RSetServiceStatus:
[reactos.git] / reactos / base / system / services / rpcserver.c
index ef82f0b..b0030dc 100644 (file)
@@ -1,5 +1,11 @@
 /*
-
+ * PROJECT:     ReactOS Service Control Manager
+ * LICENSE:     GPL - See COPYING in the top level directory
+ * FILE:        base/system/services/rpcserver.c
+ * PURPOSE:     RPC server interface for the advapi32 calls
+ * COPYRIGHT:   Copyright 2005-2006 Eric Kohl
+ *              Copyright 2006-2007 HervĂ© Poussineau <hpoussin@reactos.org>
+ *              Copyright 2007 Ged Murphy <gedmurphy@reactos.org>
  */
 
 /* INCLUDES ****************************************************************/
@@ -10,7 +16,6 @@
 #define NDEBUG
 #include <debug.h>
 
-
 /* GLOBALS *****************************************************************/
 
 #define MANAGER_TAG 0x72674D68  /* 'hMgr' */
@@ -105,7 +110,7 @@ ScmStartRpcServer(VOID)
 {
     RPC_STATUS Status;
 
-    DPRINT("ScmStartRpcServer() called");
+    DPRINT("ScmStartRpcServer() called\n");
 
     Status = RpcServerUseProtseqEpW(L"ncacn_np",
                                     10,
@@ -117,7 +122,7 @@ ScmStartRpcServer(VOID)
         return;
     }
 
-    Status = RpcServerRegisterIf(svcctl_ServerIfHandle,
+    Status = RpcServerRegisterIf(svcctl_v2_0_s_ifspec,
                                  NULL,
                                  NULL);
     if (Status != RPC_S_OK)
@@ -133,7 +138,7 @@ ScmStartRpcServer(VOID)
         return;
     }
 
-    DPRINT("ScmStartRpcServer() done");
+    DPRINT("ScmStartRpcServer() done\n");
 }
 
 
@@ -146,9 +151,20 @@ ScmCreateManagerHandle(LPWSTR lpDatabaseName,
     if (lpDatabaseName == NULL)
         lpDatabaseName = SERVICES_ACTIVE_DATABASEW;
 
+    if (wcsicmp(lpDatabaseName,SERVICES_FAILED_DATABASEW)==0)
+    {
+        DPRINT1("Database %S, does not exist\n",lpDatabaseName);
+        return ERROR_DATABASE_DOES_NOT_EXIST;
+    }
+    else if (wcsicmp(lpDatabaseName, SERVICES_ACTIVE_DATABASEW) != 0)
+    {
+        DPRINT1("Invalid Database name %S.\n",lpDatabaseName);
+        return ERROR_INVALID_NAME;
+    }
+
     Ptr = (MANAGER_HANDLE*) HeapAlloc(GetProcessHeap(),
                     HEAP_ZERO_MEMORY,
-                    sizeof(MANAGER_HANDLE) + wcslen(lpDatabaseName) * sizeof(WCHAR));
+                    sizeof(MANAGER_HANDLE) + (wcslen(lpDatabaseName) + 1) * sizeof(WCHAR));
     if (Ptr == NULL)
         return ERROR_NOT_ENOUGH_MEMORY;
 
@@ -229,21 +245,181 @@ ScmAssignNewTag(PSERVICE lpService)
 }
 
 
+/* Internal recursive function */
+/* Need to search for every dependency on every service */
+static DWORD
+Int_EnumDependentServicesW(HKEY hServicesKey,
+                           PSERVICE lpService,
+                           DWORD dwServiceState,
+                           PSERVICE *lpServices,
+                           LPDWORD pcbBytesNeeded,
+                           LPDWORD lpServicesReturned)
+{
+    DWORD dwError = ERROR_SUCCESS;
+    WCHAR szNameBuf[MAX_PATH];
+    WCHAR szValueBuf[MAX_PATH];
+    WCHAR *lpszNameBuf = szNameBuf;
+    WCHAR *lpszValueBuf = szValueBuf;
+    DWORD dwSize;
+    DWORD dwNumSubKeys;
+    DWORD dwIteration;
+    PSERVICE lpCurrentService;
+    HKEY hServiceEnumKey;
+    DWORD dwCurrentServiceState = SERVICE_ACTIVE;
+    DWORD dwDependServiceStrPtr = 0;
+    DWORD dwRequiredSize = 0;
+
+    /* Get the number of service keys */
+    dwError = RegQueryInfoKeyW(hServicesKey,
+                               NULL,
+                               NULL,
+                               NULL,
+                               &dwNumSubKeys,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NULL,
+                               NULL);
+    if (dwError != ERROR_SUCCESS)
+    {
+        DPRINT1("ERROR! Unable to get number of services keys.\n");
+        return dwError;
+    }
+
+    /* Iterate the service keys to see if another service depends on the this service */
+    for (dwIteration = 0; dwIteration < dwNumSubKeys; dwIteration++)
+    {
+        dwSize = MAX_PATH;
+        dwError = RegEnumKeyExW(hServicesKey,
+                                dwIteration,
+                                lpszNameBuf,
+                                &dwSize,
+                                NULL,
+                                NULL,
+                                NULL,
+                                NULL);
+        if (dwError != ERROR_SUCCESS)
+            return dwError;
+
+        /* Open the Service key */
+        dwError = RegOpenKeyExW(hServicesKey,
+                                lpszNameBuf,
+                                0,
+                                KEY_READ,
+                                &hServiceEnumKey);
+        if (dwError != ERROR_SUCCESS)
+            return dwError;
+
+        dwSize = MAX_PATH;
+
+        /* Check for the DependOnService Value */
+        dwError = RegQueryValueExW(hServiceEnumKey,
+                                   L"DependOnService",
+                                   NULL,
+                                   NULL,
+                                   (LPBYTE)lpszValueBuf,
+                                   &dwSize);
+
+        /* FIXME: Handle load order. */
+
+        /* If the service found has a DependOnService value */
+        if (dwError == ERROR_SUCCESS)
+        {
+            dwDependServiceStrPtr = 0;
+
+            /* Can be more than one Dependencies in the DependOnService string */
+            while (wcslen(lpszValueBuf + dwDependServiceStrPtr) > 0)
+            {
+                if (wcsicmp(lpszValueBuf + dwDependServiceStrPtr, lpService->lpServiceName) == 0)
+                {
+                    /* Get the current enumed service pointer */
+                    lpCurrentService = ScmGetServiceEntryByName(lpszNameBuf);
+
+                    /* Check for valid Service */
+                    if (!lpCurrentService)
+                    {
+                        /* This should never happen! */
+                        DPRINT1("This should not happen at this point, report to Developer\n");
+                        return ERROR_NOT_FOUND;
+                    }
+
+                    /* Determine state the service is in */
+                    if (lpCurrentService->Status.dwCurrentState == SERVICE_STOPPED)
+                        dwCurrentServiceState = SERVICE_INACTIVE;
+
+                    /* If the ServiceState matches that requested or searching for SERVICE_STATE_ALL */
+                    if ((dwCurrentServiceState == dwServiceState) ||
+                        (dwServiceState == SERVICE_STATE_ALL))
+                    {
+                        /* Calculate the required size */
+                        dwRequiredSize += sizeof(SERVICE_STATUS);
+                        dwRequiredSize += ((wcslen(lpCurrentService->lpServiceName) + 1) * sizeof(WCHAR));
+                        dwRequiredSize += ((wcslen(lpCurrentService->lpDisplayName) + 1) * sizeof(WCHAR));
+
+                        /* Add the size for service name and display name pointers */
+                        dwRequiredSize += (2 * sizeof(PVOID));
+
+                        /* increase the BytesNeeded size */
+                        *pcbBytesNeeded = *pcbBytesNeeded + dwRequiredSize;
+
+                        /* Don't fill callers buffer yet, as MSDN read that the last service with dependency
+                           comes first */
+
+                        /* Recursive call to check for its dependencies */
+                        Int_EnumDependentServicesW(hServicesKey,
+                                                   lpCurrentService,
+                                                   dwServiceState,
+                                                   lpServices,
+                                                   pcbBytesNeeded,
+                                                   lpServicesReturned);
+
+                        /* If the lpServices is valid set the service pointer */
+                        if (lpServices)
+                            lpServices[*lpServicesReturned] = lpCurrentService;
+
+                        *lpServicesReturned = *lpServicesReturned + 1;
+                    }
+                }
+
+                dwDependServiceStrPtr += (wcslen(lpszValueBuf + dwDependServiceStrPtr) + 1);
+            }
+        }
+        else if (*pcbBytesNeeded)
+        {
+            dwError = ERROR_SUCCESS;
+        }
+
+        RegCloseKey(hServiceEnumKey);
+    }
+
+    return dwError;
+}
+
+
 /* Function 0 */
-unsigned long
-ScmrCloseServiceHandle(handle_t BindingHandle,
-                       unsigned int hScObject)
+DWORD RCloseServiceHandle(
+    handle_t BindingHandle,
+    LPSC_RPC_HANDLE hSCObject)
 {
     PMANAGER_HANDLE hManager;
+    PSERVICE_HANDLE hService;
+    PSERVICE lpService;
+    HKEY hServicesKey;
+    DWORD dwError;
+    DWORD pcbBytesNeeded = 0;
+    DWORD dwServicesReturned = 0;
 
-    DPRINT("ScmrCloseServiceHandle() called\n");
+    DPRINT("RCloseServiceHandle() called\n");
 
-    DPRINT("hScObject = %X\n", hScObject);
+    DPRINT("hSCObject = %p\n", *hSCObject);
 
-    if (hScObject == 0)
+    if (*hSCObject == 0)
         return ERROR_INVALID_HANDLE;
 
-    hManager = (PMANAGER_HANDLE)hScObject;
+    hManager = (PMANAGER_HANDLE)*hSCObject;
+    hService = (PSERVICE_HANDLE)*hSCObject;
     if (hManager->Handle.Tag == MANAGER_TAG)
     {
         DPRINT("Found manager handle\n");
@@ -251,27 +427,94 @@ ScmrCloseServiceHandle(handle_t BindingHandle,
         hManager->Handle.RefCount--;
         if (hManager->Handle.RefCount == 0)
         {
-            /* FIXME: add cleanup code */
+            /* FIXME: add handle cleanup code */
 
             HeapFree(GetProcessHeap(), 0, hManager);
+            hManager = NULL;
         }
 
-        DPRINT("ScmrCloseServiceHandle() done\n");
+        DPRINT("RCloseServiceHandle() done\n");
         return ERROR_SUCCESS;
     }
-    else if (hManager->Handle.Tag == SERVICE_TAG)
+    else if (hService->Handle.Tag == SERVICE_TAG)
     {
         DPRINT("Found service handle\n");
 
-        hManager->Handle.RefCount--;
-        if (hManager->Handle.RefCount == 0)
+        /* Get the pointer to the service record */
+        lpService = hService->ServiceEntry;
+
+        ASSERT(hService->Handle.RefCount > 0);
+
+        hService->Handle.RefCount--;
+        if (hService->Handle.RefCount == 0)
         {
-            /* FIXME: add cleanup code */
+            /* FIXME: add handle cleanup code */
 
-            HeapFree(GetProcessHeap(), 0, hManager);
+            /* Free the handle */
+            HeapFree(GetProcessHeap(), 0, hService);
+            hService = NULL;
+        }
+
+        ASSERT(lpService->dwRefCount > 0);
+
+        lpService->dwRefCount--;
+        DPRINT("CloseServiceHandle - lpService->dwRefCount %u\n",
+               lpService->dwRefCount);
+
+        if (lpService->dwRefCount == 0)
+        {
+            /* If this service has been marked for deletion */
+            if (lpService->bDeleted)
+            {
+                /* Open the Services Reg key */
+                dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
+                                        L"System\\CurrentControlSet\\Services",
+                                        0,
+                                        KEY_SET_VALUE | KEY_READ,
+                                        &hServicesKey);
+                if (dwError != ERROR_SUCCESS)
+                {
+                    DPRINT1("Failed to open services key\n");
+                    return dwError;
+                }
+
+                /* Call the internal function with NULL, just to get bytes we need */
+                Int_EnumDependentServicesW(hServicesKey,
+                                           lpService,
+                                           SERVICE_ACTIVE,
+                                           NULL,
+                                           &pcbBytesNeeded,
+                                           &dwServicesReturned);
+
+                /* if pcbBytesNeeded returned a value then there are services running that are dependent on this service*/
+                if (pcbBytesNeeded)
+                {
+                    DPRINT1("Deletion failed due to running dependencies.\n");
+                    RegCloseKey(hServicesKey);
+                    return ERROR_SUCCESS;
+                }
+
+                /* There are no references and no runnning dependencies,
+                   it is now safe to delete the service */
+
+                /* Delete the Service Key */
+                dwError = RegDeleteKey(hServicesKey,
+                                       lpService->lpServiceName);
+
+                RegCloseKey(hServicesKey);
+
+                if (dwError != ERROR_SUCCESS)
+                {
+                    DPRINT1("Failed to Delete the Service Registry key\n");
+                    return dwError;
+                }
+
+                /* Delete the Service */
+                ScmDeleteServiceRecord(lpService);
+            }
         }
 
-        DPRINT("ScmrCloseServiceHandle() done\n");
+        DPRINT("RCloseServiceHandle() done\n");
         return ERROR_SUCCESS;
     }
 
@@ -282,30 +525,41 @@ ScmrCloseServiceHandle(handle_t BindingHandle,
 
 
 /* Function 1 */
-unsigned long
-ScmrControlService(handle_t BindingHandle,
-                   unsigned int hService,
-                   unsigned long dwControl,
-                   LPSERVICE_STATUS lpServiceStatus)
+DWORD RControlService(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwControl,
+    LPSERVICE_STATUS lpServiceStatus)
 {
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService;
     ACCESS_MASK DesiredAccess;
     DWORD dwError = ERROR_SUCCESS;
+    DWORD pcbBytesNeeded = 0;
+    DWORD dwServicesReturned = 0;
+    HKEY hServicesKey = NULL;
 
-    DPRINT("ScmrControlService() called\n");
+    DPRINT("RControlService() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     /* Check the service handle */
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
     }
 
+    /* Check the service entry point */
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n"); 
+        return ERROR_INVALID_HANDLE;
+    }
+
     /* Check access rights */
     switch (dwControl)
     {
@@ -338,12 +592,40 @@ ScmrControlService(handle_t BindingHandle,
                                   DesiredAccess))
         return ERROR_ACCESS_DENIED;
 
-    /* Check the service entry point */
-    lpService = hSvc->ServiceEntry;
-    if (lpService == NULL)
+    if (dwControl == SERVICE_CONTROL_STOP)
     {
-        DPRINT1("lpService == NULL!\n");
-        return ERROR_INVALID_HANDLE;
+        /* Check if the service has dependencies running as windows
+           doesn't stop a service that does */
+
+        /* Open the Services Reg key */
+        dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
+                                L"System\\CurrentControlSet\\Services",
+                                0,
+                                KEY_READ,
+                                &hServicesKey);
+        if (dwError != ERROR_SUCCESS)
+        {
+            DPRINT1("Failed to open services key\n");
+            return dwError;
+        }
+
+        /* Call the internal function with NULL, just to get bytes we need */
+        Int_EnumDependentServicesW(hServicesKey,
+                                   lpService,
+                                   SERVICE_ACTIVE,
+                                   NULL,
+                                   &pcbBytesNeeded,
+                                   &dwServicesReturned);
+
+        RegCloseKey(hServicesKey);
+
+        /* If pcbBytesNeeded is not zero then there are services running that
+           are dependent on this service */
+        if (pcbBytesNeeded != 0)
+        {
+            DPRINT("Service has running dependencies. Failed to stop service.\n");
+            return ERROR_DEPENDENT_SERVICES_RUNNING;
+        }
     }
 
     if (lpService->Status.dwServiceType & SERVICE_DRIVER)
@@ -361,6 +643,9 @@ ScmrControlService(handle_t BindingHandle,
                                     lpServiceStatus);
     }
 
+    if ((dwError == ERROR_SUCCESS) && (pcbBytesNeeded))
+        dwError = ERROR_DEPENDENT_SERVICES_RUNNING;
+
     /* Return service status information */
     RtlCopyMemory(lpServiceStatus,
                   &lpService->Status,
@@ -371,25 +656,25 @@ ScmrControlService(handle_t BindingHandle,
 
 
 /* Function 2 */
-unsigned long
-ScmrDeleteService(handle_t BindingHandle,
-                  unsigned int hService)
+DWORD RDeleteService(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService)
 {
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService;
     DWORD dwError;
 
-    DPRINT("ScmrDeleteService() called\n");
+    DPRINT("RDeleteService() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
         return ERROR_INVALID_HANDLE;
 
     if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
-                                  STANDARD_RIGHTS_REQUIRED))
+                                  DELETE))
         return ERROR_ACCESS_DENIED;
 
     lpService = hSvc->ServiceEntry;
@@ -414,26 +699,26 @@ ScmrDeleteService(handle_t BindingHandle,
 
     /* FIXME: Release service database lock */
 
-    DPRINT("ScmrDeleteService() done\n");
+    DPRINT("RDeleteService() done\n");
 
     return dwError;
 }
 
 
 /* Function 3 */
-unsigned long
-ScmrLockServiceDatabase(handle_t BindingHandle,
-                        unsigned int hSCManager,
-                        unsigned int *hLock)
+DWORD RLockServiceDatabase(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPSC_RPC_LOCK lpLock)
 {
     PMANAGER_HANDLE hMgr;
 
-    DPRINT("ScmrLockServiceDatabase() called\n");
+    DPRINT("RLockServiceDatabase() called\n");
 
-    *hLock = 0;
+    *lpLock = 0;
 
     hMgr = (PMANAGER_HANDLE)hSCManager;
-    if (hMgr->Handle.Tag != MANAGER_TAG)
+    if (!hMgr || hMgr->Handle.Tag != MANAGER_TAG)
         return ERROR_INVALID_HANDLE;
 
     if (!RtlAreAllAccessesGranted(hMgr->Handle.DesiredAccess,
@@ -443,20 +728,20 @@ ScmrLockServiceDatabase(handle_t BindingHandle,
 //    return ScmLockDatabase(0, hMgr->0xC, hLock);
 
     /* FIXME: Lock the database */
-    *hLock = 0x12345678; /* Dummy! */
+    *lpLock = (void *)0x12345678; /* Dummy! */
 
     return ERROR_SUCCESS;
 }
 
 
 /* Function 4 */
-unsigned long
-ScmrQueryServiceObjectSecurity(handle_t BindingHandle,
-                               unsigned int hService,
-                               unsigned long dwSecurityInformation,
-                               unsigned char *lpSecurityDescriptor,
-                               unsigned long dwSecuityDescriptorSize,
-                               unsigned long *pcbBytesNeeded)
+DWORD RQueryServiceObjectSecurity(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    SECURITY_INFORMATION dwSecurityInformation,
+    LPBYTE lpSecurityDescriptor,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded)
 {
 #if 0
     PSERVICE_HANDLE hSvc;
@@ -466,10 +751,10 @@ ScmrQueryServiceObjectSecurity(handle_t BindingHandle,
     DWORD dwBytesNeeded;
     DWORD dwError;
 
-    DPRINT("ScmrQueryServiceObjectSecurity() called\n");
+    DPRINT("RQueryServiceObjectSecurity() called\n");
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -528,18 +813,18 @@ ScmrQueryServiceObjectSecurity(handle_t BindingHandle,
 
     return dwError;
 #endif
-    DPRINT1("ScmrQueryServiceObjectSecurity() is unimplemented\n");
+    UNIMPLEMENTED;
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
 
 /* Function 5 */
-unsigned long
-ScmrSetServiceObjectSecurity(handle_t BindingHandle,
-                             unsigned int hService,
-                             unsigned long dwSecurityInformation,
-                             unsigned char *lpSecurityDescriptor,
-                             unsigned long dwSecuityDescriptorSize)
+DWORD RSetServiceObjectSecurity(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwSecurityInformation,
+    LPBYTE lpSecurityDescriptor,
+    DWORD dwSecuityDescriptorSize)
 {
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService;
@@ -549,10 +834,10 @@ ScmrSetServiceObjectSecurity(handle_t BindingHandle,
     NTSTATUS Status;
     DWORD dwError;
 
-    DPRINT1("ScmrSetServiceObjectSecurity() called\n");
+    DPRINT1("RSetServiceObjectSecurity() called\n");
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -632,7 +917,7 @@ ScmrSetServiceObjectSecurity(handle_t BindingHandle,
     if (dwError != ERROR_SUCCESS)
         goto Done;
 
-    DPRINT1("Stub: ScmrSetServiceObjectSecurity() is unimplemented\n");
+    UNIMPLEMENTED;
     dwError = ERROR_SUCCESS;
 //    dwError = ScmWriteSecurityDescriptor(hServiceKey,
 //                                         lpService->lpSecurityDescriptor);
@@ -647,28 +932,28 @@ Done:
 
     /* FIXME: Unlock service database */
 
-    DPRINT("ScmrSetServiceObjectSecurity() done (Error %lu)\n", dwError);
+    DPRINT("RSetServiceObjectSecurity() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
 /* Function 6 */
-unsigned long
-ScmrQueryServiceStatus(handle_t BindingHandle,
-                       unsigned int hService,
-                       LPSERVICE_STATUS lpServiceStatus)
+DWORD RQueryServiceStatus(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    LPSERVICE_STATUS lpServiceStatus)
 {
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService;
 
-    DPRINT("ScmrQueryServiceStatus() called\n");
+    DPRINT("RQueryServiceStatus() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -697,97 +982,151 @@ ScmrQueryServiceStatus(handle_t BindingHandle,
 }
 
 
+static BOOL
+ScmIsValidServiceState(DWORD dwCurrentState)
+{
+    switch (dwCurrentState)
+    {
+        case SERVICE_STOPPED:
+        case SERVICE_START_PENDING:
+        case SERVICE_STOP_PENDING:
+        case SERVICE_RUNNING:
+        case SERVICE_CONTINUE_PENDING:
+        case SERVICE_PAUSE_PENDING:
+        case SERVICE_PAUSED:
+            return TRUE;
+
+        default:
+            return FALSE;
+    }
+}
+
+
 /* Function 7 */
-unsigned long
-ScmrSetServiceStatus(handle_t BindingHandle,
-                     unsigned long hServiceStatus,
-                     LPSERVICE_STATUS lpServiceStatus)
+DWORD RSetServiceStatus(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hServiceStatus,
+    LPSERVICE_STATUS lpServiceStatus)
 {
     PSERVICE lpService;
 
-    DPRINT("ScmrSetServiceStatus() called\n");
-
-    if (ScmShutdown)
-        return ERROR_SHUTDOWN_IN_PROGRESS;
+    DPRINT("RSetServiceStatus() called\n");
+    DPRINT("hServiceStatus = %p\n", hServiceStatus);
+    DPRINT("dwServiceType = %lu\n", lpServiceStatus->dwServiceType);
+    DPRINT("dwCurrentState = %lu\n", lpServiceStatus->dwCurrentState);
+    DPRINT("dwControlsAccepted = %lu\n", lpServiceStatus->dwControlsAccepted);
+    DPRINT("dwWin32ExitCode = %lu\n", lpServiceStatus->dwWin32ExitCode);
+    DPRINT("dwServiceSpecificExitCode = %lu\n", lpServiceStatus->dwServiceSpecificExitCode);
+    DPRINT("dwCheckPoint = %lu\n", lpServiceStatus->dwCheckPoint);
+    DPRINT("dwWaitHint = %lu\n", lpServiceStatus->dwWaitHint);
+
+    if (hServiceStatus == 0)
+    {
+        DPRINT1("hServiceStatus == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
 
-    lpService = ScmGetServiceEntryByThreadId((ULONG)hServiceStatus);
+    lpService = ScmGetServiceEntryByClientHandle((ULONG)hServiceStatus);
     if (lpService == NULL)
     {
         DPRINT1("lpService == NULL!\n");
         return ERROR_INVALID_HANDLE;
     }
 
+    /* Check current state */
+    if (!ScmIsValidServiceState(lpServiceStatus->dwCurrentState))
+    {
+        DPRINT1("Invalid service state!\n");
+        return ERROR_INVALID_DATA;
+    }
+
+    /* Check service type */
+    if (!(lpServiceStatus->dwServiceType & SERVICE_WIN32) &&
+         (lpServiceStatus->dwServiceType & SERVICE_DRIVER))
+    {
+        DPRINT1("Invalid service type!\n");
+        return ERROR_INVALID_DATA;
+    }
+
+    /* Check accepted controls */
+    if (lpServiceStatus->dwControlsAccepted == 0 ||
+        lpServiceStatus->dwControlsAccepted & ~0xFF)
+    {
+        DPRINT1("Invalid controls accepted!\n");
+        return ERROR_INVALID_DATA;
+    }
+
+
     RtlCopyMemory(&lpService->Status,
                   lpServiceStatus,
                   sizeof(SERVICE_STATUS));
 
     DPRINT("Set %S to %lu\n", lpService->lpDisplayName, lpService->Status.dwCurrentState);
-    DPRINT("ScmrSetServiceStatus() done\n");
+    DPRINT("RSetServiceStatus() done\n");
 
     return ERROR_SUCCESS;
 }
 
 
 /* Function 8 */
-unsigned long
-ScmrUnlockServiceDatabase(handle_t BindingHandle,
-                          unsigned int hLock)
+DWORD RUnlockServiceDatabase(
+    handle_t BindingHandle,
+    LPSC_RPC_LOCK Lock)
 {
-    DPRINT1("ScmrUnlockServiceDatabase() called\n");
-    /* FIXME */
+    UNIMPLEMENTED;
     return ERROR_SUCCESS;
 }
 
 
 /* Function 9 */
-unsigned long
-ScmrNotifyBootConfigStatus(handle_t BindingHandle,
-                           unsigned long BootAcceptable)
+DWORD RNotifyBootConfigStatus(
+    handle_t BindingHandle,
+    SVCCTL_HANDLEW lpMachineName,
+    DWORD BootAcceptable)
 {
-    DPRINT1("ScmrNotifyBootConfigStatus() called\n");
-    /* FIXME */
+    UNIMPLEMENTED;
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
 
 /* Function 10 */
-unsigned long
-ScmrSetServiceBitsW(handle_t BindingHandle,
-                    unsigned long hServiceStatus,
-                    unsigned long dwServiceBits,
-                    unsigned long bSetBitsOn,
-                    unsigned long bUpdateImmediately,
-                    wchar_t *lpString)
-{
-    DPRINT1("ScmrSetServiceBitsW() called\n");
-    /* FIXME */
+DWORD RI_ScSetServiceBitsW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hServiceStatus,
+    DWORD dwServiceBits,
+    int bSetBitsOn,
+    int bUpdateImmediately,
+    wchar_t *lpString)
+{
+    UNIMPLEMENTED;
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
 
 /* Function 11 */
-unsigned long
-ScmrChangeServiceConfigW(handle_t BiningHandle,
-                         unsigned int hService,
-                         unsigned long dwServiceType,
-                         unsigned long dwStartType,
-                         unsigned long dwErrorControl,
-                         wchar_t *lpBinaryPathName,
-                         wchar_t *lpLoadOrderGroup,
-                         unsigned long *lpdwTagId, /* in, out, unique */
-                         wchar_t *lpDependencies,
-                         unsigned long dwDependenciesLength,
-                         wchar_t *lpServiceStartName,
-                         wchar_t *lpPassword,
-                         unsigned long dwPasswordLength,
-                         wchar_t *lpDisplayName)
+DWORD RChangeServiceConfigW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPWSTR lpBinaryPathName,
+    LPWSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPBYTE lpDependencies,
+    DWORD dwDependSize,
+    LPWSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPWSTR lpDisplayName)
 {
     DWORD dwError = ERROR_SUCCESS;
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService = NULL;
     HKEY hServiceKey = NULL;
+    LPWSTR lpDisplayNameW = NULL;
 
-    DPRINT("ScmrChangeServiceConfigW() called\n");
+    DPRINT("RChangeServiceConfigW() called\n");
     DPRINT("dwServiceType = %lu\n", dwServiceType);
     DPRINT("dwStartType = %lu\n", dwStartType);
     DPRINT("dwErrorControl = %lu\n", dwErrorControl);
@@ -799,7 +1138,7 @@ ScmrChangeServiceConfigW(handle_t BiningHandle,
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -845,7 +1184,21 @@ ScmrChangeServiceConfigW(handle_t BiningHandle,
                        REG_SZ,
                        (LPBYTE)lpDisplayName,
                        (wcslen(lpDisplayName) + 1) * sizeof(WCHAR));
-        /* FIXME: update lpService->lpDisplayName */
+
+        /* Update the display name */
+        lpDisplayNameW = (LPWSTR)HeapAlloc(GetProcessHeap(),
+                                           0,
+                                           (wcslen(lpDisplayName) + 1) * sizeof(WCHAR));
+        if (lpDisplayNameW == NULL)
+        {
+            dwError = ERROR_NOT_ENOUGH_MEMORY;
+            goto done;
+        }
+
+        if (lpService->lpDisplayName != lpService->lpServiceName)
+            HeapFree(GetProcessHeap(), 0, lpService->lpDisplayName);
+
+        lpService->lpDisplayName = lpDisplayNameW;
     }
 
     if (dwServiceType != SERVICE_NO_CHANGE)
@@ -938,7 +1291,7 @@ ScmrChangeServiceConfigW(handle_t BiningHandle,
                                  (wcslen(lpLoadOrderGroup) + 1) * sizeof(WCHAR));
         if (dwError != ERROR_SUCCESS)
             goto done;
-        /* FIXME: update lpService->lpServiceGroup */
+        /* FIXME: Update lpService->lpServiceGroup */
     }
 
     if (lpdwTagId != NULL)
@@ -963,8 +1316,8 @@ ScmrChangeServiceConfigW(handle_t BiningHandle,
     if (lpDependencies != NULL && *lpDependencies != 0)
     {
         dwError = ScmWriteDependencies(hServiceKey,
-                                       lpDependencies,
-                                       dwDependenciesLength);
+                                       (LPWSTR)lpDependencies,
+                                       dwDependSize);
         if (dwError != ERROR_SUCCESS)
             goto done;
     }
@@ -980,31 +1333,405 @@ done:
     if (hServiceKey != NULL)
         RegCloseKey(hServiceKey);
 
-    DPRINT("ScmrChangeServiceConfigW() done (Error %lu)\n", dwError);
+    DPRINT("RChangeServiceConfigW() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
+/* Create a path suitable for the bootloader out of the full path */
+DWORD
+ScmConvertToBootPathName(wchar_t *CanonName, wchar_t **RelativeName)
+{
+    DWORD ServiceNameLen, BufferSize, ExpandedLen;
+    WCHAR Dest;
+    WCHAR *Expanded;
+    UNICODE_STRING NtPathName, SystemRoot, LinkTarget;
+    OBJECT_ATTRIBUTES ObjectAttributes;
+    NTSTATUS Status;
+    HANDLE SymbolicLinkHandle;
+
+    DPRINT("ScmConvertToBootPathName %S\n", CanonName);
+
+    ServiceNameLen = wcslen(CanonName);
+
+    /* First check, if it's already good */
+    if (ServiceNameLen > 12 &&
+        !wcsnicmp(L"\\SystemRoot\\", CanonName, 12))
+    {
+        *RelativeName = LocalAlloc(LMEM_ZEROINIT, ServiceNameLen * sizeof(WCHAR) + sizeof(WCHAR));
+        if (*RelativeName == NULL)
+        {
+            DPRINT1("Error allocating memory for boot driver name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        /* Copy it */
+        wcscpy(*RelativeName, CanonName);
+
+        DPRINT1("Bootdriver name %S\n", *RelativeName);
+        return ERROR_SUCCESS;
+    }
+
+    /* If it has %SystemRoot% prefix, substitute it to \System*/
+    if (ServiceNameLen > 13 &&
+        !wcsnicmp(L"%SystemRoot%\\", CanonName, 13))
+    {
+        /* There is no +sizeof(wchar_t) because the name is less by 1 wchar */
+        *RelativeName = LocalAlloc(LMEM_ZEROINIT, ServiceNameLen * sizeof(WCHAR));
+
+        if (*RelativeName == NULL)
+        {
+            DPRINT1("Error allocating memory for boot driver name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        /* Copy it */
+        wcscpy(*RelativeName, L"\\SystemRoot\\");
+        wcscat(*RelativeName, CanonName + 13);
+
+        DPRINT1("Bootdriver name %S\n", *RelativeName);
+        return ERROR_SUCCESS;
+    }
+
+    /* Get buffer size needed for expanding env strings */
+    BufferSize = ExpandEnvironmentStringsW(L"%SystemRoot%\\", &Dest, 1);
+
+    if (BufferSize <= 1)
+    {
+        DPRINT1("Error during a call to ExpandEnvironmentStringsW()\n");
+        return ERROR_INVALID_ENVIRONMENT;
+    }
+
+    /* Allocate memory, since the size is known now */
+    Expanded = LocalAlloc(LMEM_ZEROINIT, BufferSize * sizeof(WCHAR) + sizeof(WCHAR));
+    if (!Expanded)
+    {
+        DPRINT1("Error allocating memory for boot driver name!\n");
+        return ERROR_NOT_ENOUGH_MEMORY;
+    }
+
+    /* Expand it */
+    if (ExpandEnvironmentStringsW(L"%SystemRoot%\\", Expanded, BufferSize) >
+        BufferSize)
+    {
+        DPRINT1("Error during a call to ExpandEnvironmentStringsW()\n");
+        LocalFree(Expanded);
+        return ERROR_NOT_ENOUGH_MEMORY;
+    }
+
+    /* Convert to NY-style path */
+    if (!RtlDosPathNameToNtPathName_U(Expanded, &NtPathName, NULL, NULL))
+    {
+        DPRINT1("Error during a call to RtlDosPathNameToNtPathName_U()\n");
+        return ERROR_INVALID_ENVIRONMENT;
+    }
+
+    DPRINT("Converted to NT-style %wZ\n", &NtPathName);
+
+    /* No need to keep the dos-path anymore */
+    LocalFree(Expanded);
+
+    /* Copy it to the allocated place */
+    Expanded = LocalAlloc(LMEM_ZEROINIT, NtPathName.Length + sizeof(WCHAR));
+    if (!Expanded)
+    {
+            DPRINT1("Error allocating memory for boot driver name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+    }
+
+    ExpandedLen = NtPathName.Length / sizeof(WCHAR);
+    wcsncpy(Expanded, NtPathName.Buffer, ExpandedLen);
+    Expanded[ExpandedLen] = 0;
+
+    if (ServiceNameLen > ExpandedLen &&
+        !wcsnicmp(Expanded, CanonName, ExpandedLen))
+    {
+        /* Only \SystemRoot\ is missing */
+        *RelativeName = LocalAlloc(LMEM_ZEROINIT,
+            (ServiceNameLen - ExpandedLen) * sizeof(WCHAR) + 13*sizeof(WCHAR));
+        if (*RelativeName == NULL)
+        {
+            DPRINT1("Error allocating memory for boot driver name!\n");
+            LocalFree(Expanded);
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        wcscpy(*RelativeName, L"\\SystemRoot\\");
+        wcscat(*RelativeName, CanonName + ExpandedLen);
+
+        RtlFreeUnicodeString(&NtPathName);
+        return ERROR_SUCCESS;
+    }
+
+    /* The most complex case starts here */
+    RtlInitUnicodeString(&SystemRoot, L"\\SystemRoot");
+    InitializeObjectAttributes(&ObjectAttributes,
+                               &SystemRoot,
+                               OBJ_CASE_INSENSITIVE,
+                               NULL,
+                               NULL);
+
+    /* Open this symlink */
+    Status = NtOpenSymbolicLinkObject(&SymbolicLinkHandle, SYMBOLIC_LINK_QUERY, &ObjectAttributes);
+
+    if (NT_SUCCESS(Status))
+    {
+        LinkTarget.Length = 0;
+        LinkTarget.MaximumLength = 0;
+
+        DPRINT("Opened symbolic link object\n");
+
+        Status = NtQuerySymbolicLinkObject(SymbolicLinkHandle, &LinkTarget, &BufferSize);
+        if (NT_SUCCESS(Status) || Status == STATUS_BUFFER_TOO_SMALL)
+        {
+            /* Check if required buffer size is sane */
+            if (BufferSize > 0xFFFD)
+            {
+                DPRINT1("Too large buffer required\n");
+                *RelativeName = 0;
+
+                if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                LocalFree(Expanded);
+                return ERROR_NOT_ENOUGH_MEMORY;
+            }
+
+            /* Alloc the string */
+            LinkTarget.Buffer = LocalAlloc(LMEM_ZEROINIT, BufferSize + sizeof(WCHAR));
+            if (!LinkTarget.Buffer)
+            {
+                DPRINT1("Unable to alloc buffer\n");
+                if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                LocalFree(Expanded);
+                return ERROR_NOT_ENOUGH_MEMORY;
+            }
+
+            /* Do a real query now */
+            LinkTarget.Length = BufferSize;
+            LinkTarget.MaximumLength = LinkTarget.Length + sizeof(WCHAR);
+
+            Status = NtQuerySymbolicLinkObject(SymbolicLinkHandle, &LinkTarget, &BufferSize);
+            if (NT_SUCCESS(Status))
+            {
+                DPRINT("LinkTarget: %wZ\n", &LinkTarget);
+
+                ExpandedLen = LinkTarget.Length / sizeof(WCHAR);
+                if ((ServiceNameLen > ExpandedLen) &&
+                    !wcsnicmp(LinkTarget.Buffer, CanonName, ExpandedLen))
+                {
+                    *RelativeName = LocalAlloc(LMEM_ZEROINIT,
+                       (ServiceNameLen - ExpandedLen) * sizeof(WCHAR) + 13*sizeof(WCHAR));
+
+                    if (*RelativeName == NULL)
+                    {
+                        DPRINT1("Unable to alloc buffer\n");
+                        if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                        LocalFree(Expanded);
+                        RtlFreeUnicodeString(&NtPathName);
+                        return ERROR_NOT_ENOUGH_MEMORY;
+                    }
+
+                    /* Copy it over, substituting the first part
+                       with SystemRoot */
+                    wcscpy(*RelativeName, L"\\SystemRoot\\");
+                    wcscat(*RelativeName, CanonName+ExpandedLen+1);
+
+                    /* Cleanup */
+                    if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                    LocalFree(Expanded);
+                    RtlFreeUnicodeString(&NtPathName);
+
+                    /* Return success */
+                    return ERROR_SUCCESS;
+                }
+                else
+                {
+                    if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                    LocalFree(Expanded);
+                    RtlFreeUnicodeString(&NtPathName);
+                    return ERROR_INVALID_PARAMETER;
+                }
+            }
+            else
+            {
+                DPRINT1("Error, Status = %08X\n", Status);
+                if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+                LocalFree(Expanded);
+                RtlFreeUnicodeString(&NtPathName);
+                return ERROR_INVALID_PARAMETER;
+            }
+        }
+        else
+        {
+            DPRINT1("Error, Status = %08X\n", Status);
+            if (SymbolicLinkHandle) NtClose(SymbolicLinkHandle);
+            LocalFree(Expanded);
+            RtlFreeUnicodeString(&NtPathName);
+            return ERROR_INVALID_PARAMETER;
+        }
+    }
+    else
+    {
+        DPRINT1("Error, Status = %08X\n", Status);
+        LocalFree(Expanded);
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    /* Failure */
+    *RelativeName = NULL;
+    return ERROR_INVALID_PARAMETER;
+}
+
+DWORD
+ScmCanonDriverImagePath(DWORD dwStartType,
+                        wchar_t *lpServiceName,
+                        wchar_t **lpCanonName)
+{
+    DWORD ServiceNameLen, Result;
+    UNICODE_STRING NtServiceName;
+    WCHAR *RelativeName;
+    WCHAR *SourceName = lpServiceName;
+
+    /* Calculate the length of the service's name */
+    ServiceNameLen = wcslen(lpServiceName);
+
+    /* 12 is wcslen(L"\\SystemRoot\\") */
+    if (ServiceNameLen > 12 &&
+        !wcsnicmp(L"\\SystemRoot\\", lpServiceName, 12))
+    {
+        /* SystemRoot prefix is already included */
+
+        *lpCanonName = LocalAlloc(LMEM_ZEROINIT, ServiceNameLen * sizeof(WCHAR) + sizeof(WCHAR));
+
+        if (*lpCanonName == NULL)
+        {
+            DPRINT1("Error allocating memory for canonized service name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        /* If it's a boot-time driver, it must be systemroot relative */
+        if (dwStartType == SERVICE_BOOT_START)
+            SourceName += 12;
+
+        /* Copy it */
+        wcscpy(*lpCanonName, SourceName);
+
+        DPRINT("Canonicalized name %S\n", *lpCanonName);
+        return NO_ERROR;
+    }
+
+    /* Check if it has %SystemRoot% (len=13) */
+    if (ServiceNameLen > 13 &&
+        !wcsnicmp(L"%%SystemRoot%%\\", lpServiceName, 13))
+    {
+        /* Substitute %SystemRoot% with \\SystemRoot\\ */
+        *lpCanonName = LocalAlloc(LMEM_ZEROINIT, ServiceNameLen * sizeof(WCHAR) + sizeof(WCHAR));
+
+        if (*lpCanonName == NULL)
+        {
+            DPRINT1("Error allocating memory for canonized service name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        /* If it's a boot-time driver, it must be systemroot relative */
+        if (dwStartType == SERVICE_BOOT_START)
+            wcscpy(*lpCanonName, L"\\SystemRoot\\");
+
+        wcscat(*lpCanonName, lpServiceName + 13);
+
+        DPRINT("Canonicalized name %S\n", *lpCanonName);
+        return NO_ERROR;
+    }
+
+    /* Check if it's a relative path name */
+    if (lpServiceName[0] != L'\\' && lpServiceName[1] != L':')
+    {
+        *lpCanonName = LocalAlloc(LMEM_ZEROINIT, ServiceNameLen * sizeof(WCHAR) + sizeof(WCHAR));
+
+        if (*lpCanonName == NULL)
+        {
+            DPRINT1("Error allocating memory for canonized service name!\n");
+            return ERROR_NOT_ENOUGH_MEMORY;
+        }
+
+        /* Just copy it over without changing */
+        wcscpy(*lpCanonName, lpServiceName);
+
+        return NO_ERROR;
+    }
+
+    /* It seems to be a DOS path, convert it */
+    if (!RtlDosPathNameToNtPathName_U(lpServiceName, &NtServiceName, NULL, NULL))
+    {
+        DPRINT1("RtlDosPathNameToNtPathName_U() failed!\n");
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    *lpCanonName = LocalAlloc(LMEM_ZEROINIT, NtServiceName.Length + sizeof(WCHAR));
+
+    if (*lpCanonName == NULL)
+    {
+        DPRINT1("Error allocating memory for canonized service name!\n");
+        RtlFreeUnicodeString(&NtServiceName);
+        return ERROR_NOT_ENOUGH_MEMORY;
+    }
+
+    /* Copy the string */
+    wcsncpy(*lpCanonName, NtServiceName.Buffer, NtServiceName.Length / sizeof(WCHAR));
+
+    /* The unicode string is not needed anymore */
+    RtlFreeUnicodeString(&NtServiceName);
+
+    if (dwStartType != SERVICE_BOOT_START)
+    {
+        DPRINT("Canonicalized name %S\n", *lpCanonName);
+        return NO_ERROR;
+    }
+
+    /* The service is boot-started, so must be relative */
+    Result = ScmConvertToBootPathName(*lpCanonName, &RelativeName);
+    if (Result)
+    {
+        /* There is a problem, free name and return */
+        LocalFree(*lpCanonName);
+        DPRINT1("Error converting named!\n");
+        return Result;
+    }
+
+    ASSERT(RelativeName);
+
+    /* Copy that string */
+    wcscpy(*lpCanonName, RelativeName + 12);
+
+    /* Free the allocated buffer */
+    LocalFree(RelativeName);
+
+    DPRINT("Canonicalized name %S\n", *lpCanonName);
+
+    /* Success */
+    return NO_ERROR;
+}
+
+
 /* Function 12 */
-unsigned long
-ScmrCreateServiceW(handle_t BindingHandle,
-                   unsigned int hSCManager,
-                   wchar_t *lpServiceName,
-                   wchar_t *lpDisplayName,
-                   unsigned long dwDesiredAccess,
-                   unsigned long dwServiceType,
-                   unsigned long dwStartType,
-                   unsigned long dwErrorControl,
-                   wchar_t *lpBinaryPathName,
-                   wchar_t *lpLoadOrderGroup,
-                   unsigned long *lpdwTagId, /* in, out */
-                   wchar_t *lpDependencies,
-                   unsigned long dwDependenciesLength,
-                   wchar_t *lpServiceStartName,
-                   wchar_t *lpPassword,
-                   unsigned long dwPasswordLength,
-                   unsigned int *hService) /* out */
+DWORD RCreateServiceW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPWSTR lpServiceName,
+    LPWSTR lpDisplayName,
+    DWORD dwDesiredAccess,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPWSTR lpBinaryPathName,
+    LPWSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPBYTE lpDependencies,
+    DWORD dwDependSize,
+    LPWSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPSC_RPC_HANDLE lpServiceHandle)
 {
     PMANAGER_HANDLE hManager;
     DWORD dwError = ERROR_SUCCESS;
@@ -1013,7 +1740,7 @@ ScmrCreateServiceW(handle_t BindingHandle,
     LPWSTR lpImagePath = NULL;
     HKEY hServiceKey = NULL;
 
-    DPRINT("ScmrCreateServiceW() called\n");
+    DPRINT("RCreateServiceW() called\n");
     DPRINT("lpServiceName = %S\n", lpServiceName);
     DPRINT("lpDisplayName = %S\n", lpDisplayName);
     DPRINT("dwDesiredAccess = %lx\n", dwDesiredAccess);
@@ -1027,7 +1754,7 @@ ScmrCreateServiceW(handle_t BindingHandle,
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hManager = (PMANAGER_HANDLE)hSCManager;
-    if (hManager->Handle.Tag != MANAGER_TAG)
+    if (!hManager || hManager->Handle.Tag != MANAGER_TAG)
     {
         DPRINT1("Invalid manager handle!\n");
         return ERROR_INVALID_HANDLE;
@@ -1042,26 +1769,63 @@ ScmrCreateServiceW(handle_t BindingHandle,
         return ERROR_ACCESS_DENIED;
     }
 
-    /* Fail if the service already exists! */
-    if (ScmGetServiceEntryByName(lpServiceName) != NULL)
-        return ERROR_SERVICE_EXISTS;
-
-    if (dwServiceType & SERVICE_DRIVER)
+    if (wcslen(lpServiceName) == 0)
     {
-        /* FIXME: Adjust the image path
-         * Following line is VERY BAD, because it assumes that the
-         * first part of full file name is the OS directory */
-        if (lpBinaryPathName[1] == ':') lpBinaryPathName += GetWindowsDirectoryW(NULL, 0);
+        return ERROR_INVALID_NAME;
+    }
 
-        lpImagePath = (WCHAR*) HeapAlloc(GetProcessHeap(),
-                                HEAP_ZERO_MEMORY,
-                                (wcslen(lpBinaryPathName) + 1) * sizeof(WCHAR));
-        if (lpImagePath == NULL)
-        {
-            dwError = ERROR_NOT_ENOUGH_MEMORY;
+    if (wcslen(lpBinaryPathName) == 0)
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    if ((dwServiceType == (SERVICE_WIN32_OWN_PROCESS | SERVICE_INTERACTIVE_PROCESS)) &&
+        (lpServiceStartName))
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    if ((dwServiceType > SERVICE_WIN32_SHARE_PROCESS) &&
+        (dwServiceType != (SERVICE_WIN32_OWN_PROCESS | SERVICE_INTERACTIVE_PROCESS)) &&
+        (dwServiceType != (SERVICE_WIN32_SHARE_PROCESS | SERVICE_INTERACTIVE_PROCESS)))
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    if (dwStartType > SERVICE_DISABLED)
+    {
+        return ERROR_INVALID_PARAMETER;
+    }
+
+    lpService = ScmGetServiceEntryByName(lpServiceName);
+    if (lpService)
+    {
+        /* check if it is marked for deletion */
+        if (lpService->bDeleted)
+            return ERROR_SERVICE_MARKED_FOR_DELETE;
+        /* Return Error exist */
+        return ERROR_SERVICE_EXISTS;
+    }
+
+    if (lpDisplayName != NULL &&
+        ScmGetServiceEntryByDisplayName(lpDisplayName) != NULL)
+        return ERROR_DUPLICATE_SERVICE_NAME;
+
+    if (dwServiceType & SERVICE_DRIVER)
+    {
+        dwError = ScmCanonDriverImagePath(dwStartType,
+                                          lpBinaryPathName,
+                                          &lpImagePath);
+        if (dwError != ERROR_SUCCESS)
             goto done;
+    }
+    else
+    {
+        if (dwStartType == SERVICE_BOOT_START ||
+            dwStartType == SERVICE_SYSTEM_START)
+        {
+            return ERROR_INVALID_PARAMETER;
         }
-        wcscpy(lpImagePath, lpBinaryPathName);
     }
 
     /* Allocate a new service entry */
@@ -1175,7 +1939,7 @@ ScmrCreateServiceW(handle_t BindingHandle,
                                  0,
                                  REG_EXPAND_SZ,
                                  (LPBYTE)lpImagePath,
-                                 (wcslen(lpImagePath) + 1) *sizeof(WCHAR));
+                                 (wcslen(lpImagePath) + 1) * sizeof(WCHAR));
         if (dwError != ERROR_SUCCESS)
             goto done;
     }
@@ -1209,8 +1973,21 @@ ScmrCreateServiceW(handle_t BindingHandle,
     if (lpDependencies != NULL && *lpDependencies != 0)
     {
         dwError = ScmWriteDependencies(hServiceKey,
-                                       lpDependencies,
-                                       dwDependenciesLength);
+                                       (LPWSTR)lpDependencies,
+                                       dwDependSize);
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+    }
+
+    /* If a non driver and NULL for lpServiceName, write ObjectName as LocalSystem */
+    if ((dwServiceType & SERVICE_WIN32) && (!lpServiceName))
+    {
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"ObjectName",
+                                 0,
+                                 REG_SZ,
+                                 (LPBYTE)L"LocalSystem",
+                                 24);
         if (dwError != ERROR_SUCCESS)
             goto done;
     }
@@ -1230,14 +2007,17 @@ ScmrCreateServiceW(handle_t BindingHandle,
     if (dwError != ERROR_SUCCESS)
         goto done;
 
+    lpService->dwRefCount = 1;
+    DPRINT("CreateService - lpService->dwRefCount %u\n", lpService->dwRefCount);
+
 done:;
     if (hServiceKey != NULL)
         RegCloseKey(hServiceKey);
 
     if (dwError == ERROR_SUCCESS)
     {
-        DPRINT("hService %lx\n", hServiceHandle);
-        *hService = (unsigned int)hServiceHandle;
+        DPRINT("hService %p\n", hServiceHandle);
+        *lpServiceHandle = (SC_RPC_HANDLE)hServiceHandle;
 
         if (lpdwTagId != NULL)
             *lpdwTagId = lpService->dwTag;
@@ -1248,7 +2028,7 @@ done:;
         if (lpService->lpServiceName != NULL)
             HeapFree(GetProcessHeap(), 0, lpService->lpDisplayName);
 
-        if (hServiceHandle != NULL)
+        if (hServiceHandle)
         {
             /* Remove the service handle */
             HeapFree(GetProcessHeap(), 0, hServiceHandle);
@@ -1263,45 +2043,153 @@ done:;
     if (lpImagePath != NULL)
         HeapFree(GetProcessHeap(), 0, lpImagePath);
 
-    DPRINT("ScmrCreateServiceW() done (Error %lu)\n", dwError);
+    DPRINT("RCreateServiceW() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
 /* Function 13 */
-unsigned long
-ScmrEnumDependentServicesW(handle_t BindingHandle,
-                           unsigned int hService,
-                           unsigned long dwServiceState,
-                           unsigned char *lpServices,
-                           unsigned long cbBufSize,
-                           unsigned long *pcbBytesNeeded,
-                           unsigned long *lpServicesReturned)
+DWORD REnumDependentServicesW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwServiceState,
+    LPBYTE lpServices,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned)
 {
     DWORD dwError = ERROR_SUCCESS;
+    DWORD dwServicesReturned = 0;
+    DWORD dwServiceCount;
+    HKEY hServicesKey = NULL;
+    LPSC_RPC_HANDLE hSCObject;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    PSERVICE *lpServicesArray = NULL;
+    LPENUM_SERVICE_STATUSW lpServicesPtr = NULL;
+    LPWSTR lpStr;
 
-    DPRINT1("ScmrEnumDependentServicesW() called\n");
     *pcbBytesNeeded = 0;
     *lpServicesReturned = 0;
 
-    DPRINT1("ScmrEnumDependentServicesW() done (Error %lu)\n", dwError);
+    DPRINT("REnumDependentServicesW() called\n");
+
+    hSCObject = &hService;
+    hSvc = (PSERVICE_HANDLE) *hSCObject;
+    lpService = hSvc->ServiceEntry;
+
+    /* Check access rights */
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SC_MANAGER_ENUMERATE_SERVICE))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n",
+                hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    /* Open the Services Reg key */
+    dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
+                            L"System\\CurrentControlSet\\Services",
+                            0,
+                            KEY_READ,
+                            &hServicesKey);
+    if (dwError != ERROR_SUCCESS)
+        return dwError;
+
+    /* First determine the bytes needed and get the number of dependent services */
+    dwError = Int_EnumDependentServicesW(hServicesKey,
+                                         lpService,
+                                         dwServiceState,
+                                         NULL,
+                                         pcbBytesNeeded,
+                                         &dwServicesReturned);
+    if (dwError != ERROR_SUCCESS)
+        goto Done;
+
+    /* If buffer size is less than the bytes needed or pointer is null */
+    if ((!lpServices) || (cbBufSize < *pcbBytesNeeded))
+    {
+        dwError = ERROR_MORE_DATA;
+        goto Done;
+    }
+
+    /* Allocate memory for array of service pointers */
+    lpServicesArray = HeapAlloc(GetProcessHeap(),
+                                0,
+                                (dwServicesReturned + 1) * sizeof(PSERVICE));
+    if (!lpServicesArray)
+    {
+        DPRINT1("Could not allocate a buffer!!\n");
+        dwError = ERROR_NOT_ENOUGH_MEMORY;
+        goto Done;
+    }
+
+    dwServicesReturned = 0;
+    *pcbBytesNeeded = 0;
+
+    dwError = Int_EnumDependentServicesW(hServicesKey,
+                                         lpService,
+                                         dwServiceState,
+                                         lpServicesArray,
+                                         pcbBytesNeeded,
+                                         &dwServicesReturned);
+    if (dwError != ERROR_SUCCESS)
+    {
+        goto Done;
+    }
+
+    lpServicesPtr = (LPENUM_SERVICE_STATUSW) lpServices;
+    lpStr = (LPWSTR)(lpServices + (dwServicesReturned * sizeof(ENUM_SERVICE_STATUSW)));
+
+    /* Copy EnumDepenedentService to Buffer */
+    for (dwServiceCount = 0; dwServiceCount < dwServicesReturned; dwServiceCount++)
+    {
+        lpService = lpServicesArray[dwServiceCount];
+
+        /* Copy status info */
+        memcpy(&lpServicesPtr->ServiceStatus,
+               &lpService->Status,
+               sizeof(SERVICE_STATUS));
+
+        /* Copy display name */
+        wcscpy(lpStr, lpService->lpDisplayName);
+        lpServicesPtr->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServices);
+        lpStr += (wcslen(lpService->lpDisplayName) + 1);
+
+        /* Copy service name */
+        wcscpy(lpStr, lpService->lpServiceName);
+        lpServicesPtr->lpServiceName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServices);
+        lpStr += (wcslen(lpService->lpServiceName) + 1);
+
+        lpServicesPtr ++;
+    }
+
+    *lpServicesReturned = dwServicesReturned;
+
+Done:
+    if (lpServicesArray != NULL)
+        HeapFree(GetProcessHeap(), 0, lpServicesArray);
+
+    RegCloseKey(hServicesKey);
+
+    DPRINT("REnumDependentServicesW() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
 /* Function 14 */
-unsigned long
-ScmrEnumServicesStatusW(handle_t BindingHandle,
-                        unsigned int hSCManager,
-                        unsigned long dwServiceType,
-                        unsigned long dwServiceState,
-                        unsigned char *lpServices,
-                        unsigned long dwBufSize,
-                        unsigned long *pcbBytesNeeded,
-                        unsigned long *lpServicesReturned,
-                        unsigned long *lpResumeHandle)
+DWORD REnumServicesStatusW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    DWORD dwServiceType,
+    DWORD dwServiceState,
+    LPBYTE lpBuffer,
+    DWORD dwBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned,
+    LPBOUNDED_DWORD_256K lpResumeHandle)
 {
     PMANAGER_HANDLE hManager;
     PSERVICE lpService;
@@ -1316,13 +2204,13 @@ ScmrEnumServicesStatusW(handle_t BindingHandle,
     LPENUM_SERVICE_STATUSW lpStatusPtr;
     LPWSTR lpStringPtr;
 
-    DPRINT("ScmrEnumServicesStatusW() called\n");
+    DPRINT("REnumServicesStatusW() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hManager = (PMANAGER_HANDLE)hSCManager;
-    if (hManager->Handle.Tag != MANAGER_TAG)
+    if (!hManager || hManager->Handle.Tag != MANAGER_TAG)
     {
         DPRINT1("Invalid manager handle!\n");
         return ERROR_INVALID_HANDLE;
@@ -1376,19 +2264,16 @@ ScmrEnumServicesStatusW(handle_t BindingHandle,
                  ((wcslen(CurrentService->lpServiceName) + 1) * sizeof(WCHAR)) +
                  ((wcslen(CurrentService->lpDisplayName) + 1) * sizeof(WCHAR));
 
-        if (dwRequiredSize + dwSize <= dwBufSize)
-        {
-            DPRINT("Service name: %S  fit\n", CurrentService->lpServiceName);
-            dwRequiredSize += dwSize;
-            dwServiceCount++;
-            dwLastResumeCount = CurrentService->dwResumeCount;
-        }
-        else
+        if (dwRequiredSize + dwSize > dwBufSize)
         {
             DPRINT("Service name: %S  no fit\n", CurrentService->lpServiceName);
             break;
         }
 
+        DPRINT("Service name: %S  fit\n", CurrentService->lpServiceName);
+        dwRequiredSize += dwSize;
+        dwServiceCount++;
+        dwLastResumeCount = CurrentService->dwResumeCount;
     }
 
     DPRINT("dwRequiredSize: %lu\n", dwRequiredSize);
@@ -1425,8 +2310,8 @@ ScmrEnumServicesStatusW(handle_t BindingHandle,
     *lpServicesReturned = dwServiceCount;
     *pcbBytesNeeded = dwRequiredSize;
 
-    lpStatusPtr = (LPENUM_SERVICE_STATUSW)lpServices;
-    lpStringPtr = (LPWSTR)((ULONG_PTR)lpServices +
+    lpStatusPtr = (LPENUM_SERVICE_STATUSW)lpBuffer;
+    lpStringPtr = (LPWSTR)((ULONG_PTR)lpBuffer +
                            dwServiceCount * sizeof(ENUM_SERVICE_STATUSW));
 
     dwRequiredSize = 0;
@@ -1452,56 +2337,49 @@ ScmrEnumServicesStatusW(handle_t BindingHandle,
                  ((wcslen(CurrentService->lpServiceName) + 1) * sizeof(WCHAR)) +
                  ((wcslen(CurrentService->lpDisplayName) + 1) * sizeof(WCHAR));
 
-        if (dwRequiredSize + dwSize <= dwBufSize)
-        {
-            /* Copy the service name */
-            wcscpy(lpStringPtr,
-                   CurrentService->lpServiceName);
-            lpStatusPtr->lpServiceName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpServices);
-            lpStringPtr += (wcslen(CurrentService->lpServiceName) + 1);
+        if (dwRequiredSize + dwSize > dwBufSize)
+            break;
 
-            /* Copy the display name */
-            wcscpy(lpStringPtr,
-                   CurrentService->lpDisplayName);
-            lpStatusPtr->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpServices);
-            lpStringPtr += (wcslen(CurrentService->lpDisplayName) + 1);
+        /* Copy the service name */
+        wcscpy(lpStringPtr, CurrentService->lpServiceName);
+        lpStatusPtr->lpServiceName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpBuffer);
+        lpStringPtr += (wcslen(CurrentService->lpServiceName) + 1);
 
-            /* Copy the status information */
-            memcpy(&lpStatusPtr->ServiceStatus,
-                   &CurrentService->Status,
-                   sizeof(SERVICE_STATUS));
+        /* Copy the display name */
+        wcscpy(lpStringPtr, CurrentService->lpDisplayName);
+        lpStatusPtr->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpBuffer);
+        lpStringPtr += (wcslen(CurrentService->lpDisplayName) + 1);
 
-            lpStatusPtr++;
-            dwRequiredSize += dwSize;
-        }
-        else
-        {
-            break;
-        }
+        /* Copy the status information */
+        memcpy(&lpStatusPtr->ServiceStatus,
+               &CurrentService->Status,
+               sizeof(SERVICE_STATUS));
 
+        lpStatusPtr++;
+        dwRequiredSize += dwSize;
     }
 
 Done:;
     /* FIXME: Unlock the service list */
 
-    DPRINT("ScmrEnumServicesStatusW() done (Error %lu)\n", dwError);
+    DPRINT("REnumServicesStatusW() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
 /* Function 15 */
-unsigned long
-ScmrOpenSCManagerW(handle_t BindingHandle,
-                   wchar_t *lpMachineName,
-                   wchar_t *lpDatabaseName,
-                   unsigned long dwDesiredAccess,
-                   unsigned int *hScm)
+DWORD ROpenSCManagerW(
+    handle_t BindingHandle,
+    LPWSTR lpMachineName,
+    LPWSTR lpDatabaseName,
+    DWORD dwDesiredAccess,
+    LPSC_RPC_HANDLE lpScHandle)
 {
     DWORD dwError;
     SC_HANDLE hHandle;
 
-    DPRINT("ScmrOpenSCManagerW() called\n");
+    DPRINT("ROpenSCManagerW() called\n");
     DPRINT("lpMachineName = %p\n", lpMachineName);
     DPRINT("lpMachineName: %S\n", lpMachineName);
     DPRINT("lpDataBaseName = %p\n", lpDatabaseName);
@@ -1511,6 +2389,9 @@ ScmrOpenSCManagerW(handle_t BindingHandle,
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
+    if (!lpScHandle)
+        return ERROR_INVALID_PARAMETER;
+
     dwError = ScmCreateManagerHandle(lpDatabaseName,
                                      &hHandle);
     if (dwError != ERROR_SUCCESS)
@@ -1529,30 +2410,30 @@ ScmrOpenSCManagerW(handle_t BindingHandle,
         return dwError;
     }
 
-    *hScm = (unsigned int)hHandle;
-    DPRINT("*hScm = %x\n", *hScm);
+    *lpScHandle = (SC_RPC_HANDLE)hHandle;
+    DPRINT("*hScm = %p\n", *lpScHandle);
 
-    DPRINT("ScmrOpenSCManagerW() done\n");
+    DPRINT("ROpenSCManagerW() done\n");
 
     return ERROR_SUCCESS;
 }
 
 
 /* Function 16 */
-unsigned long
-ScmrOpenServiceW(handle_t BindingHandle,
-                 unsigned int hSCManager,
-                 wchar_t *lpServiceName,
-                 unsigned long dwDesiredAccess,
-                 unsigned int *hService)
+DWORD ROpenServiceW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPWSTR lpServiceName,
+    DWORD dwDesiredAccess,
+    LPSC_RPC_HANDLE lpServiceHandle)
 {
     PSERVICE lpService;
     PMANAGER_HANDLE hManager;
     SC_HANDLE hHandle;
     DWORD dwError;
 
-    DPRINT("ScmrOpenServiceW() called\n");
-    DPRINT("hSCManager = %x\n", hSCManager);
+    DPRINT("ROpenServiceW() called\n");
+    DPRINT("hSCManager = %p\n", hSCManager);
     DPRINT("lpServiceName = %p\n", lpServiceName);
     DPRINT("lpServiceName: %S\n", lpServiceName);
     DPRINT("dwDesiredAccess = %x\n", dwDesiredAccess);
@@ -1560,8 +2441,14 @@ ScmrOpenServiceW(handle_t BindingHandle,
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
+    if (!lpServiceHandle)
+        return ERROR_INVALID_PARAMETER;
+
+    if (!lpServiceName)
+        return ERROR_INVALID_ADDRESS;
+
     hManager = (PMANAGER_HANDLE)hSCManager;
-    if (hManager->Handle.Tag != MANAGER_TAG)
+    if (!hManager || hManager->Handle.Tag != MANAGER_TAG)
     {
         DPRINT1("Invalid manager handle!\n");
         return ERROR_INVALID_HANDLE;
@@ -1596,39 +2483,45 @@ ScmrOpenServiceW(handle_t BindingHandle,
         return dwError;
     }
 
-    *hService = (unsigned int)hHandle;
-    DPRINT("*hService = %x\n", *hService);
+    lpService->dwRefCount++;
+    DPRINT("OpenService - lpService->dwRefCount %u\n",lpService->dwRefCount);
+
+    *lpServiceHandle = (SC_RPC_HANDLE)hHandle;
+    DPRINT("*hService = %p\n", *lpServiceHandle);
 
-    DPRINT("ScmrOpenServiceW() done\n");
+    DPRINT("ROpenServiceW() done\n");
 
     return ERROR_SUCCESS;
 }
 
 
 /* Function 17 */
-unsigned long
-ScmrQueryServiceConfigW(handle_t BindingHandle,
-                        unsigned int hService,
-                        unsigned char *lpServiceConfig,
-                        unsigned long cbBufSize,
-                        unsigned long *pcbBytesNeeded)
+DWORD RQueryServiceConfigW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    LPBYTE lpBuf, //LPQUERY_SERVICE_CONFIGW lpServiceConfig,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_8K pcbBytesNeeded)
 {
+    LPQUERY_SERVICE_CONFIGW lpServiceConfig = (LPQUERY_SERVICE_CONFIGW)lpBuf;
     DWORD dwError = ERROR_SUCCESS;
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService = NULL;
     HKEY hServiceKey = NULL;
     LPWSTR lpImagePath = NULL;
+    LPWSTR lpServiceStartName = NULL;
     DWORD dwRequiredSize;
-    LPQUERY_SERVICE_CONFIGW lpConfig;
+    LPQUERY_SERVICE_CONFIGW lpConfig = NULL;
+    WCHAR lpEmptyString[] = {0,0};
     LPWSTR lpStr;
 
-    DPRINT("ScmrQueryServiceConfigW() called\n");
+    DPRINT("RQueryServiceConfigW() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -1662,20 +2555,33 @@ ScmrQueryServiceConfigW(handle_t BindingHandle,
     if (dwError != ERROR_SUCCESS)
         goto Done;
 
+    ScmReadString(hServiceKey,
+                  L"ObjectName",
+                  &lpServiceStartName);
+
     dwRequiredSize = sizeof(QUERY_SERVICE_CONFIGW);
 
     if (lpImagePath != NULL)
         dwRequiredSize += ((wcslen(lpImagePath) + 1) * sizeof(WCHAR));
+    else
+        dwRequiredSize += 2 * sizeof(WCHAR);
 
     if (lpService->lpGroup != NULL)
         dwRequiredSize += ((wcslen(lpService->lpGroup->lpGroupName) + 1) * sizeof(WCHAR));
+    else
+        dwRequiredSize += 2 * sizeof(WCHAR);
 
     /* FIXME: Add Dependencies length*/
 
-    /* FIXME: Add ServiceStartName length*/
+    if (lpServiceStartName != NULL)
+        dwRequiredSize += ((wcslen(lpServiceStartName) + 1) * sizeof(WCHAR));
+    else
+        dwRequiredSize += 2 * sizeof(WCHAR);
 
     if (lpService->lpDisplayName != NULL)
         dwRequiredSize += ((wcslen(lpService->lpDisplayName) + 1) * sizeof(WCHAR));
+    else
+        dwRequiredSize += 2 * sizeof(WCHAR);
 
     if (lpServiceConfig == NULL || cbBufSize < dwRequiredSize)
     {
@@ -1694,40 +2600,55 @@ ScmrQueryServiceConfigW(handle_t BindingHandle,
         if (lpImagePath != NULL)
         {
             wcscpy(lpStr, lpImagePath);
-            lpConfig->lpBinaryPathName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
-            lpStr += (wcslen(lpImagePath) + 1);
         }
         else
         {
-            lpConfig->lpBinaryPathName = NULL;
+            wcscpy(lpStr, lpEmptyString);
         }
 
+        lpConfig->lpBinaryPathName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (wcslen(lpStr) + 1);
+
         if (lpService->lpGroup != NULL)
         {
             wcscpy(lpStr, lpService->lpGroup->lpGroupName);
-            lpConfig->lpLoadOrderGroup = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
-            lpStr += (wcslen(lpService->lpGroup->lpGroupName) + 1);
         }
         else
         {
-            lpConfig->lpLoadOrderGroup = NULL;
+            wcscpy(lpStr, lpEmptyString);
         }
 
+        lpConfig->lpLoadOrderGroup = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (wcslen(lpStr) + 1);
+
         /* FIXME: Append Dependencies */
-        lpConfig->lpDependencies = NULL;
+        wcscpy(lpStr, lpEmptyString);
+
+        lpStr += (wcslen(lpStr) + 1);
+        lpConfig->lpDependencies = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+
+        if (lpServiceStartName != NULL)
+        {
+            wcscpy(lpStr, lpServiceStartName);
+        }
+        else
+        {
+            wcscpy(lpStr, lpEmptyString);
+        }
 
-        /* FIXME: Append ServiceStartName */
-        lpConfig->lpServiceStartName = NULL;
+        lpConfig->lpServiceStartName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (wcslen(lpStr) + 1);
 
         if (lpService->lpDisplayName != NULL)
         {
             wcscpy(lpStr, lpService->lpDisplayName);
-            lpConfig->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
         }
         else
         {
-            lpConfig->lpDisplayName = NULL;
+            wcscpy(lpStr, lpEmptyString);
         }
+
+        lpConfig->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
     }
 
     if (pcbBytesNeeded != NULL)
@@ -1737,49 +2658,51 @@ Done:;
     if (lpImagePath != NULL)
         HeapFree(GetProcessHeap(), 0, lpImagePath);
 
+    if (lpServiceStartName != NULL)
+        HeapFree(GetProcessHeap(), 0, lpServiceStartName);
+
     if (hServiceKey != NULL)
         RegCloseKey(hServiceKey);
 
     /* FIXME: Unlock the service database */
 
-    DPRINT("ScmrQueryServiceConfigW() done\n");
+    DPRINT("RQueryServiceConfigW() done\n");
 
     return dwError;
 }
 
 
 /* Function 18 */
-unsigned long
-ScmrQueryServiceLockStatusW(handle_t BindingHandle,
-                            unsigned int hSCManager,
-                            unsigned char *lpLockStatus,   /* [out, unique, size_is(cbBufSize)] */
-                            unsigned long cbBufSize,       /* [in] */
-                            unsigned long *pcbBytesNeeded) /* [out] */
-{
-    DPRINT1("ScmrQueryServiceLockStatusW() called\n");
+DWORD RQueryServiceLockStatusW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPQUERY_SERVICE_LOCK_STATUSW lpLockStatus,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_4K pcbBytesNeeded)
+{
+    UNIMPLEMENTED;
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
 
 /* Function 19 */
-unsigned long
-ScmrStartServiceW(handle_t BindingHandle,
-                  unsigned int hService,
-                  unsigned long dwNumServiceArgs,
-                  unsigned char *lpServiceArgBuffer,
-                  unsigned long cbBufSize)
+DWORD RStartServiceW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD argc,
+    LPSTRING_PTRSW argv)
 {
     DWORD dwError = ERROR_SUCCESS;
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService = NULL;
 
-    DPRINT("ScmrStartServiceW() called\n");
+    DPRINT("RStartServiceW() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -1805,28 +2728,33 @@ ScmrStartServiceW(handle_t BindingHandle,
     if (lpService->bDeleted)
         return ERROR_SERVICE_MARKED_FOR_DELETE;
 
+    if (argv) {
+        UNIMPLEMENTED;
+        argv = NULL;
+    }
+
     /* Start the service */
-    dwError = ScmStartService(lpService, (LPWSTR)lpServiceArgBuffer);
+    dwError = ScmStartService(lpService, argc, (LPWSTR *)argv);
 
     return dwError;
 }
 
 
 /* Function 20 */
-unsigned long
-ScmrGetServiceDisplayNameW(handle_t BindingHandle,
-                           unsigned int hSCManager,
-                           wchar_t *lpServiceName,
-                           wchar_t *lpDisplayName, /* [out, unique] */
-                           unsigned long *lpcchBuffer)
+DWORD RGetServiceDisplayNameW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPWSTR lpServiceName,
+    LPWSTR lpDisplayName,
+    DWORD *lpcchBuffer)
 {
 //    PMANAGER_HANDLE hManager;
     PSERVICE lpService;
     DWORD dwLength;
     DWORD dwError;
 
-    DPRINT("ScmrGetServiceDisplayNameW() called\n");
-    DPRINT("hSCManager = %x\n", hSCManager);
+    DPRINT("RGetServiceDisplayNameW() called\n");
+    DPRINT("hSCManager = %p\n", hSCManager);
     DPRINT("lpServiceName: %S\n", lpServiceName);
     DPRINT("lpDisplayName: %p\n", lpDisplayName);
     DPRINT("*lpcchBuffer: %lu\n", *lpcchBuffer);
@@ -1843,15 +2771,37 @@ ScmrGetServiceDisplayNameW(handle_t BindingHandle,
     if (lpService == NULL)
     {
         DPRINT1("Could not find a service!\n");
+
+        /* If the service could not be found and lpcchBuffer is 0, windows
+           puts null in lpDisplayName and puts 1 in lpcchBuffer */
+        if (*lpcchBuffer == 0)
+        {
+            *lpcchBuffer = 1;
+            *lpDisplayName = '\0';
+        }
+
         return ERROR_SERVICE_DOES_NOT_EXIST;
     }
 
-    dwLength = wcslen(lpService->lpDisplayName) + 1;
+    if (!lpService->lpDisplayName)
+    {
+        dwLength = wcslen(lpService->lpServiceName);
 
-    if (lpDisplayName != NULL &&
-        *lpcchBuffer >= dwLength)
+        if (lpServiceName != NULL &&
+            *lpcchBuffer > dwLength)
+        {
+            wcscpy(lpDisplayName, lpService->lpServiceName);
+        }
+    }
+    else
     {
-        wcscpy(lpDisplayName, lpService->lpDisplayName);
+        dwLength = wcslen(lpService->lpDisplayName);
+
+        if (lpDisplayName != NULL &&
+            *lpcchBuffer > dwLength)
+        {
+            wcscpy(lpDisplayName, lpService->lpDisplayName);
+        }
     }
 
     dwError = (*lpcchBuffer > dwLength) ? ERROR_SUCCESS : ERROR_INSUFFICIENT_BUFFER;
@@ -1863,20 +2813,20 @@ ScmrGetServiceDisplayNameW(handle_t BindingHandle,
 
 
 /* Function 21 */
-unsigned long
-ScmrGetServiceKeyNameW(handle_t BindingHandle,
-                       unsigned int hSCManager,
-                       wchar_t *lpDisplayName,
-                       wchar_t *lpServiceName, /* [out, unique] */
-                       unsigned long *lpcchBuffer)
+DWORD RGetServiceKeyNameW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPWSTR lpDisplayName,
+    LPWSTR lpServiceName,
+    DWORD *lpcchBuffer)
 {
 //    PMANAGER_HANDLE hManager;
     PSERVICE lpService;
     DWORD dwLength;
     DWORD dwError;
 
-    DPRINT("ScmrGetServiceKeyNameW() called\n");
-    DPRINT("hSCManager = %x\n", hSCManager);
+    DPRINT("RGetServiceKeyNameW() called\n");
+    DPRINT("hSCManager = %p\n", hSCManager);
     DPRINT("lpDisplayName: %S\n", lpDisplayName);
     DPRINT("lpServiceName: %p\n", lpServiceName);
     DPRINT("*lpcchBuffer: %lu\n", *lpcchBuffer);
@@ -1893,238 +2843,97 @@ ScmrGetServiceKeyNameW(handle_t BindingHandle,
     if (lpService == NULL)
     {
         DPRINT1("Could not find a service!\n");
+
+        /* If the service could not be found and lpcchBuffer is 0, windows
+           puts null in lpDisplayName and puts 2 in lpcchBuffer */
+        if (*lpcchBuffer == 0)
+        {
+            *lpcchBuffer = 2;
+            *lpServiceName = '\0';
+        }
+
         return ERROR_SERVICE_DOES_NOT_EXIST;
     }
 
-    dwLength = wcslen(lpService->lpServiceName) + 1;
+    dwLength = wcslen(lpService->lpServiceName);
 
     if (lpServiceName != NULL &&
-        *lpcchBuffer >= dwLength)
+        *lpcchBuffer > dwLength)
     {
         wcscpy(lpServiceName, lpService->lpServiceName);
+        *lpcchBuffer = dwLength;
+        return ERROR_SUCCESS;
     }
 
     dwError = (*lpcchBuffer > dwLength) ? ERROR_SUCCESS : ERROR_INSUFFICIENT_BUFFER;
 
-    *lpcchBuffer = dwLength;
+    *lpcchBuffer = dwLength * 2;
 
     return dwError;
 }
 
 
 /* Function 22 */
-unsigned long
-ScmrSetServiceBitsA(handle_t BindingHandle,
-                    unsigned long hServiceStatus,
-                    unsigned long dwServiceBits,
-                    unsigned long bSetBitsOn,
-                    unsigned long bUpdateImmediately,
-                    char *lpString)
-{
-    DPRINT1("ScmrSetServiceBitsA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 23 */
-unsigned long
-ScmrChangeServiceConfigA(handle_t BiningHandle,
-                         unsigned int hService,
-                         unsigned long dwServiceType,
-                         unsigned long dwStartType,
-                         unsigned long dwErrorControl,
-                         char *lpBinaryPathName,
-                         char *lpLoadOrderGroup,
-                         unsigned long *lpdwTagId,
-                         char *lpDependencies,
-                         unsigned long dwDependenciesLength,
-                         char *lpServiceStartName,
-                         char *lpPassword,
-                         unsigned long dwPasswordLength,
-                         char *lpDisplayName)
-{
-    DPRINT1("ScmrChangeServiceConfigA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 24 */
-unsigned long
-ScmrCreateServiceA(handle_t BindingHandle,
-                   unsigned int hSCManager,
-                   char *lpServiceName,
-                   char *lpDisplayName,
-                   unsigned long dwDesiredAccess,
-                   unsigned long dwServiceType,
-                   unsigned long dwStartType,
-                   unsigned long dwErrorControl,
-                   char *lpBinaryPathName,
-                   char *lpLoadOrderGroup,
-                   unsigned long *lpdwTagId, /* in, out */
-                   char *lpDependencies,
-                   unsigned long dwDependenciesLength,
-                   char *lpServiceStartName,
-                   char *lpPassword,
-                   unsigned long dwPasswordLength,
-                   unsigned int *hService) /* out */
-{
-    DPRINT1("ScmrCreateServiceA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 25 */
-unsigned long
-ScmrEnumDependentServicesA(handle_t BindingHandle,
-                           unsigned int hService,
-                           unsigned long dwServiceState,
-                           unsigned char *lpServices,
-                           unsigned long cbBufSize,
-                           unsigned long *pcbBytesNeeded,
-                           unsigned long *lpServicesReturned)
-{
-    DPRINT1("ScmrEnumDependentServicesA() is unimplemented\n");
-    *pcbBytesNeeded = 0;
-    *lpServicesReturned = 0;
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 26 */
-unsigned long
-ScmrEnumServicesStatusA(handle_t BindingHandle,
-                        unsigned int hSCManager,
-                        unsigned long dwServiceType,
-                        unsigned long dwServiceState,
-                        unsigned char *lpServices,
-                        unsigned long dwBufSize,
-                        unsigned long *pcbBytesNeeded,
-                        unsigned long *lpServicesReturned,
-                        unsigned long *lpResumeHandle)
-{
-    DPRINT1("ScmrEnumServicesAtatusA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 27 */
-unsigned long
-ScmrOpenSCManagerA(handle_t BindingHandle,
-                   char *lpMachineName,
-                   char *lpDatabaseName,
-                   unsigned long dwDesiredAccess,
-                   unsigned int *hScm)
-{
-    UNICODE_STRING MachineName;
-    UNICODE_STRING DatabaseName;
-    DWORD dwError;
-
-    DPRINT("ScmrOpenSCManagerA() called\n");
-
-    if (lpMachineName)
-        RtlCreateUnicodeStringFromAsciiz(&MachineName,
-                                         lpMachineName);
-
-    if (lpDatabaseName)
-        RtlCreateUnicodeStringFromAsciiz(&DatabaseName,
-                                         lpDatabaseName);
-
-    dwError = ScmrOpenSCManagerW(BindingHandle,
-                                 lpMachineName ? MachineName.Buffer : NULL,
-                                 lpDatabaseName ? DatabaseName.Buffer : NULL,
-                                 dwDesiredAccess,
-                                 hScm);
-
-    if (lpMachineName)
-        RtlFreeUnicodeString(&MachineName);
-
-    if (lpDatabaseName)
-        RtlFreeUnicodeString(&DatabaseName);
-
-    return dwError;
-}
-
-
-/* Function 28 */
-unsigned int
-ScmrOpenServiceA(handle_t BindingHandle,
-                 unsigned int hSCManager,
-                 char *lpServiceName,
-                 unsigned long dwDesiredAccess,
-                 unsigned int *hService)
+DWORD RI_ScSetServiceBitsA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hServiceStatus,
+    DWORD dwServiceBits,
+    int bSetBitsOn,
+    int bUpdateImmediately,
+    char *lpString)
 {
-    UNICODE_STRING ServiceName;
-    DWORD dwError;
-
-    DPRINT("ScmrOpenServiceA() called\n");
-
-    RtlCreateUnicodeStringFromAsciiz(&ServiceName,
-                                     lpServiceName);
-
-    dwError = ScmrOpenServiceW(BindingHandle,
-                               hSCManager,
-                               ServiceName.Buffer,
-                               dwDesiredAccess,
-                               hService);
-
-    RtlFreeUnicodeString(&ServiceName);
-
-    return dwError;
-}
-
-
-/* Function 29 */
-unsigned long
-ScmrQueryServiceConfigA(handle_t BindingHandle,
-                        unsigned int hService,
-                        unsigned char *lpServiceConfig,
-                        unsigned long cbBufSize,
-                        unsigned long *pcbBytesNeeded)
-{
-    DPRINT1("ScmrQueryServiceConfigA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
-
-
-/* Function 30 */
-unsigned long
-ScmrQueryServiceLockStatusA(handle_t BindingHandle,
-                            unsigned int hSCManager,
-                            unsigned char *lpLockStatus,   /* [out, unique, size_is(cbBufSize)] */
-                            unsigned long cbBufSize,       /* [in] */
-                            unsigned long *pcbBytesNeeded) /* [out] */
-{
-    DPRINT1("ScmrQueryServiceLockStatusA() called\n");
+    UNIMPLEMENTED;
     return ERROR_CALL_NOT_IMPLEMENTED;
 }
 
 
-/* Function 31 */
-unsigned long
-ScmrStartServiceA(handle_t BindingHandle,
-                  unsigned int hService,
-                  unsigned long dwNumServiceArgs,
-                  unsigned char *lpServiceArgBuffer,
-                  unsigned long cbBufSize)
+/* Function 23 */
+DWORD RChangeServiceConfigA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPSTR lpBinaryPathName,
+    LPSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPSTR lpDependencies,
+    DWORD dwDependSize,
+    LPSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPSTR lpDisplayName)
 {
     DWORD dwError = ERROR_SUCCESS;
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService = NULL;
+    HKEY hServiceKey = NULL;
+    LPWSTR lpDisplayNameW = NULL;
+    // LPWSTR lpBinaryPathNameW = NULL;
+    LPWSTR lpLoadOrderGroupW = NULL;
+    LPWSTR lpDependenciesW = NULL;
+    // LPWSTR lpPasswordW = NULL;
 
-    DPRINT1("ScmrStartServiceA() called\n");
+    DPRINT("RChangeServiceConfigA() called\n");
+    DPRINT("dwServiceType = %lu\n", dwServiceType);
+    DPRINT("dwStartType = %lu\n", dwStartType);
+    DPRINT("dwErrorControl = %lu\n", dwErrorControl);
+    DPRINT("lpBinaryPathName = %s\n", lpBinaryPathName);
+    DPRINT("lpLoadOrderGroup = %s\n", lpLoadOrderGroup);
+    DPRINT("lpDisplayName = %s\n", lpDisplayName);
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
     }
 
     if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
-                                  SERVICE_START))
+                                  SERVICE_CHANGE_CONFIG))
     {
         DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
         return ERROR_ACCESS_DENIED;
@@ -2137,135 +2946,1298 @@ ScmrStartServiceA(handle_t BindingHandle,
         return ERROR_INVALID_HANDLE;
     }
 
-    if (lpService->dwStartType == SERVICE_DISABLED)
-        return ERROR_SERVICE_DISABLED;
+    /* FIXME: Lock database exclusively */
 
     if (lpService->bDeleted)
+    {
+        /* FIXME: Unlock database */
+        DPRINT1("The service has already been marked for delete!\n");
         return ERROR_SERVICE_MARKED_FOR_DELETE;
+    }
 
-    /* FIXME: Convert argument vector to Unicode */
-
-    /* Start the service */
-    dwError = ScmStartService(lpService, NULL);
+    /* Open the service key */
+    dwError = ScmOpenServiceKey(lpService->szServiceName,
+                                KEY_SET_VALUE,
+                                &hServiceKey);
+    if (dwError != ERROR_SUCCESS)
+        goto done;
 
-    /* FIXME: Free argument vector */
+    /* Write service data to the registry */
+
+    if (lpDisplayName != NULL && *lpDisplayName != 0)
+    {
+        /* Set the display name */
+        lpDisplayNameW = HeapAlloc(GetProcessHeap(),
+                                   0,
+                                   (strlen(lpDisplayName) + 1) * sizeof(WCHAR));
+        if (lpDisplayNameW == NULL)
+        {
+            dwError = ERROR_NOT_ENOUGH_MEMORY;
+            goto done;
+        }
+
+        MultiByteToWideChar(CP_ACP,
+                            0,
+                            lpDisplayName,
+                            -1,
+                            lpDisplayNameW,
+                            wcslen(lpDisplayNameW) + 1);
+
+        RegSetValueExW(hServiceKey,
+                       L"DisplayName",
+                       0,
+                       REG_SZ,
+                       (LPBYTE)lpDisplayNameW,
+                       (wcslen(lpDisplayNameW) + 1) * sizeof(WCHAR));
+
+        /* Update lpService->lpDisplayName */
+        if (lpService->lpDisplayName)
+            HeapFree(GetProcessHeap(), 0, lpService->lpDisplayName);
+
+        lpService->lpDisplayName = lpDisplayNameW;
+    }
+
+    if (dwServiceType != SERVICE_NO_CHANGE)
+    {
+        /* Set the service type */
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"Type",
+                                 0,
+                                 REG_DWORD,
+                                 (LPBYTE)&dwServiceType,
+                                 sizeof(DWORD));
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        lpService->Status.dwServiceType = dwServiceType;
+    }
+
+    if (dwStartType != SERVICE_NO_CHANGE)
+    {
+        /* Set the start value */
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"Start",
+                                 0,
+                                 REG_DWORD,
+                                 (LPBYTE)&dwStartType,
+                                 sizeof(DWORD));
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        lpService->dwStartType = dwStartType;
+    }
+
+    if (dwErrorControl != SERVICE_NO_CHANGE)
+    {
+        /* Set the error control value */
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"ErrorControl",
+                                 0,
+                                 REG_DWORD,
+                                 (LPBYTE)&dwErrorControl,
+                                 sizeof(DWORD));
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        lpService->dwErrorControl = dwErrorControl;
+    }
+
+#if 0
+    /* FIXME: set the new ImagePath value */
+
+    /* Set the image path */
+    if (dwServiceType & SERVICE_WIN32)
+    {
+        if (lpBinaryPathName != NULL && *lpBinaryPathName != 0)
+        {
+            lpBinaryPathNameW=HeapAlloc(GetProcessHeap(),0, (strlen(lpBinaryPathName)+1) * sizeof(WCHAR));
+            MultiByteToWideChar(CP_ACP, 0, lpBinaryPathName, -1, lpBinaryPathNameW, wcslen(lpBinaryPathNameW)+1);
+            dwError = RegSetValueExW(hServiceKey,
+                                     L"ImagePath",
+                                     0,
+                                     REG_EXPAND_SZ,
+                                     (LPBYTE)lpBinaryPathNameW,
+                                     (wcslen(lpBinaryPathNameW) + 1) * sizeof(WCHAR));
+            if (dwError != ERROR_SUCCESS)
+                goto done;
+        }
+    }
+    else if (dwServiceType & SERVICE_DRIVER)
+    {
+        if (lpImagePath != NULL && *lpImagePath != 0)
+        {
+            dwError = RegSetValueExW(hServiceKey,
+                                     L"ImagePath",
+                                     0,
+                                     REG_EXPAND_SZ,
+                                     (LPBYTE)lpImagePath,
+                                     (wcslen(lpImagePath) + 1) *sizeof(WCHAR));
+            if (dwError != ERROR_SUCCESS)
+                goto done;
+        }
+    }
+#endif
+
+    /* Set the group name */
+    if (lpLoadOrderGroup != NULL && *lpLoadOrderGroup != 0)
+    {
+        lpLoadOrderGroupW = HeapAlloc(GetProcessHeap(),
+                                      0,
+                                      (strlen(lpLoadOrderGroup)+1) * sizeof(WCHAR));
+        if (lpLoadOrderGroupW == NULL)
+        {
+            dwError = ERROR_NOT_ENOUGH_MEMORY;
+            goto done;
+        }
+
+        MultiByteToWideChar(CP_ACP,
+                            0,
+                            lpLoadOrderGroup,
+                            -1,
+                            lpLoadOrderGroupW,
+                            wcslen(lpLoadOrderGroupW) + 1);
+
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"Group",
+                                 0,
+                                 REG_SZ,
+                                 (LPBYTE)lpLoadOrderGroupW,
+                                 (wcslen(lpLoadOrderGroupW) + 1) * sizeof(WCHAR));
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        /* FIXME: Update lpService->lpServiceGroup */
+
+        HeapFree(GetProcessHeap(), 0, lpLoadOrderGroupW);
+    }
+
+    if (lpdwTagId != NULL)
+    {
+        dwError = ScmAssignNewTag(lpService);
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        dwError = RegSetValueExW(hServiceKey,
+                                 L"Tag",
+                                 0,
+                                 REG_DWORD,
+                                 (LPBYTE)&lpService->dwTag,
+                                 sizeof(DWORD));
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        *lpdwTagId = lpService->dwTag;
+    }
+
+    /* Write dependencies */
+    if (lpDependencies != NULL && *lpDependencies != 0)
+    {
+        lpDependenciesW = HeapAlloc(GetProcessHeap(),
+                                    0,
+                                    (strlen(lpDependencies)+1) * sizeof(WCHAR));
+        if (lpDependenciesW == NULL)
+        {
+            dwError = ERROR_NOT_ENOUGH_MEMORY;
+            goto done;
+        }
+
+        MultiByteToWideChar(CP_ACP,
+                            0,
+                            lpDependencies,
+                            dwDependSize,
+                            lpDependenciesW,
+                            wcslen(lpDependenciesW)+1);
+
+        dwError = ScmWriteDependencies(hServiceKey,
+                                       (LPWSTR)lpDependenciesW,
+                                       dwDependSize);
+
+        HeapFree(GetProcessHeap(), 0, lpDependenciesW);
+    }
+
+    if (lpPassword != NULL)
+    {
+        /* FIXME: Write password */
+    }
+
+    /* FIXME: Unlock database */
+
+done:
+    if (hServiceKey != NULL)
+        RegCloseKey(hServiceKey);
+
+    DPRINT("RChangeServiceConfigA() done (Error %lu)\n", dwError);
+
+    return dwError;
+}
+
+
+/* Function 24 */
+DWORD RCreateServiceA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPSTR lpServiceName,
+    LPSTR lpDisplayName,
+    DWORD dwDesiredAccess,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPSTR lpBinaryPathName,
+    LPSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPBYTE lpDependencies,
+    DWORD dwDependSize,
+    LPSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPSC_RPC_HANDLE lpServiceHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 25 */
+DWORD REnumDependentServicesA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwServiceState,
+    LPBYTE lpServices,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned)
+{
+    DWORD dwError = ERROR_SUCCESS;
+    DWORD dwServicesReturned = 0;
+    DWORD dwServiceCount;
+    HKEY hServicesKey = NULL;
+    LPSC_RPC_HANDLE hSCObject;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    PSERVICE *lpServicesArray = NULL;
+    LPENUM_SERVICE_STATUSA lpServicesPtr = NULL;
+    LPSTR lpStr;
+
+    *pcbBytesNeeded = 0;
+    *lpServicesReturned = 0;
+
+    DPRINT("REnumDependentServicesA() called\n");
+
+    hSCObject = &hService;
+    hSvc = (PSERVICE_HANDLE) *hSCObject;
+    lpService = hSvc->ServiceEntry;
+
+    /* Check access rights */
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SC_MANAGER_ENUMERATE_SERVICE))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n",
+                hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    /* Open the Services Reg key */
+    dwError = RegOpenKeyExW(HKEY_LOCAL_MACHINE,
+                            L"System\\CurrentControlSet\\Services",
+                            0,
+                            KEY_READ,
+                            &hServicesKey);
+
+    if (dwError != ERROR_SUCCESS) return dwError;
+
+    /* NOTE: Windows calculates the pcbBytesNeeded based on WCHAR strings for
+             both EnumDependentServicesA and EnumDependentServicesW. So returned pcbBytesNeeded
+             are the same for both. Verified in WINXP. */
+
+    /* First determine the bytes needed and get the number of dependent services*/
+    dwError = Int_EnumDependentServicesW(hServicesKey,
+                                         lpService,
+                                         dwServiceState,
+                                         NULL,
+                                         pcbBytesNeeded,
+                                         &dwServicesReturned);
+    if (dwError != ERROR_SUCCESS)
+        goto Done;
+
+    /* If buffer size is less than the bytes needed or pointer is null*/
+    if ((!lpServices) || (cbBufSize < *pcbBytesNeeded))
+    {
+        dwError = ERROR_MORE_DATA;
+        goto Done;
+    }
+
+    /* Allocate memory for array of service pointers */
+    lpServicesArray = HeapAlloc(GetProcessHeap(),
+                                0,
+                                (dwServicesReturned + 1) * sizeof(PSERVICE));
+    if (!lpServicesArray)
+    {
+        DPRINT1("Could not allocate a buffer!!\n");
+        dwError = ERROR_NOT_ENOUGH_MEMORY;
+        goto Done;
+    }
+
+    dwServicesReturned = 0;
+    *pcbBytesNeeded = 0;
+
+    dwError = Int_EnumDependentServicesW(hServicesKey,
+                                         lpService,
+                                         dwServiceState,
+                                         lpServicesArray,
+                                         pcbBytesNeeded,
+                                         &dwServicesReturned);
+    if (dwError != ERROR_SUCCESS)
+    {
+        goto Done;
+    }
+
+    lpServicesPtr = (LPENUM_SERVICE_STATUSA)lpServices;
+    lpStr = (LPSTR)(lpServices + (dwServicesReturned * sizeof(ENUM_SERVICE_STATUSA)));
+
+    /* Copy EnumDepenedentService to Buffer */
+    for (dwServiceCount = 0; dwServiceCount < dwServicesReturned; dwServiceCount++)
+    {
+        lpService = lpServicesArray[dwServiceCount];
+
+        /* Copy the status info */
+        memcpy(&lpServicesPtr->ServiceStatus,
+               &lpService->Status,
+               sizeof(SERVICE_STATUS));
+
+        /* Copy display name */
+        WideCharToMultiByte(CP_ACP,
+                            0,
+                            lpService->lpDisplayName,
+                            -1,
+                            lpStr,
+                            wcslen(lpService->lpDisplayName),
+                            0,
+                            0);
+        lpServicesPtr->lpDisplayName = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServices);
+        lpStr += strlen(lpStr) + 1;
+
+        /* Copy service name */
+        WideCharToMultiByte(CP_ACP,
+                            0,
+                            lpService->lpServiceName,
+                            -1,
+                            lpStr,
+                            wcslen(lpService->lpServiceName),
+                            0,
+                            0);
+        lpServicesPtr->lpServiceName = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServices);
+        lpStr += strlen(lpStr) + 1;
+
+        lpServicesPtr ++;
+    }
+
+    *lpServicesReturned = dwServicesReturned;
+
+Done:
+    if (lpServicesArray)
+        HeapFree(GetProcessHeap(), 0, lpServicesArray);
+
+    RegCloseKey(hServicesKey);
+
+    DPRINT("REnumDependentServicesA() done (Error %lu)\n", dwError);
+
+    return dwError;
+}
+
+
+/* Function 26 */
+DWORD REnumServicesStatusA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    DWORD dwServiceType,
+    DWORD dwServiceState,
+    LPBYTE lpBuffer,
+    DWORD dwBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned,
+    LPBOUNDED_DWORD_256K lpResumeHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 27 */
+DWORD ROpenSCManagerA(
+    handle_t BindingHandle,
+    LPSTR lpMachineName,
+    LPSTR lpDatabaseName,
+    DWORD dwDesiredAccess,
+    LPSC_RPC_HANDLE lpScHandle)
+{
+    UNICODE_STRING MachineName;
+    UNICODE_STRING DatabaseName;
+    DWORD dwError;
+
+    DPRINT("ROpenSCManagerA() called\n");
+
+    if (lpMachineName)
+        RtlCreateUnicodeStringFromAsciiz(&MachineName,
+                                         lpMachineName);
+
+    if (lpDatabaseName)
+        RtlCreateUnicodeStringFromAsciiz(&DatabaseName,
+                                         lpDatabaseName);
+
+    dwError = ROpenSCManagerW(BindingHandle,
+                              lpMachineName ? MachineName.Buffer : NULL,
+                              lpDatabaseName ? DatabaseName.Buffer : NULL,
+                              dwDesiredAccess,
+                              lpScHandle);
+
+    if (lpMachineName)
+        RtlFreeUnicodeString(&MachineName);
+
+    if (lpDatabaseName)
+        RtlFreeUnicodeString(&DatabaseName);
+
+    return dwError;
+}
+
+
+/* Function 28 */
+DWORD ROpenServiceA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPSTR lpServiceName,
+    DWORD dwDesiredAccess,
+    LPSC_RPC_HANDLE lpServiceHandle)
+{
+    UNICODE_STRING ServiceName;
+    DWORD dwError;
+
+    DPRINT("ROpenServiceA() called\n");
+
+    if (lpServiceName)
+        RtlCreateUnicodeStringFromAsciiz(&ServiceName,
+                                         lpServiceName);
+
+    dwError = ROpenServiceW(BindingHandle,
+                            hSCManager,
+                            lpServiceName ? ServiceName.Buffer : NULL,
+                            dwDesiredAccess,
+                            lpServiceHandle);
+
+    if (lpServiceName)
+        RtlFreeUnicodeString(&ServiceName);
+
+    return dwError;
+}
+
+
+/* Function 29 */
+DWORD RQueryServiceConfigA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    LPBYTE lpBuf, //LPQUERY_SERVICE_CONFIGA lpServiceConfig,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_8K pcbBytesNeeded)
+{
+    LPQUERY_SERVICE_CONFIGA lpServiceConfig = (LPQUERY_SERVICE_CONFIGA)lpBuf;
+    DWORD dwError = ERROR_SUCCESS;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    HKEY hServiceKey = NULL;
+    LPWSTR lpImagePath = NULL;
+    LPWSTR lpServiceStartName = NULL;
+    DWORD dwRequiredSize;
+    LPQUERY_SERVICE_CONFIGA lpConfig = NULL;
+    CHAR lpEmptyString[]={0,0};
+    LPSTR lpStr;
+
+    DPRINT("RQueryServiceConfigA() called\n");
+
+    if (ScmShutdown)
+        return ERROR_SHUTDOWN_IN_PROGRESS;
+
+    hSvc = (PSERVICE_HANDLE)hService;
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
+    {
+        DPRINT1("Invalid handle tag!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SERVICE_QUERY_CONFIG))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    /* FIXME: Lock the service database shared */
+
+    dwError = ScmOpenServiceKey(lpService->lpServiceName,
+                                KEY_READ,
+                                &hServiceKey);
+    if (dwError != ERROR_SUCCESS)
+        goto Done;
+
+    dwError = ScmReadString(hServiceKey,
+                            L"ImagePath",
+                            &lpImagePath);
+    if (dwError != ERROR_SUCCESS)
+        goto Done;
+
+    ScmReadString(hServiceKey,
+                  L"ObjectName",
+                  &lpServiceStartName);
+
+    dwRequiredSize = sizeof(QUERY_SERVICE_CONFIGW);
+
+    if (lpImagePath != NULL)
+        dwRequiredSize += wcslen(lpImagePath) + 1;
+    else
+        dwRequiredSize += 2;
+
+    if (lpService->lpGroup != NULL)
+        dwRequiredSize += wcslen(lpService->lpGroup->lpGroupName) + 1;
+    else
+        dwRequiredSize += 2;
+
+    /* FIXME: Add Dependencies length*/
+    dwRequiredSize += 2;
+
+    if (lpServiceStartName != NULL)
+        dwRequiredSize += wcslen(lpServiceStartName) + 1;
+    else
+        dwRequiredSize += 2;
+
+    if (lpService->lpDisplayName != NULL)
+        dwRequiredSize += wcslen(lpService->lpDisplayName) + 1;
+    else
+        dwRequiredSize += 2;
+
+    if (lpServiceConfig == NULL || cbBufSize < dwRequiredSize)
+    {
+        dwError = ERROR_INSUFFICIENT_BUFFER;
+    }
+    else
+    {
+        lpConfig = (LPQUERY_SERVICE_CONFIGA)lpServiceConfig;
+        lpConfig->dwServiceType = lpService->Status.dwServiceType;
+        lpConfig->dwStartType = lpService->dwStartType;
+        lpConfig->dwErrorControl = lpService->dwErrorControl;
+        lpConfig->dwTagId = lpService->dwTag;
+
+        lpStr = (LPSTR)(lpServiceConfig + 1);
+
+        /* NOTE: Strings that are NULL for QUERY_SERVICE_CONFIG are pointers to empty strings.
+          Verified in WINXP*/
+
+        if (lpImagePath)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpImagePath,
+                                -1,
+                                lpStr,
+                                wcslen(lpImagePath),
+                                0,
+                                0);
+        }
+        else
+        {
+            strcpy(lpStr, lpEmptyString);
+        }
+
+        lpConfig->lpBinaryPathName = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (strlen((LPSTR)lpStr) + 1);
+
+        if (lpService->lpGroup)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpService->lpGroup->lpGroupName,
+                                -1,
+                                lpStr,
+                                wcslen(lpService->lpGroup->lpGroupName),
+                                0,
+                                0);
+        }
+        else
+        {
+            strcpy(lpStr, lpEmptyString);
+        }
+
+        lpConfig->lpLoadOrderGroup = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (strlen(lpStr) + 1);
+
+        /* FIXME: Append Dependencies */
+        strcpy(lpStr, lpEmptyString);
+
+        lpConfig->lpDependencies = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (strlen(lpStr) + 1);
+
+        if (lpServiceStartName)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpServiceStartName,
+                                -1,
+                                lpStr,
+                                wcslen(lpServiceStartName),
+                                0,
+                                0);
+        }
+        else
+        {
+            strcpy(lpStr, lpEmptyString);
+        }
+
+        lpConfig->lpServiceStartName = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+        lpStr += (strlen(lpStr) + 1);
+
+        if (lpService->lpDisplayName)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpService->lpDisplayName,
+                                -1,
+                                lpStr,
+                                wcslen(lpService->lpDisplayName),
+                                0,
+                                0);
+        }
+        else
+        {
+            strcpy(lpStr, lpEmptyString);
+        }
+
+        lpConfig->lpDisplayName = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpConfig);
+    }
+
+    if (pcbBytesNeeded != NULL)
+        *pcbBytesNeeded = dwRequiredSize;
+
+Done:;
+    if (lpImagePath != NULL)
+        HeapFree(GetProcessHeap(), 0, lpImagePath);
+
+    if (lpServiceStartName != NULL)
+        HeapFree(GetProcessHeap(), 0, lpServiceStartName);
+
+    if (hServiceKey != NULL)
+        RegCloseKey(hServiceKey);
+
+    /* FIXME: Unlock the service database */
+
+    DPRINT("RQueryServiceConfigA() done\n");
+
+    return dwError;
+}
+
+
+/* Function 30 */
+DWORD RQueryServiceLockStatusA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPQUERY_SERVICE_LOCK_STATUSA lpLockStatus,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_4K pcbBytesNeeded)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 31 */
+DWORD RStartServiceA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD argc,
+    LPSTRING_PTRSA argv)
+{
+    DWORD dwError = ERROR_SUCCESS;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+
+    DPRINT1("RStartServiceA() called\n");
+
+    if (ScmShutdown)
+        return ERROR_SHUTDOWN_IN_PROGRESS;
+
+    hSvc = (PSERVICE_HANDLE)hService;
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
+    {
+        DPRINT1("Invalid handle tag!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SERVICE_START))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    if (lpService->dwStartType == SERVICE_DISABLED)
+        return ERROR_SERVICE_DISABLED;
+
+    if (lpService->bDeleted)
+        return ERROR_SERVICE_MARKED_FOR_DELETE;
+
+    /* FIXME: Convert argument vector to Unicode */
+
+    /* Start the service */
+    dwError = ScmStartService(lpService, 0, NULL);
+
+    /* FIXME: Free argument vector */
+
+    return dwError;
+}
+
+
+/* Function 32 */
+DWORD RGetServiceDisplayNameA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPSTR lpServiceName,
+    LPSTR lpDisplayName,
+    LPBOUNDED_DWORD_4K lpcchBuffer)
+{
+//    PMANAGER_HANDLE hManager;
+    PSERVICE lpService;
+    DWORD dwLength;
+    DWORD dwError;
+    LPWSTR lpServiceNameW;
+
+    DPRINT("RGetServiceDisplayNameA() called\n");
+    DPRINT("hSCManager = %p\n", hSCManager);
+    DPRINT("lpServiceName: %s\n", lpServiceName);
+    DPRINT("lpDisplayName: %p\n", lpDisplayName);
+    DPRINT("*lpcchBuffer: %lu\n", *lpcchBuffer);
+
+//    hManager = (PMANAGER_HANDLE)hSCManager;
+//    if (hManager->Handle.Tag != MANAGER_TAG)
+//    {
+//        DPRINT1("Invalid manager handle!\n");
+//        return ERROR_INVALID_HANDLE;
+//    }
+
+    dwLength = strlen(lpServiceName) + 1;
+    lpServiceNameW = HeapAlloc(GetProcessHeap(),
+                               HEAP_ZERO_MEMORY,
+                               dwLength * sizeof(WCHAR));
+    if (!lpServiceNameW)
+        return ERROR_NOT_ENOUGH_MEMORY;
+
+    MultiByteToWideChar(CP_ACP,
+                        0,
+                        lpServiceName,
+                        strlen(lpServiceName),
+                        lpServiceNameW,
+                        dwLength);
+
+    lpService = ScmGetServiceEntryByName(lpServiceNameW);
+
+    HeapFree(GetProcessHeap(), 0, lpServiceNameW);
+
+    if (lpService == NULL)
+    {
+        DPRINT1("Could not find a service!\n");
+
+        /* If the service could not be found and lpcchBuffer is 0, windows
+           puts null in lpDisplayName and puts 1 in lpcchBuffer */
+        if (*lpcchBuffer == 0)
+        {
+            *lpcchBuffer = 1;
+            *lpDisplayName = '\0';
+        }
+        return ERROR_SERVICE_DOES_NOT_EXIST;
+    }
+
+    if (!lpService->lpDisplayName)
+    {
+        dwLength = wcslen(lpService->lpServiceName);
+        if (lpServiceName != NULL &&
+            *lpcchBuffer > dwLength)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpService->lpServiceName,
+                                wcslen(lpService->lpServiceName),
+                                lpDisplayName,
+                                *lpcchBuffer,
+                                NULL,
+                                NULL);
+            return ERROR_SUCCESS;
+        }
+    }
+    else
+    {
+        dwLength = wcslen(lpService->lpDisplayName);
+        if (lpDisplayName != NULL &&
+            *lpcchBuffer > dwLength)
+        {
+            WideCharToMultiByte(CP_ACP,
+                                0,
+                                lpService->lpDisplayName,
+                                wcslen(lpService->lpDisplayName),
+                                lpDisplayName,
+                                *lpcchBuffer,
+                                NULL,
+                                NULL);
+            return ERROR_SUCCESS;
+        }
+    }
+
+    dwError = (*lpcchBuffer > dwLength) ? ERROR_SUCCESS : ERROR_INSUFFICIENT_BUFFER;
+
+    *lpcchBuffer = dwLength * 2;
+
+    return dwError;
+}
+
+
+/* Function 33 */
+DWORD RGetServiceKeyNameA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPSTR lpDisplayName,
+    LPSTR lpServiceName,
+    LPBOUNDED_DWORD_4K lpcchBuffer)
+{
+    PSERVICE lpService;
+    DWORD dwLength;
+    DWORD dwError;
+    LPWSTR lpDisplayNameW;
+
+    DPRINT("RGetServiceKeyNameA() called\n");
+    DPRINT("hSCManager = %p\n", hSCManager);
+    DPRINT("lpDisplayName: %s\n", lpDisplayName);
+    DPRINT("lpServiceName: %p\n", lpServiceName);
+    DPRINT("*lpcchBuffer: %lu\n", *lpcchBuffer);
+
+    dwLength = strlen(lpDisplayName) + 1;
+    lpDisplayNameW = HeapAlloc(GetProcessHeap(),
+                               HEAP_ZERO_MEMORY,
+                               dwLength * sizeof(WCHAR));
+    if (!lpDisplayNameW)
+        return ERROR_NOT_ENOUGH_MEMORY;
+
+    MultiByteToWideChar(CP_ACP,
+                        0,
+                        lpDisplayName,
+                        strlen(lpDisplayName),
+                        lpDisplayNameW,
+                        dwLength);
+
+    lpService = ScmGetServiceEntryByDisplayName(lpDisplayNameW);
+
+    HeapFree(GetProcessHeap(), 0, lpDisplayNameW);
+
+    if (lpService == NULL)
+    {
+        DPRINT1("Could not find the service!\n");
+
+        /* If the service could not be found and lpcchBuffer is 0,
+           put null in lpDisplayName and puts 1 in lpcchBuffer, verified WINXP. */
+        if (*lpcchBuffer == 0)
+        {
+            *lpcchBuffer = 1;
+            *lpServiceName = '\0';
+        }
+
+        return ERROR_SERVICE_DOES_NOT_EXIST;
+    }
+
+    dwLength = wcslen(lpService->lpServiceName);
+    if (lpService != NULL &&
+        *lpcchBuffer > dwLength)
+    {
+        WideCharToMultiByte(CP_ACP,
+                            0,
+                            lpService->lpServiceName,
+                            wcslen(lpService->lpServiceName),
+                            lpServiceName,
+                            dwLength,
+                            NULL,
+                            NULL);
+        return ERROR_SUCCESS;
+    }
+
+    dwError = (*lpcchBuffer > dwLength) ? ERROR_SUCCESS : ERROR_INSUFFICIENT_BUFFER;
+
+    *lpcchBuffer = dwLength * 2;
 
     return dwError;
 }
 
 
-/* Function 32 */
-unsigned long
-ScmrGetServiceDisplayNameA(handle_t BindingHandle,
-                           unsigned int hSCManager,
-                           char *lpServiceName,
-                           char *lpDisplayName, /* [out, unique] */
-                           unsigned long *lpcchBuffer)
-{
-    DPRINT1("ScmrGetServiceDisplayNameA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
+/* Function 34 */
+DWORD RI_ScGetCurrentGroupStateW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    LPWSTR lpLoadOrderGroup,
+    LPDWORD lpState)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 35 */
+DWORD REnumServiceGroupW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    DWORD dwServiceType,
+    DWORD dwServiceState,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned,
+    LPBOUNDED_DWORD_256K lpResumeIndex,
+    LPCWSTR pszGroupName)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 36 */
+DWORD RChangeServiceConfig2A(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    SC_RPC_CONFIG_INFOA Info)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 37 */
+DWORD RChangeServiceConfig2W(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    SC_RPC_CONFIG_INFOW Info)
+{
+    DWORD dwError = ERROR_SUCCESS;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    HKEY hServiceKey = NULL;
+
+    DPRINT("RChangeServiceConfig2W() called\n");
+    DPRINT("dwInfoLevel = %lu\n", Info.dwInfoLevel);
+
+    if (ScmShutdown)
+        return ERROR_SHUTDOWN_IN_PROGRESS;
+
+    hSvc = (PSERVICE_HANDLE)hService;
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
+    {
+        DPRINT1("Invalid handle tag!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SERVICE_CHANGE_CONFIG))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    /* FIXME: Lock database exclusively */
+
+    if (lpService->bDeleted)
+    {
+        /* FIXME: Unlock database */
+        DPRINT1("The service has already been marked for delete!\n");
+        return ERROR_SERVICE_MARKED_FOR_DELETE;
+    }
+
+    /* Open the service key */
+    dwError = ScmOpenServiceKey(lpService->szServiceName,
+                                KEY_SET_VALUE,
+                                &hServiceKey);
+    if (dwError != ERROR_SUCCESS)
+        goto done;
 
+    if (Info.dwInfoLevel & SERVICE_CONFIG_DESCRIPTION)
+    {
+        LPSERVICE_DESCRIPTIONW lpServiceDescription;
 
-/* Function 33 */
-unsigned long
-ScmrGetServiceKeyNameA(handle_t BindingHandle,
-                       unsigned int hSCManager,
-                       char *lpDisplayName,
-                       char *lpServiceName, /* [out, unique] */
-                       unsigned long *lpcchBuffer)
-{
-    DPRINT1("ScmrGetServiceKeyNameA() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
+        lpServiceDescription = (LPSERVICE_DESCRIPTIONW)&Info;
+        lpServiceDescription->lpDescription = (LPWSTR)(&Info + sizeof(LPSERVICE_DESCRIPTIONW));
 
+        if (lpServiceDescription != NULL &&
+            lpServiceDescription->lpDescription != NULL)
+        {
+            RegSetValueExW(hServiceKey,
+                           L"Description",
+                           0,
+                           REG_SZ,
+                           (LPBYTE)lpServiceDescription->lpDescription,
+                           (wcslen(lpServiceDescription->lpDescription) + 1) * sizeof(WCHAR));
 
-/* Function 34 */
-unsigned long
-ScmrGetCurrentGroupStateW(handle_t BindingHandle)
-{
-    DPRINT1("ScmrGetCurrentGroupStateW() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
+            if (dwError != ERROR_SUCCESS)
+                goto done;
+        }
+    }
+    else if (Info.dwInfoLevel & SERVICE_CONFIG_FAILURE_ACTIONS)
+    {
+        UNIMPLEMENTED;
+        dwError = ERROR_CALL_NOT_IMPLEMENTED;
+        goto done;
+    }
+
+done:
+    /* FIXME: Unlock database */
+    if (hServiceKey != NULL)
+        RegCloseKey(hServiceKey);
+
+    DPRINT("RChangeServiceConfig2W() done (Error %lu)\n", dwError);
+
+    return dwError;
 }
 
 
-/* Function 35 */
-unsigned long
-ScmrEnumServiceGroupW(handle_t BindingHandle)
+/* Function 38 */
+DWORD RQueryServiceConfig2A(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwInfoLevel,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_8K pcbBytesNeeded)
 {
-    DPRINT1("ScmrEnumServiceGroupW() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
+    DWORD dwError = ERROR_SUCCESS;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    HKEY hServiceKey = NULL;
+    DWORD dwRequiredSize;
+    LPWSTR lpDescriptionW = NULL;
+    LPSTR lpDescription = NULL;
 
+    DPRINT("RQueryServiceConfig2W() called\n");
 
-/* Function 36 */
-unsigned long
-ScmrChangeServiceConfig2A(handle_t BindingHandle,
-                          unsigned int hService,
-                          unsigned long dwInfoLevel,
-                          unsigned char *lpInfo,
-                          unsigned long dwInfoSize)
-{
-    DPRINT1("ScmrChangeServiceConfig2A() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
+    if (!lpBuffer)
+        return ERROR_INVALID_ADDRESS;
 
+    if (ScmShutdown)
+        return ERROR_SHUTDOWN_IN_PROGRESS;
 
-/* Function 37 */
-unsigned long
-ScmrChangeServiceConfig2W(handle_t BindingHandle,
-                          unsigned int hService,
-                          unsigned long dwInfoLevel,
-                          unsigned char *lpInfo,
-                          unsigned long dwInfoSize)
-{
-    DPRINT1("ScmrChangeServiceConfig2W() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
-}
+    hSvc = (PSERVICE_HANDLE)hService;
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
+    {
+        DPRINT1("Invalid handle tag!\n");
+        return ERROR_INVALID_HANDLE;
+    }
 
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SERVICE_QUERY_CONFIG))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
 
-/* Function 38 */
-unsigned long
-ScmrQueryServiceConfig2A(handle_t BindingHandle,
-                         unsigned int hService,
-                         unsigned long dwInfoLevel,
-                         unsigned char *lpBuffer,
-                         unsigned long cbBufSize,
-                         unsigned long *pcbBytesNeeded)
-{
-    DPRINT1("ScmrQueryServiceConfig2A() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    /* FIXME: Lock the service database shared */
+
+    dwError = ScmOpenServiceKey(lpService->lpServiceName,
+                                KEY_READ,
+                                &hServiceKey);
+    if (dwError != ERROR_SUCCESS)
+        goto done;
+
+    if (dwInfoLevel & SERVICE_CONFIG_DESCRIPTION)
+    {
+        LPSERVICE_DESCRIPTIONA lpServiceDescription = (LPSERVICE_DESCRIPTIONA)lpBuffer;
+        LPSTR lpStr;
+
+        dwError = ScmReadString(hServiceKey,
+                                L"Description",
+                                &lpDescriptionW);
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        dwRequiredSize = sizeof(SERVICE_DESCRIPTIONA) + ((wcslen(lpDescriptionW) + 1));
+
+        if (cbBufSize < dwRequiredSize)
+        {
+            *pcbBytesNeeded = dwRequiredSize;
+            dwError = ERROR_INSUFFICIENT_BUFFER;
+            goto done;
+        }
+
+        lpStr = (LPSTR)(lpServiceDescription + 1);
+
+        WideCharToMultiByte(CP_ACP,
+                            0,
+                            lpDescriptionW,
+                            -1,
+                            lpStr,
+                            wcslen(lpDescriptionW),
+                            NULL,
+                            NULL);
+        lpServiceDescription->lpDescription = (LPSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServiceDescription);
+    }
+    else if (dwInfoLevel & SERVICE_CONFIG_FAILURE_ACTIONS)
+    {
+        UNIMPLEMENTED;
+        dwError = ERROR_CALL_NOT_IMPLEMENTED;
+        goto done;
+    }
+
+done:
+    if (lpDescription != NULL)
+        HeapFree(GetProcessHeap(), 0, lpDescription);
+
+    if (hServiceKey != NULL)
+        RegCloseKey(hServiceKey);
+
+    /* FIXME: Unlock database */
+
+    DPRINT("RQueryServiceConfig2W() done (Error %lu)\n", dwError);
+
+    return dwError;
 }
 
 
 /* Function 39 */
-unsigned long
-ScmrQueryServiceConfig2W(handle_t BindingHandle,
-                         unsigned int hService,
-                         unsigned long dwInfoLevel,
-                         unsigned char *lpBuffer,
-                         unsigned long cbBufSize,
-                         unsigned long *pcbBytesNeeded)
-{
-    DPRINT1("ScmrQueryServiceConfig2W() is unimplemented\n");
-    return ERROR_CALL_NOT_IMPLEMENTED;
+DWORD RQueryServiceConfig2W(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwInfoLevel,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_8K pcbBytesNeeded)
+{
+    DWORD dwError = ERROR_SUCCESS;
+    PSERVICE_HANDLE hSvc;
+    PSERVICE lpService = NULL;
+    HKEY hServiceKey = NULL;
+    DWORD dwRequiredSize;
+    LPWSTR lpDescription = NULL;
+
+    DPRINT("RQueryServiceConfig2W() called\n");
+
+    if (!lpBuffer)
+        return ERROR_INVALID_ADDRESS;
+
+    if (ScmShutdown)
+        return ERROR_SHUTDOWN_IN_PROGRESS;
+
+    hSvc = (PSERVICE_HANDLE)hService;
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
+    {
+        DPRINT1("Invalid handle tag!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    if (!RtlAreAllAccessesGranted(hSvc->Handle.DesiredAccess,
+                                  SERVICE_QUERY_CONFIG))
+    {
+        DPRINT1("Insufficient access rights! 0x%lx\n", hSvc->Handle.DesiredAccess);
+        return ERROR_ACCESS_DENIED;
+    }
+
+    lpService = hSvc->ServiceEntry;
+    if (lpService == NULL)
+    {
+        DPRINT1("lpService == NULL!\n");
+        return ERROR_INVALID_HANDLE;
+    }
+
+    /* FIXME: Lock the service database shared */
+
+    dwError = ScmOpenServiceKey(lpService->lpServiceName,
+                                KEY_READ,
+                                &hServiceKey);
+    if (dwError != ERROR_SUCCESS)
+        goto done;
+
+    if (dwInfoLevel & SERVICE_CONFIG_DESCRIPTION)
+    {
+        LPSERVICE_DESCRIPTIONW lpServiceDescription = (LPSERVICE_DESCRIPTIONW)lpBuffer;
+        LPWSTR lpStr;
+
+        dwError = ScmReadString(hServiceKey,
+                                L"Description",
+                                &lpDescription);
+        if (dwError != ERROR_SUCCESS)
+            goto done;
+
+        dwRequiredSize = sizeof(SERVICE_DESCRIPTIONW) + ((wcslen(lpDescription) + 1) * sizeof(WCHAR));
+
+        if (cbBufSize < dwRequiredSize)
+        {
+            *pcbBytesNeeded = dwRequiredSize;
+            dwError = ERROR_INSUFFICIENT_BUFFER;
+            goto done;
+        }
+
+        lpStr = (LPWSTR)(lpServiceDescription + 1);
+        wcscpy(lpStr, lpDescription);
+        lpServiceDescription->lpDescription = (LPWSTR)((ULONG_PTR)lpStr - (ULONG_PTR)lpServiceDescription);
+    }
+    else if (dwInfoLevel & SERVICE_CONFIG_FAILURE_ACTIONS)
+    {
+        UNIMPLEMENTED;
+        dwError = ERROR_CALL_NOT_IMPLEMENTED;
+        goto done;
+    }
+
+done:
+    if (lpDescription != NULL)
+        HeapFree(GetProcessHeap(), 0, lpDescription);
+
+    if (hServiceKey != NULL)
+        RegCloseKey(hServiceKey);
+
+    /* FIXME: Unlock database */
+
+    DPRINT("RQueryServiceConfig2W() done (Error %lu)\n", dwError);
+
+    return dwError;
 }
 
 
 /* Function 40 */
-unsigned long
-ScmrQueryServiceStatusEx(handle_t BindingHandle,
-                         unsigned int hService,
-                         unsigned long InfoLevel,
-                         unsigned char *lpBuffer, /* out */
-                         unsigned long cbBufSize,
-                         unsigned long *pcbBytesNeeded) /* out */
+DWORD RQueryServiceStatusEx(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    SC_STATUS_TYPE InfoLevel,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_8K pcbBytesNeeded)
 {
     LPSERVICE_STATUS_PROCESS lpStatus;
     PSERVICE_HANDLE hSvc;
     PSERVICE lpService;
 
-    DPRINT("ScmrQueryServiceStatusEx() called\n");
+    DPRINT("RQueryServiceStatusEx() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
@@ -2279,7 +4251,7 @@ ScmrQueryServiceStatusEx(handle_t BindingHandle,
         return ERROR_INSUFFICIENT_BUFFER;
 
     hSvc = (PSERVICE_HANDLE)hService;
-    if (hSvc->Handle.Tag != SERVICE_TAG)
+    if (!hSvc || hSvc->Handle.Tag != SERVICE_TAG)
     {
         DPRINT1("Invalid handle tag!\n");
         return ERROR_INVALID_HANDLE;
@@ -2314,20 +4286,20 @@ ScmrQueryServiceStatusEx(handle_t BindingHandle,
 
 
 /* Function 41 */
-unsigned long
-ScmrEnumServicesStatusExA(handle_t BindingHandle,
-                          unsigned int hSCManager,
-                          unsigned long InfoLevel,
-                          unsigned long dwServiceType,
-                          unsigned long dwServiceState,
-                          unsigned char *lpServices,
-                          unsigned long dwBufSize,
-                          unsigned long *pcbBytesNeeded,
-                          unsigned long *lpServicesReturned,
-                          unsigned long *lpResumeHandle,
-                          char *pszGroupName)
-{
-    DPRINT1("ScmrEnumServicesStatusExA() is unimplemented\n");
+DWORD REnumServicesStatusExA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    SC_ENUM_TYPE InfoLevel,
+    DWORD dwServiceType,
+    DWORD dwServiceState,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned,
+    LPBOUNDED_DWORD_256K lpResumeIndex,
+    LPCSTR pszGroupName)
+{
+    UNIMPLEMENTED;
     *pcbBytesNeeded = 0;
     *lpServicesReturned = 0;
     return ERROR_CALL_NOT_IMPLEMENTED;
@@ -2335,18 +4307,18 @@ ScmrEnumServicesStatusExA(handle_t BindingHandle,
 
 
 /* Function 42 */
-unsigned long
-ScmrEnumServicesStatusExW(handle_t BindingHandle,
-                          unsigned int hSCManager,
-                          unsigned long InfoLevel,
-                          unsigned long dwServiceType,
-                          unsigned long dwServiceState,
-                          unsigned char *lpServices,
-                          unsigned long dwBufSize,
-                          unsigned long *pcbBytesNeeded,
-                          unsigned long *lpServicesReturned,
-                          unsigned long *lpResumeHandle,
-                          wchar_t *pszGroupName)
+DWORD REnumServicesStatusExW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hSCManager,
+    SC_ENUM_TYPE InfoLevel,
+    DWORD dwServiceType,
+    DWORD dwServiceState,
+    LPBYTE lpBuffer,
+    DWORD cbBufSize,
+    LPBOUNDED_DWORD_256K pcbBytesNeeded,
+    LPBOUNDED_DWORD_256K lpServicesReturned,
+    LPBOUNDED_DWORD_256K lpResumeIndex,
+    LPCWSTR pszGroupName)
 {
     PMANAGER_HANDLE hManager;
     PSERVICE lpService;
@@ -2361,7 +4333,7 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
     LPENUM_SERVICE_STATUS_PROCESSW lpStatusPtr;
     LPWSTR lpStringPtr;
 
-    DPRINT("ScmrEnumServicesStatusExW() called\n");
+    DPRINT("REnumServicesStatusExW() called\n");
 
     if (ScmShutdown)
         return ERROR_SHUTDOWN_IN_PROGRESS;
@@ -2370,7 +4342,7 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
         return ERROR_INVALID_LEVEL;
 
     hManager = (PMANAGER_HANDLE)hSCManager;
-    if (hManager->Handle.Tag != MANAGER_TAG)
+    if (!hManager || hManager->Handle.Tag != MANAGER_TAG)
     {
         DPRINT1("Invalid manager handle!\n");
         return ERROR_INVALID_HANDLE;
@@ -2388,7 +4360,7 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
     *pcbBytesNeeded = 0;
     *lpServicesReturned = 0;
 
-    dwLastResumeCount = *lpResumeHandle;
+    dwLastResumeCount = *lpResumeIndex;
 
     /* Lock the service list shared */
 
@@ -2439,7 +4411,7 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
                  ((wcslen(CurrentService->lpServiceName) + 1) * sizeof(WCHAR)) +
                  ((wcslen(CurrentService->lpDisplayName) + 1) * sizeof(WCHAR));
 
-        if (dwRequiredSize + dwSize <= dwBufSize)
+        if (dwRequiredSize + dwSize <= cbBufSize)
         {
             DPRINT("Service name: %S  fit\n", CurrentService->lpServiceName);
             dwRequiredSize += dwSize;
@@ -2499,12 +4471,12 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
 
     DPRINT("*pcbBytesNeeded: %lu\n", dwRequiredSize);
 
-    *lpResumeHandle = dwLastResumeCount;
+    *lpResumeIndex = dwLastResumeCount;
     *lpServicesReturned = dwServiceCount;
     *pcbBytesNeeded = dwRequiredSize;
 
-    lpStatusPtr = (LPENUM_SERVICE_STATUS_PROCESSW)lpServices;
-    lpStringPtr = (LPWSTR)((ULONG_PTR)lpServices +
+    lpStatusPtr = (LPENUM_SERVICE_STATUS_PROCESSW)lpBuffer;
+    lpStringPtr = (LPWSTR)((ULONG_PTR)lpBuffer +
                            dwServiceCount * sizeof(ENUM_SERVICE_STATUS_PROCESSW));
 
     dwRequiredSize = 0;
@@ -2545,18 +4517,18 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
                  ((wcslen(CurrentService->lpServiceName) + 1) * sizeof(WCHAR)) +
                  ((wcslen(CurrentService->lpDisplayName) + 1) * sizeof(WCHAR));
 
-        if (dwRequiredSize + dwSize <= dwBufSize)
+        if (dwRequiredSize + dwSize <= cbBufSize)
         {
             /* Copy the service name */
             wcscpy(lpStringPtr,
                    CurrentService->lpServiceName);
-            lpStatusPtr->lpServiceName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpServices);
+            lpStatusPtr->lpServiceName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpBuffer);
             lpStringPtr += (wcslen(CurrentService->lpServiceName) + 1);
 
             /* Copy the display name */
             wcscpy(lpStringPtr,
                    CurrentService->lpDisplayName);
-            lpStatusPtr->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpServices);
+            lpStatusPtr->lpDisplayName = (LPWSTR)((ULONG_PTR)lpStringPtr - (ULONG_PTR)lpBuffer);
             lpStringPtr += (wcslen(CurrentService->lpDisplayName) + 1);
 
             /* Copy the status information */
@@ -2579,14 +4551,173 @@ ScmrEnumServicesStatusExW(handle_t BindingHandle,
 Done:;
     /* Unlock the service list */
 
-    DPRINT("ScmrEnumServicesStatusExW() done (Error %lu)\n", dwError);
+    DPRINT("REnumServicesStatusExW() done (Error %lu)\n", dwError);
 
     return dwError;
 }
 
 
 /* Function 43 */
-/* ScmrSendTSMessage */
+DWORD RSendTSMessage(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 44 */
+DWORD RCreateServiceWOW64A(
+    handle_t BindingHandle,
+    LPSTR lpServiceName,
+    LPSTR lpDisplayName,
+    DWORD dwDesiredAccess,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPSTR lpBinaryPathName,
+    LPSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPBYTE lpDependencies,
+    DWORD dwDependSize,
+    LPSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPSC_RPC_HANDLE lpServiceHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 45 */
+DWORD RCreateServiceWOW64W(
+    handle_t BindingHandle,
+    LPWSTR lpServiceName,
+    LPWSTR lpDisplayName,
+    DWORD dwDesiredAccess,
+    DWORD dwServiceType,
+    DWORD dwStartType,
+    DWORD dwErrorControl,
+    LPWSTR lpBinaryPathName,
+    LPWSTR lpLoadOrderGroup,
+    LPDWORD lpdwTagId,
+    LPBYTE lpDependencies,
+    DWORD dwDependSize,
+    LPWSTR lpServiceStartName,
+    LPBYTE lpPassword,
+    DWORD dwPwSize,
+    LPSC_RPC_HANDLE lpServiceHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 46 */
+DWORD RQueryServiceTagInfo(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 47 */
+DWORD RNotifyServiceStatusChange(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    SC_RPC_NOTIFY_PARAMS NotifyParams,
+    GUID *pClientProcessGuid,
+    GUID *pSCMProcessGuid,
+    PBOOL pfCreateRemoteQueue,
+    LPSC_NOTIFY_RPC_HANDLE phNotify)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 48 */
+DWORD RGetNotifyResults(
+    handle_t BindingHandle,
+    SC_NOTIFY_RPC_HANDLE hNotify,
+    PSC_RPC_NOTIFY_PARAMS_LIST *ppNotifyParams)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 49 */
+DWORD RCloseNotifyHandle(
+    handle_t BindingHandle,
+    LPSC_NOTIFY_RPC_HANDLE phNotify,
+    PBOOL pfApcFired)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 50 */
+DWORD RControlServiceExA(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwControl,
+    DWORD dwInfoLevel)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 51 */
+DWORD RControlServiceExW(
+    handle_t BindingHandle,
+    SC_RPC_HANDLE hService,
+    DWORD dwControl,
+    DWORD dwInfoLevel)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 52 */
+DWORD RSendPnPMessage(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 53 */
+DWORD RValidatePnPService(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 54 */
+DWORD ROpenServiceStatusHandle(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
+
+
+/* Function 55 */
+DWORD RFunction55(
+    handle_t BindingHandle)
+{
+    UNIMPLEMENTED;
+    return ERROR_CALL_NOT_IMPLEMENTED;
+}
 
 
 void __RPC_FAR * __RPC_USER midl_user_allocate(size_t len)
@@ -2600,4 +4731,20 @@ void __RPC_USER midl_user_free(void __RPC_FAR * ptr)
     HeapFree(GetProcessHeap(), 0, ptr);
 }
 
+
+void __RPC_USER SC_RPC_HANDLE_rundown(SC_RPC_HANDLE hSCObject)
+{
+}
+
+
+void __RPC_USER SC_RPC_LOCK_rundown(SC_RPC_LOCK Lock)
+{
+}
+
+
+void __RPC_USER SC_NOTIFY_RPC_HANDLE_rundown(SC_NOTIFY_RPC_HANDLE hNotify)
+{
+}
+
+
 /* EOF */