We Keep Coding

How do I find the target of a Windows App Execution Alias in C#/Win32 api?

Microsft Windows Terminal (installed via the Microsoft Store) creates a 0 bytes wt.exe file which is a Windows execution alias. AFAIK it is somthing similar to a symbolic link, except it seems to be resolved at the CreateProcess Api level as opposed to a symlink that is translated at the file system.
In powershell:
❯ dir ~\AppData\Local\Microsoft\WindowsApps\wt.exe
Mode Name
---- ----
la--- wt.exe -> C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.0.1401.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
❯ Get-Item .\wt.exe | fl
Name : wt.exe
Length : 0
LinkType : AppExeCLink
Target : C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.0.1401.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
I wasn't able to find proper documentation for these "new" kind of aliases. Even googling PS AppExeCLink value is not very useful.
I need a fast way to resolve an execution alias (get the target file) in a C# App. Given my requirements, I prefer an unmanaged (Win32 Api) way over adding a reference to the slow WMI or an external 300kb nuget package.
Thanks!

I faced the same problem in my System Tools Library, which choked on these new type of links. This library is written in C, and uses the WIN32 API.
Here's what I found so far:
Three years after their introduction in Windows, cmd.exe and PowerShell 5.1 are still unaware of App Exec Links, and report them as 0-byte files.
But PowerShell Core 7 knows about them:
PS C:\Temp> dir $env:LOCALAPPDATA\Microsoft\WindowsApps | ?{$_.LinkType} | select Name,LinkType,Target
Name LinkType Target
---- -------- ------
GameBarElevatedFT_Alias.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_5.420.11102.0_x64__8w...
MicrosoftEdge.exe AppExeCLink C:\WINDOWS\system32\SystemUWPLauncher.exe
python.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.11.3162.0_x64__8w...
python3.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.11.3162.0_x64__8w...
ubuntu.exe AppExeCLink C:\Program Files\WindowsApps\CanonicalGroupLimited.UbuntuonWindows_2004.2020.8...
ubuntu1804.exe AppExeCLink C:\Program Files\WindowsApps\CanonicalGroupLimited.Ubuntu18.04onWindows_2020.1...
WinFR.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.WindowsFileRecovery_0.1.13492.0_x64__8w...
winget.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.11.3162.0_x64__8w...
wt.exe AppExeCLink C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.4.3243.0_x64__8wekyb3...
PS C:\Temp>
These App Exec Links are NTFS Reparse Points, tagged as
IO_REPARSE_TAG_APPEXECLINK = 0x8000001b.
You can read them in a C/C++/C# program using the WIN32 API DeviceIoControl() with the FSCTL_GET_REPARSE_POINT control code.
My readlink.c module contains a ReadReparsePointW() routine demonstrating this.
You can dump the content of such a link, by running:
fsutil reparsepoint query <REPARSE_POINT_PATHNAME>
Ex:
C:\Temp>fsutil reparsepoint query "%LOCALAPPDATA%\Microsoft\WindowsApps\wt.exe"
Reparse Tag Value : 0x8000001b
Tag value: Microsoft
Reparse Data Length: 0x168
Reparse Data:
0000: 03 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 ....M.i.c.r.o.s.
0010: 6f 00 66 00 74 00 2e 00 57 00 69 00 6e 00 64 00 o.f.t...W.i.n.d.
0020: 6f 00 77 00 73 00 54 00 65 00 72 00 6d 00 69 00 o.w.s.T.e.r.m.i.
0030: 6e 00 61 00 6c 00 5f 00 38 00 77 00 65 00 6b 00 n.a.l._.8.w.e.k.
0040: 79 00 62 00 33 00 64 00 38 00 62 00 62 00 77 00 y.b.3.d.8.b.b.w.
0050: 65 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 e...M.i.c.r.o.s.
0060: 6f 00 66 00 74 00 2e 00 57 00 69 00 6e 00 64 00 o.f.t...W.i.n.d.
0070: 6f 00 77 00 73 00 54 00 65 00 72 00 6d 00 69 00 o.w.s.T.e.r.m.i.
0080: 6e 00 61 00 6c 00 5f 00 38 00 77 00 65 00 6b 00 n.a.l._.8.w.e.k.
0090: 79 00 62 00 33 00 64 00 38 00 62 00 62 00 77 00 y.b.3.d.8.b.b.w.
00a0: 65 00 21 00 41 00 70 00 70 00 00 00 43 00 3a 00 e.!.A.p.p...C.:.
00b0: 5c 00 50 00 72 00 6f 00 67 00 72 00 61 00 6d 00 \.P.r.o.g.r.a.m.
00c0: 20 00 46 00 69 00 6c 00 65 00 73 00 5c 00 57 00 .F.i.l.e.s.\.W.
00d0: 69 00 6e 00 64 00 6f 00 77 00 73 00 41 00 70 00 i.n.d.o.w.s.A.p.
00e0: 70 00 73 00 5c 00 4d 00 69 00 63 00 72 00 6f 00 p.s.\.M.i.c.r.o.
00f0: 73 00 6f 00 66 00 74 00 2e 00 57 00 69 00 6e 00 s.o.f.t...W.i.n.
0100: 64 00 6f 00 77 00 73 00 54 00 65 00 72 00 6d 00 d.o.w.s.T.e.r.m.
0110: 69 00 6e 00 61 00 6c 00 5f 00 31 00 2e 00 34 00 i.n.a.l._.1...4.
0120: 2e 00 33 00 32 00 34 00 33 00 2e 00 30 00 5f 00 ..3.2.4.3...0._.
0130: 78 00 36 00 34 00 5f 00 5f 00 38 00 77 00 65 00 x.6.4._._.8.w.e.
0140: 6b 00 79 00 62 00 33 00 64 00 38 00 62 00 62 00 k.y.b.3.d.8.b.b.
0150: 77 00 65 00 5c 00 77 00 74 00 2e 00 65 00 78 00 w.e.\.w.t...e.x.
0160: 65 00 00 00 30 00 00 00 e...0...
C:\Temp>
The reparse data there is a structure with four wide strings, looking like:
typedef struct _REPARSE_APPEXECLINK_READ_BUFFER { // For tag IO_REPARSE_TAG_APPEXECLINK
DWORD ReparseTag;
WORD ReparseDataLength;
WORD Reserved;
ULONG Version; // Currently version 3
WCHAR StringList[1]; // Multistring (Consecutive UTF-16 strings each ending with a NUL)
/* There are normally 4 strings here. Ex:
Package ID: L"Microsoft.WindowsTerminal_8wekyb3d8bbwe"
Entry Point: L"Microsoft.WindowsTerminal_8wekyb3d8bbwe!App"
Executable: L"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.4.3243.0_x64__8wekyb3d8bbwe\wt.exe"
Applic. Type: L"0" // Integer as ASCII. "0" = Desktop bridge application; Else sandboxed UWP application
*/
} APPEXECLINK_READ_BUFFER, *PAPPEXECLINK_READ_BUFFER;
Running the App Exec Link target of wt.exe...
"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.4.3243.0_x64__8wekyb3d8bbwe\wt.exe"
... works, and starts the Windows Terminal.
But running the App Exec Link target of MicrosoftEdge.exe...
"C:\WINDOWS\system32\SystemUWPLauncher.exe"
... does NOTHING.
⇒ The other parameters in the reparse data are somehow important. (But I don't know how to use them.)
Running
"%LOCALAPPDATA%\Microsoft\WindowsApps\MicrosoftEdge.exe"
Then looking in Task Manager, I see that the real executable running for MS Edge is
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
⇒ This proves that the App Exec Link target program is not always the real program.
It is possible to start the target application using the entry point string in the reparse data, instead of the target pathname, using:
explorer.exe shell:appsFolder\<REPARSE_POINT_ENTRY_POINT_NAME>
Ex, this starts Microsoft Edge:
explorer.exe shell:appsFolder\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge
But this is not what I want. I'd really want to find how to start the application using the target application pathname AND the other two parameters.
Anyway, I've updated the readlink() routine in my MsvcLibX library to return the target of App Exec Links.
All the tools in my System Tools Library that can handle symbolic links now show that target.
But as this target is obviously not the complete answer, I consider this current version as a makeshift implementation at best.
If anybody finds more information on this subject, I'm very interested!

You can also try adding Microsoft.PowerShell.5.1.ReferenceAssemblies nuget package to your project.
Then the following code works:
using System.Linq;
using System.Management.Automation;
string wtPath =
Path.Combine(
Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData),
"Microsoft",
"WindowsApps",
"wt.exe"
);
using (var ps = PowerShell.Create())
{
var psObject = ps.AddCommand("Get-Item").AddParameter("Path", wtPath).Invoke().Single();
var psPropInfo = psObject.Properties["Target"];
string[] targets = (psPropInfo.Value as List<string>).ToArray();
Console.WriteLine($"[{psPropInfo.Name}]=[{String.Join("; ", targets)}]");
}

Thought I would also add this related thread on how this ReparsePoint link type is used by UWP exes and the WindowsApp store.
tl;dr;
The ~\AppData\Local\Microsoft\WindowsApps\ directory has EXEs
that are using a special form of IO_REPARSE_TAG_APPEXECLINK symlink
to reference the actual UWP pkg located in
C:/Program Files/WindowsApps/.

System.TimeoutException being Thrown when Attempting to Write to Holding Registers using NModbus

I'm attempting to write a Modbus master program in C# that writes values into the holding registers of a single slave device over a RTU serial connection.
void SerialTimerTick(object sender, EventArgs e) {
_sp.WriteLine(inputText.ToString());
slaveAddress = (byte)slaveAddressNumericUpDown.Value;
startAddress = (ushort)startAddressNumericUpDown.Value;
registerAddress = (ushort)registerNumericUpDown.Value;
targetRegisterValue = (ushort)targetValueNumericUpDown.Value;
modbusMaster.WriteSingleRegister(slaveAddress, registerAddress, targetRegisterValue);
SerialTimer.Enabled = false;
sendButton.Enabled = true;
}
The problem is that when I attempt to send the write request to the slave, I get the following error:
System.TimeoutException: The operation has timed out.
which happens after the program outputs these numbers to the debug console in SharpDevelop three times, indicating three attempts:
254
120
128
34
32
25
To fix it, I've tried using break points to diagnose the problem, and it appears that NModbus is expecting some kind of ACKNOWLEDGE response from the slave in order to confirm that the data was sent correctly, only no such response is given.
When I look at my slave's communications feed, I see that something is happening on the slave's end when both the master and slave applications are running and my computer is connected to itself using two USB to Serial adapters:
Port COM 3 opened.
Port I/O buffers configured.
Port configured 256000,8,N,1
Timeouts configured (100ms/500ms)
Modem status : [CTS_][DSR_RING_]
RX: 0D 0A 0A 06 00 01
RX: 00 01 19 CA
RX: 01 06 00 01 00 01
RX: 19 CA
RX: 01 06 00 01 00 01
Instead, what I expected is for the first attempt to succeed and for the 40001 register to change its value from zero to one. I've tried changing NModbus versions, I've tried messing with the timeout and attempt settings of the IModbusMasterobject and I've also tried removing the exception entirely, which seems to be the only way I've gotten the program to work correctly, however this isn't an acceptable solution in my case.
The only thing I haven't tried so far is changing the slave application I'm using, which is currently the free PLC Simulator, which is written in C++ and not C#. This might be part of the problem, but I'm not sure.
I've only been using Modbus for a few weeks, and am working with a rather old version of the NModbus library. Any help would be much appreciated.

I haven't used NModbus, but I have written my own Modbus "stack" in C++ and C# so this answer is based more on my experience with Modbus than on how NModbus works.
There should be a response from Modbus commands EXCEPT when broadcasted (slave address 0). It should be normal operation for Modbus code to send the request and wait for a response. If the response is not received in a some specified amount of time, I would expect a timeout error.
Looking at the modbus spec; the write single register function should have an identical request and response ADU (if successful). It sounds like you are trying to write slave address 1 register 1 with a value 1. In that case, both the request response ADUs should be "01 06 00 01 00 01 19 CA" ("19 CA" is the correct CRC for this PDU). I do see what could be data from a request or response, but there seems to be something interfering:
RX: 0D 0A (NOT SURE WHAT THIS DATA IS FROM)
RX: 0A 06 00 01 00 01 19 CA (LOOKS CLOSE, BUT ADDRESS IS WRONG)
RX: 01 06 00 01 00 01 19 CA (LOOKS CORRECT)
RX: 01 06 00 01 00 01 (LOOKS CORRECT, BUT INCOMPLETE)
Just to test, try a much slower baud rate (9600) and use even parity. Some USB to Serial converters have driver parameters that can be tweaked. Do you have termination enabled on both converters (first and last devices terminated)? Is there a way to configure the NModbus response timeout?

my view in asp.net mvc crashed?

I use Visual Studio 2013 with ASP.NET MVC 5 and TFS when I run project
my PC turns off.
When I run VS again my one view that is not in TFS gives me an error, it was working fine before my PC turned off.
Description: An error occurred during the compilation of a resource required to service this request. Please review the following specific error details and modify your source code appropriately.
Compiler Error Message:
CS1009: Unrecognized escape sequence
Source Error:
Line 51: BeginContext("~/Views/ATM/CreateExecl.cshtml", 0, 4434, true);
Line 52:
Line 53: WriteLiteral("\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\" +
and view in project like : -
000000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............
000000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ...............

Your file probably became corrupted due to the power outage. You'll need to rewrite your view since it sounds like you didn't yet have it checked into source code control.
In order to avoid this in the future, it's wise to have your computer on an Uninterruptible Power Supply. These are basically large batteries you plug your PC and monitor and other essential equipment into that give you some time to save your work and perform a proper shut down in the event of a power outage, or allow you to keep working through brief power outages.

Oracle.ManagedDataAccess and ORA-01017: invalid username/password; logon denied

I have a challenging situation on one of our servers. I have an ASP.NET MVC 3 application that needs to connect to an Oracle 12c database. It does so using the following connection string:
User ID=myuserid;Password=mypass;Data Source=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=<IP ADDRESS>)(PORT = 1521)))(CONNECT_DATA=(SERVICE_NAME=PDB1)));
I'm also using Oracle's Oracle.ManagedDataAccess, version 4.121.1.0. Each attempt to connect results in the following error:
ORA-01017: invalid username/password; logon denied
I can connect successfully on my desktop with the above credentials. I have the same code on another server, but using an older, un-managed version of the library, and it can connect successfully with the aforementioned credentials. However, the server on which I would like my code to run fails every single time using the same credentials that enable successful connections on different servers.
On the server that fails, I can:
connect via SQLPLUS
hit the database with TNSPING
Create a System DSN to establish an ODBC connection
I have checked the TNSNAMES.ORA in all locations and they appear to be correct.
After hitting the database too many times, the account actually locked indicating that I was, indeed, hitting the database and that the database did not like the credentials presented. I checked the applications that previously connected successfully and they also failed with an error indicating that the account was locked. Unlocking the account caused those applications to connect successfully with the exception of the server with which I am having problems.
I am at my wit's end.
Does anyone have any other suggestions as to what might cause this problem?
EDIT:
I installed WireShark on my local computer and on the offending server. I captured communication between my desktop and the database as well as the offending server and the database. I found that my desktop communicated the password:
0080 35 42 31 41 43 34 30 00 01 01 01 0d 0d 41 55 54 5B1AC40......AUT
0090 48 5f 50 41 53 53 57 4f 52 44 01 40 40 43 30 36 H_PASSWORD.##C06
00a0 37 39 42 31 31 42 46 36 42 41 43 44 39 30 38 44 79B11BF6BACD908D
00b0 37 39 34 34 31 31 46 34 32 33 30 42 34 36 44 36 794411F4230B46D6
00c0 35 36 36 33 31 42 45 39 39 41 36 43 36 37 42 44 56631BE99A6C67BD
00d0 43 33 35 42 42 44 36 44 42 45 37 34 36 00 01 0d C35BBD6DBE746...
whereas the server with which I am having problems, did not (or at least that's the assumption):
0080 39 33 39 37 32 33 46 00 01 01 01 0d 0d 41 55 54 939723F......AUT
0090 48 5f 50 41 53 53 57 4f 52 44 01 40 40 00 00 00 H_PASSWORD.##...
00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 0d ................
Does anyone know of a security/configuration setting that would prevent passwords from being transmitted even though they are present in the connection string?
Edit (20180713):
In my particular case, the issue was the FIPS setting.
For those doing research, there are several ways around this.
You can alter the registry setting located at HKLM\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\Enabled. If FIPS is enabled, the value is 1. If disabled, the value is 0. You do not need to reboot.
Most likely, the reason why you are running into this issue is that FIPS is enabled and you are using the Oracle managed data access library. A solid workaround is to use the unmanaged library. However, to use this library, you need to install the Oracle Instant Client. The client is available for download in the Oracle Data Access Components.
Upgrade your server to Oracle 12.2c. Oracle 12c versions before 12.2c still have this problem.
If you do not have FIPS enabled, the most likely you will need to investigate whether your database has the SEC_CASE_SENSITIVE_LOGON setting set to true. You will need to execute ALTER SYSTEM SET SEC_CASE_SENSITIVE_LOGON = FALSE; and then reset all of your passwords.

I have been struggling with this same issue for a couple of weeks and finally have a resolution. I had to disable the FIPS security policy, try setting this key:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\FipsAlgorithmPolicy]
"Enabled"=dword:00000000
to zero, it worked perfectly for me
I was following your thread your blank password issue eventually pointed me here:
https://community.oracle.com/thread/2557592?start=30&tstart=0

Based on Jeff's answer (10/31/2014)...
The registry setting can be set by GPO to only allow FIPS compliant algorithms. Setting this to 0 as indicated may be a violation of some security policies and get overwritten by the GPO. This registry setting controls more than just IIS or ASP.NET.
There is another way that is specific to .NET and may work at the application level. This is much easier to justify compared to modifying the settings of the whole server.
Application specific method:
In your Web.config or App.config file, add the following setting:
<configuration> <!-- Will already be there -->
<runtime>
<enforceFIPSPolicy enabled="false"/>
</runtime>
... the rest of your .config
If I remember correctly, this must be at the beginning of your config file.
All .NET application method:
Place the setting above in the machine.config file. There will be one for each .NET version and architecture (64 bit/32 bit). There will already be a element, so put the element inside it.

I had the same issue using Entity Framework and the Oracle.ManagedDataAccess.Client, but I had some success by uppercasing my password in the configuration connection string section.

I'm programming in C # with an Oracle xe 11g database, it had never happened to me before, but the new users that I created in the DB, when I tried to connect from the C# application, I got the error: ORA-01017: invalid username / password ; logon denied, only with new users (I did a migration from xe 10g to xe 11g) where migrated users from version 10g worked correctly.
I made this change in my connection string and managed to solve the problem
before
private string cadenaCone = "User Id=AAA111;Password=BBB222;Data Source=CCC333;Connection Timeout=60;";
after
private string cadenaCone = "User Id=AAA111;Password=" + ((char)34).ToString() + "BBB222"+((char)34).ToString()+";Data Source=CCC333;Connection Timeout=60;";

I did not quite have the same scenario as this case does, but I did have very similar results. What I did to sort out the problem was, I enclosed the password in quotes like the following (VB.NET):
cnx.ConnectionString = "User ID=MYID;Password=""MyPass"" ;Data Source=MyTEST"
or use chr(34) as follows
cnx.ConnectionString = "User ID=MYID;Password="+chr(34)+"MyPass"+chr(34)+" ;Data Source=MyTEST"

I had exactly same issue. When I was connecting to database directly from SqlDeveloper, it was working fine. But my application ( built on VB6) failed to connect to Oracle and giving error "ORA-01017 Invalid ID/password.
After turning off, case sensitive login for my database ID, it resolved the issue.

I had the same problem! I didn't try changing the RegKey but I did try changing the web and machine config. This did not work.
What did solve the problem was changing the app pool I was running under!
The App Pool was running under a service account and once I moved it to a new App Pool with just the default system account it started picking up the User ID and Password from the config.

I was trying with the command:
ALTER SYSTEM SET SEC_CASE_SENSITIVE_LOGON = FALSE;
But it didn't work.
I had to change it using the SQL Developer in the DBA tab.
Find the Parameter 'sec_case_sensitive_logon' and change its value to 'FALSE'
Commit your changes using the button:
It will ask the commit strategy and you have to choose both:
Click 'Apply'
I don't know if this step is required, but I also changed the user's password. (I set the same password)
In case, you don't know how to open the 'Initialization Parameters':
Open 'Oracle SQL Developer'
Go to 'View' menu and select 'DBA'
Choose a connection
And then click on 'Initialization Parameters'

For some reason (and have no idea why ) my c# code sends my username uppercased even though I write it as lowercase.
For example my username is kullaniciadi you may think uppercase of this would be KULLANICIADI but seems it's not. My server's locale is Turkish (I believe this is the reason) so uppercased version of my username becomes KULLANİCİADİ because in Turkish uppercase of i is İ and uppercase of ı is I. And this results invalid username error.
Had no control over database so can't change any settings on it.
Typing my username all uppercased solved the problem.
Also this only works in combination of accepted answer. If registry key mentioned in accepted answer is set to 1 then this answer may not work.
Spent lots of hours for this stupid thing. I'm writing this down so you won't.

Unrecognized Ciphers from mobile application

I'm writing an Android application with Xamarin (C#) that makes calls to Exchange Web Services. The code sets the out of office message. The code I have written works from a standard Windows Forms application, but fails with a "Request Invalid" SOAP exception. I've captured the requests using Fiddler, and it appears to be a cipher issue.
The Windows Forms request is this:
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.1 (TLS/1.0)
Random: 53 B1 31 EF DD 96 01 7E 0A 0A 1F 85 60 8F 2F BD D6 77 08 2D B0 C6 52 91 BC A0 19 2F 20 08 F1
SessionID: empty
Extensions:
renegotiation_info 00
server_name
elliptic_curves secp256r1 [0x17], secp384r1 [0x18]
ec_point_formats uncompressed [0x0]
Ciphers:
[002F] TLS_RSA_AES_128_SHA
[0035] TLS_RSA_AES_256_SHA
[0005] SSL_RSA_WITH_RC4_128_SHA
[000A] SSL_RSA_WITH_3DES_EDE_SHA
[C013] TLS1_CK_ECDHE_RSA_WITH_AES_128_CBC_SHA
[C014] TLS1_CK_ECDHE_RSA_WITH_AES_256_CBC_SHA
[C009] TLS1_CK_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
[C00A] TLS1_CK_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
[0032] TLS_DHE_DSS_WITH_AES_128_SHA
[0038] TLS_DHE_DSS_WITH_AES_256_SHA
[0013] SSL_DHE_DSS_WITH_3DES_EDE_SHA
[0004] SSL_RSA_WITH_RC4_128_MD5
Compression:
[00] NO_COMPRESSION
The Android request is this:
A SSLv3-compatible ClientHello handshake was found. Fiddler extracted the parameters below.
Version: 3.1 (TLS/1.0)
Random: 53 B1 30 9C 9A A2 AE 57 A9 98 A3 C8 DF 94 E0 04 1D 3F E1 34 A8 8A DF 8B 5E 8B 60 67 96 6D 1B
SessionID: empty
Extensions:
server_name
Ciphers:
[0035] TLS_RSA_AES_256_SHA
[002F] TLS_RSA_AES_128_SHA
[000A] SSL_RSA_WITH_3DES_EDE_SHA
[0005] SSL_RSA_WITH_RC4_128_SHA
[0004] SSL_RSA_WITH_RC4_128_MD5
[0009] SSL_RSA_WITH_DES_SHA
[0003] SSL_RSA_EXPORT_WITH_RC4_40_MD5
[0006] SSL_RSA_EXPORT_WITH_RC2_40_MD5
[0008] SSL_RSA_EXPORT_WITH_DES40_SHA
[0060] Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
[0061] Unrecognized cipher - See http://www.iana.org/assignments/tls-parameters/
[0062] TLS_RSA_EXPORT1024_WITH_DES_SHA
[0064] TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
Compression:
[00] NO_COMPRESSION
The "unrecognized cipher" message leaps out here. Any help on how to resolve this issue would be great.
thanks

That two ciphers are not recognized does not mean that there are no ciphers to choose from. Unless the TLS is explicitly broken down further on, it's likely another issue.
I think you are better off looking at the SOAP messages.