diff --git a/dll/win32/kernel32/client/console/readwrite.c b/dll/win32/kernel32/client/console/readwrite.c
index 953c0907259..79462148265 100644
--- a/dll/win32/kernel32/client/console/readwrite.c
+++ b/dll/win32/kernel32/client/console/readwrite.c
@@ -328,7 +328,7 @@ IntReadConsoleOutput(HANDLE hConsoleOutput,
 static
 BOOL
 IntReadConsoleOutputCode(HANDLE hConsoleOutput,
-                         USHORT CodeType,
+                         CODE_TYPE CodeType,
                          PVOID pCode,
                          DWORD nLength,
                          COORD dwReadCoord,
@@ -721,42 +721,55 @@ IntWriteConsoleOutputCharacter(HANDLE hConsoleOutput,
 
 static
 BOOL
-IntFillConsoleOutputCharacter(HANDLE hConsoleOutput,
-                              PVOID cCharacter,
-                              DWORD nLength,
-                              COORD dwWriteCoord,
-                              LPDWORD lpNumberOfCharsWritten,
-                              BOOL bUnicode)
+IntFillConsoleOutputCode(HANDLE hConsoleOutput,
+                         CODE_TYPE CodeType,
+                         PVOID pCode,
+                         DWORD nLength,
+                         COORD dwWriteCoord,
+                         LPDWORD lpNumberOfCodesWritten)
 {
-    CSR_API_MESSAGE Request;
     NTSTATUS Status;
+    CONSOLE_API_MESSAGE ApiMessage;
+    PCSRSS_FILL_OUTPUT FillOutputRequest = &ApiMessage.Data.FillOutputRequest;
 
-    Request.Data.FillOutputRequest.ConsoleHandle = hConsoleOutput;
-    Request.Data.FillOutputRequest.Unicode = bUnicode;
+    FillOutputRequest->ConsoleHandle = hConsoleOutput;
+    FillOutputRequest->CodeType = CodeType;
 
-    if(bUnicode)
-        Request.Data.FillOutputRequest.Char.UnicodeChar = *((WCHAR*)cCharacter);
-    else
-        Request.Data.FillOutputRequest.Char.AsciiChar = *((CHAR*)cCharacter);
+    switch (CodeType)
+    {
+        case CODE_ASCII:
+            FillOutputRequest->Code.AsciiChar = *(PCHAR)pCode;
+            break;
 
-    Request.Data.FillOutputRequest.Position = dwWriteCoord;
-    Request.Data.FillOutputRequest.Length = (WORD)nLength;
+        case CODE_UNICODE:
+            FillOutputRequest->Code.UnicodeChar = *(PWCHAR)pCode;
+            break;
 
-    Status = CsrClientCallServer(&Request,
+        case CODE_ATTRIBUTE:
+            FillOutputRequest->Code.Attribute = *(PWORD)pCode;
+            break;
+
+        default:
+            SetLastError(ERROR_INVALID_PARAMETER);
+            return FALSE;
+    }
+
+    FillOutputRequest->Coord = dwWriteCoord;
+    FillOutputRequest->Length = nLength;
+
+    Status = CsrClientCallServer((PCSR_API_MESSAGE)&ApiMessage,
                                  NULL,
-                                 CSR_CREATE_API_NUMBER(CSR_CONSOLE, FILL_OUTPUT),
-                                 sizeof(CSR_API_MESSAGE));
-
-    if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request.Status))
+                                 CSR_CREATE_API_NUMBER(CONSRV_SERVERDLL_INDEX, ConsolepFillConsoleOutput),
+                                 sizeof(CSRSS_FILL_OUTPUT));
+    if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = ApiMessage.Status))
     {
         BaseSetLastNTError(Status);
         return FALSE;
     }
 
-    if(lpNumberOfCharsWritten != NULL)
-    {
-        *lpNumberOfCharsWritten = Request.Data.FillOutputRequest.NrCharactersWritten;
-    }
+    if (lpNumberOfCodesWritten)
+        *lpNumberOfCodesWritten = FillOutputRequest->Length;
+        // *lpNumberOfCharsWritten = Request.Data.FillOutputRequest.NrCharactersWritten;
 
     return TRUE;
 }
@@ -1277,12 +1290,12 @@ FillConsoleOutputCharacterW(HANDLE hConsoleOutput,
                             COORD dwWriteCoord,
                             LPDWORD lpNumberOfCharsWritten)
 {
-    return IntFillConsoleOutputCharacter(hConsoleOutput,
-                                         &cCharacter,
-                                         nLength,
-                                         dwWriteCoord,
-                                         lpNumberOfCharsWritten,
-                                         TRUE);
+    return IntFillConsoleOutputCode(hConsoleOutput,
+                                    CODE_UNICODE,
+                                    &cCharacter,
+                                    nLength,
+                                    dwWriteCoord,
+                                    lpNumberOfCharsWritten);
 }
 
 
@@ -1299,12 +1312,12 @@ FillConsoleOutputCharacterA(HANDLE hConsoleOutput,
                             COORD dwWriteCoord,
                             LPDWORD lpNumberOfCharsWritten)
 {
-    return IntFillConsoleOutputCharacter(hConsoleOutput,
-                                         &cCharacter,
-                                         nLength,
-                                         dwWriteCoord,
-                                         lpNumberOfCharsWritten,
-                                         FALSE);
+    return IntFillConsoleOutputCode(hConsoleOutput,
+                                    CODE_ASCII,
+                                    &cCharacter,
+                                    nLength,
+                                    dwWriteCoord,
+                                    lpNumberOfCharsWritten);
 }
 
 
@@ -1321,28 +1334,12 @@ FillConsoleOutputAttribute(HANDLE hConsoleOutput,
                            COORD dwWriteCoord,
                            LPDWORD lpNumberOfAttrsWritten)
 {
-    CSR_API_MESSAGE Request;
-    NTSTATUS Status;
-
-    Request.Data.FillOutputAttribRequest.ConsoleHandle = hConsoleOutput;
-    Request.Data.FillOutputAttribRequest.Attribute = (CHAR)wAttribute;
-    Request.Data.FillOutputAttribRequest.Coord = dwWriteCoord;
-    Request.Data.FillOutputAttribRequest.Length = (WORD)nLength;
-
-    Status = CsrClientCallServer(&Request,
-                                 NULL,
-                                 CSR_CREATE_API_NUMBER(CSR_CONSOLE, FILL_OUTPUT_ATTRIB),
-                                 sizeof(CSR_API_MESSAGE));
-    if (!NT_SUCCESS(Status) || !NT_SUCCESS(Status = Request.Status))
-    {
-        BaseSetLastNTError ( Status );
-        return FALSE;
-    }
-
-    if (lpNumberOfAttrsWritten)
-        *lpNumberOfAttrsWritten = nLength;
-
-    return TRUE;
+    return IntFillConsoleOutputCode(hConsoleOutput,
+                                    CODE_ATTRIBUTE,
+                                    &wAttribute,
+                                    nLength,
+                                    dwWriteCoord,
+                                    lpNumberOfAttrsWritten);
 }
 
 /* EOF */
diff --git a/include/reactos/subsys/win/conmsg.h b/include/reactos/subsys/win/conmsg.h
index 539e9634be5..d4273bdbf4b 100644
--- a/include/reactos/subsys/win/conmsg.h
+++ b/include/reactos/subsys/win/conmsg.h
@@ -27,7 +27,7 @@ typedef enum _CONSRV_API_NUMBER
     ConsolepWriteConsoleOutput,
     ConsolepReadConsoleOutputString,
     // ConsolepWriteConsoleOutputString,
-    // ConsolepFillConsoleOutput,
+    ConsolepFillConsoleOutput,
     ConsolepGetMode,
     // ConsolepGetNumberOfFonts,
     ConsolepGetNumberOfInputEvents,
@@ -183,28 +183,6 @@ typedef struct
     COORD Position;
 } CSRSS_SET_CURSOR_POSITION, *PCSRSS_SET_CURSOR_POSITION;
 
-typedef struct
-{
-    HANDLE ConsoleHandle;
-    BOOL Unicode;
-    union
-    {
-        CHAR AsciiChar;
-        WCHAR UnicodeChar;
-    } Char;
-    COORD Position;
-    WORD Length;
-    ULONG NrCharactersWritten;
-} CSRSS_FILL_OUTPUT, *PCSRSS_FILL_OUTPUT;
-
-typedef struct
-{
-    HANDLE ConsoleHandle;
-    CHAR Attribute;
-    COORD Coord;
-    WORD Length;
-} CSRSS_FILL_OUTPUT_ATTRIB, *PCSRSS_FILL_OUTPUT_ATTRIB;
-
 typedef struct
 {
     HANDLE ConsoleHandle;
@@ -303,8 +281,7 @@ typedef enum _CODE_TYPE
 
 typedef struct
 {
-    HANDLE    ConsoleHandle;
-    CODE_TYPE CodeType;
+    HANDLE ConsoleHandle;
 
     DWORD NumCodesToRead;
     COORD ReadCoord;
@@ -312,6 +289,7 @@ typedef struct
 
     DWORD CodesRead;
 
+    CODE_TYPE CodeType;
     union
     {
         PVOID pCode;
@@ -321,6 +299,23 @@ typedef struct
     } pCode;    // Either a pointer to a character or to an attribute.
 } CSRSS_READ_CONSOLE_OUTPUT_CODE, *PCSRSS_READ_CONSOLE_OUTPUT_CODE;
 
+typedef struct
+{
+    HANDLE ConsoleHandle;
+
+    CODE_TYPE CodeType;
+    union
+    {
+        CHAR AsciiChar;
+        WCHAR UnicodeChar;
+        WORD Attribute;
+    } Code; // Either a character or an attribute.
+
+    COORD Coord;
+    ULONG Length;
+
+    ULONG NrCharactersWritten; // FIXME: Only for chars, is it removable ?
+} CSRSS_FILL_OUTPUT, *PCSRSS_FILL_OUTPUT;
 
 typedef struct
 {
@@ -595,7 +590,6 @@ typedef struct _CONSOLE_API_MESSAGE
         CSRSS_WRITE_CONSOLE_OUTPUT_ATTRIB WriteConsoleOutputAttribRequest;
 
         CSRSS_FILL_OUTPUT FillOutputRequest;
-        CSRSS_FILL_OUTPUT_ATTRIB FillOutputAttribRequest;
         CSRSS_SET_ATTRIB SetAttribRequest;
 
         /* Aliases */
diff --git a/win32ss/user/consrv/conoutput.c b/win32ss/user/consrv/conoutput.c
index 956f3a4503b..4ffdb1cf56c 100644
--- a/win32ss/user/consrv/conoutput.c
+++ b/win32ss/user/consrv/conoutput.c
@@ -991,45 +991,63 @@ CSR_API(CsrWriteConsoleOutputAttrib)
     return STATUS_SUCCESS;
 }
 
-CSR_API(CsrFillOutputChar)
+CSR_API(SrvFillConsoleOutput)
 {
     NTSTATUS Status;
     PCSRSS_FILL_OUTPUT FillOutputRequest = &((PCONSOLE_API_MESSAGE)ApiMessage)->Data.FillOutputRequest;
     PCSRSS_CONSOLE Console;
     PCSRSS_SCREEN_BUFFER Buff;
-    DWORD X, Y, Length, Written = 0;
-    CHAR Char;
+    DWORD X, Y, Length, Start; // , Written = 0;
+    USHORT CodeType;
+    BYTE Code;
     PBYTE Buffer;
     SMALL_RECT UpdateRect;
 
-    DPRINT("CsrFillOutputChar\n");
+    DPRINT("SrvFillConsoleOutput\n");
+
+    Status = ConioLockScreenBuffer(ConsoleGetPerProcessData(CsrGetClientThread()->Process), FillOutputRequest->ConsoleHandle, &Buff, GENERIC_WRITE);
+    if (!NT_SUCCESS(Status)) return Status;
 
-    Status = ConioLockScreenBuffer(CsrGetClientThread()->Process, FillOutputRequest->ConsoleHandle, &Buff, GENERIC_WRITE);
-    if (! NT_SUCCESS(Status))
-    {
-        return Status;
-    }
     Console = Buff->Header.Console;
 
-    X = FillOutputRequest->Position.X;
-    Y = (FillOutputRequest->Position.Y + Buff->VirtualY) % Buff->MaxY;
-    Buffer = &Buff->Buffer[2 * (Y * Buff->MaxX + X)];
-    if(FillOutputRequest->Unicode)
-        ConsoleUnicodeCharToAnsiChar(Console, &Char, &FillOutputRequest->Char.UnicodeChar);
-    else
-        Char = FillOutputRequest->Char.AsciiChar;
+    CodeType = FillOutputRequest->CodeType;
+
+    X = FillOutputRequest->Coord.X;
+    Y = (FillOutputRequest->Coord.Y + Buff->VirtualY) % Buff->MaxY;
     Length = FillOutputRequest->Length;
+    Start = 2 * (Y * Buff->MaxX + X) + (CodeType == CODE_ATTRIBUTE ? 1 : 0);
+    Buffer = &Buff->Buffer[Start];
+
+    switch (CodeType)
+    {
+        case CODE_ASCII:
+            Code = (BYTE)FillOutputRequest->Code.AsciiChar;
+            break;
+
+        case CODE_UNICODE:
+            ConsoleUnicodeCharToAnsiChar(Console, (PCHAR)&Code, &FillOutputRequest->Code.UnicodeChar);
+            break;
+
+        case CODE_ATTRIBUTE:
+            Code = (BYTE)FillOutputRequest->Code.Attribute;
+            break;
+
+        default:
+            ConioUnlockScreenBuffer(Buff);
+            return STATUS_INVALID_PARAMETER;
+    }
+
     while (Length--)
     {
-        *Buffer = Char;
+        *Buffer = Code;
         Buffer += 2;
-        Written++;
+        // Written++;
         if (++X == Buff->MaxX)
         {
             if (++Y == Buff->MaxY)
             {
                 Y = 0;
-                Buffer = Buff->Buffer;
+                Buffer = Buff->Buffer + (CodeType == CODE_ATTRIBUTE ? 1 : 0);
             }
             X = 0;
         }
@@ -1037,66 +1055,16 @@ CSR_API(CsrFillOutputChar)
 
     if (Buff == Console->ActiveBuffer)
     {
-        ConioComputeUpdateRect(Buff, &UpdateRect, &FillOutputRequest->Position,
+        ConioComputeUpdateRect(Buff, &UpdateRect, &FillOutputRequest->Coord,
                                FillOutputRequest->Length);
         ConioDrawRegion(Console, &UpdateRect);
     }
 
     ConioUnlockScreenBuffer(Buff);
+/*
     Length = FillOutputRequest->Length;
     FillOutputRequest->NrCharactersWritten = Length;
-    return STATUS_SUCCESS;
-}
-
-CSR_API(CsrFillOutputAttrib)
-{
-    PCSRSS_FILL_OUTPUT_ATTRIB FillOutputAttribRequest = &((PCONSOLE_API_MESSAGE)ApiMessage)->Data.FillOutputAttribRequest;
-    PCSRSS_SCREEN_BUFFER Buff;
-    PUCHAR Buffer;
-    NTSTATUS Status;
-    int X, Y, Length;
-    UCHAR Attr;
-    SMALL_RECT UpdateRect;
-    PCSRSS_CONSOLE Console;
-
-    DPRINT("CsrFillOutputAttrib\n");
-
-    Status = ConioLockScreenBuffer(CsrGetClientThread()->Process, FillOutputAttribRequest->ConsoleHandle, &Buff, GENERIC_WRITE);
-    if (! NT_SUCCESS(Status))
-    {
-        return Status;
-    }
-    Console = Buff->Header.Console;
-
-    X = FillOutputAttribRequest->Coord.X;
-    Y = (FillOutputAttribRequest->Coord.Y + Buff->VirtualY) % Buff->MaxY;
-    Length = FillOutputAttribRequest->Length;
-    Attr = FillOutputAttribRequest->Attribute;
-    Buffer = &Buff->Buffer[(Y * Buff->MaxX * 2) + (X * 2) + 1];
-    while (Length--)
-    {
-        *Buffer = Attr;
-        Buffer += 2;
-        if (++X == Buff->MaxX)
-        {
-            if (++Y == Buff->MaxY)
-            {
-                Y = 0;
-                Buffer = Buff->Buffer + 1;
-            }
-            X = 0;
-        }
-    }
-
-    if (Buff == Console->ActiveBuffer)
-    {
-        ConioComputeUpdateRect(Buff, &UpdateRect, &FillOutputAttribRequest->Coord,
-                               FillOutputAttribRequest->Length);
-        ConioDrawRegion(Console, &UpdateRect);
-    }
-
-    ConioUnlockScreenBuffer(Buff);
-
+*/
     return STATUS_SUCCESS;
 }