2

I am building a server that will respond to custom SQL batch messages. I have constructed various TDS messages and responses based on the official MS-TDS documentation. For example, I am able to construct a table result based on https://msdn.microsoft.com/en-us/library/dd341261.aspx. These messages works fine on SSMS and SQLCMD.

However, when I try to use SqlCommand.ExecuteReader on a C# client, i get an error:

System.InvalidOperationException occurred HResult=-2146233079
Message=Internal connection fatal error. Error state: 15, Token : 0
Source=System.Data StackTrace: at System.Data.SqlClient.TdsParser.TryRun(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj, Boolean& dataReady) InnerException:

Using a TDS proxy, I ran a simple select returning a table with single int value on a proper SQL server, the bytes that was returned was way longer than the one documented at MSDN:

04-01-00-3D-00-37-01-00-E3-03-00-12-00-00-81-01-00-00-00-00-00-00-00-09-00-26-04-07-41-00-67-00-65-00-6E-00-74-00-4E-00-6F-00-D1-04-E3-95-0E-00-FD-10-00-C1-00-01-00-00-00-00-00-00-00-6E-00-67-00-65-00-64-00-20-00-64-00-61-00-74-00-61-00-62-00-61-00-73-00-65-00-20-00-63-00-6F-00-6E-00-74-00-65-00-78-00-74-00-20-00-74-00-6F-00-20-00-27-00-54-00-65-00-73-00-74-00-2D-00-44-00-42-00-2D-00-31-00-27-00-2E-00-0B-43-00-43-00-5A-00-59-00-2D-00-57-00-49-00-4E-00-32-00-4B-00-36-00-00-01-00-00-00-E3-08-00-07-05-09-04-D0-00-34-00-E3-17-00-02-0A-75-00-73-00-5F-00-65-00-6E-00-67-00-6C-00-69-00-73-00-68-00-00-AB-72-00-47-16-00-00-01-00-27-00-43-00-68-00-61-00-6E-00-67-00-65-00-64-00-20-00-6C-00-61-00-6E-00-67-00-75-00-61-00-67-00-65-00-20-00-73-00-65-00-74-00-74-00-69-00-6E-00-67-00-20-00-74-00-6F-00-20-00-75-00-73-00-5F-00-65-00-6E-00-67-00-6C-00-69-00-73-00-68-00-2E-00-0B-43-00-43-00-5A-00-59-00-2D-00-57-00-49-00-4E-00-32-00-4B-00-36-00-00-01-00-00-00-AD-36-00-01-74-00-00-04-16-4D-00-69-00-63-00-72-00-6F-00-73-00-6F-00-66-00-74-00-20-00-53-00-51-00-4C-00-20-00-53-00-65-00-72-00-76-00-65-00-72-00-00-00-00-00-0D-00-0F-A1-E3-13-00-04-04-38-00-30-00-30-00-30-00-04-34-00-30-00-39-00-36-00-AE-01-2E-00-00-00-00-09-00-60-81-14-FF-E7-FF-FF-00-02-02-07-01-04-01-00-05-04-FF-FF-FF-FF-06-01-00-07-01-02-08-08-00-00-00-00-00-00-00-00-09-04-FF-FF-FF-FF-04-01-00-00-00-01-FF-FD-00-00-00-00-00-00-00-00-00-00-00-00-74-31-36-D9-DF-C6-56-EC-AC-F9-4A-8D-2B-4E-92-AD-7B-7D-09-46-2C-E9-7C-3F-78-47-9A-39-76-C4-17-86-19-9A-07-94-4D-D8-4B-D8-A2-04-FE-57-B7-BC-33-47-CF-F6-62-37-B8-A4-AF-31-12-6F-BF-A0-C9-E4-7C-16-57-44-2B-1E-5B-07-04-3C-22-95-3F-48-B9-46-F1-86-2B-3C-86-D6-83-50-F4-09-CD-79-78-D1-40-E8-3F-0C-76-29-B9-3B-8E-57-AF-A8-BD-34-B8-48-5E-83-E8-81-ED-3D-B0-6F-7C-16-3B-BA-ED-5A-20-64-37-20-64-B9-25-02-03-01-00-01-30-0D-06-09-2A-86-48-86-F7-0D-01-01-05-05-00-03-82-01-01-00-4C-95-8B-D2-C3-AF-CB-DF-65-18-19-B4-4B-68-C5-E8-5D-8B-A0-F9-C3-F4-F6-A3-9B-51-1C-2F-DF-83-14-8A-70-85-52-D1-A6-CC-EB-34-46-F6-A5-FA-FE-95-00-51-E3-91-66-DF-D2-71-BB-43-4B-0F-41-89-F4-56-A8-4F-B1-1F-6B-1D-67-3B-68-97-98-B6-A7-B2-16-91-47-EA-25-D5-95-5C-FA-29-A5-C7-13-DA-03-C4-A6-1B-39-EC-F7-1C-70-69-F6-48-30-55-AF-23-B8-FC-FC-4C-23-CF-76-86-B3-57-D3-5F-6D-18-D0-E3-E7-30-EB-AB-36-12-F2-37-11-47-AF-BC-42-55-17-CD-8E-DA-24-F2-88-B0-28-35-20-0C-04-F1-77-A6-61-22-75-ED-84-86-E0-F0-AF-12-C5-37-58-8A-D6-BA-FC-E4-1C-4C-49-5E-15-75-C5-C9-90-9D-88-68-CE-9E-EE-06-F5-A0-CD-1C-7C-09-E8-37-E2-9C-7B-C3-C2-4F-31-BD-88-48-23-E6-65-5A-C7-7D-1A-E2-0F-BA-8F-1E-A1-7C-00-7A-CF-98-4B-B7-86-AD-C3-97-C1-7F-3F-C4-86-02-54-F7-5C-A0-E2-53-F0-9E-ED-26-13-FC-15-F2-B2-6D-D9-AD-45-AD-82-90-0C-00-01-28-03-00-1D-20-ED-99-94-F9-10-29-C3-C0-1E-A1-08-AA-CF-0B-5D-49-13-36-F2-2C-2F-1C-DD-0A-F3-CA-E9-0B-39-10-03-45-02-01-01-00-BF-92-C0-8C-C9-61-BB-A8-D2-22-67-7D-B1-DC-DA-9F-67-1A-4E-97-9F-EC-B3-05-C6-84-BC-51-1B-4C-79-9E-5E-7D-72-7F-6D-32-BB-90-43-0A-4A-7D-F3-F0-40-96-EF-4A-88-AA-53-71-77-E0-87-BB-2E-79-08-95-C5-6F-F4-10-08-F0-50-FA-41-77-FE-EA-FF-17-ED-25-05-EA-DF-96-87-A4-3B-AD-AC-B6-E9-FC-F3-6B-00-A8-04-D4-ED-FF-51-24-78-A6-44-F4-59-FF-85-0F-DA-13-6E-2C-F9-B7-43-C7-D9-55-31-43-D0-96-67-B5-2E-FE-13-5E-A4-D3-DE-48-4A-B0-48-04-A1-48-D7-F5-E4-12-BB-08-EA-A7-DC-04-03-87-40-93-2C-32-7D-73-4F-FC-82-C5-34-55-5B-93-AD-71-74-7F-18-A7-7C-97-F5-12-81-7D-D9-B5-50-32-E8-F1-E6-4D-28-D3-72-83-02-52-76-45-6B-E9-70-0B-56-90-40-66-6B-1F-D7-A6-B2-6A-FE-00-B3-A8-36-8C-90-B3-63-F9-C1-74-D4-9F-0B-B7-33-0B-30-60-01-73-E3-2A-69-86-42-45-C9-ED-0E-6A-CF-39-A4-69-ED-03-E7-EB-14-CF-CF-3D-A7-49-43-F7-16-A2-0E-00-00-00-00-0...

Comparing the example at the documentation, there are a few unexplained bytes, for example:

E3-03-00-12-00-00

right after the PacketHeader block. This is undocumented in MS-TDS.

Also, after the COLMETADATA token, Count, UserType, and Flags, it starts with 09, which is not any TYPE_INFO specified here: https://msdn.microsoft.com/en-us/library/dd305325.aspx, when it is supposed to be an INT datatype.

Other than that, there are a lot of other data after the initial response that is not documented as well.

Can anyone help to shed some light on this?

Calvin
  • 21
  • 2

0 Answers0