinfo               - Dumps security provider/package info\n");
        dprintf( "!dict      <address>   - Dumps SDICT \n");
        dprintf( "!dict2     <address>   - Dumps SDICT2 \n");
        dprintf( "!queue     <address>   - Dumps QUEUE \n");
        dprintf( "!thread     <teb>      - Dumps THREAD \n");
        dprintf( "!copacket  <address>   - Dumps CO packet \n");
        dprintf( "!lpcpacket  <address>   - Dumps LRPC packet \n");
        dprintf( "!transinfo  <address>   - Dumps TRANS_INFO \n");
        dprintf( "\n");
        dprintf( "!scan       [options]  - Dumps the event log, add '-?' for help\n");
        dprintf( "!dgcc       <address>  - Dumps DG_CCALL \n");
        dprintf( "!dgsc       <address>  - Dumps DG_SCALL \n");
        dprintf( "!dgpe       <address>  - Dumps DG_PACKET_ENGINE\n");
        dprintf( "!dgpkt      <address>  - Dumps DG_PACKET \n");
        dprintf( "!dgpkthdr   <address>  - Dumps dg packet header (NCA_PACKET_HEADER)\n");
        dprintf( "!dgep       <address>  - Dumps DG_ENDPOINT \n");
        dprintf( "\n");
        dprintf( "!asyncmsg   <address>  - Dumps NDR_ASYNC_MESSAGE\n");
        dprintf( "!asyncrpc   <address>  - Dumps RPC_ASYNC_STATE\n");
        dprintf( "!asyncdcom  <address>  - Dumps CAsyncManager\n");
        dprintf( "\n");
        dprintf( "!pipemsg    <address>  - Dumps NDR_PIPE_MESSAGE\n");
        dprintf( "!pipedesc   <address>  - Dumps NDR_PIPE_DESC\n");
        dprintf( "!pipestate  <address>  - Dumps NDR_PIPE_STATE\n");
        dprintf( "\n");
        dprintf( "!trans      <address>  - Dumps most NT RPC transport objects\n");
        dprintf( "!overlap    <address>  - Dumps object associated with OVERLAPPED pointer\n");
        dprintf( "!wsaddr     <address>  - Dumps sockaddr structure\n");
        dprintf( "!protocols  <address>  - Dumps PnP protocols map & related objects\n");
        dprintf( "\n");
        dprintf( "!rpctime               - Displays current system time\n");
        dprintf( "!getcallinfo [options] - Searches the system for call info, add '-?' for help\n");
        dprintf( "!getendpointinfo [options] - Searches the system for endpoint info, add '-?' for help\n");
        dprintf( "!getdbgcell  <processID> <cellID1>.<cellID2> - Gets info for the specified cell\n");
        dprintf( "!getthreadinfo [options] - Searches the system for thread info, add '-?' for help\n");
        dprintf( "!getclientcallinfo [options] - Searches the system for client call info, add '-?' for help\n");
        dprintf( "!checkrpcsym - Checks whether RPC symbols are correct\n");
        dprintf( "!rpcreadstack - Reads an RPC client side stack and retrieves the call info\n");
        dprintf( "!rpcverbosestack - toggles the state of the verbose spew when reading the stack\n");
        dprintf( "!eerecord - prints an extended error info record\n");
        dprintf( "!eeinfo - prints the extended error info chain\n");
        dprintf( "!typeinfo - turns on/off the use of type information\n");
        dprintf( "!stackmatch start_addr [depth] matches stack symbols and target addresses\n");
        dprintf( "!listcalls <address>  - Dumps addresses, associations, and calls active within the RPC_SERVER at address\n");
        dprintf( "!rpcverifier - Dumps the RPC verifier settings\n\n");
    }
}

void do_symbol(ULONG64 qwAddr)
{
    CHAR Symbol[128];
    ULONG64 Displacement = 0;

    GetSymbol(qwAddr, Symbol, &Displacement);

    dprintf("%I64x %s+%I64x\n", qwAddr, Symbol, Displacement);
}

DECLARE_API( symbol )
{
    ULONG64 qwAddr;
    LPSTR lpArgumentString = (LPSTR)args;

    qwAddr = GetExpression(lpArgumentString);
    if ( !qwAddr )
        {
        return;
        }
    do_symbol(qwAddr);
}

#define MAX_ARGS 4

DECLARE_API( rpcheap )
{
    ULONG64  qwAddr      = 0;
    ULONG64  dwTmpAddr   = 0;
    long   lDisplay    = 0;
    long   lVerbose    = 1;
    BOOL Summary = 0;
    int    argc        = 0;
    int    i;
    long lSize = 0;

    CurrentSize = 0;

    char   **argv      = new char*[MAX_ARGS];
    if (argv == NULL)
        return;

    LPSTR lpArgumentString = (LPSTR)args;

    //#ifdef DEBUGRPC
    for (i = 0; ; ) {
        while (lpArgumentString[i] == ' ') {
            lpArgumentString[i] = '\0';
            i++;
        }
        if (lpArgumentString[i] == '\0') {
            break;
        }

        argv[argc] = &(lpArgumentString[i]);
        argc++;

        if (argc > MAX_ARGS) {
            dprintf("\nToo many arguments. Extra args ignored.\n\n");
            break;
        }
        while ((lpArgumentString[i] != ' ')&&
               (lpArgumentString[i] != '\0')) {
              i++;
        }
    }
    for (i = 0; i < argc; i++) {
        if ((*argv[i] == '-') || (*argv[i] == '/') || (*argv[i] == '+')) {
            switch (*(argv[i]+1)) {
                case 'A':
                case 'a':
                    qwAddr = GetExpression(argv[++i]);
                    if (!qwAddr) {
                        dprintf("Error: Failure to get address of RPC memory list\n");
                        return;
                    }
                    break;

                case 'D':
                case 'd':
                    lDisplay = (long)myatol(argv[++i]);
                    break;

                case 's':
                    Summary = 1;
                    break;

                case 'z':
                    lSize = (long) GetExpression(argv[++i]);
                    break;

                case 'q':
                case 'Q':
                    lVerbose = FALSE;
                    break;

                case '?':
                default:
                    dprintf("rpcheap \n");
                    dprintf("     -a <address> (default:starts at head of linked list)\n");
                    dprintf("     -d <number of mem blks to display> (default: to end)\n");
                    dprintf("     -s display summary only (default: full dump)\n");
                    dprintf("     -z <size> display blocks of size <size> only (default: all)\n");
                    dprintf("     -q quiet (default: verbose)\n");
                    break;
            }
        }
        else {
            dprintf("rpcheap \n");
            dprintf("     -a <address> (default:starts at head of linked list)\n");
            dprintf("     -d <number of mem blks to display> (default: to end)\n");
        }
    }

    if (!qwAddr) {
        dwTmpAddr = GetExpression("rpcrt4!AllocatedBlocks");
        dprintf("Address of AllocatedBlocks - 0x%I64x\n", dwTmpAddr);
        if (!ReadPtrUnextend(dwTmpAddr, &qwAddr))
            dprintf("Contents of AllocatedBlocks - 0x%I64x\n", qwAddr);
    }
    do_rpcmem(qwAddr, lDisplay, lVerbose, Summary, lSize);
    //#else  // DEBUGRPC
    //dprintf("This extension command is not supported on a free build!\n");
    //#endif // DEBUGRPC
    if (argv) {
        delete[] argv;
    }
    return;
}

VOID
do_lpcaddr(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    do_rpcaddr( qwAddr );

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, LpcAddressPort, "LpcAddressPort(HANDLE)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, CallThreadCount, "CallThreadCount\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, MinimumCallThreads, "MinimumCallThreads\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationDictionary, "&Associations(LRPC_ASSOCIATION_DICT)", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationCount, "AssociationCount\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, ServerListeningFlag, "ServerListeningFlag\t\t", tmp1);

    dprintf("\n");
    }


VOID
do_lpcsa(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, AssociationReferenceCount, "AssociationReferenceCount\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, DictionaryKey, "DictionaryKey\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, LpcServerPort, "LpcServerPort(HANDLE)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, LpcReplyPort, "LpcReplyPort\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Address, "Address\t\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Bindings, "&Bindings(LRPC_SBINDING_DICT)\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Aborted, "Aborted\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Deleted, "Deleted\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, CachedSCall, "CachedSCall\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, CachedSCallAvailable, "CachedSCallAvailable\t\t", tmp1);

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, Buffers, "&Buffers(LRPC_CLIENT_BUFFER_DICT)", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, AssociationMutex, "&AssociationMutex\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, FreeSCallQueue, "&FreeSCallQueue\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, ClientThreadDict, "&ClientThreadDict\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, SContextDict, "&SContextDict\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SASSOCIATION, RPCRT4!LRPC_SASSOCIATION, SCallDict, "&SCallDict\t\t\t", tmp2);

    dprintf("\n");
}

VOID
do_lpcscall(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AsyncStatus, "AsyncStatus\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CachedAPCInfo, "pCachedAPCInfo\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, pAsync, "pAsync\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallingThread, "CallingThread\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NotificationIssued, "NotificationIssued\t\t", tmp1);

    ULONG64 AuthInfo;
    GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AuthInfo, AuthInfo, tmp2);
    dprintf("&ClientAuthInfo\t\t\t - 0x%I64x\n", AuthInfo);
    do_authinfo(AuthInfo );

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ActiveContextHandles, "&ActiveContextHandles(ServerContextHandle_DICT)\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, DispatchBuffer, "DispatchBuffer\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Association, "pAssociation(LRPC_ASSOCIATION)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, LrpcRequestMessage, "pLrpcMessage(LRPC_MESSAGE)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, LrpcReplyMessage, "pLrpcReplyMessage(LRPC_MESSAGE)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, SBinding, "pSBinding(LRPC_SBINDING)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ObjectUuidFlag, "ObjectUuidFlag\t\t\t", tmp1);


    ULONG64 ObjectUuid;
    GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ObjectUuid, ObjectUuid, tmp2);
    dprintf("ObjectUuid\t\t\t - ");
    PrintUuid(ObjectUuid); dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallId, "CallId\t\t\t\t", tmp1);

    ULONG64 ClientId;
    GET_ADDRESS_OF(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ClientId, ClientId, tmp2);
    PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueProcess, "ClientId.UniqueProcess(CLIENT_ID.HANDLE)", tmp1);
    PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueThread, "ClientId.UniqueThread (CLIENT_ID.HANDLE)", tmp1);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, MessageId, "MessageId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, PushedResponse, "pPushedResponse(VOID)\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CurrentBufferLength, "CurrentBuffferLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, BufferComplete, "BufferComplete\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Flags, "Flags\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, FirstSend, "FirstSend\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, PipeSendCalled, "PipeSendCalled\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Deleted, "Deleted\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, ReceiveEvent, "ReceiveEvent\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CallMutex, "CallMutex\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, RcvBufferLength, "RcvBufferLength\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, AsyncReply, "AsyncReply\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NextSCall, "NextSCall\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, NeededLength, "NeededLength\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, fSyncDispatch, "fSyncDispatch\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, Choked, "Choked\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, CancelPending, "CancelPending\t\t\t", tmp1);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, RefCount, "RefCount\t\t\t", tmp1);

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, BufferQueue, "&BufferQueue\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_SCALL, RPCRT4!LRPC_SCALL, SContext, "SContext\t\t\t", tmp1);

    dprintf("\n");
}

VOID
do_lpcbh(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp0;
    ULONG tmp1;

    do_bh(qwAddr);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, CurrentAssociation, "pCurrentAssociation(LRPC_CASSOCIATION)", tmp0);
    PRINT_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, SecAssociation, tmp1);
    PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, DceBinding, tmp0);

    GET_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, DceBinding, tmp0, tmp1);
    do_dcebinding(tmp0);

    PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, BindingReferenceCount, tmp0);
    PRINT_ADDRESS_OF(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, RecursiveCalls, tmp1);
    PRINT_MEMBER(qwAddr, LRPC_BINDING_HANDLE, RPCRT4!LRPC_BINDING_HANDLE, AuthInfoInitialized, tmp0);
}

VOID
do_lpcca(
    ULONG64 qwAddr
    )
{
    dprintf("\n");

    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 DceBinding;
    GET_MEMBER(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, DceBinding, DceBinding);
    dprintf("pDceBinding(DCE_BINDING)\t- 0x%I64x\n", DceBinding);
    do_dcebinding(DceBinding);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssociationDictKey, "AssociationDictKey\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, Bindings, "&Bindings(LRPC_BINDING_DICT)\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, FreeCCalls, "&FreeCCalls\t\t\t", tmp2);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, ActiveCCalls, "&ActiveCCalls\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LpcClientPort, "LpcClientPort\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LpcReceivePort, "LpcReceivePort\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssociationMutex, "&AssociationMutex(MUTEX)\t", tmp2);

    ULONG64 AssocAuthInfo;
    GET_ADDRESS_OF(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, AssocAuthInfo, AssocAuthInfo, tmp2);
    do_authinfo(AssocAuthInfo);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, BackConnectionCreated, "BackConnectionCreated\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CachedCCall, "pCachedCCall(LRPC_CCALL)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CachedCCallFlag, "CachedCCallFlag\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, CallIdCounter, "CallIdCounter\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, SecurityContextDict, "&SecurityContextDict\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, LastSecContextTrimmingTimestamp, "Timestamp\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CASSOCIATION, RPCRT4!LRPC_CASSOCIATION, BindingHandleReferenceCount, "BindingHAndleReferenceCount\t", tmp1);

    dprintf("\n");
}

VOID
do_lpcccall(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, AsyncStatus, "AsyncStatus\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedAPCInfo, "pCachedAPCInfo\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedAPCInfoAvailable, "CachedAPCInfoAvailable\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, pAsync, "pAsync\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallingThread, "CallingThread\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, NotificationIssued, "NotificationIssued\t\t", tmp1);

    ULONG64 AuthInfo; 
    GET_ADDRESS_OF(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, AuthInfo, AuthInfo, tmp2);
    dprintf("AuthInfo\t\t\t- 0x%I64x\n", AuthInfo);
    do_authinfo(AuthInfo);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentBindingHandle, "pCurrentBindingHandle(LRPC_BINDING_HANDLE)", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Association, "pAssociation(LRPC_CASSOCIATION)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, LrpcMessage, "pLrpcMessage(LRPC_MESSAGE)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RpcReplyMessage, "RpcReplyMessage\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, LpcReplyMessage, "LpcReplyMessage\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RcvBufferLength, "RcvBufferLength\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Choked, "Choked\t\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RecursiveCallsKey, "RecursiveCallsKey\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, FreeCallKey, "FreeCallKey\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallId, "CallId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, MessageId, "MessageId\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallbackId, "CallbackId\t\t\t", tmp1);

    ULONG64 ClientId;
    GET_ADDRESS_OF(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, ClientId, ClientId, tmp2);
    PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueProcess, "ClientId.UniqueProcess(CLIENT_ID.HANDLE)", tmp1);
    PRINT_MEMBER_WITH_LABEL(ClientId, CLIENT_ID, RPCRT4!CLIENT_ID, UniqueThread, "ClientId.UniqueThread (CLIENT_ID.HANDLE)", tmp1);

    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, DataInfoOffset, "DataInfoOffset\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallAbortedFlag, "CallAbortedFlag\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Thread, "Thread(THREAD_IDENTIFIER)\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, Binding, "Binding(LRPC_BINDING)", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, RecursionCount, "RecursionCount\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, SyncEvent, "SyncEvent\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, MsgFlags, "MsgFlags\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallMutex, "CallMutex\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CallStack, "CallStack\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CachedLrpcMessage, "CachedLrpcMessage\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, FirstFrag, "FirstFrag\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentBufferLength, "CurrentBufferLength\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, NeededLength, "NeededLength\t\t\t", tmp1);
    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, BufferQueue, "BufferQueue\t\t\t", tmp2);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, fSendComplete, "fSendcomplete\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, CurrentSecurityContext, "CurrentSecurityContext\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, LRPC_CCALL, RPCRT4!LRPC_CCALL, EEInfo, "Extended Error Info\t\t", tmp1);

    dprintf("\n");
}


VOID
do_pasync(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Size, "Size\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Signature, "Signature\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Lock, "Lock\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Flags, "Flags\t\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, StubInfo, "StubInfo\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, UserInfo, "UserInfo\t\t", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, RuntimeInfo, "RuntimeInfo\t\t", tmp1);

    ULONG64 Event;
    GET_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Event, Event);
    dprintf("Event\t\t\t - ");
    switch ((ULONG)Event)
        {
        case RpcCallComplete:
            dprintf("RpcCallComplete\n");
            break;
        case RpcSendComplete:
            dprintf("RpcSendComplete\n");
            break;
        case RpcReceiveComplete:
            dprintf("RpcReceiveComplete\n");
            break;
        default:
            dprintf("(unknown) 0x%I64x\n", Event);
            break;
        }

    ULONG64 NotificationType;
    GET_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, NotificationType, NotificationType);
    dprintf("NotificationType\t - ");

    BOOL b;
    char block[sizeof(RPC_ASYNC_STATE)];
    PRPC_ASYNC_STATE pa = (PRPC_ASYNC_STATE)block;

    if (!fUseTypeInfo) {
        b = GetData(qwAddr, block, sizeof(RPC_ASYNC_STATE));
        if ( !b ) {
            dprintf("can't read %p\n", qwAddr);
            return;
        }
    }

    switch ((ULONG)NotificationType)
        {
        case RpcNotificationTypeNone:
            dprintf("RpcNotificationTypeNone\n");
            break;

        case RpcNotificationTypeEvent:
            dprintf("RpcNotificationTypeEvent\n");

            if (!fUseTypeInfo)
                dprintf("\thEvent\t\t - 0x%p\n", pa->u.hEvent);
            break;

        case RpcNotificationTypeApc:
            dprintf("RpcNotificationTypeApc\n");

            if (!fUseTypeInfo) {
                dprintf("\tNotificationRoutine\t - 0x%p\n", pa->u.APC.NotificationRoutine);
                dprintf("\thThread\t\t\t - 0x%p\n", pa->u.APC.hThread);
            }
            break;

        case RpcNotificationTypeIoc:
            dprintf("RpcNotificationTypeIoc\n");

            if (!fUseTypeInfo) {
                dprintf("\thIOPort\t\t\t - 0x%p\n", pa->u.IOC.hIOPort);
                dprintf("\tdwNumberOfBytesTransferred - 0x%x\n",
                        pa->u.IOC.dwNumberOfBytesTransferred);
                dprintf("\tdwCompletionKey\t\t - 0x%p\n", pa->u.IOC.dwCompletionKey);
                dprintf("\tlpOverlapped\t\t - 0x%x\n", pa->u.IOC.lpOverlapped);
            }
            break;

        case RpcNotificationTypeHwnd:
            dprintf("RpcNotificationTypeHwnd\n");

            if (!fUseTypeInfo) {
                dprintf("\thWnd\t\t - 0x%p\n", pa->u.HWND.hWnd);
                dprintf("\tMsg\t\t - 0x%x\n", pa->u.HWND.Msg);
            }
            break;

        case RpcNotificationTypeCallback:
            dprintf("RpcNotificationTypeCallback\n");

            if (!fUseTypeInfo) {
                dprintf("NotificationRoutine\t - 0x%p\n", pa->u.NotificationRoutine);
            }
            break;

        default:
            dprintf("Bad notification type\n");
        }

    dprintf("\n");
}

char *
ReceiveStates[] =
{
    "START",
    "COPY_PIPE_ELEM",
    "RETURN_PARTIAL",
    "READ_PARTIAL"
};

void
do_stubmsg(
    ULONG64 msg
    )
{
    ULONG64 tmp0;

    dprintf("MIDL_STUB_MESSAGE at 0x%I64x\n\n", msg);

    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Buffer, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferStart, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferEnd, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferMark, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, MemorySize, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Memory, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, BufferLength, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pAllocAllNodesContext, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, RpcMsg, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, SavedHandle, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, StubDesc, tmp0);
    PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, IsClient, tmp0);
    PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, ReuseBuffer, tmp0);
    PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, IgnoreEmbeddedPointers, tmp0);
    PRINT_MEMBER_BOOLEAN(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, fBufferValid, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, MaxCount, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, ActualCount, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, Offset, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, StackTop, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pPresentedType, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pTransmitType, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pRpcChannelBuffer, tmp0);
    PRINT_MEMBER(msg, MIDL_STUB_MESSAGE, RPCRT4!MIDL_STUB_MESSAGE, pAsyncMsg, tmp0);
}

VOID
do_dgaddr(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp0;
    ULONG tmp1;

    dprintf("DG_ADDRESS at 0x%I64x\n\n", qwAddr);

    do_rpcaddr(qwAddr);

    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TransInfo, tmp0);
    PRINT_MEMBER_SYMBOL(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TransInfo, tmp0);
    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ActiveCallCount, tmp0);
    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, CachedConnections, tmp0);

    dprintf("\nendpoint data:\n");

    GET_ADDRESS_OF(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, Endpoint, tmp0, tmp1);
    do_dgep(tmp0);

    dprintf("\nobsolete data:\n");

    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, TotalThreadsThisEndpoint, tmp0);
    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ThreadsReceivingThisEndpoint, tmp0);
    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, MinimumCallThreads, tmp0);
    PRINT_MEMBER(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, MaximumConcurrentCalls, tmp0);
    PRINT_ADDRESS_OF(qwAddr, DG_ADDRESS, RPCRT4!DG_ADDRESS, ScavengerTimer, tmp1);
}

VOID
do_dgbh(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    do_bh(qwAddr);

    dprintf("DCE_BINDING:\n");
    ULONG64 pDceBinding;
    GET_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, pDceBinding, pDceBinding);
    do_dcebinding(pDceBinding);

    PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, EndpointFlags, tmp1);
    PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, Association, tmp1);
    PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, ReferenceCount, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, fDynamicEndpoint, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, fContextHandle, tmp1);
    PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, TransportObject, tmp1);
    PRINT_MEMBER(qwAddr, DG_BINDING_HANDLE, RPCRT4!DG_BINDING_HANDLE, TransportInterface, tmp1);
}

VOID
do_dgpe(
    ULONG64 qwAddr
    )
{
    DG_PACKET_ENGINE *dgpe;
    char block[sizeof(DG_PACKET_ENGINE)];
    dgpe = (DG_PACKET_ENGINE *) block;

    ULONG64 tmp1;
    ULONG tmp;

    if (!fUseTypeInfo) {
        GetData(qwAddr, block, sizeof(DG_PACKET_ENGINE));
    }

    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SequenceNumber, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ReferenceCount, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, PacketType,tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ActivityHint, tmp1);

    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, TimeoutCount, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, CurrentPduSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, MaxFragmentSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SecurityTrailerSize, tmp1);

    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pSavedPacket, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SourceEndpoint, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RemoteAddress, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BaseConnection, tmp1);

    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pReceivedPackets, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ReceiveFragmentBase, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, LastReceiveBuffer, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, pLastConsecutivePacket, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, LastReceiveBufferLength, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, ConsecutiveDataBytes, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, fReceivedAllFragments, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, Buffer, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBase, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FinalSendFrag, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BufferLength, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBits, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FackSerialNumber, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, BufferFlags,tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, fRetransmitted, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FirstUnsentOffset, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendBurstLength, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, QueuedBufferHead, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, FirstUnsentFragment, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, QueuedBufferTail, tmp1);
    PRINT_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RingBufferBase, tmp1);

    if (!fUseTypeInfo) {
        dprintf("  Frag  Offset    Length  Serial # |  Frag  Offset    Length  Serial #\n"
            "  ----  --------  ------  -------- |  ----  --------  ------  --------\n"
            );
    }

    ULONG64 RingBufferBase;
    ULONG64 SendWindowBase;
    GET_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, RingBufferBase, RingBufferBase);
    GET_MEMBER(qwAddr, DG_PACKET_ENGINE, RPCRT4!DG_PACKET_ENGINE, SendWindowBase, SendWindowBase);

    unsigned short i;
    for (i=1; i <= MAX_WINDOW_SIZE/2; ++i)
        {
        unsigned Index1 = (i + (ULONG)RingBufferBase) % MAX_WINDOW_SIZE;
        unsigned Frag1 = (ULONG)SendWindowBase+i;

        if (Frag1 >= MAX_WINDOW_SIZE)
            {
            Frag1 -= MAX_WINDOW_SIZE;
            }

        if (!fUseTypeInfo) {
            dprintf("  %4x: %8lx  %5hx     %4hx   |",
                    Frag1,
                    dgpe->FragmentRingBuffer[Index1].Offset,
                    dgpe->FragmentRingBuffer[Index1].Length,
                    dgpe->FragmentRingBuffer[Index1].SerialNumber
                    );
        }

        unsigned Index2 = (i+MAX_WINDOW_SIZE/2 + (ULONG)RingBufferBase) % MAX_WINDOW_SIZE;
        unsigned Frag2 = (ULONG)SendWindowBase+i+MAX_WINDOW_SIZE/2;

        if (Frag2 >= MAX_WINDOW_SIZE)
            {
            Frag2 -= MAX_WINDOW_SIZE;
            }

        if (!fUseTypeInfo) {
            dprintf("  %4x: %8lx  %5hx     %4hx   \n",
                    Frag2,
                    dgpe->FragmentRingBuffer[Index2].Offset,
                    dgpe->FragmentRingBuffer[Index2].Length,
                    dgpe->FragmentRingBuffer[Index2].SerialNumber
                    );
        }
    }
    dprintf("\n");
}

char *
ClientState(
    DG_CCALL::DG_CLIENT_STATE State
    )
{
    switch (State)
        {
        case DG_CCALL::CallInit:          return "init";
        case DG_CCALL::CallQuiescent:     return "quiescent";
        case DG_CCALL::CallSend:          return "sending";
        case DG_CCALL::CallSendReceive:   return "sendreceive";
        case DG_CCALL::CallReceive:       return "receiving";
        case DG_CCALL::CallCancellingSend:return "cancel send";
        case DG_CCALL::CallComplete:      return "complete";
        default:
            {
            static char scratch[40];

            sprintf(scratch, "0x%lx", State);
            return scratch;
            }
        }
}

char *
ServerState(
    DG_SCALL::CALL_STATE State
    )
{
    switch (State)
        {
        case DG_SCALL::CallInit:            return "init";
        case DG_SCALL::CallBeforeDispatch:  return "receiving";
        case DG_SCALL::CallDispatched:      return "dispatched";
        case DG_SCALL::CallAfterDispatch:   return "after stub";
        case DG_SCALL::CallSendingResponse: return "sending";
        case DG_SCALL::CallComplete:        return "complete";
        default:
            {
            static char scratch[40];

            sprintf(scratch, "0x%lx", State);
            return scratch;
            }
        }
}

char *
PipeOp(
    PENDING_OPERATION Op
    )
{
    switch (Op)
        {
        case PWT_NONE:          return "none";
        case PWT_RECEIVE:       return "receive";
        case PWT_SEND:          return "send";
        case PWT_SEND_RECEIVE:  return "send/recv";
        default:
            {
            static char scratch[40];

            sprintf(scratch, "0x%lx", Op);
            return scratch;
            }
        }
}

VOID
do_dgcc(
    ULONG64 dgcc
    )
{
    ULONG64 State, PreviousState;
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    GET_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, State, State);
    GET_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, PreviousState, PreviousState);

    dprintf("state %-14s  prev  %-14s\n\n",
            ClientState((DG_CCALL::DG_CLIENT_STATE)State),
            ClientState((DG_CCALL::DG_CLIENT_STATE)PreviousState));

    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, TimeStamp, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, TimeoutLimit, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, LastReceiveTime, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AsyncStatus, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelTime, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, EEInfo, tmp1);

    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ReceiveTimeout, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, WorkingCount, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, UnansweredRequestCount, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, PipeReceiveSize, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, Previous, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, Next, tmp1);
    PRINT_MEMBER(dgcc, DG_CCALL, RPCRT4!DG_CCALL, pAsync, tmp1);

    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, StaticArgsSent, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, DelayedSendPending, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AllArgsSent, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, LastSendTimedOut, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelComplete, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ForceAck, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, CancelPending, tmp1);
    PRINT_MEMBER_BOOLEAN(dgcc, DG_CCALL, RPCRT4!DG_CCALL, AutoReconnectOk, tmp1);

    dprintf("\n");

    ULONG64 ActivityHint;
    GET_ADDRESS_OF(dgcc, DG_CCALL, RPCRT4!DG_CCALL, ActivityHint, ActivityHint, tmp2);

    do_dgpe(ActivityHint-AddressSize);
}

VOID
do_dgep(
        ULONG64 ep
        )
{
    ULONG64 tmp0;
    ULONG tmp1;
    ULONG64 Stats;

    PRINT_MEMBER_BOOLEAN(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Async, tmp0);
    PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TimeStamp, tmp0);
    PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Next, tmp0);
    PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, NumberOfCalls, tmp0);

    PRINT_MEMBER(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TransportInterface, tmp0);
    PRINT_MEMBER_SYMBOL(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, TransportInterface, tmp0);

    GET_ADDRESS_OF(ep, DG_ENDPOINT, RPCRT4!DG_ENDPOINT, Stats, Stats, tmp1);
    PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, PreferredPduSize, tmp0);
    PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, MaxPduSize, tmp0);
    PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, MaxPacketSize, tmp0);
    PRINT_MEMBER(Stats, DG_ENDPOINT_STATS, RPCRT4!DG_ENDPOINT_STATS, ReceiveBufferSize, tmp0);
}

VOID
do_dgccn(
         ULONG64 qwAddr
         )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\nbase:\n");

    ULONG64 ActivityNode;
    GET_ADDRESS_OF(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ActivityNode, ActivityNode, tmp2);

    ULONG64 Uuid;
    ULONG64 pPrev, pNext;
    GET_ADDRESS_OF(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, Uuid, Uuid, tmp2);
    GET_MEMBER(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, pPrev, pPrev);
    GET_MEMBER(ActivityNode, UUID_HASH_TABLE_NODE, RPCRT4!UUID_HASH_TABLE_NODE, pNext, pNext);

    dprintf("  activity ID "); PrintUuid(Uuid);
    dprintf("  next %I64x prev %I64x\n", pNext, pPrev );

    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TimeStamp, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TransportInterface, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ActiveSecurityContext, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, ReferenceCount, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, TransportInterface, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, LowestActiveSequence, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, LowestUnusedSequence, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, CurrentPduSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_COMMON_CONNECTION, RPCRT4!DG_COMMON_CONNECTION, RemoteWindowSize, tmp1);
}

VOID
do_dgcn(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    do_dgccn(qwAddr);

    dprintf("\nclient:\n");

    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ActiveCallHead, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CurrentCall, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ActiveCallTail, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CachedCalls, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CachedCallCount, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ThreadId, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, BindingHandle, tmp1);

    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, ServerResponded, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, CallbackCompleted, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fServerSupportsAsync, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fSecurePacketReceived, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fBusy, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, InConnectionTable, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AckPending, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AckOrphaned, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, PossiblyRunDown, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fAutoReconnect,tmp1);

    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Association, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AssociationKey, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, AuthInfo, tmp2);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, SecurityContextId, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, TimeStamp, tmp1);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, LastScavengeTime, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, DelayedAckTimer, tmp2);
    PRINT_MEMBER(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Next, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, fError, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_CCONNECTION, RPCRT4!DG_CCONNECTION, Mutex, tmp2);
}

char *
CallbackState(
    DG_SCONNECTION::CALLBACK_STATE State
    )
{
    switch (State)
        {
        case DG_SCONNECTION::NoCallbackAttempted:    return "NoCallbackAttempted";
        case DG_SCONNECTION::SetupInProgress:        return "SetupInProgress";
        case DG_SCONNECTION::MsConvWayAuthInProgress:return "MsConvWayAuthInProgress";
        case DG_SCONNECTION::  ConvWayAuthInProgress:return "  ConvWayAuthInProgress";
        case DG_SCONNECTION::MsConvWay2InProgress:   return "MsConvWay2InProgress";
        case DG_SCONNECTION::  ConvWay2InProgress:   return "  ConvWay2InProgress";
        case DG_SCONNECTION::  ConvWayInProgress:    return "  ConvWayInProgress";
        case DG_SCONNECTION::CallbackSucceeded:      return "CallbackSucceeded";
        case DG_SCONNECTION::CallbackFailed:         return "CallbackFailed";
        default:
            {
            static char scratch[40];

            sprintf(scratch, "0x%lx", State);
            return scratch;
            }
        }
}


VOID
do_dgsn(
        ULONG64 qwAddr
        )
{
    ULONG64 tmp1;
    ULONG tmp2;

    do_dgccn(qwAddr);

    dprintf("\nserver:\n");

    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, ActiveCalls, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, CurrentCall, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, CachedCalls, tmp1);

    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, pAddress, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, LastInterface, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, pAssocGroup, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, Next, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, ActivityHint, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, AuthInfo, tmp2);
    PRINT_MEMBER(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, MaxKeySeq, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, SecurityContextDict, tmp2);
    PRINT_ADDRESS_OF(qwAddr, DG_SCONNECTION, RPCRT4!DG_SCONNECTION, Callback, tmp2);

    if (!fUseTypeInfo) {

        uchar buff[sizeof(DG_SCONNECTION)];
        GetData(qwAddr, buff, sizeof(DG_SCONNECTION));
        DG_SCONNECTION * cn = (DG_SCONNECTION *) buff;

        dprintf(                                            "\n"
            "  status        %-8lx  binding     %p   datarep   %-8lx   \n"
            "  scall         %p  client seq  %-8lx   \n"
            "\n"
            "  token buffer  %p  token len    %-8lx  async state offset %x  \n"
            "  response buf  %p  response len %-8lx  ThirdLegNeeded    %s\n"
            "  sec cxt       %p  credentials  %p  ksno              %-8lx \n"
            "  data index    %-8lx \n",

            cn->Callback.Status,            cn->Callback.Binding,           cn->Callback.DataRep,
            cn->Callback.Call,              cn->Callback.ClientSequence,

            cn->Callback.TokenBuffer,       cn->Callback.TokenLength,       offsetof(DG_SCONNECTION, Callback.AsyncState),
            cn->Callback.ResponseBuffer,    cn->Callback.ResponseLength,    BoolString(cn->Callback.ThirdLegNeeded),
            cn->Callback.SecurityContext,   cn->Callback.Credentials,       cn->Callback.KeySequence,
            cn->Callback.DataIndex
            );
    }
}

VOID
do_dgca(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ReferenceCount, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, BindingHandleReferences, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InternalTableIndex, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, LastScavengeTime, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, CurrentPduSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, RemoteWindowSize, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, TransportInterface, tmp1);

    dprintf("\n");

    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerAddress, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerBootTime, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ServerDataRep, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, AssociationFlag, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fServerSupportsAsync, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fLoneBindingHandle, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, fErrorFlag, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, LastReceiveTime, tmp1);

    PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, Mutex, tmp2);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ResolvedEndpoint, tmp1);
    PRINT_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, KeepAliveHandle, tmp1);
    PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, ActiveConnections, tmp2);
    PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InactiveConnections, tmp2);
    PRINT_ADDRESS_OF(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, InterfaceAndObjectDict, tmp2);

    ULONG64 pDceBinding;
    GET_MEMBER(qwAddr, DG_CASSOCIATION, RPCRT4!DG_CASSOCIATION, pDceBinding, pDceBinding);
    dprintf("DCE_BINDING:\n");
    do_dcebinding(pDceBinding);
}

VOID
do_dgsc(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    ULONG64 State;
    GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, State, State);
    dprintf("state - %-14s\n", ServerState((DG_SCALL::CALL_STATE)State));

    ULONG64 PreviousState;
    GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PreviousState, PreviousState);
    dprintf("prev state - %-14s\n", ServerState((DG_SCALL::CALL_STATE)State));

    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, TimeStamp, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, DispatchBuffer, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, AsyncStatus, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, pAsync, tmp1);

    ULONG64 PipeWaitType;
    GET_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeWaitType, PipeWaitType);
    dprintf("pipe op - %-10s\n", PipeOp((PENDING_OPERATION)PipeWaitType));

    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeWaitLength, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, PipeThreadId, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Previous, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Next, tmp1);

    PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, CallInProgress, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, CallWasForwarded, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, KnowClientAddress, tmp1);
    PRINT_MEMBER_BOOLEAN(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, TerminateWhenConvenient, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, AuthorizationService, tmp1);
    PRINT_MEMBER(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, Privileges, tmp1);

    dprintf("\n");

    ULONG64 ActivityHint;
    GET_ADDRESS_OF(qwAddr, DG_SCALL, RPCRT4!DG_SCALL, ActivityHint, ActivityHint, tmp2);

    do_dgpe(ActivityHint-AddressSize);
}


VOID
do_dgag(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;
    ULONG64 Node;
    GET_ADDRESS_OF(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, Node, Node, tmp2);
    ULONG64 Uuid;
    GET_ADDRESS_OF(Node, UUID_HASH_TABLE_NODE, UUID_HASH_TABLE_NODE, Uuid, Uuid, tmp2);

    dprintf("\n"
            "    CAG UUID:   ");   PrintUuid(Uuid);

    ULONG64 ReferenceCount;
    ULONG64 CurrentPduSize;
    ULONG64 RemoteWindowSize;
    ULONG64 AssociationID;
    ULONG64 CtxCollection;
    ULONG64 MutexAddr;
    GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, ReferenceCount, ReferenceCount);
    GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, CurrentPduSize, CurrentPduSize);
    GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, RemoteWindowSize, RemoteWindowSize);
    GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, AssociationID, AssociationID);
    GET_MEMBER(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, CtxCollection, CtxCollection);
    GET_ADDRESS_OF(qwAddr, ASSOCIATION_GROUP, RPCRT4!ASSOCIATION_GROUP, Mutex, MutexAddr, tmp2);

    dprintf("                  \n"
            "    refs:       %8.8x             mutex at  %p    \n"
            "    pdu length: %8.8x             assoc ID: %x    \n"
            "    send window %8.8x             CtxColl : %I64p    \n",
            (ULONG)ReferenceCount,             MutexAddr,
            (ULONG)CurrentPduSize,             (ULONG)AssociationID,
            (ULONG)RemoteWindowSize,           CtxCollection);
}

// Do some arm twisting to include pipendr.h and asyncndr.

#define _NEWINTRP_
typedef unsigned char   uchar;
typedef unsigned short  ushort;
typedef unsigned long   ulong;
typedef unsigned int    uint;
#include "..\..\ndr20\pipendr.h"

typedef void            IAsyncManager;
#define MAX_CONTEXT_HNDL_NUMBER     8
#include "..\..\ndr20\mulsyntx.h"
#include "..\..\ndr20\asyncndr.h"


char *
PipeState(
    int State
    )
{
    static char buf[40];

    if (State <= 3)
        {
        return ReceiveStates[State];
        }

    sprintf(buf, "0x%x", State);

    return buf;
}

char *
PipeFlags(
    unsigned short Flags
    )
{
    static char buf[80];

    buf[0] = 0;

    if (Flags & NDR_IN_PIPE)
        {
        strcat(buf, "I ");
        }

    if (Flags & NDR_OUT_PIPE)
        {
        strcat(buf, "O ");
        }

    if (Flags & NDR_LAST_IN_PIPE)
        {
        strcat(buf, "LI ");
        }

    if (Flags & NDR_LAST_OUT_PIPE)
        {
        strcat(buf, "LO ");
        }

    if (Flags & NDR_OUT_ALLOCED)
        {
        strcat(buf, "ALLOC ");
        }

    if (Flags & 0xffe0)
        {
        char Excess[10];
        sprintf(Excess, "%hx ", Flags & 0xffe0);
        strcat(buf, Excess);
        }

    return buf;
}

char *
PipeStatusStrings[] =
{
    "QUIET",
    "IN",
    "OUT",
    "DRAIN"
};

char *
PipeStatus(
    unsigned short Status
    )
{
    static char buf[40];

    if (Status <= 3)
        {
        return PipeStatusStrings[Status];
        }

    sprintf(buf, "0x%x", Status);

    return buf;
}

void
do_pipestate(
    ULONG64 qwAddr
    )
{
    ULONG64 ElemsInChunk;
    ULONG64 ElemAlign;
    ULONG64 ElemWireSize;
    ULONG64 ElemMemSize;
    ULONG64 PartialBufferSize;
    ULONG64 PartialElem;
    ULONG64 PartialElemSize;
    ULONG64 PartialOffset;
    ULONG64 CurrentState;
    ULONG64 EndOfPipe;

    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemsInChunk, ElemsInChunk);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemAlign, ElemAlign);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemWireSize, ElemWireSize);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, ElemMemSize, ElemMemSize);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialBufferSize, PartialBufferSize);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialElem, PartialElem);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialElemSize, PartialElemSize);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialOffset, PartialOffset);
    GET_MEMBER(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, CurrentState, CurrentState);

    ULONG tmp2;
    GET_ADDRESS_OF(qwAddr, NDR_PIPE_STATE, RPCRT4!NDR_PIPE_STATE, PartialOffset, EndOfPipe, tmp2);
    EndOfPipe += 4;

    dprintf("\n");
    dprintf(" elems in chunk %8lx   partial buf size  %8lx   state %s\n",
             (ULONG)ElemsInChunk,    (ULONG)PartialBufferSize, PipeState((ULONG)CurrentState) );
    dprintf(" elem align     %8lx   partial element   %8lx   end of pipe bits %I64x\n",
             (ULONG)ElemAlign,       (ULONG)PartialElem,     EndOfPipe );
    dprintf(" elem wire size %8lx   partial elem size %8lx   \n",
             (ULONG)ElemWireSize,    (ULONG)PartialElemSize  );
    dprintf(" elem mem  size %8lx   partial offset    %8lx   \n",
             (ULONG)ElemMemSize,     (ULONG)PartialOffset    );
}

void
do_pipedesc(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, CurrentPipe, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, InPipes, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, OutPipes, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, TotalPipes, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, Flags, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, PipeVersion, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, pPipeMsg, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, DispatchBuffer, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, ChainingBuffer, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, DispatchBufferLength, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, ChainingBufferSize, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LastPartialBuffer, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, BufferSave, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LastPartialSize, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LengthSave, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, LeftoverSize, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, RuntimeState, tmp1);
    PRINT_ADDRESS_OF(qwAddr, NDR_PIPE_DESC, RPCRT4!NDR_PIPE_DESC, Leftover, tmp2);

    do_pipestate(tmp1);
}

void
do_pipearg(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;

    dprintf("\n");

    PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnPull, tmp1);
    PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnPush, tmp1);
    PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pfnAlloc, tmp1);
    PRINT_MEMBER(qwAddr, GENERIC_PIPE_TYPE, RPCRT4!GENERIC_PIPE_TYPE, pState, tmp1);
}

void
do_pipemsg(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, Signature, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeId, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pPipeObject, tmp1);
    ULONG64 pPipeObject = tmp1;

    PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pStubMsg, tmp1);
    PRINT_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, pTypeFormat, tmp1);

    ULONG64 PipeStatusVal;
    ULONG64 PipeFlagsVal;
    GET_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeStatus, PipeStatusVal);
    GET_MEMBER(qwAddr, NDR_PIPE_MESSAGE, RPCRT4!NDR_PIPE_MESSAGE, PipeFlags, PipeFlagsVal);
    dprintf("pipe status %5s\n", PipeStatus((unsigned short)PipeStatusVal));
    dprintf("pipe flags  %s\n", PipeFlags((unsigned short)PipeStatusVal));

    do_pipearg(pPipeObject );
}

void
async_flags(
    NDR_ASYNC_CALL_FLAGS flags
    )
{
    dprintf("   flags %4x: ", *(unsigned short *)&flags );
    if ( flags.ValidCallPending )
        dprintf(" call pending, " );
    if ( flags.ErrorPending )
        dprintf(" err pending, " );
    if ( flags.BadStubData )
        dprintf(" BSD, " );
    if ( flags.RuntimeCleanedUp )
        dprintf(" rt cleaned, " );
    if ( flags.HandlelessObjCall )
        dprintf(" autocomplete, " );
    if ( flags.Unused )
        dprintf(" Unused %4x ", flags.Unused );
    dprintf("-\n" );

}

char * AsyncPhaseString[5] =
    {
    "zero",
    "prep : initialized",
    "set :  (cl) after get buffer and ( cl | srv) register call",
    "call : cl after marshaling, calling send",
    "error : exception taken"
    };

void
async_stub_phase(
    unsigned short phase
    )
{
    dprintf("   phase %4x: ", phase );
    if ( 0 <= phase  &&  phase < 5 )
        dprintf(" %s\n", AsyncPhaseString[ phase ] );
    else
        dprintf(" unknown??\n" );
}

typedef struct _NDR_ASYNC_OBJ_HANDLE
{
    void *              pIAMvtble;
    void *              pICMvtble;
    NDR_ASYNC_MESSAGE * _pAsyncMsg;
    unsigned long       _Lock;
    unsigned long       _Signature;
    GUID                _iid;
    void *              _InnerUnknown;
    unsigned long       _iRef;
    void *              _pParent;
    void *              _pControl;
    void *              _pSyncInner;
    unsigned long       _fAutoComplete;
} NDR_ASYNC_OBJ_HANDLE;


void
do_asyncdcom(
    ULONG64 qwAddr
    )
{
    if (fUseTypeInfo) {
      dprintf("Can't dump NDR_ASYNC_OBJ_HANDLE when using type info\n");
    }
    else {
        BOOL b;
        char block[sizeof(NDR_ASYNC_OBJ_HANDLE)];

        b = GetData(qwAddr, block, sizeof(block));
        if ( !b ) {
          dprintf("can't read %p\n", qwAddr);
          return;
        }

        NDR_ASYNC_OBJ_HANDLE * msg = (NDR_ASYNC_OBJ_HANDLE *) block;

        dprintf("\n");
        dprintf(" pIAMvtble %p  pICMvtble %p   asyncmsg %p  lock     %8lx\n",
                msg->pIAMvtble, msg->pICMvtble,  msg->_pAsyncMsg, msg->_Lock );
        dprintf(" innerpUnk %p  iref      %8lx   pParent  %p  pControl %p\n",
                msg->_InnerUnknown,msg->_iRef,   msg->_pParent,msg->_pControl );
        dprintf(" Signature %8lx  iid       ", msg->_Signature ); PrintUuidLocal( & msg->_iid );dprintf("\n");
        dprintf(" innerSync %p  autocompl %d\n",
                msg->_pSyncInner,msg->_fAutoComplete );
    }
}

void
do_asyncrpc(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;

    dprintf("\n");

    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Size, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Signature, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Lock, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, Flags, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, StubInfo, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, UserInfo, tmp1); 
    PRINT_MEMBER(qwAddr, RPC_ASYNC_STATE, RPCRT4!RPC_ASYNC_STATE, RuntimeInfo, tmp1); 
}

void
do_asyncmsg(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Signature, tmp1);
    PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Version, tmp1);
    PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, AsyncHandle, tmp1);
    PRINT_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, ProcContext, tmp1);

    ULONG64 Flags;
    GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, Flags, Flags);
    async_flags( *((NDR_ASYNC_CALL_FLAGS*)&Flags) );

    ULONG64 StubPhase;
    GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, StubPhase, StubPhase);
    async_stub_phase( (unsigned short) StubPhase );

    ULONG64 StubMsg;
    GET_MEMBER(qwAddr, NDR_ASYNC_MESSAGE, RPCRT4!NDR_ASYNC_MESSAGE, StubMsg, StubMsg);
    do_stubmsg( StubMsg );
}

//
// Datagram stuff
//

char * PacketFlagStrings[8] =
{
    "forwarded ",
    "lastfrag ",
    "frag ",
    "nofack ",
    "maybe ",
    "idem ",
    "broadcast ",
    "flags-0x80 "
};

char * PacketFlag2Strings[8] =
{
    "fragmented ",
    "cancel-pending ",
    "flags2-0x04 ",
    "flags2-0x08 ",
    "flags2-0x10 ",
    "flags2-0x20 ",
    "flags2-0x40 ",
    "flags2-0x80 "
};

char *
PrintPacketFlags(
    unsigned char PacketFlags1,
    unsigned char PacketFlags2
    )
{
    static char buf[160];
    unsigned char Flags;
    unsigned i;

    buf[0] = 0;

    Flags = PacketFlags1;
    for (i=0; i < 8; i++)
        {
        if (Flags & 1)
            {
            strcat(buf, PacketFlagStrings[i]);
            }

        Flags >>= 1;
        }

    Flags = PacketFlags2;
    for (i=0; i < 8; i++)
        {
        if (Flags & 1)
            {
            strcat(buf, PacketFlag2Strings[i]);
            }

        Flags >>= 1;
        }

    return buf;
}

char * PacketTypes[] =
{
    "REQ ",
    "PING",
    "RESP",
    "FLT ",
    "WORK",
    "NOCA",
    "REJ ",
    "ACK ",
    "QUIT",
    "FACK",
    "QACK"
};

char *
PrintPacketType(
    unsigned char PacketType
    )
{
    static char buf[40];

    if (PacketType < sizeof(PacketTypes)/sizeof(PacketTypes[0]))
        {
        return PacketTypes[PacketType];
        }

    sprintf(buf, "illegal packet type %x ", PacketType);

    return buf;
}

VOID
do_dgpkt(
    ULONG64 p
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, MaxDataLength, tmp1);
    PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, TimeReceived, tmp1);
    PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, DataLength, tmp1);
    PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, pNext, tmp1);
    PRINT_MEMBER(p, DG_PACKET, RPCRT4!DG_PACKET, pPrevious, tmp1);

    ULONG64 Header;
    GET_ADDRESS_OF(p, DG_PACKET, RPCRT4!DG_PACKET, Header, Header, tmp2);

    do_dgpkthdr(Header);
}

VOID
do_dgpkthdr(
    ULONG64 h
    )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketType, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, RpcVersion, tmp1);

    ULONG64 PacketFlags;
    ULONG64 PacketFlags2;
    GET_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketFlags, PacketFlags);
    GET_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketFlags2, PacketFlags2);
    dprintf("flags: %s\n", PrintPacketFlags((unsigned char)PacketFlags, (unsigned char)PacketFlags2));

    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, FragmentNumber, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, PacketBodyLen, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, SerialLo, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, DataRep, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ServerBootTime, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, AuthProto, tmp1);

    dprintf("  activity  ");
    ULONG64 ActivityId;
    GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ActivityId, ActivityId, tmp2);
    PrintUuid(ActivityId);
    dprintf("\n");

    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ActivityHint, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, SequenceNumber, tmp1);

    dprintf("  interface ");
    ULONG64 InterfaceId;
    GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceId, InterfaceId, tmp2);
    PrintUuid(InterfaceId);
    dprintf("\n");

    ULONG64 InterfaceVersion;
    GET_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceVersion, InterfaceVersion, tmp2);
    PRINT_MEMBER(h, _RPC_VERSION, RPCRT4!_RPC_VERSION, MajorVersion, tmp1);
    PRINT_MEMBER(h, _RPC_VERSION, RPCRT4!_RPC_VERSION, MinorVersion, tmp1);

    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, InterfaceHint, tmp1);
    PRINT_MEMBER(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, OperationNumber, tmp1);

    PRINT_ADDRESS_OF(h, _NCA_PACKET_HEADER, RPCRT4!_NCA_PACKET_HEADER, ObjectId, tmp2);

    dprintf("\n");
}

void
do_assoctable(
      ULONG64 qwAddr
      )
{
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("DG_ASSOCIATION_TABLE at 0x%I64x:\n", qwAddr);

    ULONG64 CasUuid;
    ULONG64 fCasUuidReady;
    GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, CasUuid, CasUuid);
    GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, fCasUuidReady, fCasUuidReady);

    dprintf("  CAS: ");  PrintUuid( CasUuid );
    dprintf(", %svalid\n", (ULONG)fCasUuidReady ? "" : "not ");

    dprintf("\n");

    PRINT_ADDRESS_OF_WITH_LABEL(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, Mutex, "&Mutex (CSharedLock)", tmp2);

    ULONG64 Associations;
    ULONG64 AssociationsLength;
    GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, Associations, Associations);
    GET_MEMBER(qwAddr, DG_ASSOCIATION_TABLE, RPCRT4!DG_ASSOCIATION_TABLE, AssociationsLength, AssociationsLength); 
    dprintf("association array at 0x%I64x, %x elements\n", Associations, AssociationsLength);
}


char *
strtok(
    char *String
    )
{
    char * Word;
    static char * End;

    if (String)
        {
        Word = String;
        }
    else if (!End)
        {
        return 0;
        }
    else
        {
        Word = End+1;
        }

    while (*Word == ' ' || *Word == '\t')
        {
        ++Word;
        }

    if (!*Word)
        {
        End = 0;
        return 0;
        }

    End = Word;
    while (*End && *End != ' ' && *End != '\t')
        {
        ++End;
        }

    if (!*End)
        {
        End = 0;
        }
    else
        {
        *End = 0;
        }

    return Word;
}

BOOL
IsMember(
         char Item,
         char * List
         )
{
    BOOL Mask = FALSE;
    if (List[0] == '~')
        {
        Mask = TRUE;
        }

    while (*List)
        {
        if (Item == *List)
            {
            return TRUE ^ Mask;
            }
        ++List;
        }

    return FALSE ^ Mask;
}

BOOL
FetchEvent(
    IN ULONG_PTR RpcEvents,
    IN unsigned Index,
    IN struct RPC_EVENT * Entry
    )
{
    return GetData(RpcEvents + Index * sizeof(struct RPC_EVENT), Entry, sizeof(struct RPC_EVENT));
}

BOOL
FetchEventAddress(
    IN ULONG64 RpcEvents,
    IN int Index,
    IN PULONG64 EntryAddress
    )
{
    static ULONG EntrySize = 0;

    if (EntrySize == 0) {
        EntrySize = GetTypeSize("RPCRT4!RPC_EVENT");
        if (EntrySize == 0) {
            return FALSE;
        }
    }

    *EntryAddress = RpcEvents + Index * EntrySize;

    return TRUE;
}

BOOL
DoesEntryMatch(
    IN struct RPC_EVENT * Entry,
    IN char * Subjects,
    IN char * verbs,
    IN DWORD thread,
    IN ULONG_PTR addr,
    IN ULONG_PTR obj_addr
    )
{
    if (!Entry->Subject)
        {
        return FALSE;
        }

    if (Subjects && !IsMember(Entry->Subject, Subjects))
        {
        return FALSE;
        }

    if (verbs && !IsMember(Entry->Verb, verbs))
        {
        return FALSE;
        }

    if (thread && Entry->Thread != (unsigned short) thread)
        {
        return FALSE;
        }

    if (addr && Entry->SubjectPointer != (void *) addr)
        {
        return FALSE;
        }

    if (obj_addr && Entry->ObjectPointer != (void *) obj_addr)
        {
        return FALSE;
        }

    return TRUE;
}

BOOL
DoesEntryAddressMatch(
    IN ULONG64 Entry,
    IN char * Subjects,
    IN char * verbs,
    IN DWORD thread,
    IN ULONG64 addr,
    IN ULONG64 obj_addr
    )
{
    ULONG64 tmp;
    char item;

    GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, tmp);

    if (!tmp)
        {
        return FALSE;
        }

    if (Subjects && !IsMember((char)tmp, Subjects))
        {
        return FALSE;
        }

    GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Verb, tmp);

    if (verbs && !IsMember((char)tmp, verbs))
        {
        return FALSE;
        }

    GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Thread, tmp);

    if (thread && tmp != (unsigned short) thread)
        {
        return FALSE;
        }

    GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, SubjectPointer, tmp);

    if (addr && tmp != addr)
        {
        return FALSE;
        }

    GET_MEMBER_NORET_NOSPEW(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, ObjectPointer, tmp);

    if (obj_addr && tmp != obj_addr)
        {
        return FALSE;
        }

    return TRUE;
}

char * DgPacketTypes[] =
{
    "REQ",
    "PING",
    "RESP",
    "FAULT",

    "WORKING",
    "NOCALL",
    "REJECT",
    "ACK",

    "QUIT",
    "FACK",
    "QUACK",
    "BIND",
    "BIND-ACK",

    "BIND_NAK",
    "ALTER-CXT",
    "ALTER-RESP",
    "AUTH-3",
    "SHUTDOWN",

    "CANCEL",
    "ORPHAN"
};

char * ScallStates[] =
{
    "Init",
    "BeforeDispatch",
    "Dispatched",
    "DispatchedWithCompleteData",
    "AfterDispatch",
    "SendingResponse",
    "Complete"
};

char * CcallStates[] =
{
    "Init",
    "Quiescent",
    "Send",
    "SendReceive",
    "Receive",
    "CancellingSend",
    "Complete"
};

char * HandleTypeStrings[] =
{
    "wmsg_cas     ",
    "wmsg_handle  ",
    "dg_ccall     ",
    "dg_scall     ",
    "dg_binding   ",
    "osf_ccall    ",
    "osf_scall    ",
    "osf_cconn    ",
    "osf_sconn    ",
    "osf_cassoc   ",
    "osf_assoc    ",
    "osf_address  ",
    "lrpc_ccall   ",
    "lrpc_scall   ",
    "lrpc_cassoc  ",
    "lrpc_sassoc  ",
    "lrpc_binding ",
    "svr_binding  ",
    "dg_cconn     ",
    "dg_sconn     ",
    "osf_binding  ",
    "dg_callback  ",
    "dg_address   ",
    "lrpc_address ",
    "dg_assoc     "
};

char *
GetHandleType(
    void * Value
    )
{
    int i;

    for (i=0; i < sizeof(HandleTypeStrings)/sizeof(char *); ++i)
        {
        if ((1UL << i) == PtrToUlong(Value))
            {
            return HandleTypeStrings[i];
            }
        }

    static char scratch[40];

    sprintf(scratch, "refobj %p", Value);
    return scratch;
}

char *
GetHandleTypeAddr(
    ULONG64 Pointer
    )
{
    int i;

    for (i=0; i < sizeof(HandleTypeStrings)/sizeof(char *); ++i)
        {
        if ((1UL << i) == Pointer)
            {
            return HandleTypeStrings[i];
            }
        }

    static char scratch[40];

    sprintf(scratch, "refobj %.6x", Pointer);
    return scratch;
}

int
PrintEntry(
    IN struct RPC_EVENT * Entry,
    IN ULONG index,
    IN BOOL ShowStack
    )
{
    char * Subject;
    char * Verb;
    BOOL Printed = FALSE;

    switch (Entry->Subject)
        {
        case SU_HANDLE   : Subject = "binding     "; break;
        case SU_CCONN    : Subject = "cconn       "; break;
        case SU_SCONN    : Subject = "sconn       "; break;
        case SU_CASSOC   : Subject = "cassoc      "; break;
        case SU_SASSOC   : Subject = "sassoc      "; break;
        case SU_CCALL    : Subject = "ccall       "; break;
        case SU_SCALL    : Subject = "scall       "; break;
        case SU_PACKET   : Subject = "packet      "; break;
        case SU_CENDPOINT: Subject = "endpnt      "; break;
        case SU_ENGINE   : Subject = " call       "; break;
        case SU_ASSOC    : Subject = " assoc      "; break;
        case SU_MUTEX    : Subject = "mutex       "; break;
        case SU_STABLE   : Subject = "sc tabl     "; break;
        case SU_BCACHE   : Subject = "bcache      "; break;
        case SU_HEAP     : Subject = "heap        "; break;
        case SU_THREAD   : Subject = "thread      "; break;
        case SU_EVENT    : Subject = "event       "; break;
        case SU_TRANS_CONN:Subject = "trans conn  "; break;
        case SU_ADDRESS  : Subject = "address     "; break;
        case SU_EXCEPT   : Subject = "exception   "; break;
        case SU_REFOBJ   :
            {
            Subject = GetHandleType(Entry->ObjectPointer);
            break;
            }
        case SU_CTXHANDLE: Subject = "ctx handle  "; break;
        default:
            {
            static char string[4];
            Subject = string;

            Subject[0] = '\"';
            Subject[1] = Entry->Subject;
            Subject[2] = '\"';
            Subject[3] = '\0';
            break;
            }
        }

    dprintf("%5x: %06.6d.%03.3d/%-4x  %s %p ", index, Entry->Time /1000, Entry->Time % 1000, Entry->Thread, Subject, Entry->SubjectPointer);

    Verb = "(extension bug)";

    switch (Entry->Verb)
        {
        case EV_CREATE    : Verb = "create   "; break;
        case EV_DELETE    : Verb = "delete   "; break;
        case EV_START     : Verb = "active   "; break;
        case EV_STOP      : Verb = "inactive "; break;
        case EV_INC       : Verb = "ref++    "; break;
        case EV_DEC       : Verb = "ref--    "; break;
        case EV_ACK       : Verb = "ack sent "; break;
        case EV_NOTIFY    : Verb = "notify   "; break;
        case EV_APC       : Verb = "APC fired"; break;
        case EV_RESOLVED  : Verb = "resolved "; break;
        case EV_REMOVED   : Verb = "removed  "; break;
        case EV_CLEANUP   : Verb = "cleanup  "; break;
        case EV_SEC_INIT1   : Verb = "init SC 1"; break;
        case EV_SEC_INIT3   : Verb = "init SC 3"; break;
        case EV_SEC_ACCEPT1 : Verb = "accptSC 1"; break;
        case EV_SEC_ACCEPT3 : Verb = "accptSC 3"; break;
        case EV_STATUS:
            {
            if (Entry->Subject != SU_EXCEPT)
                {
                if (Entry->ObjectPointer)
                    {
                    dprintf("status %lx, location %d", Entry->Data, Entry->ObjectPointer);
                    }
                else
                    {
                    dprintf("status %lx", Entry->Data);
                    }
                Printed = TRUE;
                break;
                }
            else
                {
                dprintf("exception info: %lx, %lx, %lx", Entry->SubjectPointer, Entry->ObjectPointer, Entry->Data);
                Printed = TRUE;
                break;
                }
            }
        case EV_DISASSOC  : Verb = "disassoc "; break;
        case EV_STATE:
            {
            char * state = "----";

            if (Entry->Subject == SU_CCALL)
                {
                if (Entry->Data < DG_CCALL::CallInit     ||
                    Entry->Data > DG_CCALL::CallComplete )
                    {
                    dprintf("unknown state 0x%x", Entry->Data);
                    Printed = TRUE;
                    }
                else
                    {
                    state = CcallStates[Entry->Data - DG_CCALL::CallInit];
                    }
                }
            else
                {
                if (Entry->Data < DG_SCALL::CallInit     ||
                    Entry->Data > DG_SCALL::CallComplete )
                    {
                    dprintf("unknown state 0x%x", Entry->Data);
                    Printed = TRUE;
                    }
                else
                    {
                    state = ScallStates[Entry->Data - DG_SCALL::CallInit];
                    }
                }

            if (!Printed)
                {
                dprintf("state %s", state);
                Printed = TRUE;
                }

            break;
            }
        case EV_POP       : Verb = "pop      "; break;
        case EV_PUSH      : Verb = "push     "; break;
        case EV_PKT_IN:
            {
            unsigned short frag  = (unsigned short) (Entry->Data);
            unsigned short ptype = (unsigned short) (Entry->Data >> 16);
            char * ptypestring;

            if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
                {
                dprintf("recv pkt unknown type 0x%hx", ptype);
                Printed = TRUE;
                }
            else
                {
                ptypestring = DgPacketTypes[ptype];
                }

            if (!Printed)
                {
                if (Entry->ObjectPointer)
                    {
                    dprintf("recv pkt %s frag %hx, location %d", ptypestring, frag, Entry->ObjectPointer);
                    }
                else
                    {
                    dprintf("recv pkt %s frag/len %hx", ptypestring, frag);
                    }
                Printed = TRUE;
                }
            break;
            }

        case EV_BUFFER_IN : Verb = "buf    in"; break;
        case EV_BUFFER_OUT: Verb = "buf   out"; break;
        case EV_TRANSFER:   Verb = "xfer call"; break;
        case EV_DROP:       Verb = "dropped  "; break;
        case EV_DELAY:      Verb = "delayed  "; break;
        case EV_CALLBACK:   Verb = "callback "; break;

        default:
            {
            static char string[4];
            Verb = string;

            Verb[0] = '\"';
            Verb[1] = Entry->Verb;
            Verb[2] = '\"';
            Verb[3] = '\0';
            break;
            }
        case 'p':
            {
            if (Entry->Subject == SU_STABLE)
                {
                Verb = "prune    ";
                }
            else
                {
                DWORD buf[2];
                buf[0] = (DWORD) Entry->Data;
                buf[1] = 0;

                dprintf("proc %s  %p", (char *) buf, Entry->ObjectPointer);

                Printed = TRUE;
                }
            break;
            }
        case EV_PKT_OUT:
            {
            unsigned short frag  = (unsigned short) (Entry->Data);
            unsigned short ptype = (unsigned short) (Entry->Data >> 16);
            char * ptypestring;

            if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
                {
                ptypestring = "???";
                }
            else
                {
                ptypestring = DgPacketTypes[ptype];
                }

            dprintf("sent pkt %s frag/len %hx", ptypestring, frag);
            Printed = TRUE;
            break;
            }
        }

    if (!Printed)
        {
        dprintf("%s  %p %p", Verb, Entry->ObjectPointer, Entry->Data);
        }

    dprintf("\n");

    int LinesPrinted = 1;

    if (ShowStack && Entry->EventStackTrace[0])
        {
        int i;

        for (i = 0; Entry->EventStackTrace[i] && i < STACKTRACE_DEPTH; i++)
            {
            dprintf("        ");
            do_symbol((ULONG_PTR) Entry->EventStackTrace[i]);
            ++LinesPrinted;
            }
        }

    return LinesPrinted;
}

int
PrintEntryAddress(
    IN ULONG64 Entry,
    IN int index,
    IN BOOL ShowStack
    )
{
    char * Subject;
    char * Verb;
    BOOL Printed = FALSE;

    ULONG tmp;

    ULONG64 Time = 0;
    ULONG64 Thread = 0;
    ULONG64 SubjectPointer = 0;
    ULONG64 ObjectPointer = 0;
    ULONG64 SubjectData = 0;
    ULONG64 VerbData = 0;
    ULONG64 Data = 0;
    ULONG64 EventStackTraceAddress =0 ;
    ULONG64 EventStackTrace_0 = 0;

    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Time, Time);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Thread, Thread);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, SubjectPointer, SubjectPointer);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, SubjectData);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, ObjectPointer, ObjectPointer);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Verb, VerbData);
    GET_MEMBER_NORET(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, Data, Data);
    GET_ADDRESS_OF(Entry, RPC_EVENT, RPCRT4!RPC_EVENT, EventStackTrace, EventStackTraceAddress, tmp);

    ReadPtrUnextend(EventStackTraceAddress, &EventStackTrace_0);

    switch ((char)SubjectData)
        {
        case SU_HANDLE   : Subject = "binding      "; break;
        case SU_CCONN    : Subject = "cconn        "; break;
        case SU_SCONN    : Subject = "sconn        "; break;
        case SU_CASSOC   : Subject = "cassoc       "; break;
        case SU_SASSOC   : Subject = "sassoc       "; break;
        case SU_CCALL    : Subject = "ccall        "; break;
        case SU_SCALL    : Subject = "scall        "; break;
        case SU_PACKET   : Subject = "packet       "; break;
        case SU_CENDPOINT: Subject = "endpnt       "; break;
        case SU_ENGINE   : Subject = " call        "; break;
        case SU_ASSOC    : Subject = " assoc       "; break;
        case SU_MUTEX    : Subject = "mutex        "; break;
        case SU_STABLE   : Subject = "sc tabl      "; break;
        case SU_BCACHE   : Subject = "bcache       "; break;
        case SU_HEAP     : Subject = "heap         "; break;
        case SU_THREAD   : Subject = "thread       "; break;
        case SU_EVENT    : Subject = "event        "; break;
        case SU_TRANS_CONN:Subject = "trans conn   "; break;
        case SU_ADDRESS  : Subject = "address      "; break;
        case SU_EXCEPT   : Subject = "exception    "; break;
        case SU_REFOBJ   :
            {
            Subject = GetHandleTypeAddr(ObjectPointer);
            break;
            }
        case SU_CTXHANDLE: Subject = "ctx handle   "; break;
        case SU_EEINFO   : Subject = "EEInfo       "; break;

        default:
            {
            static char string[4];
            Subject = string;
            Subject[0] = '\"';
            Subject[1] = (char)SubjectData;
            Subject[2] = '\"';
            Subject[3] = '\0';

            break;
            }
        }

    dprintf("%5x: %06.6d.%03.3d/%-4x %s %I64p ", index, (ULONG)Time / 1000, (ULONG)Time % 1000, (ULONG)Thread, Subject, SubjectPointer);

    if (SubjectData != SU_EEINFO)
        {
        Verb = "(extension bug)";

        switch ((char)VerbData)
            {
            case EV_CREATE    : Verb = "create   "; break;
            case EV_DELETE    : Verb = "delete   "; break;
            case EV_START     : Verb = "active   "; break;
            case EV_STOP      : Verb = "inactive "; break;
            case EV_INC       : Verb = "ref++    "; break;
            case EV_DEC       : Verb = "ref--    "; break;
            case EV_ACK       : Verb = "ack sent "; break;
            case EV_NOTIFY    : Verb = "notify   "; break;
            case EV_APC       : Verb = "APC fired"; break;
            case EV_RESOLVED  : Verb = "resolved "; break;
            case EV_REMOVED   : Verb = "removed  "; break;
            case EV_CLEANUP   : Verb = "cleanup  "; break;
            case EV_SEC_INIT1   : Verb = "init SC 1"; break;
            case EV_SEC_INIT3   : Verb = "init SC 3"; break;
            case EV_SEC_ACCEPT1 : Verb = "accptSC 1"; break;
            case EV_SEC_ACCEPT3 : Verb = "accptSC 3"; break;
            case EV_STATUS:
                {
                if ((ULONG)SubjectData != SU_EXCEPT)
                    {
                    if (VerbData)
                        {
                        dprintf("status %lx, location %d", (ULONG)Data, (ULONG)ObjectPointer);
                        }
                    else
                        {
                        dprintf("status %lx", (ULONG)Data);
                        }
                    Printed = TRUE;
                    break;
                    }
                else
                    {
                    dprintf("exception info: %lx, %lx, %lx", (ULONG)SubjectPointer, (ULONG)ObjectPointer, (ULONG)Data);
                    Printed = TRUE;
                    break;
                    }
                }
            case EV_DISASSOC  : Verb = "disassoc "; break;
            case EV_STATE:
                {
                char * state = "----";

                if ((ULONG)SubjectData == SU_CCALL)
                    {
                    if (Data < GetExpression("rpcrt4!DG_CCALL__CallInit") ||
                        Data > GetExpression("rpcrt4!DG_CCALL__CallComplete"))
                        {
                        dprintf("unknown state 0x%x", Data);
                        Printed = TRUE;
                        }
                    else
                        {
                        state = CcallStates[Data - GetExpression("rpcrt4!DG_CCALL__CallInit")];
                        }
                    }
                else
                    {
                    if (Data < GetExpression("RPCRT4!DG_SCALL__CallInit") ||
                        Data > GetExpression("RPCRT4!DG_SCALL__CallComplete"))
                        {
                        dprintf("unknown state 0x%x", Data);
                        Printed = TRUE;
                        }
                    else
                        {
                        state = ScallStates[Data - GetExpression("RPCRT4!DG_SCALL__CallInit")];
                        }
                    }

                if (!Printed)
                    {
                    dprintf("state %s", state);
                    Printed = TRUE;
                    }

                break;
                }
            case EV_POP       : Verb = "pop      "; break;
            case EV_PUSH      : Verb = "push     "; break;
            case EV_PKT_IN:
                {
                unsigned short frag  = (unsigned short) (Data);
                unsigned short ptype = (unsigned short) (Data >> 16);
                char * ptypestring;

                if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
                    {
                    dprintf("recv pkt unknown type 0x%hx", ptype);
                    Printed = TRUE;
                    }
                else
                    {
                    ptypestring = DgPacketTypes[ptype];
                    }

                if (!Printed)
                    {
                    if (ObjectPointer)
                        {
                        dprintf("recv pkt %s frag %hx, location %d", ptypestring, frag, (ULONG)ObjectPointer);
                        }
                    else
                        {
                        dprintf("recv pkt %s frag/len %hx", ptypestring, frag);
                        }
                    Printed = TRUE;
                    }
                break;
                }

            case EV_BUFFER_IN : Verb = "buf    in"; break;
            case EV_BUFFER_OUT: Verb = "buf   out"; break;
            case EV_TRANSFER:   Verb = "xfer call"; break;
            case EV_DROP:       Verb = "dropped  "; break;
            case EV_DELAY:      Verb = "delayed  "; break;
            case EV_CALLBACK:   Verb = "callback "; break;

            default:
                {
                static char string[10];
                Verb = string;
                Verb[0] = '\"';
                Verb[1] = (char)VerbData;
                Verb[2] = '\"';
                Verb[3] = '\0';

                break;
                }

            case 'p':
                {
                if (SubjectData == SU_STABLE)
                    {
                    Verb = "prune    ";
                    }
                else
                    {
                    DWORD buf[2];
                    buf[0] = (DWORD) Data;
                    buf[1] = 0;

                    dprintf("proc %s  %I64x", (char *) buf, ObjectPointer);

                    Printed = TRUE;
                    }
                break;
                }

            case EV_PKT_OUT:
                {
                unsigned short frag  = (unsigned short) (Data);
                unsigned short ptype = (unsigned short) ((Data >> 16) & 0xFF);
                unsigned short opnum = (unsigned short) (Data >> 24);
                ULONG CallId = (ULONG)ObjectPointer;
                char * ptypestring;

                if (ptype >= sizeof(DgPacketTypes)/sizeof(DgPacketTypes[0]))
                    {
                    ptypestring = "???";
                    }
                else
                    {
                    ptypestring = DgPacketTypes[ptype];
                    }

                if (opnum)
                    {
                    dprintf("sent p %s fr/len %hx op# %d cid %d", ptypestring, frag, opnum, CallId);
                    }
                else
                    {
                    dprintf("sent p %s fr/len %hx cid %d", ptypestring, frag, CallId);
                    }
                Printed = TRUE;
                break;
                }
            }
        }
    else
        {
        // this is an eeinfo record
        dprintf("GC %d St %d DL %d P#1 %d", (ULONG)VerbData, (ULONG)SubjectPointer, (ULONG)ObjectPointer, (ULONG)Data);
        Printed = TRUE;
        }

    if (!Printed)
        {
        dprintf("%s  %I64p %I64p", Verb, ObjectPointer, Data);
        }

    dprintf("\n");

    int LinesPrinted = 1;

    if (ShowStack && EventStackTrace_0) {
        int i = 0;
        ULONG64 StackEntry = 0;

        do {
            if (!ReadPtrUnextend(EventStackTraceAddress + i * AddressSize, &StackEntry)) {

                dprintf("        ");
                do_symbol(StackEntry);
                ++LinesPrinted;
                ++i;
            }
        }
        while (StackEntry && i < STACKTRACE_DEPTH);
    }

    return LinesPrinted;
}

void scan_usage()
{
    dprintf("options:\n"
            "\n"
            "    -sXYZ          print entries with subject character == X or Y or Z\n"
            "    -vXYZ          print entries with verb    character == X or Y or Z\n"
            "    -s~XYZ         print entries with subject character != X or Y or Z\n"
            "    -v~XYZ         print entries with verb    character != X or Y or Z\n"
            "    -t NNNN        print entries for thread NNNN            \n"
            "    -a NNNN        print entries for subject at address NNNN \n"
            "    -o NNNN        print entries for  object at address NNNN \n"
            "    -k or -k+      show stack traces if available\n"
            "    -k-            don't show stack traces (default)\n"
            "    -b NNNN1 NNNN2 NNNN3  \n"
            "                   (if symbols are broken) RpcEvents is at NNNN1"
            "                   and NextEvent is NNNN2\n"
            "                   and event array length is NNNN3\n"
            "    -NNNN          print the NNNN entries ending with NextEvent (or specified base)\n"
            "    +NNNN          print the NNNN entries starting with NextEvent (or specified base)\n"
            "    NNNN           the base index is NNNN"
            "    -f filename    reads a binary version of the log and displays it as text\n"
            "\n"
            "e.g. '!scan -40 -sN' would print the last 40 DG_SCONNECTION events\n"
            "     '!scan +30 200' would print 30 entries starting at index 200\n"
            );
}

char VerbsToDisplay[40];
char SubjectsToDisplay[40];

DECLARE_API( scan )
{
    char * Subject = 0;
    char * verb = 0;
    ULONG64 addr = 0;
    ULONG64 obj_addr = 0;
    DWORD thread = 0;

    static ULONG64 RpcEvents = 0;
    static LONG EventArrayLength = 0;

    static LONG NextEvent = 0;

    int   RequestCount = 30;
    int   NextEventToPrint = 0;
    BOOL  ForwardSearch = FALSE;
    BOOL  ShowStackTraces = FALSE;

    BOOL Wrapped = FALSE;
    int BaseIndex = -1;
    int MatchCount = 0;
    int index;
    int i;

    BOOL fFileInput = FALSE;
    HANDLE hFile;

    struct RPC_EVENT Entry;

    ULONG64 EntryAddress;
    ULONG64 tmp;

    //
    // Interpret options.
    //
    char * arg;

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        if (arg[0] == '-')
            {
            ++arg;

            switch (arg[0])
                {
                case 's':
                    {
                    if (!arg[1])
                        {
                        scan_usage();
                        return;
                        }

                    if (strlen(arg+1) >= sizeof(SubjectsToDisplay))
                        {
                        dprintf("-s: too many subject types proposed\n");
                        return;
                        }

                    strcpy(SubjectsToDisplay, arg+1);
                    Subject = SubjectsToDisplay;
                    if (Subject[0] == '*')
                        {
                        Subject = 0;
                        }
                    break;
                    }

                case 'v':
                    {
                    if (!arg[1])
                        {
                        scan_usage();
                        return;
                        }

                    if (strlen(arg+1) >= sizeof(VerbsToDisplay))
                        {
                        dprintf("-v: too many verbs proposed\n");
                        return;
                        }

                    strcpy(VerbsToDisplay, arg+1);
                    verb = VerbsToDisplay;
                    if (verb[0] == '*')
                        {
                        verb = 0;
                        }
                    break;
                    }

                case 'a':
                    {
                    if (arg[1])
                        {
                        scan_usage();
                        return;
                        }

                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-a: no object address specified\n");
                        return;
                        }

                    addr = GetExpression(arg);

                    if (!addr)
                        {
                        dprintf("-a: can't evaluate %s\n", arg);
                        return;
                        }

                    break;
                    }

                case 'o':
                    {
                    if (arg[1])
                        {
                        scan_usage();
                        return;
                        }

                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-o: no object address specified\n");
                        return;
                        }

                    obj_addr = GetExpression(arg);

                    if (!obj_addr)
                        {
                        dprintf("-o: can't evaluate %s\n", arg);
                        return;
                        }

                    break;
                    }

                case 't':
                    {
                    if (arg[1])
                        {
                        scan_usage();
                        return;
                        }

                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-t: no thread ID specified\n");
                        return;
                        }

                    thread = (DWORD) GetExpression(arg);

                    if (!thread)
                        {
                        dprintf("-t: can't evaluate %s\n", arg);
                        return;
                        }
                    break;
                    }

                case 'b':
                    {
                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-b: no base address specified\n");
                        return;
                        }

                    RpcEvents = GetExpression(arg);

                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-b: no NextEvent specified\n");
                        return;
                        }

                    NextEvent = (LONG) GetExpression(arg);

                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-b: no event array length specified\n");
                        return;
                        }

                    EventArrayLength = (long) GetExpression(arg);

                    break;
                    }

                case 'k':
                    {
                    if (arg[1] == '+' ||
                        arg[1] == '\0')
                        {
                        ShowStackTraces = TRUE;
                        }
                    else if (arg[1] == '-')
                        {
                        ShowStackTraces = FALSE;
                        }
                    else
                        {
                        dprintf("-k:  use '-k' or '-k+' for stack traces, '-k-' for none\n");
                        return;
                        }
                    break;
                    }

                case 'f':
                    {
                    arg = strtok(0);

                    if (!arg)
                        {
                        dprintf("-f: no file name specified\n");
                        return;
                        }

                    hFile = CreateFileA(arg, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING,
                        FILE_ATTRIBUTE_NORMAL, NULL);
                    if (hFile == INVALID_HANDLE_VALUE)
                        {
                        dprintf("-f: Couldn't open file name %s - error %d\n", arg, GetLastError());
                        return;
                        }

                    fFileInput = TRUE;
                    }
                    break;

                case '0':
                case '1':
                case '2':
                case '3':
                case '4':
                case '5':
                case '6':
                case '7':
                case '8':
                case '9':
                    {
                    ForwardSearch = FALSE;
                    RequestCount = myatol(arg);

                    if (!RequestCount)
                        {
                        dprintf("-%s: zero lines specified\n", arg);
                        return;
                        }
                    break;
                    }

                default:
                    {
                    dprintf("unknown option %s\n", arg);
                    scan_usage();
                    return;
                    }
                }
            }
        else if (arg[0] == '+')
            {
            ++arg;
            RequestCount = myatol(arg);

            if (!RequestCount)
                {
                dprintf("+%s: zero lines specified\n", arg);
                return;
                }

            MatchCount = RequestCount;
            ForwardSearch = TRUE;
            }
        else
            {
            BaseIndex = (int) GetExpression(arg);
            }
        }

    if (fFileInput)
        {
        BOOL Result;
        DWORD NumberOfBytesRead;
        index = 1;

        while (1)
            {
            Result = ReadFile(hFile, &Entry, sizeof(Entry), &NumberOfBytesRead, NULL);
            if (!Result)
                {
                dprintf("-f: Error reading file: %d\n", GetLastError());
                break;
                }

            if (NumberOfBytesRead < sizeof(Entry))
                {
                dprintf("-f: EOF reached\n");
                break;
                }

            PrintEntry(&Entry, index, ShowStackTraces);

            index ++;

            if ((CheckControlC)())
                {
                CloseHandle(hFile);
                return;
                }
            }

        CloseHandle(hFile);
        return;
        }

    ULONG64 NextEventAddress = GetExpression("rpcrt4!NextEvent");
    ULONG64 EventLengthAddress = GetExpression("rpcrt4!EventArrayLength");

    //
    // Find the current event.
    //
    if (!RpcEvents)
        {
        RpcEvents = GetExpression("rpcrt4!RpcEvents");

        if (!RpcEvents || !NextEventAddress)
            {
            dprintf("I can't find rpcrt4!RpcEvents or rpcrt4!NextEvent; use -b\n");
            return;
            }

        if (!ReadMemory(NextEventAddress, &NextEvent, sizeof(DWORD), 0))
            {
            dprintf("I can't read NextEvent from 0x%I64x\n", NextEventAddress);
            return;
            }

        if (EventLengthAddress)
            {
            if (!ReadMemory(EventLengthAddress, &EventArrayLength, sizeof(DWORD), 0))
                {
                dprintf("I can't read EventArrayLength from 0x%I64x\n", EventLengthAddress);
                return;
                }

            if (!ReadMemory(RpcEvents, &tmp, sizeof(ULONG64), 0))
                {
                dprintf("I can't read rpcrt4!RpcEvents at 0x%I64x\n", RpcEvents);
                return;
                }

            RpcEvents = tmp;
            }
        else
            {
            dprintf("rpcrt4!EventArrayLength isn't defined; probably an older build\n");

            EventArrayLength = 4096;
            }

        dprintf("RpcEvents at 0x%I64x; array has %u entries; NextEvent = %lx, %s\n",
                RpcEvents, EventArrayLength, NextEvent, Wrapped ? "wrapped around" : "");
        }

    if (FALSE == FetchEventAddress(RpcEvents, 0, &EntryAddress))
        {
        dprintf("I can't read memory at 0x%I64x \n", RpcEvents);
        return;
        }
    
    GET_MEMBER(EntryAddress, RPC_EVENT, RPCRT4!RPC_EVENT, Subject, tmp);
    if (tmp)
        {
        Wrapped = TRUE;
        }

    if (thread || Subject || verb || addr || obj_addr)
        {
        dprintf("filter: ");
        }
    else
        {
        dprintf("no filter");
        }

    if (thread)
        {
        dprintf("thread %x ", thread);
        }
    if (Subject)
        {
        dprintf("subjects '%s' ", Subject);
        }
    if (verb)
        {
        dprintf("verbs '%s' ", verb);
        }
    if (addr)
        {
        dprintf("address %x ", addr);
        }
    if (obj_addr)
        {
        dprintf("direct-object address 0x%I64x ", obj_addr);
        }

    dprintf(", base index = %x\n", BaseIndex);

    // Allow one set of debug spew to be printed if some data can't 
    // be properly read or fields extracted.
    fSpew = TRUE;

    //
    // Scan backwards until we have enough matching events.
    //
    if (NextEvent > EventArrayLength)
        {
        NextEvent %= EventArrayLength;
        }

    if (ForwardSearch)
        {
        if (BaseIndex == -1)
            {
            BaseIndex = NextEventToPrint;
            }

        if (!Wrapped && BaseIndex + MatchCount > NextEvent+1)
            {
            MatchCount = NextEvent+1 - BaseIndex;
            }
        }
    else
        {
        if (BaseIndex == -1)
            {
            BaseIndex = NextEvent;
            }

        LONG Point = BaseIndex;

        for (index = Point; index >= 0 && MatchCount < RequestCount; --index )
            {
            if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
                {
                dprintf("I can't read memory at index %x\n", index);
                return;
                }

            if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
                {
                ++MatchCount;
                BaseIndex = index;
                }
            }

        if (Wrapped && MatchCount < RequestCount)
            {
            for (index = EventArrayLength-1; index > Point && MatchCount < RequestCount; --index )
                {
                if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
                    {
                    dprintf("I can't read memory at index %d\n", index);
                    return;
                    }

                if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
                    {
                    ++MatchCount;
                    BaseIndex = index;
                    }
                }
            }
        }

    //
    // Print matching events.
    //
    index = BaseIndex;

    do
        {
        if (FALSE == FetchEventAddress(RpcEvents, index, &EntryAddress))
            {
            dprintf("I can't read memory at index %x\n", index);
            return;
            }

        if (DoesEntryAddressMatch(EntryAddress, Subject, verb, thread, addr, obj_addr))
            {
            PrintEntryAddress(EntryAddress, index, ShowStackTraces);
            --MatchCount;
            }

        ++index;
        index = index % EventArrayLength;

        if ((CheckControlC)())
            {
            return;
            }
        }
    while (MatchCount && index != BaseIndex);

    NextEventToPrint = index;
}

DECLARE_API( rpctime )
{
    DWORD dwCurrentTime;

    if (fKD)
        {
        dprintf("Cannot dump time in kd\n");
        return;
        }

    dwCurrentTime = GetTickCount();
    dprintf("Current time is: %06.6d.%03.3d (0x%06.6x.%03.3x)\n", dwCurrentTime / 1000, dwCurrentTime % 1000,
        dwCurrentTime / 1000, dwCurrentTime % 1000);
}

DECLARE_API( version )
{
#if    DBG
    PCSTR kind = "Checked";
#else
    PCSTR kind = "Free";
#endif

    if (fKD)
        {
        dprintf(
                "%s RPC Extension dll for Build %d debugging %s kernel for Build %d\n",
                kind,
                VER_PRODUCTBUILD,
                SavedMajorVersion == 0x0c ? "Checked" : "Free",
                SavedMinorVersion
                );
        }
    else
        {
        dprintf(
                "%s RPC Extension dll for Build %d\n",
                kind,
                VER_PRODUCTBUILD
                );
        }
}

DECLARE_API( bcache )
{
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 StateArray = 0;

    // For process cache
    ULONG64 Cache;
    ULONG64 CacheAddress;

    BOOL b, fGuardPageMode = FALSE;

    //
    // Interpret options.
    //
    char * arg1;
    char * arg2;

    LPSTR lpArgumentString = (LPSTR)args;

    arg1 = strtok(lpArgumentString);
    arg2 = strtok(0);

    if (arg2)
        {
        dprintf("usage:  \n"
                "        !bcache <TEB-address>  for a thread's cache\n"
                "        !bcache                for the process cache\n"
                "\n");
        return;
        }

    if (arg1)
        {
        ULONG64 RpcThread;

        ULONG64 pTeb = GetExpression(arg1);

        GET_MEMBER(pTeb, TEB, TEB, ReservedForNtRpc, RpcThread);

        GET_ADDRESS_OF(RpcThread, THREAD, RPCRT4!THREAD, BufferCache, StateArray, tmp2);
        }
    else
        {
        ULONG64 CachePointerAddress = GetExpression("rpcrt4!gBufferCache");

        if (!CachePointerAddress)
            {
            dprintf("can't find rpcrt4!gBufferCache\n");
            return;
            }

        b = GetData(CachePointerAddress, &CacheAddress, sizeof(PVOID));
        if ( !b )
            {
            dprintf("couldn't read process buffer cache pointer at %x\n", CacheAddress);
            return;
            }

        dprintf("process-wide buffer cache:\n");

        ULONG64 GuardPageMode = GetExpression("rpcrt4!fGuardPageMode");

        if(GuardPageMode)
            b = GetData(GuardPageMode, &fGuardPageMode, sizeof(fGuardPageMode));

        if (!b)
            {
            dprintf("couldn't read guard page mode flag at address %p\n", GuardPageMode);
            return;
            }

        if (fGuardPageMode)
            {
            dprintf("---> GUARD PAGE mode enabled!\n");
            }

        GET_ADDRESS_OF(CacheAddress, BCACHE, RPCRT4!BCACHE, _bcGlobalState, StateArray, tmp2);
        }

    //
    // Load the size hints.
    //
    ULONG64 HintAddress;

    HintAddress = GetExpression("rpcrt4!pHints");

    ReadPtrUnextend(HintAddress, &HintAddress);

    //
    // Dump the buffer states.
    //
    int i;
    ULONG64 State = StateArray;
    ULONG64 Hint = HintAddress;
    ULONG64 cBlocks;
    ULONG64 pList;
    ULONG64 cSize;

    for (i=0; i < 4; ++i)
        {
        GET_MEMBER(State, BCACHE_STATE, RPCRT4!BCACHE_STATE, cBlocks, cBlocks);
        GET_MEMBER(State, BCACHE_STATE, RPCRT4!BCACHE_STATE, pList, pList);
        GET_MEMBER(Hint, BUFFER_CACHE_HINTS, RPCRT4!BUFFER_CACHE_HINTS, cSize, cSize);

        dprintf("   count %5u    head %I64x     size %5x\n",
                (ULONG)cBlocks,
                pList,
                (ULONG)cSize);

        State += GET_TYPE_SIZE(BCACHE_STATE, RPCRT4!BCACHE_STATE);
        Hint += GET_TYPE_SIZE(BUFFER_CACHE_HINTS, RPCRT4!BUFFER_CACHE_HINTS);
        }

    if (!arg1)
        {
        ULONG64  _bcGlobalStats;
        GET_ADDRESS_OF(CacheAddress, BCACHE, RPCRT4!BCACHE, _bcGlobalStats, _bcGlobalStats, tmp2);

        // Dump out the bcache cache stats
        dprintf("\nGlobal Stats:\n     cap   hits misses\n");
        for (i = 0; i < ((fGuardPageMode) ? 2 : 4); i++)
            {
            ULONG64 cBufferCacheCap;
            ULONG64 cAllocationHits;
            ULONG64 cAllocationMisses;
            GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cBufferCacheCap, cBufferCacheCap);
            GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cAllocationHits, cAllocationHits);
            GET_MEMBER(_bcGlobalStats, BCACHE_STATS, RPCRT4!BCACHE_STATS, cAllocationMisses, cAllocationMisses);

            dprintf("   %5d  %5d  %5d\n",
                    cBufferCacheCap,
                    cAllocationHits,
                    cAllocationMisses);

            _bcGlobalStats += GET_TYPE_SIZE(BCACHE_STATS, RPCRT4!BCACHE_STATS);
            }
        }
}


VOID
CheckVersion(
    VOID
    )
{
}

LPEXT_API_VERSION
ExtensionApiVersion(
    VOID
    )
{
    return &ApiVersion;
}

void PrintGetCallInfoUsage(void)
{
    dprintf("Usage: \n\tgetcallinfo [CallID|0 [IfStart|0 [ProcNum|FFFF [ProcessID|0]]]]\n");
}

DECLARE_API( getcallinfo )
{
    ULONG CallID = 0;
    ULONG IfStart = 0;
    USHORT ProcNum = RPCDBG_NO_PROCNUM_SPECIFIED;
    ULONG ProcessID = 0;
    int ArgumentNo = 0;

    //
    // Interpret options.
    //
    char * arg;

    if (fKD != 0)
        {
        dprintf("This extension command does not work under kd\n");
        return;
        }

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                // either help or CallID
                if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
                    {
                    PrintGetCallInfoUsage();
                    return;
                    }
                else
                    {
                    CallID = (ULONG)GetExpression(arg);
                    }
                break;

            case 1:
                IfStart = (ULONG)GetExpression(arg);
                break;

            case 2:
                ProcNum = (unsigned short) GetExpression(arg);
                break;

            case 3:
                ProcessID = (ULONG)GetExpression(arg);
                break;

            default:
                dprintf("Too many arguments\n");
                PrintGetCallInfoUsage();

            }
        ArgumentNo ++;
        }

    GetAndPrintCallInfo(CallID, IfStart, ProcNum, ProcessID, dprintf);
}

void PrintGetDbgCellUsage(void)
{
    dprintf("Usage: \n\tgetdbgcell ProcessID CellID1.CellID2\n");
}

DECLARE_API( getdbgcell )
{
    ULONG ProcessID = 0;
    int ArgumentNo = 0;
    DebugCellID CellID;
    char *DotSeparator;

    CellID.SectionID = 0;
    CellID.CellID = 0;

    //
    // Interpret options.
    //
    char * arg;

    if (fKD != 0)
        {
        dprintf("This extension command does not work under kd\n");
        return;
        }

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                // either help or ProcessID
                if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
                    {
                    PrintGetDbgCellUsage();
                    return;
                    }
                else
                    {
                    ProcessID = (ULONG)GetExpression(arg);
                    }
                break;

            case 1:
                DotSeparator = strchr(arg, '.');
                if (DotSeparator == NULL)
                    {
                    PrintGetCallInfoUsage();
                    return;
                    }
                *DotSeparator = 0;
                DotSeparator ++;
                CellID.SectionID = (USHORT)GetExpression(arg);
                CellID.CellID = (USHORT)GetExpression(DotSeparator);
                break;

            default:
                dprintf("Too many arguments\n");
                PrintGetDbgCellUsage();

            }
        ArgumentNo ++;
        }

    GetAndPrintDbgCellInfo(ProcessID, CellID, dprintf);
}

void PrintGetEndpointInfoUsage(void)
{
    dprintf("Usage: \n\tgetendpointinfo [EndpointName]\n");
}

DECLARE_API( getendpointinfo )
{
    int ArgumentNo = 0;
    char *EndpointName = NULL;

    //
    // Interpret options.
    //
    char * arg;

    if (fKD != 0)
        {
        dprintf("This extension command does not work under kd\n");
        return;
        }

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                // either help or EndpointName
                if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
                    {
                    PrintGetEndpointInfoUsage();
                    return;
                    }
                else
                    {
                    EndpointName = arg;
                    }
                break;

            default:
                dprintf("Too many arguments\n");
                PrintGetCallInfoUsage();

            }
        ArgumentNo ++;
        }

    GetAndPrintEndpointInfo(EndpointName, dprintf);
}

void PrintGetThreadInfoUsage(void)
{
    dprintf("Usage: \n\tgetthreadinfo ProcessID [ThreadID]\n");
}

DECLARE_API( getthreadinfo )
{
    DWORD ProcessID = 0;
    DWORD ThreadID = 0;

    int ArgumentNo = 0;
    BOOL fFirstTime = TRUE;

    //
    // Interpret options.
    //
    char * arg;

    if (fKD != 0)
        {
        dprintf("This extension command does not work under kd\n");
        return;
        }

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                // either help or EndpointName
                if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
                    {
                    PrintGetThreadInfoUsage();
                    return;
                    }
                else
                    {
                    ProcessID = (DWORD)GetExpression(arg);
                    }
                fFirstTime = FALSE;
                break;

            case 1:
                ThreadID = (DWORD)GetExpression(arg);
                break;

            default:
                dprintf("Too many arguments\n");
                PrintGetThreadInfoUsage();

            }
        ArgumentNo ++;
        }

    if (fFirstTime)
        {
        dprintf("You must specify at least a process id\n");
        PrintGetThreadInfoUsage();
        return;
        }

    GetAndPrintThreadInfo(ProcessID, ThreadID, dprintf);
}

void PrintGetClientCallInfoUsage(void)
{
    dprintf("Usage: \n\tgetclientcallinfo [CallID|0 [IfStart|0 [ProcNum|FFFF [ProcessID|0]]]]\n");
}

DECLARE_API( getclientcallinfo )
{
    ULONG CallID = 0;
    ULONG IfStart = 0;
    USHORT ProcNum = RPCDBG_NO_PROCNUM_SPECIFIED;
    ULONG ProcessID = 0;
    int ArgumentNo = 0;

    //
    // Interpret options.
    //
    char * arg;

    if (fKD != 0)
        {
        dprintf("This extension command does not work under kd\n");
        return;
        }

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                // either help or CallID
                if ((arg[0] == '?') || ((arg[0] == '-') && (arg[1] == '?')))
                    {
                    PrintGetClientCallInfoUsage();
                    return;
                    }
                else
                    {
                    CallID = (ULONG)GetExpression(arg);
                    }
                break;

            case 1:
                IfStart = (ULONG)GetExpression(arg);
                break;

            case 2:
                ProcNum = (USHORT)GetExpression(arg);
                break;

            case 3:
                ProcessID = (ULONG)GetExpression(arg);
                break;

            default:
                dprintf("Too many arguments\n");
                PrintGetCallInfoUsage();

            }
        ArgumentNo ++;
        }

    GetAndPrintClientCallInfo(CallID, IfStart, ProcNum, ProcessID, dprintf);
}


DECLARE_API( checkrpcsym )
{
    PVOID FunctionPtr;
    DWORD Data;
    BOOL b;
    BOOL fUnsure = FALSE;

    const int FunctionNamesSize = 2;
    const int ExpectedDataSize = 3;

    DWORD ExpectedData_x86[2][3] = {{0x55, 0x8B, 0xEC},{0x55, 0x8B, 0xEC}};
    DWORD ExpectedData_ia64[2][3] = {{0x00, 0xa8, 0x85},{0x00, 0x20, 0x2d}};

    const char *FunctionNames[2] = {"RPCRT4!WS_NewConnection", "RPCRT4!OSF_ADDRESS__NewConnection"};
    int i, FunctionNo;

    BOOL fNoSpew = FALSE;

    for (FunctionNo = 0; FunctionNo < FunctionNamesSize; FunctionNo ++)
        {
        FunctionPtr = (PVOID)GetExpression(FunctionNames[FunctionNo]);
        if (FunctionPtr == NULL)
            {
            dprintf("Cannot find address of %s - RPC symbols are wrong\n",
                FunctionNames[FunctionNo]);
            return;
            }

        b = GetData(HandleToUlong(FunctionPtr), &Data, sizeof(DWORD));
        if (!b)
            {
            // under UM debugger this is bad symbols
            if (fKD == 0)
                {
                dprintf("Cannot access address %x - RPC symbols are wrong\n", FunctionPtr);
                return;
                }
            // in kd this is possible even with valid symbols
            fUnsure = TRUE;
            }
        else
            {
            for (i = 0; i < ExpectedDataSize; i ++)
                {
                if (((IsPtr64() && ((Data & 0xFF) != ExpectedData_ia64[FunctionNo][i]) ||
                     (!IsPtr64()) && ((Data & 0xFF) != ExpectedData_x86[FunctionNo][i])))
                    && fNoSpew == FALSE)
                    {
                    dprintf("Function %s does not have expected\n"
                        "contents - debugger and debuggee have\n"
                        "different versions or architectures or the RPC\n"
                        "symbols are wrong\n\n",
                        FunctionNames[FunctionNo]);
                    fUnsure = TRUE;
                    fNoSpew = TRUE;
                    }
                Data >>= 8;
                }
            }
        }

    if (fUnsure)
        {
        dprintf("The correctness of RPC symbols could not be determined conclusively\n");
        }
    else
        {
        dprintf("RPC symbols are correct\n");
        }
}

typedef struct tagCallStackPatternMatch
{
    const char *FunctionBase;
    int ValueOffset;    // 0 if the value is not relative to this symbols, or
                        // any positive/negative if the value is relative to
                        // this symbol
} CallStackPatternMatch;

typedef struct tagStackGroupPattern
{
    CallStackPatternMatch *StackPattern;
    int NumberOfEntries;
} StackGroupPattern;

CallStackPatternMatch WS_CallStack1[] = {{"kernel32!WaitForSingleObjectEx", 0},
                                         {"rpcrt4!UTIL_WaitForSyncIO", 0},
                                         {"rpcrt4!WS_SyncRecv", 0},
                                         {"rpcrt4!WS_SyncRecv", 0},
                                         {"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
                                         {"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
                                         {"rpcrt4!OSF_CCALL__SendNextFragment", 0},
                                         {"rpcrt4!OSF_CCALL__FastSendReceive", 0},
                                         {"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
                                         {"rpcrt4!OSF_CCALL__SendReceive", 0},
                                         {"rpcrt4!I_RpcSendReceive", 0},
                                         {"rpcrt4!NdrSendReceive", sizeof(PVOID)}};

CallStackPatternMatch WS_CallStack2[] = {{"kernel32!WaitForSingleObjectEx", 0},
                                         {"rpcrt4!UTIL_WaitForSyncIO", 0},
                                         {"rpcrt4!UTIL_GetOverlappedResultEx", 0},
                                         {"rpcrt4!WS_SyncRecv", 0},
                                         {"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
                                         {"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
                                         {"rpcrt4!OSF_CCALL__SendNextFragment", 0},
                                         {"rpcrt4!OSF_CCALL__FastSendReceive", 0},
                                         {"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
                                         {"rpcrt4!OSF_CCALL__SendReceive", 0},
                                         {"rpcrt4!I_RpcSendReceive", 0},
                                         {"rpcrt4!NdrSendReceive", sizeof(PVOID)}};

CallStackPatternMatch NMP_CallStack1[] = {{"kernel32!WaitForSingleObjectEx", 0},
                                          {"rpcrt4!UTIL_WaitForSyncIO", 0},
                                          {"rpcrt4!UTIL_GetOverlappedResultEx", 0},
                                          {"rpcrt4!NMP_SyncSendRecv", 0},
                                          {"rpcrt4!OSF_CCONNECTION__TransSendReceive", 0},
                                          {"rpcrt4!OSF_CCONNECTION__SendFragment", 0},
                                          {"rpcrt4!OSF_CCALL__SendNextFragment", 0},
                                          {"rpcrt4!OSF_CCALL__FastSendReceive", 0},
                                          {"rpcrt4!OSF_CCALL__SendReceiveHelper", 0},
                                          {"rpcrt4!OSF_CCALL__SendReceive", 0},
                                          {"rpcrt4!I_RpcSendReceive", 0},
                                          {"rpcrt4!NdrSendReceive", sizeof(PVOID)}};

CallStackPatternMatch LRPC_CallStack1[] = {{"rpcrt4!LRPC_CCALL__SendReceive", 0},
                                           {"rpcrt4!I_RpcSendReceive", 0},
                                           {"rpcrt4!NdrSendReceive", sizeof(PVOID)}};

const int NumberOfWsCallStacks = 2;
StackGroupPattern WS_CallStacks[] = {{WS_CallStack1, 12}, {WS_CallStack2, 12}};

const int NumberOfNmpCallStacks = 1;
StackGroupPattern NMP_CallStacks[] = {{NMP_CallStack1, 12}};

const int NumberOfLrpcCallStacks = 1;
StackGroupPattern LRPC_CallStacks[] = {{LRPC_CallStack1, 3}};

BOOL VerboseStack = FALSE;


BOOL MatchStack(IN PVOID StackStart, IN StackGroupPattern *StackGroup,
                IN int NumberOfElementsInGroup, OUT ULONG_PTR *Value)
{
    int i;
    BOOL Result;
    ULONG_PTR CurrentPos;
    ULONG_PTR CurrentValue;
    ULONG_PTR Displacement;
    int StackPatternPos; // the next stack entry to match
    ULONG_PTR FinalValue = 0;
    int ValueOffset;
    CHAR CurrentName[256];

    for (i = 0; i < NumberOfElementsInGroup; i ++)
        {
        CurrentPos = (ULONG_PTR)StackStart;
        StackPatternPos = 0;
        while (TRUE)
            {
            Result = GetData(CurrentPos, &CurrentValue, sizeof(ULONG_PTR));
            if (Result == FALSE)
                goto NextStack;

            GetSymbol((ULONG64)CurrentValue, CurrentName, (PULONG64)&Displacement);
            if (RpcpStringCompareA((const char *)CurrentName, StackGroup[i].StackPattern[StackPatternPos].FunctionBase) == 0)
                {
                if (VerboseStack)
                    {
                    dprintf("Stack: %d: Match with '%s'\n", i, CurrentName);
                    }
                ValueOffset = StackGroup[i].StackPattern[StackPatternPos].ValueOffset;
                if (ValueOffset != 0)
                    {
                    Result = GetData(CurrentPos + ValueOffset, &FinalValue,
                        sizeof(ULONG_PTR));
                    if (Result == FALSE)
                        goto NextStack;
                    }
                StackPatternPos ++;
                if (StackPatternPos >= StackGroup[i].NumberOfEntries)
                    {
                    // full stack match - return success
                    ASSERT(FinalValue != 0);
                    *Value = FinalValue;
                    return TRUE;
                    }
                }

            CurrentPos += sizeof(ULONG_PTR);
            }
NextStack:
        ;
        }
    return FALSE;
}

BOOL GetDataFromRpcMessage(IN ULONG_PTR RpcMessage, OUT ULONG_PTR *CallObject,
                           OUT DWORD *IfStart, OUT USHORT *ProcNum)
{
    BOOL Result;
    union
        {
        RPC_MESSAGE RpcMessage;
        RPC_CLIENT_INTERFACE Interface;
        } MemLoc;
    ULONG_PTR Interface;

    Result = GetData(RpcMessage, (PVOID) &MemLoc.RpcMessage, sizeof(MemLoc.RpcMessage));
    if (Result == FALSE)
        return FALSE;
    *CallObject = (ULONG_PTR)MemLoc.RpcMessage.Handle;
    *ProcNum = (USHORT)MemLoc.RpcMessage.ProcNum;
    Interface = (ULONG_PTR)MemLoc.RpcMessage.RpcInterfaceInformation;
    Result = GetData(Interface, &MemLoc.Interface, sizeof(MemLoc.Interface));
    if (Result == FALSE)
        return FALSE;
    *IfStart = MemLoc.Interface.InterfaceId.SyntaxGUID.Data1;
    return TRUE;
}

BOOL PrintDceBinding(ULONG_PTR DceBindingPointer)
{
    NO_CONSTRUCTOR_TYPE(DCE_BINDING, DceBinding);
    RPC_CHAR *RpcProtocolSequence;
    RPC_CHAR *NetworkAddress;
    RPC_CHAR *Endpoint;
    BOOL Result;

    Result = GetData(DceBindingPointer, DceBinding, sizeof(DCE_BINDING));
    if (Result == FALSE)
        return FALSE;

    RpcProtocolSequence = ReadProcessRpcChar((ULONG64)DceBinding->RpcProtocolSequence);
    if (RpcProtocolSequence) {
        dprintf("\tProtocol Sequence: \t\"%ws\"\t(Address: %p)\n", RpcProtocolSequence, DceBinding->RpcProtocolSequence);
        delete RpcProtocolSequence;
    }

    NetworkAddress = ReadProcessRpcChar((ULONG64)DceBinding->NetworkAddress);
    if (NetworkAddress) {
        dprintf("\tNetworkAddress:\t\t\"%ws\"\t(Address: %p)\n", NetworkAddress, DceBinding->NetworkAddress);
        delete NetworkAddress;
    }

    Endpoint = ReadProcessRpcChar((ULONG64)DceBinding->Endpoint);
    if (Endpoint) {
        dprintf("\tEndpoint:\t\t\"%ws\" \t(Address: %p)\n", Endpoint, DceBinding->Endpoint);
        delete Endpoint;
    }

    if ((RpcProtocolSequence == NULL) && (NetworkAddress == NULL)
        && (Endpoint == NULL))
        {
        return FALSE;
        }

    return TRUE;
}

BOOL PrintOsfCallInfoFromRpcMessage(ULONG_PTR RpcMessage)
{
    ULONG_PTR CallObject;
    BOOL Result;
    NO_CONSTRUCTOR_TYPE(OSF_CCALL, OsfCCall);
    DWORD CallID;
    DWORD IfStart;
    USHORT ProcNum;
    ULONG_PTR ConnPointer;
    ULONG_PTR AssocPointer;
    ULONG_PTR DceBindingPointer;

    Result = GetDataFromRpcMessage(RpcMessage, &CallObject, &IfStart, &ProcNum);
    if (Result == FALSE)
        return FALSE;

    Result = GetData(CallObject, OsfCCall, sizeof(OSF_CCALL));
    if (Result == FALSE)
        return FALSE;

    CallID = OsfCCall->CallId;
    dprintf("CallID: %d\n", CallID);
    dprintf("IfStart: %x\n", IfStart);
    dprintf("ProcNum: %d\n", (int)ProcNum);

    ConnPointer = (ULONG_PTR)OsfCCall->Connection;
    // get the association pointer
    Result = GetData(ConnPointer + FIELD_OFFSET(OSF_CCONNECTION, Association), &AssocPointer,
        sizeof(ULONG_PTR));
    if (Result == FALSE)
        return FALSE;

    // get the dcebinding pointer
    Result = GetData(AssocPointer + FIELD_OFFSET(OSF_CASSOCIATION, DceBinding), &DceBindingPointer,
        sizeof(ULONG_PTR));
    if (Result == FALSE)
        return FALSE;

    // print the DCE binding info
    PrintDceBinding(DceBindingPointer);

    return TRUE;
}

BOOL PrintLrpcCallInfoFromRpcMessage(ULONG_PTR RpcMessage)
{
    ULONG_PTR CallObject;
    BOOL Result;
    NO_CONSTRUCTOR_TYPE(LRPC_CCALL, LrpcCCall);
    DWORD CallID;
    DWORD IfStart;
    USHORT ProcNum;
    ULONG_PTR AssocPointer;
    ULONG_PTR DceBindingPointer;

    Result = GetDataFromRpcMessage(RpcMessage, &CallObject, &IfStart, &ProcNum);
    if (Result == FALSE)
        return FALSE;

    Result = GetData(CallObject, LrpcCCall, sizeof(LRPC_CCALL));
    if (Result == FALSE)
        return FALSE;

    CallID = LrpcCCall->CallId;
    dprintf("CallID: %d\n", CallID);
    dprintf("IfStart: %x\n", IfStart);
    dprintf("ProcNum: %d\n", (int)ProcNum);

    AssocPointer = (ULONG_PTR)LrpcCCall->Association;

    // get the dcebinding pointer
    Result = GetData(AssocPointer + FIELD_OFFSET(LRPC_CASSOCIATION, DceBinding), &DceBindingPointer,
        sizeof(ULONG_PTR));
    if (Result == FALSE)
        return FALSE;

    // print the DCE binding info
    PrintDceBinding(DceBindingPointer);

    return TRUE;
}

DECLARE_API (rpcreadstack)
{
    PVOID StackStart;
    BOOL Result;
    ULONG_PTR Value;

    LPSTR lpArgumentString = (LPSTR)args;

    StackStart = (PVOID)GetExpression(lpArgumentString);

    // try to match the stack against the different types we support
    // first, try Winsock
    if (VerboseStack)
        {
        dprintf("Matching Winsock stacks\n");
        }
    Result = MatchStack(StackStart, WS_CallStacks, NumberOfWsCallStacks, &Value);
    if (Result == TRUE)
        {
        // call the Winsock stack analysis function
        PrintOsfCallInfoFromRpcMessage(Value);
        return;
        }

    // next, try Named pipes
    if (VerboseStack)
        {
        dprintf("Matching named pipe stacks\n");
        }
    Result = MatchStack(StackStart, NMP_CallStacks, NumberOfNmpCallStacks, &Value);
    if (Result == TRUE)
        {
        // call the named pipe stack analysis function
        PrintOsfCallInfoFromRpcMessage(Value);
        return;
        }

    // next, try LRPC
    if (VerboseStack)
        {
        dprintf("Matching LRPC stacks\n");
        }
    Result = MatchStack(StackStart, LRPC_CallStacks, NumberOfLrpcCallStacks, &Value);
    if (Result == TRUE)
        {
        // call the Lrpc stack analysis function
        PrintLrpcCallInfoFromRpcMessage(Value);
        return;
        }

    dprintf("Not found!\n");
}

DECLARE_API (rpcverbosestack)
{
    VerboseStack = !VerboseStack;
    if (VerboseStack)
        {
        dprintf("Switched to ON\n");
        }
    else
        {
        dprintf("Switched to OFF\n");
        }
}

VOID
do_eerecord(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp0;
    ULONG64 tmp1;
    ULONG tmp2;

    unsigned char Buf[sizeof(ExtendedErrorInfo) + sizeof(ExtendedErrorParam) * (MaxNumberOfEEInfoParams - 1)];
    ULONG64 EEInfoAddr;
    BOOL Result;
    int EEInfoSize;
    RPC_CHAR *ComputerNameStr;
    SYSTEMTIME SystemTime;
    int i;

    ULONG64 nLen;
    ULONG64 TimeStamp;
    ULONG64 ComputerName;
    ULONG64 Params;
    ULONG64 ParamType;
    ULONG64 ParamAddr;

    ULONG64 UnicodeStringAddr;
    ULONG64 AnsiStringAddr;
    ULONG64 BlobAddr;
    ULONG64 nLength;
    ULONG64 pString;
  
    char *AnsiBuf;
    RPC_CHAR *UnicodeBuf;

    dprintf("eerecord at 0x%I64x:\n", qwAddr);

    GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, nLen, nLen);
    GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, TimeStamp, TimeStamp);
    GET_ADDRESS_OF(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Params, Params, tmp2);

    GET_ADDRESS_OF(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, ComputerName, ComputerName, tmp2);
    GET_MEMBER(ComputerName, EEComputerName, RPCRT4!EEComputerName, Type, tmp1);
    if ((ULONG)tmp1 == eecnpPresent)
        {
        GET_ADDRESS_OF(ComputerName, EEComputerName, RPCRT4!EEComputerName, Name, tmp1, tmp2);
        GET_MEMBER(tmp1, EEUString, RPCRT4!EEUString, pString, tmp0);

        ComputerNameStr = ReadProcessRpcChar(tmp0);
        if (ComputerNameStr != NULL)
            {
            dprintf("Computer Name: %S\n", ComputerNameStr);
            delete ComputerNameStr;
            }
        }
    else
        {
        dprintf("Computer Name: (null)\n");
        }

    PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, ProcessID, tmp0);
    PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Status, tmp0);

    // BUG
    dprintf ("TimeStamp=%I64x\n", TimeStamp);
    Result = FileTimeToSystemTime((FILETIME *)&TimeStamp, &SystemTime);

    if (Result)
        {
        dprintf("System Time is: %d/%d/%d %d:%d:%d:%d\n",
            SystemTime.wMonth,
            SystemTime.wDay,
            SystemTime.wYear,
            SystemTime.wHour,
            SystemTime.wMinute,
            SystemTime.wSecond,
            SystemTime.wMilliseconds);
        }
    else
        {
        dprintf("Couldn't extract system time. Error is %d\n", GetLastError());
        }

    PRINT_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, GeneratingComponent, tmp0);
    PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Status, tmp0);
    PRINT_MEMBER_DECIMAL_AND_HEX(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, DetectionLocation, tmp0);
    GET_MEMBER(qwAddr, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Flags, tmp0);
    dprintf("Flags: %S %S\n",
        tmp0 & EEInfoPreviousRecordsMissing ? "Previous Record Missing" : "",
        tmp0 & EEInfoNextRecordsMissing ? "Next Record Missing" : "");

    dprintf("nLen = %d\n", (int)nLen);

    ParamAddr = Params;

    for (i = 0; i < (int)nLen; i++)
        {
        dprintf("Parameter %d:", i);

        GET_MEMBER(ParamAddr, tagParam, RPCRT4!tagParam, Type, ParamType);

        switch((ULONG)ParamType)
            {
            case eeptiAnsiString:

                dprintf("(Ansi string) : ");

                GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, AnsiString, AnsiStringAddr, tmp2);
                GET_MEMBER(AnsiStringAddr, tagEEAString, RPCRT4!tagEEAString, nLength, nLength);
                GET_MEMBER(AnsiStringAddr, tagEEAString, RPCRT4!tagEEAString, pString, pString);

                // we know the length - use GetData
                AnsiBuf = new char [(unsigned)nLength];
                if (AnsiBuf != NULL)
                    {
                    Result = GetData(pString,
                        AnsiBuf,
                        (ULONG)nLength);
                    if (Result)
                        {
                        dprintf("%s\n", AnsiBuf);
                        }
                    // else
                    // error info has already been printed - nothing to do
                    delete [] AnsiBuf;
                    }
                break;

            case eeptiUnicodeString:
  
                dprintf("(Unicode string) : ");

                GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, UnicodeString, UnicodeStringAddr, tmp2);
                GET_MEMBER(UnicodeStringAddr, tagEEAString, RPCRT4!tagEEAString, nLength, nLength);
                GET_MEMBER(UnicodeStringAddr, tagEEAString, RPCRT4!tagEEAString, pString, pString);

                // we know the length - use GetData
                UnicodeBuf = new RPC_CHAR [(unsigned)nLength];
                if (UnicodeBuf != NULL)
                    {
                    Result = GetData(pString,
                        UnicodeBuf,
                        (ULONG)(nLength * sizeof(RPC_CHAR)));
                    if (Result)
                        {
                        dprintf("%S\n", UnicodeBuf);
                        }
                    // else
                    // error info has already been printed - nothing to do
                    delete [] UnicodeBuf;
                    }
                break;

            case eeptiLongVal:
                PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, LVal, tmp0);
                break;

            case eeptiShortVal:
                PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, IVal, tmp0);
                break;

            case eeptiPointerVal:
                PRINT_MEMBER_DECIMAL_AND_HEX(ParamAddr, tagParam, RPCRT4!tagParam, PVal, tmp0);
                break;

            case eeptiNone:
                dprintf("(Truncated value)\n");
                break;

            case eeptiBinary:
                dprintf("(Binary value:)\n");
                GET_ADDRESS_OF(ParamAddr, tagParam, RPCRT4!tagParam, Blob, BlobAddr, tmp2);
                PRINT_MEMBER_DECIMAL_AND_HEX(BlobAddr, tagBinaryEEInfo, RPCRT4!tagBinaryEEInfo, nSize, tmp0);
                PRINT_MEMBER_DECIMAL_AND_HEX(BlobAddr, tagBinaryEEInfo, RPCRT4!tagBinaryEEInfo, pBlob, tmp0);
                break;

            default:
                dprintf("Invalid type: %d\n", (ULONG)ParamType);
            }

        ParamAddr += GET_TYPE_SIZE(tagParam, RPCRT4!tagParam);
        }
}

VOID
do_eeinfo(
    ULONG64 qwAddr
    )
{
    ULONG64 PrevNextElement = qwAddr;
    ULONG64 NextElement = qwAddr;
    ULONG64 FirstElement = qwAddr;
    BOOL Result;

    do
        {
        do_eerecord(NextElement);

        PrevNextElement = NextElement; 
        GET_MEMBER(NextElement, ExtendedErrorInfo, RPCRT4!ExtendedErrorInfo, Next, NextElement);
 
        // prevent loops
        if (NextElement == FirstElement)
            {
            dprintf("Loop detected - exitting ...\n");
            return;
            }
        dprintf("------------------------\n");
        }
    while(NextElement != 0 && PrevNextElement != NextElement);
}

VOID PrintTypeinfoUsage(VOID) {
    dprintf("Wrong arguments to !rpcexts.typeinfo\n");
    dprintf("Please use !rpcexts.typeinfo on|off\n");
}

DECLARE_API (typeinfo)
{
    LPSTR lpArgumentString = (LPSTR)args;

    if (strcmp(lpArgumentString, "on") == 0)
        fUseTypeInfo = TRUE;
    else if (strcmp(lpArgumentString, "off") == 0)
        fUseTypeInfo = FALSE;
    else if (strcmp(lpArgumentString, "") == 0)
        {
        if (fUseTypeInfo == TRUE)
            dprintf ("typeinfo use is on\n");
        else
            dprintf ("typeinfo use is off\n");
        }
    else
        PrintTypeinfoUsage();

    return;
}


VOID PrintStackMatchUsage(VOID) {
    dprintf("Wrong arguments to !rpcexts.stackmatch");
    dprintf("Please use !rpcexts.stackmatch start_addr [depth]\n");
}


DECLARE_API( stackmatch )
{
    static ULONG64 Start;
    static ULONG Depth = 0x80;

    CHAR Symbol[128];
    ULONG64 Displacement = 0;
    CHAR ObjSymbol[128];
    ULONG64 ObjDisplacement = 0;

    //
    // Interpret options.
    //
    ULONG ProcessID = 0;
    int ArgumentNo = 0;
    DebugCellID CellID;
    char *DotSeparator;

    //
    // Interpret options.
    //
    char * arg;

    LPSTR lpArgumentString = (LPSTR)args;

    for (arg=strtok(lpArgumentString); arg; arg = strtok(0))
        {
        switch(ArgumentNo)
            {
            case 0:
                Start = GetExpression(arg);
                break;

            case 1:
                Depth = (ULONG) GetExpression(arg);
                break;

            default:
                dprintf("Too many arguments\n");
                PrintStackMatchUsage();

            }
        ArgumentNo ++;
        }

    for (ULONG64 Addr=Start; Addr<=Start+Depth; Addr+=AddressSize) {
        ULONG64 Val;
        ReadPtrUnextend(Addr, &Val);
        dprintf("%I64p  %I64p", Addr, Val);

        GetSymbol(Val, Symbol, &Displacement);
        if (strcmp(Symbol, "") != 0)
            dprintf(" %s+%x", Symbol, Displacement);
        else {
            ULONG64 Obj;
            ReadPtrUnextend(Val, &Obj);

            if (Obj) {
                dprintf(" -> %I64p", Obj);
                GetSymbol(Obj, ObjSymbol, &ObjDisplacement);
                if (strcmp(ObjSymbol, "") != 0)
                    dprintf(" %s+%x", ObjSymbol, ObjDisplacement);
            }
        }

        dprintf("\n");
    }

    Start = Addr;
}

DECLARE_API( listcalls )
{
    ULONG64 qwAddr;
    BOOL fArgSpecified = FALSE;
    ULONG64 ServerAddress;

    LPSTR lpArgumentString = (LPSTR)args;

    if (0 == strtok(lpArgumentString))
        {
        lpArgumentString = "rpcrt4!GlobalRpcServer";
        fArgSpecified = TRUE;
        }

    qwAddr = GetExpression(lpArgumentString);

    if ( !qwAddr )
        {
        dprintf("Error: can't evaluate '%s'\n", lpArgumentString);
        return;
        }

    if (fArgSpecified)
        {
        if (ReadPtrUnextend(qwAddr, &ServerAddress))
            {
            dprintf("couldn't read memory at address 0x%I64x\n", qwAddr);
            return;
            }
        }
    else
        ServerAddress = qwAddr;

    do_listcalls(ServerAddress);
}

VOID LoopThroughDict(ULONG64 Dict, PCHAR offset) {
    ULONG64 tmp0;
    ULONG64 tmp1;
    ULONG tmp2;

    ULONG64 cDictSize;
    ULONG64 cDictSlots;
    ULONG64 DictSlots;
    int j;
    ULONG64 DictSlot;

    GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSize, cDictSize);
    GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, cDictSlots, cDictSlots);

    if ((ULONG)cDictSize > (ULONG)cDictSlots)
        {
        dprintf("Bad dictionary\t\t- %I64p\n", Dict);
        return;
        }

    GET_MEMBER(Dict, SIMPLE_DICT, RPCRT4!SIMPLE_DICT, DictSlots, DictSlots);

    dprintf("%sPrinting %d items in dictionary: %I64p with %d slots\n\n", offset, (ULONG)cDictSize, Dict, (ULONG)cDictSlots);

    // Loop throught the associations.
    for (j = 0; j < MIN((int)cDictSize, MAX_ITEMS_IN_DICTIONARY); j++)
        {
        if (!ReadPtrUnextend(DictSlots + j * AddressSize, &DictSlot))
            dprintf ("%s(%d): 0x%I64x - ", offset, j, DictSlot);

        ULONG64 MagicValue;
        ULONG64 ObjectType;
        ULONG64 LocalDict;

        if (ReadPtrUnextend(DictSlot+AddressSize, &MagicValue) ||
            ReadPtrUnextend(DictSlot+AddressSize+4, &ObjectType)) {
            dprintf("Bad or deleted object at %p\n", DictSlot);
            return;
	}

        if ((ULONG)MagicValue != MAGICLONG)
            {
            dprintf("Bad or deleted object at %p\n", DictSlot);
            return;
            }

        switch (((ULONG)ObjectType) & (~OBJECT_DELETED))
            {
            case DG_ADDRESS_TYPE:
                dprintf("DG_ADDRESS\n");
                break;

            case OSF_ADDRESS_TYPE:
                dprintf("OSF_ADDRESS\n");

                GET_ADDRESS_OF(DictSlot, OSF_ADDRESS, RPCRT4!OSF_ADDRESS, Associations, LocalDict, tmp2);

                LoopThroughDict(LocalDict, "\t\t");

                break;

            case LRPC_ADDRESS_TYPE:
                dprintf("LRPC_ADDRESS\n");

                GET_ADDRESS_OF(DictSlot, LRPC_ADDRESS, RPCRT4!LRPC_ADDRESS, AssociationDictionary, LocalDict, tmp2);

                LoopThroughDict(LocalDict, "\t\t");

                break;

            case OSF_ASSOCIATION_TYPE:
                dprintf("OSF_ASSOCIATION_TYPE\n");

                break;

            case LRPC_SASSOCIATION_TYPE:
                dprintf("LRPC_SASSOCIATION_TYPE\n");

                break;

            default:
                dprintf("The RPC object type is 0x%lx and I don't recognize it.\n", (ObjectType) & ~(OBJECT_DELETED));
            }    
        }
}

VOID
do_listcalls(
    ULONG64 qwAddr
    )
{
    ULONG64 tmp0;
    ULONG64 tmp1;
    ULONG tmp2;

    dprintf("\n");

    dprintf("RPC_SERVER at 0x%I64x\n", qwAddr);

    ULONG64 RpcAddressDictionary;
    GET_ADDRESS_OF(qwAddr, RPC_SERVER, RPCRT4!RPC_SERVER, RpcAddressDictionary, RpcAddressDictionary, tmp2);
    dprintf("&RpcAddressDictionary(RPC_SIMPLE_DICT) - 0x%I64x\n", RpcAddressDictionary);

    LoopThroughDict(RpcAddressDictionary, "\t");

    dprintf("\n");
}

DECLARE_API( rpcverifier )
{
    ULONG64 qwAddr;
    ULONG64 tmp1;

    dprintf("\n");

    dprintf("gfAppVerifierEnabled = %d\n", GetVar("rpcrt4!gfAppVerifierEnabled"));
    dprintf("gfRPCVerifierEnabled = %d\n\n", GetVar("rpcrt4!gfRPCVerifierEnabled"));

    if (!((BOOL)GetVar("rpcrt4!gfRPCVerifierEnabled")))return;

    qwAddr = GetVar("rpcrt4!pRpcVerifierSettings");

    dprintf("RpcVerifierFlags = 0x%x\n\n", GetVar("rpcrt4!RpcVerifierFlags"));
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, fFaultInjectImpersonateClient, "FaultInjectImpersonateClient", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, ProbFaultInjectImpersonateClient, "ProbFaultInjectImpersonateClient", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, DelayFaultInjectImpersonateClient, "DelayFaultInjectImpersonateClient", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, fCorruptionInjectServerReceives, "CorruptionInjectServerReceives", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, fCorruptionInjectClientReceives, "CorruptionInjectClientReceives", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, ProbRpcHeaderCorruption, "ProbRpcHeaderCorruption", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, ProbDataCorruption, "ProbDataCorruption", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, ProbSecureDataCorruption, "ProbSecureDataCorruption", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, CorruptionPattern, "CorruptionPattern", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, CorruptionSizeType, "CorruptionSizeType", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, CorruptionSize, "CorruptionSize", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, CorruptionDistributionType, "CorruptionDistributionType", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, ProbBufferTruncation, "ProbBufferTruncation", tmp1);
    PRINT_MEMBER_WITH_LABEL(qwAddr, tRpcVerifierSettings, RPCRT4!tRpcVerifierSettings, MaxBufferTruncationSize, "MaxBufferTruncationSize", tmp1);
    dprintf("\n");
}