From: Amine Khaldi <amine.khaldi@reactos.org>
Date: Tue, 17 Nov 2015 10:08:00 +0000 (+0000)
Subject: [RPCRT4] Sync with Wine Staging 1.7.55. CORE-10536
X-Git-Tag: ReactOS-0.4.0~154
X-Git-Url: https://git.reactos.org/?p=reactos.git;a=commitdiff_plain;h=ada28839e7b859628dfda22c999d7be99f0e04b9

[RPCRT4] Sync with Wine Staging 1.7.55. CORE-10536

svn path=/trunk/; revision=69906
---

diff --git a/reactos/dll/win32/rpcrt4/CMakeLists.txt b/reactos/dll/win32/rpcrt4/CMakeLists.txt
index 31ad2e4741f..fc18421943a 100644
--- a/reactos/dll/win32/rpcrt4/CMakeLists.txt
+++ b/reactos/dll/win32/rpcrt4/CMakeLists.txt
@@ -1,4 +1,7 @@
 
+remove_definitions(-D_WIN32_WINNT=0x502)
+add_definitions(-D_WIN32_WINNT=0x600)
+
 include_directories(BEFORE ${REACTOS_SOURCE_DIR}/include/reactos/wine)
 spec2def(rpcrt4.dll rpcrt4.spec ADD_IMPORTLIB)
 add_rpc_files(client epm.idl)
@@ -49,6 +52,6 @@ add_library(rpcrt4 SHARED
 set_module_type(rpcrt4 win32dll)
 target_link_libraries(rpcrt4 wine uuid ${PSEH_LIB})
 add_delay_importlibs(rpcrt4 iphlpapi wininet secur32 user32)
-add_importlibs(rpcrt4 advapi32 ws2_32 shlwapi msvcrt kernel32 ntdll)
+add_importlibs(rpcrt4 advapi32 advapi32_vista ws2_32 msvcrt kernel32 ntdll)
 add_pch(rpcrt4 precomp.h SOURCE)
 add_cd_file(TARGET rpcrt4 DESTINATION reactos/system32 FOR all)
diff --git a/reactos/dll/win32/rpcrt4/cpsf.c b/reactos/dll/win32/rpcrt4/cpsf.c
index 888b057c73d..d4e3f9965ae 100644
--- a/reactos/dll/win32/rpcrt4/cpsf.c
+++ b/reactos/dll/win32/rpcrt4/cpsf.c
@@ -314,7 +314,7 @@ HRESULT WINAPI NdrDllUnregisterProxy(HMODULE hDll,
 
       strcpyW( keyname, interfaceW );
       format_clsid( keyname + strlenW(keyname), proxy->header.piid );
-      SHDeleteKeyW(HKEY_CLASSES_ROOT, keyname);
+      RegDeleteTreeW(HKEY_CLASSES_ROOT, keyname);
     }
     pProxyFileList++;
   }
@@ -322,7 +322,7 @@ HRESULT WINAPI NdrDllUnregisterProxy(HMODULE hDll,
   /* unregister clsid */
   strcpyW( keyname, clsidW );
   strcatW( keyname, clsid );
-  SHDeleteKeyW(HKEY_CLASSES_ROOT, keyname);
+  RegDeleteTreeW(HKEY_CLASSES_ROOT, keyname);
 
   return S_OK;
 }
diff --git a/reactos/dll/win32/rpcrt4/cstub.c b/reactos/dll/win32/rpcrt4/cstub.c
index ec4b0fc7063..7c78f1c82e6 100644
--- a/reactos/dll/win32/rpcrt4/cstub.c
+++ b/reactos/dll/win32/rpcrt4/cstub.c
@@ -41,7 +41,7 @@ typedef struct
 
 static inline cstdstubbuffer_delegating_t *impl_from_delegating( IRpcStubBuffer *iface )
 {
-    return (cstdstubbuffer_delegating_t*)((char *)iface - FIELD_OFFSET(cstdstubbuffer_delegating_t, stub_buffer));
+    return CONTAINING_RECORD(iface, cstdstubbuffer_delegating_t, stub_buffer);
 }
 
 HRESULT CStdStubBuffer_Construct(REFIID riid,
diff --git a/reactos/dll/win32/rpcrt4/ndr_clientserver.c b/reactos/dll/win32/rpcrt4/ndr_clientserver.c
index b65b39ec31e..d0920412d83 100644
--- a/reactos/dll/win32/rpcrt4/ndr_clientserver.c
+++ b/reactos/dll/win32/rpcrt4/ndr_clientserver.c
@@ -105,6 +105,7 @@ unsigned char* WINAPI NdrServerInitializeNew( PRPC_MESSAGE pRpcMsg, PMIDL_STUB_M
   pStubMsg->pPointerQueueState = NULL;
   pStubMsg->IgnoreEmbeddedPointers = 0;
   pStubMsg->PointerBufferMark = NULL;
+  pStubMsg->CorrDespIncrement = 0;
   pStubMsg->uFlags = 0;
   pStubMsg->UniquePtrCount = 0;
   pStubMsg->pfnAllocate = pStubDesc->pfnAllocate;
diff --git a/reactos/dll/win32/rpcrt4/ndr_contexthandle.c b/reactos/dll/win32/rpcrt4/ndr_contexthandle.c
index 4855be3b100..eedd4a7f702 100644
--- a/reactos/dll/win32/rpcrt4/ndr_contexthandle.c
+++ b/reactos/dll/win32/rpcrt4/ndr_contexthandle.c
@@ -84,7 +84,7 @@ RPC_BINDING_HANDLE WINAPI NDRCContextBinding(NDR_CCONTEXT CContext)
     if (!handle)
     {
         ERR("invalid handle %p\n", CContext);
-        RpcRaiseException(ERROR_INVALID_HANDLE);
+        RpcRaiseException(RPC_X_SS_CONTEXT_MISMATCH);
     }
     return handle;
 }
@@ -150,7 +150,15 @@ void WINAPI RpcSsDestroyClientContext(void **ContextHandle)
         RpcRaiseException(status);
 }
 
-static UINT ndr_update_context_handle(NDR_CCONTEXT *CContext,
+/***********************************************************************
+ *           RpcSsDontSerializeContext [RPCRT4.@]
+ */
+ void WINAPI RpcSsDontSerializeContext(void)
+{
+    FIXME("stub\n");
+}
+
+static RPC_STATUS ndr_update_context_handle(NDR_CCONTEXT *CContext,
                                       RPC_BINDING_HANDLE hBinding,
                                       const ndr_context_handle *chi)
 {
@@ -163,7 +171,7 @@ static UINT ndr_update_context_handle(NDR_CCONTEXT *CContext,
         {
             che = get_context_entry(*CContext);
             if (!che)
-                return ERROR_INVALID_HANDLE;
+                return RPC_X_SS_CONTEXT_MISMATCH;
             list_remove(&che->entry);
             RpcBindingFree(&che->handle);
             HeapFree(GetProcessHeap(), 0, che);
@@ -175,7 +183,7 @@ static UINT ndr_update_context_handle(NDR_CCONTEXT *CContext,
     {
         che = HeapAlloc(GetProcessHeap(), 0, sizeof *che);
         if (!che)
-            return ERROR_NOT_ENOUGH_MEMORY;
+            return RPC_X_NO_MEMORY;
         che->magic = NDR_CONTEXT_HANDLE_MAGIC;
         RpcBindingCopy(hBinding, &che->handle);
         list_add_tail(&context_handle_list, &che->entry);
@@ -184,7 +192,7 @@ static UINT ndr_update_context_handle(NDR_CCONTEXT *CContext,
 
     *CContext = che;
 
-    return ERROR_SUCCESS;
+    return RPC_S_OK;
 }
 
 /***********************************************************************
@@ -194,16 +202,16 @@ void WINAPI NDRCContextUnmarshall(NDR_CCONTEXT *CContext,
                                   RPC_BINDING_HANDLE hBinding,
                                   void *pBuff, ULONG DataRepresentation)
 {
-    UINT r;
+    RPC_STATUS status;
 
     TRACE("*%p=(%p) %p %p %08x\n",
           CContext, *CContext, hBinding, pBuff, DataRepresentation);
 
     EnterCriticalSection(&ndr_context_cs);
-    r = ndr_update_context_handle(CContext, hBinding, pBuff);
+    status = ndr_update_context_handle(CContext, hBinding, pBuff);
     LeaveCriticalSection(&ndr_context_cs);
-    if (r)
-        RpcRaiseException(r);
+    if (status)
+        RpcRaiseException(status);
 }
 
 /***********************************************************************
@@ -248,7 +256,7 @@ void WINAPI NDRSContextMarshall2(RPC_BINDING_HANDLE hBinding,
           hBinding, SContext, pBuff, userRunDownIn, CtxGuard, Flags);
 
     if (!binding->server || !binding->Assoc)
-        RpcRaiseException(ERROR_INVALID_HANDLE);
+        RpcRaiseException(RPC_S_INVALID_BINDING);
 
     if (Flags & RPC_CONTEXT_HANDLE_FLAGS)
         FIXME("unimplemented flags: 0x%x\n", Flags & RPC_CONTEXT_HANDLE_FLAGS);
@@ -267,7 +275,7 @@ void WINAPI NDRSContextMarshall2(RPC_BINDING_HANDLE hBinding,
     else
     {
         if (!RpcContextHandle_IsGuardCorrect(SContext, CtxGuard))
-            RpcRaiseException(ERROR_INVALID_HANDLE);
+            RpcRaiseException(RPC_X_SS_CONTEXT_MISMATCH);
         memset(ndr, 0, sizeof(*ndr));
 
         RPCRT4_RemoveThreadContextHandle(SContext);
@@ -322,7 +330,7 @@ NDR_SCONTEXT WINAPI NDRSContextUnmarshall2(RPC_BINDING_HANDLE hBinding,
           hBinding, pBuff, DataRepresentation, CtxGuard, Flags);
 
     if (!binding->server || !binding->Assoc)
-        RpcRaiseException(ERROR_INVALID_HANDLE);
+        RpcRaiseException(RPC_S_INVALID_BINDING);
 
     if (Flags & RPC_CONTEXT_HANDLE_FLAGS)
         FIXME("unimplemented flags: 0x%x\n", Flags & RPC_CONTEXT_HANDLE_FLAGS);
@@ -336,7 +344,7 @@ NDR_SCONTEXT WINAPI NDRSContextUnmarshall2(RPC_BINDING_HANDLE hBinding,
         if (context_ndr->attributes)
         {
             ERR("non-null attributes 0x%x\n", context_ndr->attributes);
-            status = ERROR_INVALID_HANDLE;
+            status = RPC_X_SS_CONTEXT_MISMATCH;
         }
         else
             status = RpcServerAssoc_FindContextHandle(binding->Assoc,
diff --git a/reactos/dll/win32/rpcrt4/ndr_es.c b/reactos/dll/win32/rpcrt4/ndr_es.c
index 95a230349be..b487f60ad7a 100644
--- a/reactos/dll/win32/rpcrt4/ndr_es.c
+++ b/reactos/dll/win32/rpcrt4/ndr_es.c
@@ -30,6 +30,7 @@ static inline void init_MIDL_ES_MESSAGE(MIDL_ES_MESSAGE *pEsMsg)
     /* even if we are unmarshalling, as we don't want pointers to be pointed
      * to buffer memory */
     pEsMsg->StubMsg.IsClient = TRUE;
+    pEsMsg->MesVersion = 1;
 }
 
 /***********************************************************************
@@ -45,7 +46,7 @@ RPC_STATUS WINAPI MesEncodeIncrementalHandleCreate(
 
     pEsMsg = HeapAlloc(GetProcessHeap(), 0, sizeof(*pEsMsg));
     if (!pEsMsg)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     init_MIDL_ES_MESSAGE(pEsMsg);
 
@@ -72,7 +73,7 @@ RPC_STATUS WINAPI MesDecodeIncrementalHandleCreate(
 
     pEsMsg = HeapAlloc(GetProcessHeap(), 0, sizeof(*pEsMsg));
     if (!pEsMsg)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     init_MIDL_ES_MESSAGE(pEsMsg);
 
@@ -110,6 +111,40 @@ RPC_STATUS WINAPI MesIncrementalHandleReset(
     return RPC_S_OK;
 }
 
+/***********************************************************************
+ *            MesBufferHandleReset [RPCRT4.@]
+ */
+RPC_STATUS WINAPI MesBufferHandleReset(handle_t Handle, ULONG HandleStyle,
+    MIDL_ES_CODE Operation, char **Buffer, ULONG BufferSize, ULONG *EncodedSize)
+{
+    MIDL_ES_MESSAGE *pEsMsg = (MIDL_ES_MESSAGE *)Handle;
+
+    TRACE("(%p, %u, %d, %p, %u, %p)\n", Handle, HandleStyle, Operation, Buffer,
+        BufferSize, EncodedSize);
+
+    if (!Handle || !Buffer || !EncodedSize)
+        return RPC_S_INVALID_ARG;
+
+    if (Operation != MES_ENCODE && Operation != MES_DECODE && Operation != MES_ENCODE_NDR64)
+        return RPC_S_INVALID_ARG;
+
+    if (HandleStyle != MES_FIXED_BUFFER_HANDLE && HandleStyle != MES_DYNAMIC_BUFFER_HANDLE)
+        return RPC_S_INVALID_ARG;
+
+    init_MIDL_ES_MESSAGE(pEsMsg);
+
+    pEsMsg->Operation = Operation;
+    pEsMsg->HandleStyle = HandleStyle;
+    if (HandleStyle == MES_FIXED_BUFFER_HANDLE)
+        pEsMsg->Buffer = (unsigned char*)*Buffer;
+    else
+        pEsMsg->pDynBuffer = (unsigned char**)Buffer;
+    pEsMsg->BufferSize = BufferSize;
+    pEsMsg->pEncodedSize = EncodedSize;
+
+    return RPC_S_OK;
+}
+
 /***********************************************************************
  *            MesHandleFree [RPCRT4.@]
  */
@@ -120,6 +155,17 @@ RPC_STATUS WINAPI MesHandleFree(handle_t Handle)
     return RPC_S_OK;
 }
 
+static RPC_STATUS validate_mes_buffer_pointer(const char *Buffer)
+{
+    if (!Buffer)
+        return RPC_S_INVALID_ARG;
+
+    if (((ULONG_PTR)Buffer & 7) != 0)
+        return RPC_X_INVALID_BUFFER;
+
+    return RPC_S_OK;
+}
+
 /***********************************************************************
  *            MesEncodeFixedBufferHandleCreate [RPCRT4.@]
  */
@@ -127,12 +173,21 @@ RPC_STATUS RPC_ENTRY MesEncodeFixedBufferHandleCreate(
     char *Buffer, ULONG BufferSize, ULONG *pEncodedSize, handle_t *pHandle)
 {
     MIDL_ES_MESSAGE *pEsMsg;
+    RPC_STATUS status;
 
     TRACE("(%p, %d, %p, %p)\n", Buffer, BufferSize, pEncodedSize, pHandle);
 
+    if ((status = validate_mes_buffer_pointer(Buffer)))
+        return status;
+
+    if (!pEncodedSize)
+        return RPC_S_INVALID_ARG;
+
+    /* FIXME: check BufferSize too */
+
     pEsMsg = HeapAlloc(GetProcessHeap(), 0, sizeof(*pEsMsg));
     if (!pEsMsg)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     init_MIDL_ES_MESSAGE(pEsMsg);
 
@@ -150,10 +205,29 @@ RPC_STATUS RPC_ENTRY MesEncodeFixedBufferHandleCreate(
 /***********************************************************************
  *            MesEncodeDynBufferHandleCreate [RPCRT4.@]
  */
-RPC_STATUS RPC_ENTRY MesEncodeDynBufferHandleCreate(char **ppBuffer,
+RPC_STATUS RPC_ENTRY MesEncodeDynBufferHandleCreate(char **Buffer,
         ULONG *pEncodedSize, handle_t *pHandle)
 {
-    FIXME("%p %p %p stub\n", ppBuffer, pEncodedSize, pHandle);
+    MIDL_ES_MESSAGE *pEsMsg;
+
+    TRACE("(%p, %p, %p)\n", Buffer, pEncodedSize, pHandle);
+
+    if (!pEncodedSize)
+        return RPC_S_INVALID_ARG;
+
+    pEsMsg = HeapAlloc(GetProcessHeap(), 0, sizeof(*pEsMsg));
+    if (!pEsMsg)
+        return RPC_S_OUT_OF_MEMORY;
+
+    init_MIDL_ES_MESSAGE(pEsMsg);
+
+    pEsMsg->Operation = MES_ENCODE;
+    pEsMsg->HandleStyle = MES_DYNAMIC_BUFFER_HANDLE;
+    pEsMsg->pDynBuffer = (unsigned char **)Buffer;
+    pEsMsg->pEncodedSize = pEncodedSize;
+
+    *pHandle = (handle_t)pEsMsg;
+
     return RPC_S_OK;
 }
 
@@ -164,12 +238,16 @@ RPC_STATUS RPC_ENTRY MesDecodeBufferHandleCreate(
     char *Buffer, ULONG BufferSize, handle_t *pHandle)
 {
     MIDL_ES_MESSAGE *pEsMsg;
+    RPC_STATUS status;
 
     TRACE("(%p, %d, %p)\n", Buffer, BufferSize, pHandle);
 
+    if ((status = validate_mes_buffer_pointer(Buffer)))
+        return status;
+
     pEsMsg = HeapAlloc(GetProcessHeap(), 0, sizeof(*pEsMsg));
     if (!pEsMsg)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     init_MIDL_ES_MESSAGE(pEsMsg);
 
@@ -193,7 +271,7 @@ static void es_data_alloc(MIDL_ES_MESSAGE *pEsMsg, ULONG size)
         if (tmpsize < size)
         {
             ERR("not enough bytes allocated - requested %d, got %d\n", size, tmpsize);
-            RpcRaiseException(ERROR_OUTOFMEMORY);
+            RpcRaiseException(RPC_S_OUT_OF_MEMORY);
         }
     }
     else if (pEsMsg->HandleStyle == MES_FIXED_BUFFER_HANDLE)
@@ -214,7 +292,7 @@ static void es_data_read(MIDL_ES_MESSAGE *pEsMsg, ULONG size)
         if (tmpsize < size)
         {
             ERR("not enough bytes read - requested %d, got %d\n", size, tmpsize);
-            RpcRaiseException(ERROR_OUTOFMEMORY);
+            RpcRaiseException(RPC_S_OUT_OF_MEMORY);
         }
     }
     else
diff --git a/reactos/dll/win32/rpcrt4/ndr_marshall.c b/reactos/dll/win32/rpcrt4/ndr_marshall.c
index f12c11a65fc..3d7cf4672d5 100644
--- a/reactos/dll/win32/rpcrt4/ndr_marshall.c
+++ b/reactos/dll/win32/rpcrt4/ndr_marshall.c
@@ -183,7 +183,9 @@ const NDR_MARSHALL NdrMarshaller[NDR_TABLE_SIZE] = {
   NdrUserMarshalMarshall,
   0, 0,
   /* 0xb7 */
-  NdrRangeMarshall
+  NdrRangeMarshall,
+  NdrBaseTypeMarshall,
+  NdrBaseTypeMarshall
 };
 const NDR_UNMARSHALL NdrUnmarshaller[NDR_TABLE_SIZE] = {
   0,
@@ -225,7 +227,9 @@ const NDR_UNMARSHALL NdrUnmarshaller[NDR_TABLE_SIZE] = {
   NdrUserMarshalUnmarshall,
   0, 0,
   /* 0xb7 */
-  NdrRangeUnmarshall
+  NdrRangeUnmarshall,
+  NdrBaseTypeUnmarshall,
+  NdrBaseTypeUnmarshall
 };
 const NDR_BUFFERSIZE NdrBufferSizer[NDR_TABLE_SIZE] = {
   0,
@@ -267,7 +271,9 @@ const NDR_BUFFERSIZE NdrBufferSizer[NDR_TABLE_SIZE] = {
   NdrUserMarshalBufferSize,
   0, 0,
   /* 0xb7 */
-  NdrRangeBufferSize
+  NdrRangeBufferSize,
+  NdrBaseTypeBufferSize,
+  NdrBaseTypeBufferSize
 };
 const NDR_MEMORYSIZE NdrMemorySizer[NDR_TABLE_SIZE] = {
   0,
@@ -309,7 +315,9 @@ const NDR_MEMORYSIZE NdrMemorySizer[NDR_TABLE_SIZE] = {
   NdrUserMarshalMemorySize,
   0, 0,
   /* 0xb7 */
-  NdrRangeMemorySize
+  NdrRangeMemorySize,
+  NdrBaseTypeMemorySize,
+  NdrBaseTypeMemorySize
 };
 const NDR_FREE NdrFreer[NDR_TABLE_SIZE] = {
   0,
@@ -350,7 +358,9 @@ const NDR_FREE NdrFreer[NDR_TABLE_SIZE] = {
   NdrUserMarshalFree,
   0, 0,
   /* 0xb7 */
-  NdrRangeFree
+  NdrRangeFree,
+  NdrBaseTypeFree,
+  NdrBaseTypeFree
 };
 
 typedef struct _NDR_MEMORY_LIST
@@ -377,7 +387,7 @@ typedef struct _NDR_MEMORY_LIST
  *
  * NOTES
  *  The memory block is always 8-byte aligned.
- *  If the function is unable to allocate memory an ERROR_OUTOFMEMORY
+ *  If the function is unable to allocate memory an RPC_X_NO_MEMORY
  *  exception is raised.
  */
 void * WINAPI NdrAllocate(MIDL_STUB_MESSAGE *pStubMsg, SIZE_T len)
@@ -397,7 +407,7 @@ void * WINAPI NdrAllocate(MIDL_STUB_MESSAGE *pStubMsg, SIZE_T len)
     }
 
     p = pStubMsg->pfnAllocate(adjusted_len);
-    if (!p) RpcRaiseException(ERROR_OUTOFMEMORY);
+    if (!p) RpcRaiseException(RPC_X_NO_MEMORY);
 
     mem_list = (NDR_MEMORY_LIST *)((char *)p + aligned_len);
     mem_list->magic = MEML_MAGIC;
@@ -422,6 +432,11 @@ static inline BOOL IsConformanceOrVariancePresent(PFORMAT_STRING pFormat)
     return (*(const ULONG *)pFormat != -1);
 }
 
+static inline PFORMAT_STRING SkipConformance(const PMIDL_STUB_MESSAGE pStubMsg, const PFORMAT_STRING pFormat)
+{
+    return pFormat + 4 + pStubMsg->CorrDespIncrement;
+}
+
 static PFORMAT_STRING ReadConformance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat)
 {
   align_pointer(&pStubMsg->Buffer, 4);
@@ -430,10 +445,7 @@ static PFORMAT_STRING ReadConformance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRIN
   pStubMsg->MaxCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
   pStubMsg->Buffer += 4;
   TRACE("unmarshalled conformance is %ld\n", pStubMsg->MaxCount);
-  if (pStubMsg->fHasNewCorrDesc)
-    return pFormat+6;
-  else
-    return pFormat+4;
+  return SkipConformance(pStubMsg, pFormat);
 }
 
 static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat, ULONG MaxValue)
@@ -465,10 +477,7 @@ static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_S
   }
 
 done:
-  if (pStubMsg->fHasNewCorrDesc)
-    return pFormat+6;
-  else
-    return pFormat+4;
+  return SkipConformance(pStubMsg, pFormat);
 }
 
 /* writes the conformance value to the buffer */
@@ -646,20 +655,8 @@ done_conf_grab:
 
 finish_conf:
   TRACE("resulting conformance is %ld\n", *pCount);
-  if (pStubMsg->fHasNewCorrDesc)
-    return pFormat+6;
-  else
-    return pFormat+4;
-}
 
-static inline PFORMAT_STRING SkipConformance(PMIDL_STUB_MESSAGE pStubMsg,
-                                             PFORMAT_STRING pFormat)
-{
-    if (pStubMsg->fHasNewCorrDesc)
-      pFormat += 6;
-    else
-      pFormat += 4;
-    return pFormat;
+  return SkipConformance(pStubMsg, pFormat);
 }
 
 static inline PFORMAT_STRING SkipVariance(PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
@@ -2767,11 +2764,7 @@ static ULONG EmbeddedComplexSize(MIDL_STUB_MESSAGE *pStubMsg,
   }
   case RPC_FC_NON_ENCAPSULATED_UNION:
     pFormat += 2;
-    if (pStubMsg->fHasNewCorrDesc)
-        pFormat += 6;
-    else
-        pFormat += 4;
-
+    pFormat = SkipConformance(pStubMsg, pFormat);
     pFormat += *(const SHORT*)pFormat;
     return *(const SHORT*)pFormat;
   case RPC_FC_IP:
@@ -4596,7 +4589,7 @@ RPC_STATUS RPC_ENTRY NdrGetUserMarshalInfo(ULONG *flags, ULONG level, NDR_USER_M
 
         if (umcb->pStubMsg->Buffer < buffer_start ||
             umcb->pStubMsg->Buffer > buffer_end)
-            return ERROR_INVALID_USER_BUFFER;
+            return RPC_X_INVALID_BUFFER;
 
         umi->u1.Level1.Buffer = umcb->pStubMsg->Buffer;
         umi->u1.Level1.BufferSize = buffer_end - umcb->pStubMsg->Buffer;
@@ -6168,10 +6161,7 @@ static LONG unmarshall_discriminant(PMIDL_STUB_MESSAGE pStubMsg,
     }
     (*ppFormat)++;
 
-    if (pStubMsg->fHasNewCorrDesc)
-        *ppFormat += 6;
-    else
-        *ppFormat += 4;
+    *ppFormat = SkipConformance(pStubMsg, *ppFormat);
     return discriminant;
 }
 
@@ -7198,7 +7188,11 @@ NDR_SCONTEXT WINAPI NdrServerContextNewUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
  */
 void WINAPI NdrCorrelationInitialize(PMIDL_STUB_MESSAGE pStubMsg, void *pMemory, ULONG CacheSize, ULONG Flags)
 {
-    FIXME("(%p, %p, %d, 0x%x): stub\n", pStubMsg, pMemory, CacheSize, Flags);
+    FIXME("(%p, %p, %d, 0x%x): semi-stub\n", pStubMsg, pMemory, CacheSize, Flags);
+
+    if (pStubMsg->CorrDespIncrement == 0)
+        pStubMsg->CorrDespIncrement = 2; /* size of the normal (non-range) /robust payload */
+
     pStubMsg->fHasNewCorrDesc = TRUE;
 }
 
diff --git a/reactos/dll/win32/rpcrt4/ndr_ole.c b/reactos/dll/win32/rpcrt4/ndr_ole.c
index 56c8852cec9..9bf13ada0ee 100644
--- a/reactos/dll/win32/rpcrt4/ndr_ole.c
+++ b/reactos/dll/win32/rpcrt4/ndr_ole.c
@@ -75,14 +75,15 @@ static HRESULT WINAPI RpcStream_QueryInterface(LPSTREAM iface,
                                               REFIID riid,
                                               LPVOID *obj)
 {
-  RpcStreamImpl *This = impl_from_IStream(iface);
   if (IsEqualGUID(&IID_IUnknown, riid) ||
       IsEqualGUID(&IID_ISequentialStream, riid) ||
       IsEqualGUID(&IID_IStream, riid)) {
-    *obj = This;
-    InterlockedIncrement( &This->RefCount );
+    *obj = iface;
+    IStream_AddRef(iface);
     return S_OK;
   }
+
+  *obj = NULL;
   return E_NOINTERFACE;
 }
 
@@ -100,7 +101,6 @@ static ULONG WINAPI RpcStream_Release(LPSTREAM iface)
     TRACE("size=%d\n", *This->size);
     This->pMsg->Buffer = This->data + *This->size;
     HeapFree(GetProcessHeap(),0,This);
-    return 0;
   }
   return ref;
 }
@@ -174,6 +174,58 @@ static HRESULT WINAPI RpcStream_SetSize(LPSTREAM iface,
   return S_OK;
 }
 
+static HRESULT WINAPI RpcStream_CopyTo(IStream *iface, IStream *dest,
+  ULARGE_INTEGER len, ULARGE_INTEGER *read, ULARGE_INTEGER *written)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_Commit(IStream *iface, DWORD flags)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p)->(0x%08x): stub\n", This, flags);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_Revert(IStream *iface)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_LockRegion(IStream *iface,
+  ULARGE_INTEGER offset, ULARGE_INTEGER len, DWORD locktype)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_UnlockRegion(IStream *iface,
+  ULARGE_INTEGER offset, ULARGE_INTEGER len, DWORD locktype)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_Stat(IStream *iface, STATSTG *stat, DWORD flag)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
+static HRESULT WINAPI RpcStream_Clone(IStream *iface, IStream **cloned)
+{
+  RpcStreamImpl *This = impl_from_IStream(iface);
+  FIXME("(%p): stub\n", This);
+  return E_NOTIMPL;
+}
+
 static const IStreamVtbl RpcStream_Vtbl =
 {
   RpcStream_QueryInterface,
@@ -183,29 +235,34 @@ static const IStreamVtbl RpcStream_Vtbl =
   RpcStream_Write,
   RpcStream_Seek,
   RpcStream_SetSize,
-  NULL, /* CopyTo */
-  NULL, /* Commit */
-  NULL, /* Revert */
-  NULL, /* LockRegion */
-  NULL, /* UnlockRegion */
-  NULL, /* Stat */
-  NULL  /* Clone */
+  RpcStream_CopyTo,
+  RpcStream_Commit,
+  RpcStream_Revert,
+  RpcStream_LockRegion,
+  RpcStream_UnlockRegion,
+  RpcStream_Stat,
+  RpcStream_Clone
 };
 
-static LPSTREAM RpcStream_Create(PMIDL_STUB_MESSAGE pStubMsg, BOOL init)
+static HRESULT RpcStream_Create(PMIDL_STUB_MESSAGE pStubMsg, BOOL init, ULONG *size, IStream **stream)
 {
   RpcStreamImpl *This;
-  This = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(RpcStreamImpl));
-  if (!This) return NULL;
+
+  *stream = NULL;
+  This = HeapAlloc(GetProcessHeap(), 0, sizeof(RpcStreamImpl));
+  if (!This) return E_OUTOFMEMORY;
   This->IStream_iface.lpVtbl = &RpcStream_Vtbl;
   This->RefCount = 1;
   This->pMsg = pStubMsg;
   This->size = (LPDWORD)pStubMsg->Buffer;
-  This->data = (unsigned char*)(This->size + 1);
+  This->data = pStubMsg->Buffer + sizeof(DWORD);
   This->pos = 0;
   if (init) *This->size = 0;
   TRACE("init size=%d\n", *This->size);
-  return (LPSTREAM)This;
+
+  if (size) *size = *This->size;
+  *stream = &This->IStream_iface;
+  return S_OK;
 }
 
 static const IID* get_ip_iid(PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory, PFORMAT_STRING pFormat)
@@ -240,19 +297,17 @@ unsigned char * WINAPI NdrInterfacePointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
   pStubMsg->MaxCount = 0;
   if (!LoadCOM()) return NULL;
   if (pStubMsg->Buffer + sizeof(DWORD) <= (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength) {
-    stream = RpcStream_Create(pStubMsg, TRUE);
-    if (stream) {
+    hr = RpcStream_Create(pStubMsg, TRUE, NULL, &stream);
+    if (hr == S_OK) {
       if (pMemory)
         hr = COM_MarshalInterface(stream, riid, (LPUNKNOWN)pMemory,
                                   pStubMsg->dwDestContext, pStubMsg->pvDestContext,
                                   MSHLFLAGS_NORMAL);
-      else
-        hr = S_OK;
-
       IStream_Release(stream);
-      if (FAILED(hr))
-        RpcRaiseException(hr);
     }
+
+    if (FAILED(hr))
+      RpcRaiseException(hr);
   }
   return NULL;
 }
@@ -272,13 +327,16 @@ unsigned char * WINAPI NdrInterfacePointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg
   if (!LoadCOM()) return NULL;
   *(LPVOID*)ppMemory = NULL;
   if (pStubMsg->Buffer + sizeof(DWORD) < (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength) {
-    stream = RpcStream_Create(pStubMsg, FALSE);
-    if (!stream) RpcRaiseException(E_OUTOFMEMORY);
-    if (*((RpcStreamImpl *)stream)->size != 0)
-      hr = COM_UnmarshalInterface(stream, &IID_NULL, (LPVOID*)ppMemory);
-    else
-      hr = S_OK;
-    IStream_Release(stream);
+    ULONG size;
+
+    hr = RpcStream_Create(pStubMsg, FALSE, &size, &stream);
+    if (hr == S_OK) {
+      if (size != 0)
+        hr = COM_UnmarshalInterface(stream, &IID_NULL, (LPVOID*)ppMemory);
+
+      IStream_Release(stream);
+    }
+
     if (FAILED(hr))
         RpcRaiseException(hr);
   }
diff --git a/reactos/dll/win32/rpcrt4/ndr_stubless.c b/reactos/dll/win32/rpcrt4/ndr_stubless.c
index a0cbd7843e0..d2f16f59f7c 100644
--- a/reactos/dll/win32/rpcrt4/ndr_stubless.c
+++ b/reactos/dll/win32/rpcrt4/ndr_stubless.c
@@ -29,6 +29,11 @@ WINE_DEFAULT_DEBUG_CHANNEL(rpc);
 
 #define NDR_TABLE_MASK 127
 
+static inline BOOL is_oicf_stubdesc(const PMIDL_STUB_DESC pStubDesc)
+{
+    return pStubDesc->Version >= 0x20000;
+}
+
 static inline void call_buffer_sizer(PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
                                      const NDR_PARAM_OIF *param)
 {
@@ -323,7 +328,11 @@ static PFORMAT_STRING client_get_handle(
         *phBinding = *pStubMsg->StubDesc->IMPLICIT_HANDLE_INFO.pPrimitiveHandle;
         break;
     case RPC_FC_CALLBACK_HANDLE: /* implicit callback */
-        FIXME("RPC_FC_CALLBACK_HANDLE\n");
+        TRACE("RPC_FC_CALLBACK_HANDLE\n");
+        /* server calls callback procedures only in response to remote call, and most recent
+           binding handle is used. Calling back to a client can potentially result in another
+           callback with different current handle. */
+        *phBinding = I_RpcGetCurrentCallHandle();
         break;
     case RPC_FC_AUTO_HANDLE: /* implicit auto handle */
         /* strictly speaking, it isn't necessary to set hBinding here
@@ -645,7 +654,7 @@ LONG_PTR CDECL ndr_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING pForma
         if (!pFormat) goto done;
     }
 
-    if (pStubDesc->Version >= 0x20000)  /* -Oicf format */
+    if (is_oicf_stubdesc(pStubDesc))  /* -Oicf format */
     {
         const NDR_PROC_PARTIAL_OIF_HEADER *pOIFHeader =
             (const NDR_PROC_PARTIAL_OIF_HEADER *)pFormat;
@@ -706,6 +715,8 @@ LONG_PTR CDECL ndr_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING pForma
     {
         /* initialize extra correlation package */
         NdrCorrelationInitialize(&stubMsg, NdrCorrCache, sizeof(NdrCorrCache), 0);
+        if (ext_flags.Unused & 0x2) /* has range on conformance */
+            stubMsg.CorrDespIncrement = 12;
     }
 
     /* order of phases:
@@ -1047,10 +1058,10 @@ __ASM_GLOBAL_FUNC( call_server_func,
                    "movq 8(%rsp),%rdx\n\t"
                    "movq 16(%rsp),%r8\n\t"
                    "movq 24(%rsp),%r9\n\t"
-                   "movq %rcx,%xmm0\n\t"
-                   "movq %rdx,%xmm1\n\t"
-                   "movq %r8,%xmm2\n\t"
-                   "movq %r9,%xmm3\n\t"
+                   "movq 0(%rsp),%xmm0\n\t"
+                   "movq 8(%rsp),%xmm1\n\t"
+                   "movq 16(%rsp),%xmm2\n\t"
+                   "movq 24(%rsp),%xmm3\n\t"
                    "callq *%rax\n\t"
                    "leaq -16(%rbp),%rsp\n\t"  /* restore stack */
                    "popq %rdi\n\t"
@@ -1062,13 +1073,40 @@ __ASM_GLOBAL_FUNC( call_server_func,
                    __ASM_CFI(".cfi_adjust_cfa_offset -8\n\t")
                    __ASM_CFI(".cfi_same_value %rbp\n\t")
                    "ret")
-#elif defined(__arm__)
-LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char * args, unsigned short stack_size)
-{
-    FIXME("Not implemented for ARM\n");
-    assert(FALSE);
-    return 0;
-}
+#elif defined __arm__
+LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char *args, unsigned int stack_size);
+__ASM_GLOBAL_FUNC( call_server_func,
+                   ".arm\n\t"
+                   "push {r4, r5, LR}\n\t"
+                   "mov r4, r0\n\t"
+                   "mov r5, SP\n\t"
+                   "lsr r3, r2, #2\n\t"
+                   "cmp r3, #0\n\t"
+                   "beq 5f\n\t"
+                   "sub SP, SP, r2\n\t"
+                   "tst r3, #1\n\t"
+                   "subeq SP, SP, #4\n\t"
+                   "1:\tsub r2, r2, #4\n\t"
+                   "ldr r0, [r1, r2]\n\t"
+                   "str r0, [SP, r2]\n\t"
+                   "cmp r2, #0\n\t"
+                   "bgt 1b\n\t"
+                   "cmp r3, #1\n\t"
+                   "bgt 2f\n\t"
+                   "pop {r0}\n\t"
+                   "b 5f\n\t"
+                   "2:\tcmp r3, #2\n\t"
+                   "bgt 3f\n\t"
+                   "pop {r0-r1}\n\t"
+                   "b 5f\n\t"
+                   "3:\tcmp r3, #3\n\t"
+                   "bgt 4f\n\t"
+                   "pop {r0-r2}\n\t"
+                   "b 5f\n\t"
+                   "4:\tpop {r0-r3}\n\t"
+                   "5:\tblx r4\n\t"
+                   "mov SP, r5\n\t"
+                   "pop {r4, r5, PC}" )
 #else
 #warning call_server_func not implemented for your architecture
 LONG_PTR __cdecl call_server_func(SERVER_ROUTINE func, unsigned char * args, unsigned short stack_size)
@@ -1086,19 +1124,6 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
     unsigned int i;
     LONG_PTR *retval_ptr = NULL;
 
-    if (phase == STUBLESS_FREE)
-    {
-        /* Process the params allocated by the application first */
-        for (i = 0; i < number_of_params; i++)
-        {
-            unsigned char *pArg = pStubMsg->StackTop + params[i].stack_offset;
-            if (params[i].attr.MustFree)
-            {
-                call_freer(pStubMsg, pArg, &params[i]);
-            }
-        }
-    }
-
     for (i = 0; i < number_of_params; i++)
     {
         unsigned char *pArg = pStubMsg->StackTop + params[i].stack_offset;
@@ -1115,10 +1140,14 @@ static LONG_PTR *stub_do_args(MIDL_STUB_MESSAGE *pStubMsg,
             if (params[i].attr.IsOut || params[i].attr.IsReturn)
                 call_marshaller(pStubMsg, pArg, &params[i]);
             break;
-        case STUBLESS_FREE:
+        case STUBLESS_MUSTFREE:
             if (params[i].attr.MustFree)
-                break;
-            else if (params[i].attr.ServerAllocSize)
+            {
+                call_freer(pStubMsg, pArg, &params[i]);
+            }
+            break;
+        case STUBLESS_FREE:
+            if (params[i].attr.ServerAllocSize)
             {
                 HeapFree(GetProcessHeap(), 0, *(void **)pArg);
             }
@@ -1304,7 +1333,7 @@ LONG WINAPI NdrStubCall2(
     if (pThis)
         *(void **)args = ((CStdStubBuffer *)pThis)->pvServerObject;
 
-    if (pStubDesc->Version >= 0x20000)  /* -Oicf format */
+    if (is_oicf_stubdesc(pStubDesc))
     {
         const NDR_PROC_PARTIAL_OIF_HEADER *pOIFHeader = (const NDR_PROC_PARTIAL_OIF_HEADER *)pFormat;
 
@@ -1332,8 +1361,9 @@ LONG WINAPI NdrStubCall2(
         if (ext_flags.HasNewCorrDesc)
         {
             /* initialize extra correlation package */
-            FIXME("new correlation description not implemented\n");
-            stubMsg.fHasNewCorrDesc = TRUE;
+            NdrCorrelationInitialize(&stubMsg, NdrCorrCache, sizeof(NdrCorrCache), 0);
+            if (ext_flags.Unused & 0x2) /* has range on conformance */
+                stubMsg.CorrDespIncrement = 12;
         }
     }
     else
@@ -1396,7 +1426,7 @@ LONG WINAPI NdrStubCall2(
 
                 pRpcMsg->BufferLength = stubMsg.BufferLength;
                 /* allocate buffer for [out] and [ret] params */
-                Status = I_RpcGetBuffer(pRpcMsg);
+                Status = I_RpcGetBuffer(pRpcMsg); 
                 if (Status)
                     RpcRaiseException(Status);
                 stubMsg.Buffer = pRpcMsg->Buffer;
@@ -1406,6 +1436,7 @@ LONG WINAPI NdrStubCall2(
         case STUBLESS_INITOUT:
         case STUBLESS_CALCSIZE:
         case STUBLESS_MARSHAL:
+        case STUBLESS_MUSTFREE:
         case STUBLESS_FREE:
             retval_ptr = stub_do_args(&stubMsg, pFormat, phase, number_of_params);
             break;
@@ -1420,7 +1451,7 @@ LONG WINAPI NdrStubCall2(
     if (ext_flags.HasNewCorrDesc)
     {
         /* free extra correlation package */
-        /* NdrCorrelationFree(&stubMsg); */
+        NdrCorrelationFree(&stubMsg);
     }
 
     if (Oif_flags.HasPipes)
@@ -1495,8 +1526,6 @@ LONG_PTR CDECL ndr_async_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING
     INTERPRETER_OPT_FLAGS2 ext_flags = { 0 };
     /* header for procedure string */
     const NDR_PROC_HEADER * pProcHeader = (const NDR_PROC_HEADER *)&pFormat[0];
-    /* -Oif or -Oicf generated format */
-    BOOL bV2Format = FALSE;
     RPC_STATUS status;
 
     TRACE("pStubDesc %p, pFormat %p, ...\n", pStubDesc, pFormat);
@@ -1509,7 +1538,7 @@ LONG_PTR CDECL ndr_async_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING
     }
 
     async_call_data = I_RpcAllocate(sizeof(*async_call_data) + sizeof(MIDL_STUB_MESSAGE) + sizeof(RPC_MESSAGE));
-    if (!async_call_data) RpcRaiseException(ERROR_OUTOFMEMORY);
+    if (!async_call_data) RpcRaiseException(RPC_X_NO_MEMORY);
     async_call_data->pProcHeader = pProcHeader;
 
     async_call_data->pStubMsg = pStubMsg = (PMIDL_STUB_MESSAGE)(async_call_data + 1);
@@ -1558,9 +1587,7 @@ LONG_PTR CDECL ndr_async_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING
     pFormat = client_get_handle(pStubMsg, pProcHeader, async_call_data->pHandleFormat, &async_call_data->hBinding);
     if (!pFormat) goto done;
 
-    bV2Format = (pStubDesc->Version >= 0x20000);
-
-    if (bV2Format)
+    if (is_oicf_stubdesc(pStubDesc))
     {
         const NDR_PROC_PARTIAL_OIF_HEADER *pOIFHeader =
             (const NDR_PROC_PARTIAL_OIF_HEADER *)pFormat;
@@ -1611,6 +1638,8 @@ LONG_PTR CDECL ndr_async_client_call( PMIDL_STUB_DESC pStubDesc, PFORMAT_STRING
     {
         /* initialize extra correlation package */
         NdrCorrelationInitialize(pStubMsg, async_call_data->NdrCorrCache, sizeof(async_call_data->NdrCorrCache), 0);
+        if (ext_flags.Unused & 0x2) /* has range on conformance */
+            pStubMsg->CorrDespIncrement = 12;
     }
 
     /* order of phases:
diff --git a/reactos/dll/win32/rpcrt4/ndr_stubless.h b/reactos/dll/win32/rpcrt4/ndr_stubless.h
index fe067f51776..de78d8eed2c 100644
--- a/reactos/dll/win32/rpcrt4/ndr_stubless.h
+++ b/reactos/dll/win32/rpcrt4/ndr_stubless.h
@@ -37,7 +37,8 @@ typedef struct _NDR_PROC_HEADER
      * RPC_FC_BIND_PRIMITIVE = 32 - Implicit handle using handle_t created by
      *   calling application
      * RPC_FC_AUTO_HANDLE = 33 - Automatic handle
-     * RPC_FC_CALLBACK_HANDLE = 34 - undocumented
+     * RPC_FC_CALLBACK_HANDLE = 34 - Implicit handle used for a callback: current handle
+     *   from last remote call
      */
     unsigned char handle_type;
 
@@ -235,6 +236,7 @@ enum stubless_phase
     STUBLESS_CALCSIZE,
     STUBLESS_GETBUFFER,
     STUBLESS_MARSHAL,
+    STUBLESS_MUSTFREE,
     STUBLESS_FREE
 };
 
diff --git a/reactos/dll/win32/rpcrt4/rpc_assoc.c b/reactos/dll/win32/rpcrt4/rpc_assoc.c
index 2ef0260cfa0..cf61cf64fdc 100644
--- a/reactos/dll/win32/rpcrt4/rpc_assoc.c
+++ b/reactos/dll/win32/rpcrt4/rpc_assoc.c
@@ -68,6 +68,7 @@ static RPC_STATUS RpcAssoc_Alloc(LPCSTR Protseq, LPCSTR NetworkAddr,
     assoc->Endpoint = RPCRT4_strdupA(Endpoint);
     assoc->NetworkOptions = NetworkOptions ? RPCRT4_strdupW(NetworkOptions) : NULL;
     assoc->assoc_group_id = 0;
+    UuidCreate(&assoc->http_uuid);
     list_init(&assoc->entry);
     *assoc_out = assoc;
     return RPC_S_OK;
@@ -329,7 +330,7 @@ static RPC_STATUS RpcAssoc_BindConnection(const RpcAssoc *assoc, RpcConnection *
             break;
         case REJECT_INVALID_CHECKSUM:
             ERR("invalid checksum\n");
-            status = ERROR_ACCESS_DENIED;
+            status = RPC_S_ACCESS_DENIED;
             break;
         default:
             ERR("rejected bind for reason %d\n", response_hdr->bind_nack.reject_reason);
@@ -431,7 +432,7 @@ RPC_STATUS RpcServerAssoc_AllocateContextHandle(RpcAssoc *assoc, void *CtxGuard,
 
     context_handle = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(*context_handle));
     if (!context_handle)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     context_handle->ctx_guard = CtxGuard;
     RtlInitializeResource(&context_handle->rw_lock);
diff --git a/reactos/dll/win32/rpcrt4/rpc_binding.c b/reactos/dll/win32/rpcrt4/rpc_binding.c
index 9916fad47d6..3cd2feaa927 100644
--- a/reactos/dll/win32/rpcrt4/rpc_binding.c
+++ b/reactos/dll/win32/rpcrt4/rpc_binding.c
@@ -1102,7 +1102,7 @@ RPC_STATUS RpcAuthInfo_Create(ULONG AuthnLevel, ULONG AuthnSvc,
 {
     RpcAuthInfo *AuthInfo = HeapAlloc(GetProcessHeap(), 0, sizeof(*AuthInfo));
     if (!AuthInfo)
-        return ERROR_OUTOFMEMORY;
+        return RPC_S_OUT_OF_MEMORY;
 
     AuthInfo->refs = 1;
     AuthInfo->AuthnLevel = AuthnLevel;
@@ -1122,7 +1122,7 @@ RPC_STATUS RpcAuthInfo_Create(ULONG AuthnLevel, ULONG AuthnSvc,
         if (!AuthInfo->nt_identity)
         {
             HeapFree(GetProcessHeap(), 0, AuthInfo);
-            return ERROR_OUTOFMEMORY;
+            return RPC_S_OUT_OF_MEMORY;
         }
 
         AuthInfo->nt_identity->Flags = SEC_WINNT_AUTH_IDENTITY_UNICODE;
@@ -1151,7 +1151,7 @@ RPC_STATUS RpcAuthInfo_Create(ULONG AuthnLevel, ULONG AuthnSvc,
             HeapFree(GetProcessHeap(), 0, AuthInfo->nt_identity->Password);
             HeapFree(GetProcessHeap(), 0, AuthInfo->nt_identity);
             HeapFree(GetProcessHeap(), 0, AuthInfo);
-            return ERROR_OUTOFMEMORY;
+            return RPC_S_OUT_OF_MEMORY;
         }
     }
     else
@@ -1475,7 +1475,7 @@ RpcBindingInqAuthInfoExA( RPC_BINDING_HANDLE Binding, RPC_CSTR *ServerPrincName,
     {
         *ServerPrincName = (RPC_CSTR)RPCRT4_strdupWtoA(principal);
         RpcStringFreeW(&principal);
-        if (!*ServerPrincName) return ERROR_OUTOFMEMORY;
+        if (!*ServerPrincName) return RPC_S_OUT_OF_MEMORY;
     }
 
     return status;
@@ -1507,7 +1507,7 @@ RpcBindingInqAuthInfoExW( RPC_BINDING_HANDLE Binding, RPC_WSTR *ServerPrincName,
         if (bind->AuthInfo->server_principal_name)
         {
             *ServerPrincName = RPCRT4_strdupW(bind->AuthInfo->server_principal_name);
-            if (!*ServerPrincName) return ERROR_OUTOFMEMORY;
+            if (!*ServerPrincName) return RPC_S_OUT_OF_MEMORY;
         }
         else *ServerPrincName = NULL;
     }
@@ -1588,7 +1588,7 @@ RpcBindingInqAuthClientExA( RPC_BINDING_HANDLE ClientBinding, RPC_AUTHZ_HANDLE *
     if (status == RPC_S_OK && ServerPrincName)
     {
         *ServerPrincName = (RPC_CSTR)RPCRT4_strdupWtoA(principal);
-        if (!*ServerPrincName && principal) status = ERROR_OUTOFMEMORY;
+        if (!*ServerPrincName && principal) status = RPC_S_OUT_OF_MEMORY;
         RpcStringFreeW(&principal);
     }
 
@@ -1733,7 +1733,7 @@ RpcBindingSetAuthInfoExA( RPC_BINDING_HANDLE Binding, RPC_CSTR ServerPrincName,
       else
       {
         RpcAuthInfo_Release(new_auth_info);
-        r = ERROR_OUTOFMEMORY;
+        r = RPC_S_OUT_OF_MEMORY;
       }
     }
     else
@@ -1864,7 +1864,7 @@ RpcBindingSetAuthInfoExW( RPC_BINDING_HANDLE Binding, RPC_WSTR ServerPrincName,
       else
       {
         RpcAuthInfo_Release(new_auth_info);
-        r = ERROR_OUTOFMEMORY;
+        r = RPC_S_OUT_OF_MEMORY;
       }
     }
     else
@@ -1918,7 +1918,7 @@ RPC_STATUS WINAPI RpcBindingSetOption(RPC_BINDING_HANDLE BindingHandle, ULONG Op
         int len = MultiByteToWideChar(CP_ACP, 0, cookie->Buffer, cookie->BufferSize, NULL, 0);
         WCHAR *str;
 
-        if (!(str = HeapAlloc(GetProcessHeap(), 0, (len + 1) * sizeof(WCHAR)))) return ERROR_OUTOFMEMORY;
+        if (!(str = HeapAlloc(GetProcessHeap(), 0, (len + 1) * sizeof(WCHAR)))) return RPC_S_OUT_OF_MEMORY;
         MultiByteToWideChar(CP_ACP, 0, cookie->Buffer, cookie->BufferSize, str, len);
         str[len] = 0;
         HeapFree(GetProcessHeap(), 0, binding->CookieAuth);
@@ -1931,3 +1931,13 @@ RPC_STATUS WINAPI RpcBindingSetOption(RPC_BINDING_HANDLE BindingHandle, ULONG Op
     }
     return RPC_S_OK;
 }
+
+/***********************************************************************
+ *             I_RpcBindingInqLocalClientPID (RPCRT4.@)
+ */
+
+RPC_STATUS WINAPI I_RpcBindingInqLocalClientPID(RPC_BINDING_HANDLE ClientBinding, ULONG *ClientPID)
+{
+    FIXME("%p %p: stub\n", ClientBinding, ClientPID);
+    return RPC_S_INVALID_BINDING;
+}
diff --git a/reactos/dll/win32/rpcrt4/rpc_binding.h b/reactos/dll/win32/rpcrt4/rpc_binding.h
index 831ce25ed9e..4cc2a5ad04c 100644
--- a/reactos/dll/win32/rpcrt4/rpc_binding.h
+++ b/reactos/dll/win32/rpcrt4/rpc_binding.h
@@ -100,6 +100,7 @@ struct connection_ops {
   int (*write)(RpcConnection *conn, const void *buffer, unsigned int len);
   int (*close)(RpcConnection *conn);
   void (*cancel_call)(RpcConnection *conn);
+  RPC_STATUS (*is_server_listening)(const char *endpoint);
   int (*wait_for_incoming_data)(RpcConnection *conn);
   size_t (*get_top_of_tower)(unsigned char *tower_data, const char *networkaddr, const char *endpoint);
   RPC_STATUS (*parse_top_of_tower)(const unsigned char *tower_data, size_t tower_size, char **networkaddr, char **endpoint);
@@ -158,6 +159,7 @@ RpcConnection *RPCRT4_GrabConnection( RpcConnection *conn ) DECLSPEC_HIDDEN;
 RPC_STATUS RPCRT4_ReleaseConnection(RpcConnection* Connection) DECLSPEC_HIDDEN;
 RPC_STATUS RPCRT4_OpenClientConnection(RpcConnection* Connection) DECLSPEC_HIDDEN;
 RPC_STATUS RPCRT4_CloseConnection(RpcConnection* Connection) DECLSPEC_HIDDEN;
+RPC_STATUS RPCRT4_IsServerListening(const char *protseq, const char *endpoint) DECLSPEC_HIDDEN;
 
 RPC_STATUS RPCRT4_ResolveBinding(RpcBinding* Binding, LPCSTR Endpoint) DECLSPEC_HIDDEN;
 RPC_STATUS RPCRT4_SetBindingObject(RpcBinding* Binding, const UUID* ObjectUuid) DECLSPEC_HIDDEN;
diff --git a/reactos/dll/win32/rpcrt4/rpc_epmap.c b/reactos/dll/win32/rpcrt4/rpc_epmap.c
index 07a76b5bbbf..b7ee205dffe 100644
--- a/reactos/dll/win32/rpcrt4/rpc_epmap.c
+++ b/reactos/dll/win32/rpcrt4/rpc_epmap.c
@@ -80,7 +80,7 @@ static BOOL start_rpcss(void)
     lstrcatW( cmd, rpcss );
 
     Wow64DisableWow64FsRedirection( &redir );
-    rslt = CreateProcessW( cmd, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );
+    rslt = CreateProcessW( cmd, cmd, NULL, NULL, FALSE, DETACHED_PROCESS, NULL, NULL, &si, &pi );
     Wow64RevertWow64FsRedirection( redir );
 
     if (rslt)
diff --git a/reactos/dll/win32/rpcrt4/rpc_server.c b/reactos/dll/win32/rpcrt4/rpc_server.c
index 436a014ea01..c3cffc968fe 100644
--- a/reactos/dll/win32/rpcrt4/rpc_server.c
+++ b/reactos/dll/win32/rpcrt4/rpc_server.c
@@ -740,9 +740,18 @@ static RPC_STATUS RPCRT4_start_listen(BOOL auto_listen)
   return status;
 }
 
-static void RPCRT4_stop_listen(BOOL auto_listen)
+static RPC_STATUS RPCRT4_stop_listen(BOOL auto_listen)
 {
+  RPC_STATUS status = RPC_S_OK;
+
   EnterCriticalSection(&listen_cs);
+
+  if (!std_listen)
+  {
+    status = RPC_S_NOT_LISTENING;
+    goto done;
+  }
+
   if (auto_listen || (--manual_listen_count == 0))
   {
     if (listen_count != 0 && --listen_count == 0) {
@@ -757,12 +766,14 @@ static void RPCRT4_stop_listen(BOOL auto_listen)
       EnterCriticalSection(&listen_cs);
       if (listen_done_event) SetEvent( listen_done_event );
       listen_done_event = 0;
-      LeaveCriticalSection(&listen_cs);
-      return;
+      goto done;
     }
     assert(listen_count >= 0);
   }
+
+done:
   LeaveCriticalSection(&listen_cs);
+  return status;
 }
 
 static BOOL RPCRT4_protseq_is_endpoint_registered(RpcServerProtseq *protseq, const char *endpoint)
@@ -1053,10 +1064,8 @@ void RPCRT4_destroy_all_protseqs(void)
     EnterCriticalSection(&server_cs);
     LIST_FOR_EACH_ENTRY_SAFE(cps, cursor2, &protseqs, RpcServerProtseq, entry)
     {
-#ifndef __REACTOS__
         if (listen_count != 0)
             RPCRT4_sync_with_server_thread(cps);
-#endif
         destroy_serverprotoseq(cps);
     }
     LeaveCriticalSection(&server_cs);
@@ -1540,9 +1549,7 @@ RPC_STATUS WINAPI RpcMgmtStopServerListening ( RPC_BINDING_HANDLE Binding )
     return RPC_S_WRONG_KIND_OF_BINDING;
   }
   
-  RPCRT4_stop_listen(FALSE);
-
-  return RPC_S_OK;
+  return RPCRT4_stop_listen(FALSE);
 }
 
 /***********************************************************************
@@ -1647,9 +1654,15 @@ RPC_STATUS WINAPI RpcMgmtIsServerListening(RPC_BINDING_HANDLE Binding)
 
   TRACE("(%p)\n", Binding);
 
-  EnterCriticalSection(&listen_cs);
-  if (manual_listen_count > 0) status = RPC_S_OK;
-  LeaveCriticalSection(&listen_cs);
+  if (Binding) {
+    RpcBinding *rpc_binding = (RpcBinding*)Binding;
+    status = RPCRT4_IsServerListening(rpc_binding->Protseq, rpc_binding->Endpoint);
+  }else {
+    EnterCriticalSection(&listen_cs);
+    if (manual_listen_count > 0) status = RPC_S_OK;
+    LeaveCriticalSection(&listen_cs);
+  }
+
   return status;
 }
 
diff --git a/reactos/dll/win32/rpcrt4/rpc_transport.c b/reactos/dll/win32/rpcrt4/rpc_transport.c
index 42f50563be5..5c0755f349f 100644
--- a/reactos/dll/win32/rpcrt4/rpc_transport.c
+++ b/reactos/dll/win32/rpcrt4/rpc_transport.c
@@ -245,6 +245,18 @@ static RPC_STATUS rpcrt4_conn_open_pipe(RpcConnection *Connection, LPCSTR pname,
   return RPC_S_OK;
 }
 
+static char *ncalrpc_pipe_name(const char *endpoint)
+{
+  static const char prefix[] = "\\\\.\\pipe\\lrpc\\";
+  char *pipe_name;
+
+  /* protseq=ncalrpc: supposed to use NT LPC ports,
+   * but we'll implement it with named pipes for now */
+  pipe_name = I_RpcAllocate(sizeof(prefix) + strlen(endpoint));
+  strcat(strcpy(pipe_name, prefix), endpoint);
+  return pipe_name;
+}
+
 static RPC_STATUS rpcrt4_ncalrpc_open(RpcConnection* Connection)
 {
   RpcConnection_np *npc = (RpcConnection_np *) Connection;
@@ -304,6 +316,17 @@ static RPC_STATUS rpcrt4_protseq_ncalrpc_open_endpoint(RpcServerProtseq* protseq
   return r;
 }
 
+static char *ncacn_pipe_name(const char *endpoint)
+{
+  static const char prefix[] = "\\\\.";
+  char *pipe_name;
+
+  /* protseq=ncacn_np: named pipes */
+  pipe_name = I_RpcAllocate(sizeof(prefix) + strlen(endpoint));
+  strcat(strcpy(pipe_name, prefix), endpoint);
+  return pipe_name;
+}
+
 static RPC_STATUS rpcrt4_ncacn_np_open(RpcConnection* Connection)
 {
   RpcConnection_np *npc = (RpcConnection_np *) Connection;
@@ -408,7 +431,7 @@ static RPC_STATUS rpcrt4_protseq_ncacn_np_open_endpoint(RpcServerProtseq *protse
 }
 
 static void rpcrt4_conn_np_handoff(RpcConnection_np *old_npc, RpcConnection_np *new_npc)
-{
+{    
   /* because of the way named pipes work, we'll transfer the connected pipe
    * to the child, then reopen the server binding to continue listening */
 
@@ -435,6 +458,33 @@ static RPC_STATUS rpcrt4_ncacn_np_handoff(RpcConnection *old_conn, RpcConnection
   return status;
 }
 
+static RPC_STATUS is_pipe_listening(const char *pipe_name)
+{
+  return WaitNamedPipeA(pipe_name, 1) ? RPC_S_OK : RPC_S_NOT_LISTENING;
+}
+
+static RPC_STATUS rpcrt4_ncacn_np_is_server_listening(const char *endpoint)
+{
+  char *pipe_name;
+  RPC_STATUS status;
+
+  pipe_name = ncacn_pipe_name(endpoint);
+  status = is_pipe_listening(pipe_name);
+  I_RpcFree(pipe_name);
+  return status;
+}
+
+static RPC_STATUS rpcrt4_ncalrpc_np_is_server_listening(const char *endpoint)
+{
+  char *pipe_name;
+  RPC_STATUS status;
+
+  pipe_name = ncalrpc_pipe_name(endpoint);
+  status = is_pipe_listening(pipe_name);
+  I_RpcFree(pipe_name);
+  return status;
+}
+
 static RPC_STATUS rpcrt4_ncalrpc_handoff(RpcConnection *old_conn, RpcConnection *new_conn)
 {
   RPC_STATUS status;
@@ -449,7 +499,7 @@ static RPC_STATUS rpcrt4_ncalrpc_handoff(RpcConnection *old_conn, RpcConnection
   strcat(strcpy(pname, prefix), old_conn->Endpoint);
   status = rpcrt4_conn_create_pipe(old_conn, pname);
   I_RpcFree(pname);
-
+    
   return status;
 }
 
@@ -715,9 +765,9 @@ static void *rpcrt4_protseq_np_get_wait_array(RpcServerProtseq *protseq, void *p
     HANDLE *objs = prev_array;
     RpcConnection_np *conn;
     RpcServerProtseq_np *npps = CONTAINING_RECORD(protseq, RpcServerProtseq_np, common);
-
+    
     EnterCriticalSection(&protseq->cs);
-
+    
     /* open and count connections */
     *count = 1;
     conn = CONTAINING_RECORD(protseq->conn, RpcConnection_np, common);
@@ -727,7 +777,7 @@ static void *rpcrt4_protseq_np_get_wait_array(RpcServerProtseq *protseq, void *p
             (*count)++;
         conn = CONTAINING_RECORD(conn->common.Next, RpcConnection_np, common);
     }
-
+    
     /* make array of connections */
     if (objs)
         objs = HeapReAlloc(GetProcessHeap(), 0, objs, *count*sizeof(HANDLE));
@@ -739,7 +789,7 @@ static void *rpcrt4_protseq_np_get_wait_array(RpcServerProtseq *protseq, void *p
         LeaveCriticalSection(&protseq->cs);
         return NULL;
     }
-
+    
     objs[0] = npps->mgr_event;
     *count = 1;
     conn = CONTAINING_RECORD(protseq->conn, RpcConnection_np, common);
@@ -764,7 +814,7 @@ static int rpcrt4_protseq_np_wait_for_new_connection(RpcServerProtseq *protseq,
     DWORD res;
     RpcConnection *cconn;
     RpcConnection_np *conn;
-
+    
     if (!objs)
         return -1;
 
@@ -994,6 +1044,7 @@ static size_t rpcrt4_ip_tcp_get_top_of_tower(unsigned char *tower_data,
     else
     {
         ERR("unexpected protocol family %d\n", ai->ai_family);
+        freeaddrinfo(ai);
         return 0;
     }
 
@@ -1473,7 +1524,7 @@ static RPC_STATUS rpcrt4_protseq_ncacn_ip_tcp_open_endpoint(RpcServerProtseq *pr
         conn->Next = protseq->conn;
         protseq->conn = first_connection;
         LeaveCriticalSection(&protseq->cs);
-
+        
         TRACE("listening on %s\n", endpoint);
         return RPC_S_OK;
     }
@@ -1517,6 +1568,8 @@ static int rpcrt4_conn_tcp_read(RpcConnection *Connection,
       return -1;
     else if (r > 0)
       bytes_read += r;
+    else if (errno == EINTR)
+      continue;
     else if (errno != EAGAIN)
     {
       WARN("recv() failed: %s\n", strerror(errno));
@@ -1542,6 +1595,8 @@ static int rpcrt4_conn_tcp_write(RpcConnection *Connection,
     int r = send(tcpc->sock, (const char *)buffer + bytes_written, count - bytes_written, 0);
     if (r >= 0)
       bytes_written += r;
+    else if (errno == EINTR)
+      continue;
     else if (errno != EAGAIN)
       return -1;
     else
@@ -1574,6 +1629,12 @@ static void rpcrt4_conn_tcp_cancel_call(RpcConnection *Connection)
     rpcrt4_sock_wait_cancel(tcpc);
 }
 
+static RPC_STATUS rpcrt4_conn_tcp_is_server_listening(const char *endpoint)
+{
+    FIXME("\n");
+    return RPC_S_ACCESS_DENIED;
+}
+
 static int rpcrt4_conn_tcp_wait_for_incoming_data(RpcConnection *Connection)
 {
     RpcConnection_tcp *tcpc = (RpcConnection_tcp *) Connection;
@@ -1639,7 +1700,7 @@ static void *rpcrt4_protseq_sock_get_wait_array(RpcServerProtseq *protseq, void
     RpcServerProtseq_sock *sockps = CONTAINING_RECORD(protseq, RpcServerProtseq_sock, common);
 
     EnterCriticalSection(&protseq->cs);
-
+    
     /* open and count connections */
     *count = 1;
     conn = (RpcConnection_tcp *)protseq->conn;
@@ -1648,7 +1709,7 @@ static void *rpcrt4_protseq_sock_get_wait_array(RpcServerProtseq *protseq, void
             (*count)++;
         conn = (RpcConnection_tcp *)conn->common.Next;
     }
-
+    
     /* make array of connections */
     if (poll_info)
         poll_info = HeapReAlloc(GetProcessHeap(), 0, poll_info, *count*sizeof(*poll_info));
@@ -1690,10 +1751,10 @@ static int rpcrt4_protseq_sock_wait_for_new_connection(RpcServerProtseq *protseq
     unsigned int i;
     RpcConnection *cconn;
     RpcConnection_tcp *conn;
-
+    
     if (!poll_info)
         return -1;
-
+    
     ret = poll(poll_info, count, -1);
     if (ret < 0)
     {
@@ -1902,7 +1963,7 @@ typedef struct _RpcHttpAsyncData
     LONG refs;
     HANDLE completion_event;
     WORD async_result;
-    INTERNET_BUFFERSA inet_buffers;
+    INTERNET_BUFFERSW inet_buffers;
     CRITICAL_SECTION cs;
 } RpcHttpAsyncData;
 
@@ -2009,7 +2070,7 @@ static RpcConnection *rpcrt4_ncacn_http_alloc(void)
     TRACE("async data = %p\n", httpc->async_data);
     httpc->cancel_event = CreateEventW(NULL, FALSE, FALSE, NULL);
     httpc->async_data->refs = 1;
-    httpc->async_data->inet_buffers.dwStructSize = sizeof(INTERNET_BUFFERSA);
+    httpc->async_data->inet_buffers.dwStructSize = sizeof(INTERNET_BUFFERSW);
     httpc->async_data->inet_buffers.lpvBuffer = NULL;
     InitializeCriticalSection(&httpc->async_data->cs);
     httpc->async_data->cs.DebugInfo->Spare[0] = (DWORD_PTR)(__FILE__ ": RpcHttpAsyncData.cs");
@@ -2254,9 +2315,47 @@ static RPC_STATUS rpcrt4_http_internet_connect(RpcConnection_http *httpc)
     return RPC_S_OK;
 }
 
+static int rpcrt4_http_async_read(HINTERNET req, RpcHttpAsyncData *async_data, HANDLE cancel_event,
+                                  void *buffer, unsigned int count)
+{
+    char *buf = buffer;
+    BOOL ret;
+    unsigned int bytes_left = count;
+    RPC_STATUS status = RPC_S_OK;
+
+    async_data->inet_buffers.lpvBuffer = HeapAlloc(GetProcessHeap(), 0, count);
+
+    while (bytes_left)
+    {
+        async_data->inet_buffers.dwBufferLength = bytes_left;
+        prepare_async_request(async_data);
+        ret = InternetReadFileExW(req, &async_data->inet_buffers, IRF_ASYNC, 0);
+        status = wait_async_request(async_data, ret, cancel_event);
+        if (status != RPC_S_OK)
+        {
+            if (status == RPC_S_CALL_CANCELLED)
+                TRACE("call cancelled\n");
+            break;
+        }
+
+        if (!async_data->inet_buffers.dwBufferLength)
+            break;
+        memcpy(buf, async_data->inet_buffers.lpvBuffer,
+               async_data->inet_buffers.dwBufferLength);
+
+        bytes_left -= async_data->inet_buffers.dwBufferLength;
+        buf += async_data->inet_buffers.dwBufferLength;
+    }
+
+    HeapFree(GetProcessHeap(), 0, async_data->inet_buffers.lpvBuffer);
+    async_data->inet_buffers.lpvBuffer = NULL;
+
+    TRACE("%p %p %u -> %u\n", req, buffer, count, status);
+    return status == RPC_S_OK ? count : -1;
+}
+
 static RPC_STATUS send_echo_request(HINTERNET req, RpcHttpAsyncData *async_data, HANDLE cancel_event)
 {
-    DWORD bytes_read;
     BYTE buf[20];
     BOOL ret;
     RPC_STATUS status;
@@ -2271,12 +2370,23 @@ static RPC_STATUS send_echo_request(HINTERNET req, RpcHttpAsyncData *async_data,
     status = rpcrt4_http_check_response(req);
     if (status != RPC_S_OK) return status;
 
-    InternetReadFile(req, buf, sizeof(buf), &bytes_read);
+    rpcrt4_http_async_read(req, async_data, cancel_event, buf, sizeof(buf));
     /* FIXME: do something with retrieved data */
 
     return RPC_S_OK;
 }
 
+static RPC_STATUS insert_content_length_header(HINTERNET request, DWORD len)
+{
+    static const WCHAR fmtW[] =
+        {'C','o','n','t','e','n','t','-','L','e','n','g','t','h',':',' ','%','u','\r','\n',0};
+    WCHAR header[sizeof(fmtW) / sizeof(fmtW[0]) + 10];
+
+    sprintfW(header, fmtW, len);
+    if ((HttpAddRequestHeadersW(request, header, -1, HTTP_ADDREQ_FLAG_REPLACE | HTTP_ADDREQ_FLAG_ADD))) return RPC_S_OK;
+    return RPC_S_SERVER_UNAVAILABLE;
+}
+
 /* prepare the in pipe for use by RPC packets */
 static RPC_STATUS rpcrt4_http_prepare_in_pipe(HINTERNET in_request, RpcHttpAsyncData *async_data, HANDLE cancel_event,
                                               const UUID *connection_uuid, const UUID *in_pipe_uuid,
@@ -2298,6 +2408,9 @@ static RPC_STATUS rpcrt4_http_prepare_in_pipe(HINTERNET in_request, RpcHttpAsync
     buffers_in.dwStructSize = sizeof(buffers_in);
     /* FIXME: get this from the registry */
     buffers_in.dwBufferTotal = 1024 * 1024 * 1024; /* 1Gb */
+    status = insert_content_length_header(in_request, buffers_in.dwBufferTotal);
+    if (status != RPC_S_OK) return status;
+
     prepare_async_request(async_data);
     ret = HttpSendRequestExW(in_request, &buffers_in, NULL, 0, 0);
     status = wait_async_request(async_data, ret, cancel_event);
@@ -2317,14 +2430,13 @@ static RPC_STATUS rpcrt4_http_prepare_in_pipe(HINTERNET in_request, RpcHttpAsync
     return RPC_S_OK;
 }
 
-static RPC_STATUS rpcrt4_http_read_http_packet(HINTERNET request, RpcPktHdr *hdr, BYTE **data)
+static RPC_STATUS rpcrt4_http_read_http_packet(HINTERNET request, RpcHttpAsyncData *async_data,
+                                               HANDLE cancel_event, RpcPktHdr *hdr, BYTE **data)
 {
-    BOOL ret;
-    DWORD bytes_read;
     unsigned short data_len;
+    unsigned int size;
 
-    ret = InternetReadFile(request, hdr, sizeof(hdr->common), &bytes_read);
-    if (!ret)
+    if (rpcrt4_http_async_read(request, async_data, cancel_event, hdr, sizeof(hdr->common)) < 0)
         return RPC_S_SERVER_UNAVAILABLE;
     if (hdr->common.ptype != PKT_HTTP || hdr->common.frag_len < sizeof(hdr->http))
     {
@@ -2333,8 +2445,8 @@ static RPC_STATUS rpcrt4_http_read_http_packet(HINTERNET request, RpcPktHdr *hdr
         return RPC_S_PROTOCOL_ERROR;
     }
 
-    ret = InternetReadFile(request, &hdr->common + 1, sizeof(hdr->http) - sizeof(hdr->common), &bytes_read);
-    if (!ret)
+    size = sizeof(hdr->http) - sizeof(hdr->common);
+    if (rpcrt4_http_async_read(request, async_data, cancel_event, &hdr->common + 1, size) < 0)
         return RPC_S_SERVER_UNAVAILABLE;
 
     data_len = hdr->common.frag_len - sizeof(hdr->http);
@@ -2343,8 +2455,7 @@ static RPC_STATUS rpcrt4_http_read_http_packet(HINTERNET request, RpcPktHdr *hdr
         *data = HeapAlloc(GetProcessHeap(), 0, data_len);
         if (!*data)
             return RPC_S_OUT_OF_RESOURCES;
-        ret = InternetReadFile(request, *data, data_len, &bytes_read);
-        if (!ret)
+        if (rpcrt4_http_async_read(request, async_data, cancel_event, *data, data_len) < 0)
         {
             HeapFree(GetProcessHeap(), 0, *data);
             return RPC_S_SERVER_UNAVAILABLE;
@@ -2356,6 +2467,7 @@ static RPC_STATUS rpcrt4_http_read_http_packet(HINTERNET request, RpcPktHdr *hdr
     if (!RPCRT4_IsValidHttpPacket(hdr, *data, data_len))
     {
         ERR("invalid http packet\n");
+        HeapFree(GetProcessHeap(), 0, *data);
         return RPC_S_PROTOCOL_ERROR;
     }
 
@@ -2374,7 +2486,6 @@ static RPC_STATUS rpcrt4_http_prepare_out_pipe(HINTERNET out_request, RpcHttpAsy
     BYTE *data_from_server;
     RpcPktHdr pkt_from_server;
     ULONG field1, field3;
-    DWORD bytes_read;
     BYTE buf[20];
 
     if (!authorized)
@@ -2384,11 +2495,18 @@ static RPC_STATUS rpcrt4_http_prepare_out_pipe(HINTERNET out_request, RpcHttpAsy
         if (status != RPC_S_OK) return status;
     }
     else
-        InternetReadFile(out_request, buf, sizeof(buf), &bytes_read);
+        rpcrt4_http_async_read(out_request, async_data, cancel_event, buf, sizeof(buf));
 
     hdr = RPCRT4_BuildHttpConnectHeader(TRUE, connection_uuid, out_pipe_uuid, NULL);
     if (!hdr) return RPC_S_OUT_OF_RESOURCES;
 
+    status = insert_content_length_header(out_request, hdr->common.frag_len);
+    if (status != RPC_S_OK)
+    {
+        RPCRT4_FreeHeader(hdr);
+        return status;
+    }
+
     TRACE("sending HTTP connect header to server\n");
     prepare_async_request(async_data);
     ret = HttpSendRequestW(out_request, NULL, 0, hdr, hdr->common.frag_len);
@@ -2399,8 +2517,8 @@ static RPC_STATUS rpcrt4_http_prepare_out_pipe(HINTERNET out_request, RpcHttpAsy
     status = rpcrt4_http_check_response(out_request);
     if (status != RPC_S_OK) return status;
 
-    status = rpcrt4_http_read_http_packet(out_request, &pkt_from_server,
-                                          &data_from_server);
+    status = rpcrt4_http_read_http_packet(out_request, async_data, cancel_event,
+                                          &pkt_from_server, &data_from_server);
     if (status != RPC_S_OK) return status;
     status = RPCRT4_ParseHttpPrepareHeader1(&pkt_from_server, data_from_server,
                                             &field1);
@@ -2410,8 +2528,8 @@ static RPC_STATUS rpcrt4_http_prepare_out_pipe(HINTERNET out_request, RpcHttpAsy
 
     for (;;)
     {
-        status = rpcrt4_http_read_http_packet(out_request, &pkt_from_server,
-                                              &data_from_server);
+        status = rpcrt4_http_read_http_packet(out_request, async_data, cancel_event,
+                                              &pkt_from_server, &data_from_server);
         if (status != RPC_S_OK) return status;
         if (pkt_from_server.http.flags != 0x0001) break;
 
@@ -2816,7 +2934,7 @@ static RPC_STATUS insert_authorization_header(HINTERNET request, ULONG scheme, c
     return status;
 }
 
-static void drain_content(HINTERNET request)
+static void drain_content(HINTERNET request, RpcHttpAsyncData *async_data, HANDLE cancel_event)
 {
     DWORD count, len = 0, size = sizeof(len);
     char buf[2048];
@@ -2826,7 +2944,7 @@ static void drain_content(HINTERNET request)
     for (;;)
     {
         count = min(sizeof(buf), len);
-        if (!InternetReadFile(request, buf, count, &count) || !count) return;
+        if (rpcrt4_http_async_read(request, async_data, cancel_event, buf, count) <= 0) return;
         len -= count;
     }
 }
@@ -2853,40 +2971,16 @@ static RPC_STATUS authorize_request(RpcConnection_http *httpc, HINTERNET request
 
         status = rpcrt4_http_check_response(request);
         if (status != RPC_S_OK && status != ERROR_ACCESS_DENIED) break;
-        drain_content(request);
+        drain_content(request, httpc->async_data, httpc->cancel_event);
     }
 
     if (info->scheme != RPC_C_HTTP_AUTHN_SCHEME_BASIC)
-        HttpAddRequestHeadersW(request, authW, -1, HTTP_ADDREQ_FLAG_REPLACE);
+        HttpAddRequestHeadersW(request, authW, -1, HTTP_ADDREQ_FLAG_REPLACE | HTTP_ADDREQ_FLAG_ADD);
 
     destroy_authinfo(info);
     return status;
 }
 
-static RPC_STATUS insert_cookie_header(HINTERNET request, const WCHAR *value)
-{
-    static const WCHAR cookieW[] = {'C','o','o','k','i','e',':',' '};
-    WCHAR *header, *ptr;
-    int len;
-    RPC_STATUS status = RPC_S_SERVER_UNAVAILABLE;
-
-    if (!value) return RPC_S_OK;
-
-    len = strlenW(value);
-    if ((header = HeapAlloc(GetProcessHeap(), 0, sizeof(cookieW) + (len + 3) * sizeof(WCHAR))))
-    {
-        memcpy(header, cookieW, sizeof(cookieW));
-        ptr = header + sizeof(cookieW) / sizeof(cookieW[0]);
-        memcpy(ptr, value, len * sizeof(WCHAR));
-        ptr[len++] = '\r';
-        ptr[len++] = '\n';
-        ptr[len] = 0;
-        if ((HttpAddRequestHeadersW(request, header, -1, HTTP_ADDREQ_FLAG_ADD_IF_NEW))) status = RPC_S_OK;
-        HeapFree(GetProcessHeap(), 0, header);
-    }
-    return status;
-}
-
 static BOOL has_credentials(RpcConnection_http *httpc)
 {
     RPC_HTTP_TRANSPORT_CREDENTIALS_W *creds;
@@ -2912,6 +3006,51 @@ static BOOL is_secure(RpcConnection_http *httpc)
            (httpc->common.QOS->qos->u.HttpCredentials->Flags & RPC_C_HTTP_FLAG_USE_SSL);
 }
 
+static RPC_STATUS set_auth_cookie(RpcConnection_http *httpc, const WCHAR *value)
+{
+    static WCHAR httpW[] = {'h','t','t','p',0};
+    static WCHAR httpsW[] = {'h','t','t','p','s',0};
+    URL_COMPONENTSW uc;
+    DWORD len;
+    WCHAR *url;
+    BOOL ret;
+
+    if (!value) return RPC_S_OK;
+
+    uc.dwStructSize     = sizeof(uc);
+    uc.lpszScheme       = is_secure(httpc) ? httpsW : httpW;
+    uc.dwSchemeLength   = 0;
+    uc.lpszHostName     = httpc->servername;
+    uc.dwHostNameLength = 0;
+    uc.nPort            = 0;
+    uc.lpszUserName     = NULL;
+    uc.dwUserNameLength = 0;
+    uc.lpszPassword     = NULL;
+    uc.dwPasswordLength = 0;
+    uc.lpszUrlPath      = NULL;
+    uc.dwUrlPathLength  = 0;
+    uc.lpszExtraInfo    = NULL;
+    uc.dwExtraInfoLength = 0;
+
+    if (!InternetCreateUrlW(&uc, 0, NULL, &len) && (GetLastError() != ERROR_INSUFFICIENT_BUFFER))
+        return RPC_S_SERVER_UNAVAILABLE;
+
+    if (!(url = HeapAlloc(GetProcessHeap(), 0, len))) return RPC_S_OUT_OF_MEMORY;
+
+    len = len / sizeof(WCHAR) - 1;
+    if (!InternetCreateUrlW(&uc, 0, url, &len))
+    {
+        HeapFree(GetProcessHeap(), 0, url);
+        return RPC_S_SERVER_UNAVAILABLE;
+    }
+
+    ret = InternetSetCookieW(url, NULL, value);
+    HeapFree(GetProcessHeap(), 0, url);
+    if (!ret) return RPC_S_SERVER_UNAVAILABLE;
+
+    return RPC_S_OK;
+}
+
 static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
 {
     RpcConnection_http *httpc = (RpcConnection_http *)Connection;
@@ -2941,9 +3080,9 @@ static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
 
     httpc->async_data->completion_event = CreateEventW(NULL, FALSE, FALSE, NULL);
 
-    status = UuidCreate(&httpc->connection_uuid);
-    status = UuidCreate(&httpc->in_pipe_uuid);
-    status = UuidCreate(&httpc->out_pipe_uuid);
+    UuidCreate(&httpc->connection_uuid);
+    UuidCreate(&httpc->in_pipe_uuid);
+    UuidCreate(&httpc->out_pipe_uuid);
 
     status = rpcrt4_http_internet_connect(httpc);
     if (status != RPC_S_OK)
@@ -2965,6 +3104,12 @@ static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
     if (secure) flags |= INTERNET_FLAG_SECURE;
     if (credentials) flags |= INTERNET_FLAG_NO_AUTH;
 
+    status = set_auth_cookie(httpc, Connection->CookieAuth);
+    if (status != RPC_S_OK)
+    {
+        HeapFree(GetProcessHeap(), 0, url);
+        return status;
+    }
     httpc->in_request = HttpOpenRequestW(httpc->session, wszVerbIn, url, NULL, NULL, wszAcceptTypes,
                                          flags, (DWORD_PTR)httpc->async_data);
     if (!httpc->in_request)
@@ -2973,12 +3118,7 @@ static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
         HeapFree(GetProcessHeap(), 0, url);
         return RPC_S_SERVER_UNAVAILABLE;
     }
-    status = insert_cookie_header(httpc->in_request, Connection->CookieAuth);
-    if (status != RPC_S_OK)
-    {
-        HeapFree(GetProcessHeap(), 0, url);
-        return status;
-    }
+
     if (credentials)
     {
         status = authorize_request(httpc, httpc->in_request);
@@ -2993,7 +3133,7 @@ static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
             HeapFree(GetProcessHeap(), 0, url);
             return status;
         }
-        drain_content(httpc->in_request);
+        drain_content(httpc->in_request, httpc->async_data, httpc->cancel_event);
     }
 
     httpc->out_request = HttpOpenRequestW(httpc->session, wszVerbOut, url, NULL, NULL, wszAcceptTypes,
@@ -3004,9 +3144,6 @@ static RPC_STATUS rpcrt4_ncacn_http_open(RpcConnection* Connection)
         ERR("HttpOpenRequestW failed with error %d\n", GetLastError());
         return RPC_S_SERVER_UNAVAILABLE;
     }
-    status = insert_cookie_header(httpc->out_request, Connection->CookieAuth);
-    if (status != RPC_S_OK)
-        return status;
 
     if (credentials)
     {
@@ -3059,39 +3196,7 @@ static int rpcrt4_ncacn_http_read(RpcConnection *Connection,
                                 void *buffer, unsigned int count)
 {
   RpcConnection_http *httpc = (RpcConnection_http *) Connection;
-  char *buf = buffer;
-  BOOL ret;
-  unsigned int bytes_left = count;
-  RPC_STATUS status = RPC_S_OK;
-
-  httpc->async_data->inet_buffers.lpvBuffer = HeapAlloc(GetProcessHeap(), 0, count);
-
-  while (bytes_left)
-  {
-    httpc->async_data->inet_buffers.dwBufferLength = bytes_left;
-    prepare_async_request(httpc->async_data);
-    ret = InternetReadFileExA(httpc->out_request, &httpc->async_data->inet_buffers, IRF_ASYNC, 0);
-    status = wait_async_request(httpc->async_data, ret, httpc->cancel_event);
-    if(status != RPC_S_OK) {
-        if(status == RPC_S_CALL_CANCELLED)
-            TRACE("call cancelled\n");
-        break;
-    }
-
-    if(!httpc->async_data->inet_buffers.dwBufferLength)
-        break;
-    memcpy(buf, httpc->async_data->inet_buffers.lpvBuffer,
-           httpc->async_data->inet_buffers.dwBufferLength);
-
-    bytes_left -= httpc->async_data->inet_buffers.dwBufferLength;
-    buf += httpc->async_data->inet_buffers.dwBufferLength;
-  }
-
-  HeapFree(GetProcessHeap(), 0, httpc->async_data->inet_buffers.lpvBuffer);
-  httpc->async_data->inet_buffers.lpvBuffer = NULL;
-
-  TRACE("%p %p %u -> %u\n", httpc->out_request, buffer, count, status);
-  return status == RPC_S_OK ? count : -1;
+  return rpcrt4_http_async_read(httpc->out_request, httpc->async_data, httpc->cancel_event, buffer, count);
 }
 
 static RPC_STATUS rpcrt4_ncacn_http_receive_fragment(RpcConnection *Connection, RpcPktHdr **Header, void **Payload)
@@ -3299,6 +3404,12 @@ static void rpcrt4_ncacn_http_cancel_call(RpcConnection *Connection)
   SetEvent(httpc->cancel_event);
 }
 
+static RPC_STATUS rpcrt4_ncacn_http_is_server_listening(const char *endpoint)
+{
+    FIXME("\n");
+    return RPC_S_ACCESS_DENIED;
+}
+
 static int rpcrt4_ncacn_http_wait_for_incoming_data(RpcConnection *Connection)
 {
   RpcConnection_http *httpc = (RpcConnection_http *) Connection;
@@ -3340,6 +3451,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_np_write,
     rpcrt4_conn_np_close,
     rpcrt4_conn_np_cancel_call,
+    rpcrt4_ncacn_np_is_server_listening,
     rpcrt4_conn_np_wait_for_incoming_data,
     rpcrt4_ncacn_np_get_top_of_tower,
     rpcrt4_ncacn_np_parse_top_of_tower,
@@ -3360,6 +3472,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_np_write,
     rpcrt4_conn_np_close,
     rpcrt4_conn_np_cancel_call,
+    rpcrt4_ncalrpc_np_is_server_listening,
     rpcrt4_conn_np_wait_for_incoming_data,
     rpcrt4_ncalrpc_get_top_of_tower,
     rpcrt4_ncalrpc_parse_top_of_tower,
@@ -3380,6 +3493,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_conn_tcp_write,
     rpcrt4_conn_tcp_close,
     rpcrt4_conn_tcp_cancel_call,
+    rpcrt4_conn_tcp_is_server_listening,
     rpcrt4_conn_tcp_wait_for_incoming_data,
     rpcrt4_ncacn_ip_tcp_get_top_of_tower,
     rpcrt4_ncacn_ip_tcp_parse_top_of_tower,
@@ -3400,6 +3514,7 @@ static const struct connection_ops conn_protseq_list[] = {
     rpcrt4_ncacn_http_write,
     rpcrt4_ncacn_http_close,
     rpcrt4_ncacn_http_cancel_call,
+    rpcrt4_ncacn_http_is_server_listening,
     rpcrt4_ncacn_http_wait_for_incoming_data,
     rpcrt4_ncacn_http_get_top_of_tower,
     rpcrt4_ncacn_http_parse_top_of_tower,
@@ -3573,6 +3688,20 @@ RPC_STATUS RPCRT4_ReleaseConnection(RpcConnection* Connection)
   return RPC_S_OK;
 }
 
+RPC_STATUS RPCRT4_IsServerListening(const char *protseq, const char *endpoint)
+{
+  const struct connection_ops *ops;
+
+  ops = rpcrt4_get_conn_protseq_ops(protseq);
+  if (!ops)
+  {
+    FIXME("not supported for protseq %s\n", protseq);
+    return RPC_S_INVALID_BINDING;
+  }
+
+  return ops->is_server_listening(endpoint);
+}
+
 RPC_STATUS RpcTransport_GetTopOfTower(unsigned char *tower_data,
                                       size_t *tower_size,
                                       const char *protseq,
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4.spec b/reactos/dll/win32/rpcrt4/rpcrt4.spec
index 3507ab73e3b..648ccff0a1d 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4.spec
+++ b/reactos/dll/win32/rpcrt4/rpcrt4.spec
@@ -32,7 +32,7 @@
 32 stub I_RpcBindingInqDynamicEndPoint
 33 stub I_RpcBindingInqDynamicEndPointA
 34 stub I_RpcBindingInqDynamicEndPointW
-35 stub I_RpcBindingInqLocalClientPID
+35 stdcall I_RpcBindingInqLocalClientPID(ptr ptr)
 # I_RpcBindingInqMarshalledTargetInfo
 37 stub I_RpcBindingInqSecurityContext
 38 stdcall I_RpcBindingInqTransportType(ptr ptr)
@@ -100,10 +100,10 @@
 100 stub I_RpcTransIoCancelled
 101 stub I_RpcTransServerNewConnection
 102 stub I_RpcTurnOnEEInfoPropagation
-103 stub I_UuidCreate
+103 stdcall I_UuidCreate(ptr)
 104 stub MIDL_wchar_strcpy
 105 stub MIDL_wchar_strlen
-106 stub MesBufferHandleReset
+106 stdcall MesBufferHandleReset(ptr long long ptr long ptr)
 107 stdcall MesDecodeBufferHandleCreate(ptr long ptr)
 108 stdcall MesDecodeIncrementalHandleCreate(ptr ptr ptr)
 109 stdcall MesEncodeDynBufferHandleCreate(ptr ptr ptr)
@@ -465,7 +465,7 @@
 465 stub RpcSsContextLockShared
 466 stdcall RpcSsDestroyClientContext(ptr)
 467 stub RpcSsDisableAllocate
-468 stub RpcSsDontSerializeContext
+468 stdcall RpcSsDontSerializeContext()
 469 stub RpcSsEnableAllocate
 470 stub RpcSsFree
 471 stub RpcSsGetContextBinding
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4_main.c b/reactos/dll/win32/rpcrt4/rpcrt4_main.c
index 060297483b4..562732e8508 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4_main.c
+++ b/reactos/dll/win32/rpcrt4/rpcrt4_main.c
@@ -431,6 +431,15 @@ RPC_STATUS WINAPI UuidCreateSequential(UUID *Uuid)
     return status;
 }
 
+/*************************************************************************
+ *           I_UuidCreate   [RPCRT4.@]
+ *
+ * See UuidCreateSequential()
+ */
+RPC_STATUS WINAPI I_UuidCreate(UUID *Uuid)
+{
+    return UuidCreateSequential(Uuid);
+}
 
 /*************************************************************************
  *           UuidHash   [RPCRT4.@]
diff --git a/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff b/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
index 0ebbfaff537..fba1d243938 100644
--- a/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
+++ b/reactos/dll/win32/rpcrt4/rpcrt4_ros.diff
@@ -1,15 +1,57 @@
-diff -prudN .\wine\dlls\rpcrt4/rpc_epmap.c .\reactos\dll\win32\rpcrt4/rpc_epmap.c
---- .\wine\dlls\rpcrt4/rpc_epmap.c	2014-05-09 03:43:55.965035900 +0200
-+++ .\reactos\dll\win32\rpcrt4/rpc_epmap.c	2013-12-27 18:11:56.421567500 +0100
-@@ -92,7 +80,7 @@ static BOOL start_rpcss(void)
-     lstrcatW( cmd, rpcss );
- 
-     Wow64DisableWow64FsRedirection( &redir );
--    rslt = CreateProcessW( cmd, cmd, NULL, NULL, FALSE, DETACHED_PROCESS, NULL, NULL, &si, &pi );
-+    rslt = CreateProcessW( cmd, cmd, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );
-     Wow64RevertWow64FsRedirection( redir );
- 
-     if (rslt)
+diff -pudN --strip-trailing-cr e:\wine\dlls\rpcrt4/cproxy.c e:\reactos\dll\win32\rpcrt4/cproxy.c
+--- e:\wine\dlls\rpcrt4/cproxy.c	2015-02-21 17:13:10 +0100
++++ e:\reactos\dll\win32\rpcrt4/cproxy.c	2015-08-27 22:03:34 +0100
+@@ -167,6 +150,30 @@ static inline void init_thunk( struct th
+     thunk->call_stubless = call_stubless_func;
+ }
+ 
++#elif defined(__arm__)
++
++extern void call_stubless_func(void);
++__ASM_GLOBAL_FUNC(call_stubless_func,
++                  "DCD 0xDEFC\n\t" // _assertfail
++                  "" );
++
++#include "pshpack1.h"
++struct thunk
++{
++    DWORD assertfail;
++};
++#include "poppack.h"
++
++static const struct thunk thunk_template =
++{
++    { 0xDEFC }            /* _assertfail */
++};
++
++static inline void init_thunk( struct thunk *thunk, unsigned int index )
++{
++    *thunk = thunk_template;
++}
++
+ #else  /* __i386__ */
+ 
+ #warning You must implement stubless proxies for your CPU
+diff -pudN --strip-trailing-cr e:\wine\dlls\rpcrt4/cstub.c e:\reactos\dll\win32\rpcrt4/cstub.c
+--- e:\wine\dlls\rpcrt4/cstub.c	2015-10-30 18:41:53 +0100
++++ e:\reactos\dll\win32\rpcrt4/cstub.c	2015-11-16 22:55:49 +0100
+@@ -174,6 +156,13 @@ typedef struct
+ 
+ static const BYTE opcodes[16] = { 0x48, 0x8b, 0x49, 0x20, 0x48, 0x8b, 0x01,
+                                   0xff, 0xa0, 0, 0, 0, 0, 0x48, 0x8d, 0x36 };
++#elif defined(__arm__)
++typedef struct
++{
++    DWORD offset;
++} vtbl_method_t;
++static const BYTE opcodes[1];
++
+ #else
+ 
+ #warning You must implement delegated proxies/stubs for your CPU
+diff -pudN --strip-trailing-cr e:\wine\dlls\rpcrt4/rpc_epmap.c e:\reactos\dll\win32\rpcrt4/rpc_epmap.c
+--- e:\wine\dlls\rpcrt4/rpc_epmap.c	2015-02-21 17:13:10 +0100
++++ e:\reactos\dll\win32\rpcrt4/rpc_epmap.c	2015-11-16 22:55:50 +0100
 @@ -162,7 +150,7 @@ static RPC_STATUS get_epm_handle_server(
  
  static LONG WINAPI rpc_filter(EXCEPTION_POINTERS *__eptr)
@@ -19,24 +61,18 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_epmap.c .\reactos\dll\win32\rpcrt4/rpc_epmap.
      {
          case EXCEPTION_ACCESS_VIOLATION:
          case EXCEPTION_ILLEGAL_INSTRUCTION:
-diff -prudN .\wine\dlls\rpcrt4/rpc_server.c .\reactos\dll\win32\rpcrt4/rpc_server.c
---- .\wine\dlls\rpcrt4/rpc_server.c	2014-05-09 03:43:55.973036400 +0200
-+++ .\reactos\dll\win32\rpcrt4/rpc_server.c	2013-12-27 18:11:56.780368100 +0100
-@@ -1075,8 +1053,10 @@ void RPCRT4_destroy_all_protseqs(void)
-     EnterCriticalSection(&server_cs);
-     LIST_FOR_EACH_ENTRY_SAFE(cps, cursor2, &protseqs, RpcServerProtseq, entry)
-     {
-+#ifndef __REACTOS__
-         if (listen_count != 0)
-             RPCRT4_sync_with_server_thread(cps);
-+#endif
-         destroy_serverprotoseq(cps);
-     }
-     LeaveCriticalSection(&server_cs);
-diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_transport.c
---- .\wine\dlls\rpcrt4/rpc_transport.c	2014-05-09 03:43:55.977036600 +0200
-+++ .\reactos\dll\win32\rpcrt4/rpc_transport.c	2014-05-09 03:10:59.250551600 +0200
-@@ -113,31 +91,41 @@ typedef struct _RpcConnection_np
+diff -pudN --strip-trailing-cr e:\wine\dlls\rpcrt4/rpc_transport.c e:\reactos\dll\win32\rpcrt4/rpc_transport.c
+--- e:\wine\dlls\rpcrt4/rpc_transport.c	2015-11-01 09:49:28 +0100
++++ e:\reactos\dll\win32\rpcrt4/rpc_transport.c	2015-11-16 22:55:50 +0100
+@@ -102,6 +79,7 @@
+ 
+ #define DEFAULT_NCACN_HTTP_TIMEOUT (60 * 1000)
+ 
++#undef ARRAYSIZE
+ #define ARRAYSIZE(a) (sizeof((a)) / sizeof((a)[0]))
+ 
+ WINE_DEFAULT_DEBUG_CHANNEL(rpc);
+@@ -114,31 +92,41 @@ typedef struct _RpcConnection_np
  {
    RpcConnection common;
    HANDLE pipe;
@@ -85,7 +121,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
        case ERROR_NO_DATA_DETECTED:
            /* client has disconnected, retry */
            DisconnectNamedPipe( npc->pipe );
-@@ -150,6 +138,7 @@ static DWORD CALLBACK listen_thread(void
+@@ -151,6 +139,7 @@ static DWORD CALLBACK listen_thread(void
    }
  }
  
@@ -93,7 +129,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
  static RPC_STATUS rpcrt4_conn_listen_pipe(RpcConnection_np *npc)
  {
    if (npc->listening)
-@@ -165,13 +154,14 @@ static RPC_STATUS rpcrt4_conn_listen_pip
+@@ -166,13 +155,14 @@ static RPC_STATUS rpcrt4_conn_listen_pip
    }
    return RPC_S_OK;
  }
@@ -109,7 +145,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
                                 PIPE_TYPE_MESSAGE | PIPE_READMODE_MESSAGE,
                                 PIPE_UNLIMITED_INSTANCES,
                                 RPC_MAX_PACKET_SIZE, RPC_MAX_PACKET_SIZE, 5000, NULL);
-@@ -183,6 +173,9 @@ static RPC_STATUS rpcrt4_conn_create_pip
+@@ -184,6 +174,9 @@ static RPC_STATUS rpcrt4_conn_create_pip
        return RPC_S_CANT_CREATE_ENDPOINT;
    }
  
@@ -119,7 +155,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    /* Note: we don't call ConnectNamedPipe here because it must be done in the
     * server thread as the thread must be alertable */
    return RPC_S_OK;
-@@ -229,6 +222,9 @@ static RPC_STATUS rpcrt4_conn_open_pipe(
+@@ -230,6 +223,9 @@ static RPC_STATUS rpcrt4_conn_open_pipe(
      if (err == ERROR_PIPE_BUSY) {
        TRACE("connection failed, error=%x\n", err);
        return RPC_S_SERVER_TOO_BUSY;
@@ -129,7 +165,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
      }
      if (!wait || !WaitNamedPipeA(pname, NMPWAIT_WAIT_FOREVER)) {
        err = GetLastError();
-@@ -238,9 +234,11 @@ static RPC_STATUS rpcrt4_conn_open_pipe(
+@@ -239,9 +235,11 @@ static RPC_STATUS rpcrt4_conn_open_pipe(
    }
  
    /* success */
@@ -141,11 +177,50 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    npc->pipe = pipe;
  
    return RPC_S_OK;
-@@ -308,18 +306,64 @@ static RPC_STATUS rpcrt4_protseq_ncalrpc
+@@ -262,6 +260,7 @@ static char *ncalrpc_pipe_name(const cha
+ static RPC_STATUS rpcrt4_ncalrpc_open(RpcConnection* Connection)
+ {
+   RpcConnection_np *npc = (RpcConnection_np *) Connection;
++  static const char prefix[] = "\\\\.\\pipe\\lrpc\\";
+   RPC_STATUS r;
+   LPSTR pname;
+ 
+@@ -269,7 +268,10 @@ static RPC_STATUS rpcrt4_ncalrpc_open(Rp
+   if (npc->pipe)
+     return RPC_S_OK;
+ 
+-  pname = ncalrpc_pipe_name(Connection->Endpoint);
++  /* protseq=ncalrpc: supposed to use NT LPC ports,
++   * but we'll implement it with named pipes for now */
++  pname = I_RpcAllocate(strlen(prefix) + strlen(Connection->Endpoint) + 1);
++  strcat(strcpy(pname, prefix), Connection->Endpoint);
+   r = rpcrt4_conn_open_pipe(Connection, pname, TRUE);
+   I_RpcFree(pname);
+ 
+@@ -278,6 +280,7 @@ static RPC_STATUS rpcrt4_ncalrpc_open(Rp
+ 
+ static RPC_STATUS rpcrt4_protseq_ncalrpc_open_endpoint(RpcServerProtseq* protseq, const char *endpoint)
+ {
++  static const char prefix[] = "\\\\.\\pipe\\lrpc\\";
+   RPC_STATUS r;
+   LPSTR pname;
+   RpcConnection *Connection;
+@@ -298,7 +301,10 @@ static RPC_STATUS rpcrt4_protseq_ncalrpc
+   if (r != RPC_S_OK)
+       return r;
+ 
+-  pname = ncalrpc_pipe_name(Connection->Endpoint);
++  /* protseq=ncalrpc: supposed to use NT LPC ports,
++   * but we'll implement it with named pipes for now */
++  pname = I_RpcAllocate(strlen(prefix) + strlen(Connection->Endpoint) + 1);
++  strcat(strcpy(pname, prefix), Connection->Endpoint);
+   r = rpcrt4_conn_create_pipe(Connection, pname);
+   I_RpcFree(pname);
+ 
+@@ -324,15 +330,64 @@ static char *ncacn_pipe_name(const char 
  static RPC_STATUS rpcrt4_ncacn_np_open(RpcConnection* Connection)
  {
    RpcConnection_np *npc = (RpcConnection_np *) Connection;
--  static const char prefix[] = "\\\\.";
 +  static const char prefix[] = "\\\\";
 +  static const char local[] = ".";
 +  BOOL bUseLocalName = TRUE;
@@ -160,10 +235,9 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    if (npc->pipe)
      return RPC_S_OK;
  
-   /* protseq=ncacn_np: named pipes */
--  pname = I_RpcAllocate(strlen(prefix) + strlen(Connection->Endpoint) + 1);
--  strcat(strcpy(pname, prefix), Connection->Endpoint);
+-  pname = ncacn_pipe_name(Connection->Endpoint);
 -  r = rpcrt4_conn_open_pipe(Connection, pname, FALSE);
++  /* protseq=ncacn_np: named pipes */
 +  size = strlen(prefix);
 +
 +  if (Connection->NetworkAddr == NULL || strlen(Connection->NetworkAddr) == 0)
@@ -210,7 +284,26 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    I_RpcFree(pname);
  
    return r;
-@@ -368,9 +412,9 @@ static void rpcrt4_conn_np_handoff(RpcCo
+@@ -340,6 +395,7 @@ static RPC_STATUS rpcrt4_ncacn_np_open(R
+ 
+ static RPC_STATUS rpcrt4_protseq_ncacn_np_open_endpoint(RpcServerProtseq *protseq, const char *endpoint)
+ {
++  static const char prefix[] = "\\\\.";
+   RPC_STATUS r;
+   LPSTR pname;
+   RpcConnection *Connection;
+@@ -360,7 +416,9 @@ static RPC_STATUS rpcrt4_protseq_ncacn_n
+   if (r != RPC_S_OK)
+     return r;
+ 
+-  pname = ncacn_pipe_name(Connection->Endpoint);
++  /* protseq=ncacn_np: named pipes */
++  pname = I_RpcAllocate(strlen(prefix) + strlen(Connection->Endpoint) + 1);
++  strcat(strcpy(pname, prefix), Connection->Endpoint);
+   r = rpcrt4_conn_create_pipe(Connection, pname);
+   I_RpcFree(pname);
+ 
+@@ -378,9 +436,9 @@ static void rpcrt4_conn_np_handoff(RpcCo
     * to the child, then reopen the server binding to continue listening */
  
    new_npc->pipe = old_npc->pipe;
@@ -222,10 +315,41 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    old_npc->listening = FALSE;
  }
  
-@@ -415,11 +459,17 @@ static int rpcrt4_conn_np_read(RpcConnec
+@@ -388,10 +446,12 @@ static RPC_STATUS rpcrt4_ncacn_np_handof
+ {
+   RPC_STATUS status;
+   LPSTR pname;
++  static const char prefix[] = "\\\\.";
+ 
+   rpcrt4_conn_np_handoff((RpcConnection_np *)old_conn, (RpcConnection_np *)new_conn);
+ 
+-  pname = ncacn_pipe_name(old_conn->Endpoint);
++  pname = I_RpcAllocate(strlen(prefix) + strlen(old_conn->Endpoint) + 1);
++  strcat(strcpy(pname, prefix), old_conn->Endpoint);
+   status = rpcrt4_conn_create_pipe(old_conn, pname);
+   I_RpcFree(pname);
+ 
+@@ -429,12 +489,14 @@ static RPC_STATUS rpcrt4_ncalrpc_handoff
+ {
+   RPC_STATUS status;
+   LPSTR pname;
++  static const char prefix[] = "\\\\.\\pipe\\lrpc\\";
+ 
+   TRACE("%s\n", old_conn->Endpoint);
+ 
+   rpcrt4_conn_np_handoff((RpcConnection_np *)old_conn, (RpcConnection_np *)new_conn);
+ 
+-  pname = ncalrpc_pipe_name(old_conn->Endpoint);
++  pname = I_RpcAllocate(strlen(prefix) + strlen(old_conn->Endpoint) + 1);
++  strcat(strcpy(pname, prefix), old_conn->Endpoint);
+   status = rpcrt4_conn_create_pipe(old_conn, pname);
+   I_RpcFree(pname);
+     
+@@ -448,12 +510,17 @@ static int rpcrt4_conn_np_read(RpcConnec
    char *buf = buffer;
    BOOL ret = TRUE;
    unsigned int bytes_left = count;
+-  DWORD err = GetLastError();
 +  OVERLAPPED ovl;
 +
 +  ZeroMemory(&ovl, sizeof(ovl));
@@ -241,15 +365,16 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
      if (!ret && GetLastError() == ERROR_MORE_DATA)
          ret = TRUE;
      if (!ret || !bytes_read)
-@@ -427,6 +472,7 @@ static int rpcrt4_conn_np_read(RpcConnec
+@@ -461,7 +528,7 @@ static int rpcrt4_conn_np_read(RpcConnec
      bytes_left -= bytes_read;
      buf += bytes_read;
    }
+-  if (ret) SetLastError(err);
 +  CloseHandle(ovl.hEvent);
    return ret ? count : -1;
  }
  
-@@ -437,16 +488,23 @@ static int rpcrt4_conn_np_write(RpcConne
+@@ -472,16 +539,23 @@ static int rpcrt4_conn_np_write(RpcConne
    const char *buf = buffer;
    BOOL ret = TRUE;
    unsigned int bytes_left = count;
@@ -274,7 +399,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    return ret ? count : -1;
  }
  
-@@ -458,9 +516,9 @@ static int rpcrt4_conn_np_close(RpcConne
+@@ -493,9 +567,9 @@ static int rpcrt4_conn_np_close(RpcConne
      CloseHandle(npc->pipe);
      npc->pipe = 0;
    }
@@ -287,7 +412,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
    }
    return 0;
  }
-@@ -664,7 +722,7 @@ static void *rpcrt4_protseq_np_get_wait_
+@@ -699,7 +773,7 @@ static void *rpcrt4_protseq_np_get_wait_
      conn = CONTAINING_RECORD(protseq->conn, RpcConnection_np, common);
      while (conn) {
          rpcrt4_conn_listen_pipe(conn);
@@ -296,7 +421,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
              (*count)++;
          conn = CONTAINING_RECORD(conn->common.Next, RpcConnection_np, common);
      }
-@@ -685,7 +743,7 @@ static void *rpcrt4_protseq_np_get_wait_
+@@ -720,7 +794,7 @@ static void *rpcrt4_protseq_np_get_wait_
      *count = 1;
      conn = CONTAINING_RECORD(protseq->conn, RpcConnection_np, common);
      while (conn) {
@@ -305,7 +430,7 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
              (*count)++;
          conn = CONTAINING_RECORD(conn->common.Next, RpcConnection_np, common);
      }
-@@ -732,18 +790,12 @@ static int rpcrt4_protseq_np_wait_for_ne
+@@ -767,18 +841,12 @@ static int rpcrt4_protseq_np_wait_for_ne
          EnterCriticalSection(&protseq->cs);
          conn = CONTAINING_RECORD(protseq->conn, RpcConnection_np, common);
          while (conn) {
@@ -326,15 +451,3 @@ diff -prudN .\wine\dlls\rpcrt4/rpc_transport.c .\reactos\dll\win32\rpcrt4/rpc_tr
          else
              ERR("failed to locate connection for handle %p\n", b_handle);
          LeaveCriticalSection(&protseq->cs);
-diff -prudN .\wine\dlls\rpcrt4/rpcrt4.spec .\reactos\dll\win32\rpcrt4/rpcrt4.spec
---- .\wine\dlls\rpcrt4/rpcrt4.spec	2014-05-09 03:43:55.911032800 +0200
-+++ .\reactos\dll\win32\rpcrt4/rpcrt4.spec	2013-12-07 15:35:15.331527800 +0100
-@@ -266,7 +266,7 @@
- @ stdcall NdrRangeUnmarshall(ptr ptr ptr long)
- @ stub NdrRpcSmClientAllocate
- @ stub NdrRpcSmClientFree
--@ stub NdrRpcSmSetClientToOsf
-+@ stdcall NdrRpcSmSetClientToOsf(ptr)
- @ stub NdrRpcSsDefaultAllocate
- @ stub NdrRpcSsDefaultFree
- @ stub NdrRpcSsDisableAllocate
diff --git a/reactos/media/doc/README.WINE b/reactos/media/doc/README.WINE
index 5202e1efa2d..35e3682c102 100644
--- a/reactos/media/doc/README.WINE
+++ b/reactos/media/doc/README.WINE
@@ -165,7 +165,7 @@ reactos/dll/win32/rasapi32            # Synced to WineStaging-1.7.47
 reactos/dll/win32/resutils            # Synced to WineStaging-1.7.47
 reactos/dll/win32/riched20            # Synced to WineStaging-1.7.47
 reactos/dll/win32/riched32            # Synced to WineStaging-1.7.47
-reactos/dll/win32/rpcrt4              # Synced to Wine-1.7.17
+reactos/dll/win32/rpcrt4              # Synced to WineStaging-1.7.55
 reactos/dll/win32/rsabase             # Synced to WineStaging-1.7.47
 reactos/dll/win32/rsaenh              # Synced to WineStaging-1.7.47
 reactos/dll/win32/sccbase             # Synced to WineStaging-1.7.47