what does a DCOM message look like?

John Farrell

unread,

Mar 26, 1997, 3:00:00 AM3/26/97

to

Hi world, I am trying to monitor DCOM network activity. I know that COM
and
DCOM use Windows messages for transport into processes, but I can't
figure
out which messages are the ones. I noticed under Win95 there is a
registered
message call "Ole Rpc notify message", but I can't see it happen under
NT4.
I would very much appreciate some hints on this, and a pointer to an MSJ
article or something would be LOVELY. Thanks very much,

John
--
http://www.geocities.com/Athens/6763 <-- Click here to begin!
http://www.geocities.com/Heartland/8588 <-- Click here for pictures of
Harley!
http://www.geocities.com/Colosseum/Field/1525 <-- Cricket and Java
stuff!
mailto:frien...@geocities.com mailto:frien...@usa.net

Gopal Kumar

unread,

Mar 28, 1997, 3:00:00 AM3/28/97

to

These are the windows that handle the messages under NT4.0

"OleMainThreadWndClass", - Window Class Name
"OleMainThreadWndName"; - Window Title Name
-Kumar

John Farrell <frien...@usa.net> wrote in article
<333871...@usa.net>...

Michael Nelson

unread,

Mar 29, 1997, 3:00:00 AM3/29/97

to

In the free-threaded model, Windows messages aren't used at all by
COM/DCOM. In the single-threaded and apartment model, window messages are
only used for notification purposes, AFAIK, they are not used to transport
data.

-mike

Gopal Kumar (ku...@siebel.com) wrote:
: These are the windows that handle the messages under NT4.0

John Farrell

unread,

Apr 1, 1997, 3:00:00 AM4/1/97

to

Michael Nelson wrote:
> In the free-threaded model, Windows messages aren't used at all by
> COM/DCOM. In the single-threaded and apartment model, window messages are
> only used for notification purposes, AFAIK, they are not used to transport
> data.

Urk, this throws a spanner in the works. Well I guess the
OleRpcNotifyMessage
I saw must have been single-threaded or apartment model, and on NT the
servers
use free-threading. In any case, I would definitely like to see the DCOM
communication regardless of the threading model. So if it's not done
with
Windows messages, how is it done? Direct calls to an entry point in the
other
process's thread or something? Is there any way to observe this at all?
Thanks for any help, responses so far have been great!

John
--
http://www.geocities.com/Athens/6763 <-- Click here to begin!
http://www.geocities.com/Heartland/8588 <-- Click here for pictures of
Harley!
http://www.geocities.com/Colosseum/Field/1525 <-- Cricket and Java
stuff!
mailto:frien...@geocities.com mailto:frien...@usa.net

mailto:jfar...@jarrah.com.au mailto:jfar...@openenv.com.au

Richard Grimes

unread,

Apr 8, 1997, 3:00:00 AM4/8/97

to

Michael Nelson wrote:
>
> In the free-threaded model, Windows messages aren't used at all by
> COM/DCOM. In the single-threaded and apartment model, window messages are
> only used for notification purposes, AFAIK, they are not used to transport
> data.
>

> -mike

The windows messages sent to an apartment model server does have data. I
haven't the results at hand, but basically I have written a simple
server that implements a windows message queue (used by COM to serialize
the calls) and printed out the messages received. What happens is that
all the message have the ID of WM_USER + 0x14a, the wparam is 0xbabe and
the lparam is a pointer to to process's memory. This is a block that
contains information about the request. The second WORD of this block
appears to be the length. This is for an EXE run on the same machine as
the client.

If you try the same test on a DCOM remote EXE server, you find that most
of the DCOM calls are WM_USER + 0x14a, but some (the interface method
calls for example) are WM_USER and the buffer length is passed in
wparam.

If you do a dump of these buffers you can get the information passed by
DCOM concerning the interface that is required, a stream used to marshal
the interface information and parameters passed to the methods.

[shameless plug start]
This is covered in Chapter 6 of my book "Professional DCOM Programming"
due to be published by Wrox Press in early May (see http://www.wrox.com)
[shameless plug end]

Richard

--
My opinions, not my employers.
Dr Richard Grimes MSCE Tel: 01203 514471
Parallax Solutions Ltd. Fax: 01203 514401
Stonecourt, Siskin Drive, email: gri...@parallax.co.uk
Coventry, UK r...@grimes.demon.co.uk