2.2.1.3.2 Client Core Data (TS_UD_CS_CORE)

Article
09/03/2022

The TS_UD_CS_CORE data block contains core client connection-related information.

0	6	4
header
version
desktopWidth	desktopHeight
colorDepth	SASSequence
keyboardLayout
clientBuild
clientName (32 bytes)
...
...
keyboardType
keyboardSubType
keyboardFunctionKey
imeFileName (64 bytes)
...
...
postBeta2ColorDepth (optional)	clientProductId (optional)
serialNumber (optional)
highColorDepth (optional)	supportedColorDepths (optional)
earlyCapabilityFlags (optional)	clientDigProductId (64 bytes, optional)
...
...
...	connectionType (optional)	pad1octet (optional)
serverSelectedProtocol (optional)
desktopPhysicalWidth (optional)
desktopPhysicalHeight (optional)
desktopOrientation (optional)	desktopScaleFactor (optional)
...	deviceScaleFactor (optional)
...

header (4 bytes): A GCC user data block header, as specified in section 2.2.1.3.1. The User Data Header type field MUST be set to CS_CORE (0xC001).

version (4 bytes): A 32-bit, unsigned integer. Client version number for the RDP. The major version number is stored in the high 2 bytes, while the minor version number is stored in the low 2 bytes.

Value	Meaning
0x00080001	RDP 4.0 clients
0x00080004	RDP 5.0, 5.1, 5.2, 6.0, 6.1, 7.0, 7.1, 8.0, and 8.1 clients
0x00080005	RDP 10.0 clients
0x00080006	RDP 10.1 clients
0x00080007	RDP 10.2 clients
0x00080008	RDP 10.3 clients
0x00080009	RDP 10.4 clients
0x0008000A	RDP 10.5 clients
0x0008000B	RDP 10.6 clients
0x0008000C	RDP 10.7 clients
0x0008000D	RDP 10.8 clients
0x0008000E	RDP 10.9 clients
0x0008000F	RDP 10.10 clients
0x00080010	RDP 10.11 clients
0x00080011	RDP 10.12 clients

desktopWidth (2 bytes): A 16-bit, unsigned integer. The requested desktop width in pixels (validation of this field is described in section 3.3.5.3.3).

desktopHeight (2 bytes): A 16-bit, unsigned integer. The requested desktop height in pixels (validation of this field is described in section 3.3.5.3.3).

colorDepth (2 bytes): A 16-bit, unsigned integer. The requested color depth. Values in this field MUST be ignored if the postBeta2ColorDepth field is present.

Value

Meaning

RNS_UD_COLOR_4BPP

0xCA00

4 bits-per-pixel (bpp)

RNS_UD_COLOR_8BPP

0xCA01

8 bpp

SASSequence (2 bytes): A 16-bit, unsigned integer. Secure access sequence. This field SHOULD be set to RNS_UD_SAS_DEL (0xAA03).

keyboardLayout (4 bytes): A 32-bit, unsigned integer. The active input locale identifier, also known as the "HKL" (for example, 0x00010409 for a "United States-Dvorak" keyboard layout and 0x00020418 for a "Romanian (Programmers)" keyboard layout). For a list of input locale identifiers, see [MSFT-DIL].<5> If the keyboardLayout field is set to zero, then the server SHOULD use the default active input locale identifier and active language identifier (see the CodePage field in section 2.2.1.11.1.1) associated with the user account.<6>

clientBuild (4 bytes): A 32-bit, unsigned integer. The build number of the client.

clientName (32 bytes): Name of the client computer. This field contains up to 15 Unicode characters plus a null terminator.

keyboardType (4 bytes): A 32-bit, unsigned integer. The keyboard type.

Value	Meaning
0x00000001	IBM PC/XT or compatible (83-key) keyboard
0x00000002	Olivetti "ICO" (102-key) keyboard
0x00000003	IBM PC/AT (84-key) and similar keyboards
0x00000004	IBM enhanced (101-key or 102-key) keyboard
0x00000005	Nokia 1050 and similar keyboards
0x00000006	Nokia 9140 and similar keyboards
0x00000007	Japanese keyboard
0x00000008	Korean keyboard

keyboardSubType (4 bytes): A 32-bit, unsigned integer. The keyboard subtype (an original equipment manufacturer-dependent value).

keyboardFunctionKey (4 bytes): A 32-bit, unsigned integer. The number of function keys on the keyboard.

imeFileName (64 bytes): A 64-byte field. The input method editor (IME) file name associated with the active input locale. This field contains up to 31 Unicode characters plus a null terminator.

postBeta2ColorDepth (2 bytes): A 16-bit, unsigned integer. The requested color depth. Values in this field MUST be ignored if the highColorDepth field is present.

Value	Meaning
RNS_UD_COLOR_4BPP 0xCA00	4 bits-per-pixel (bpp)
RNS_UD_COLOR_8BPP 0xCA01	8 bpp
RNS_UD_COLOR_16BPP_555 0xCA02	15-bit 555 RGB mask (5 bits for red, 5 bits for green, and 5 bits for blue)
RNS_UD_COLOR_16BPP_565 0xCA03	16-bit 565 RGB mask (5 bits for red, 6 bits for green, and 5 bits for blue)
RNS_UD_COLOR_24BPP 0xCA04	24-bit RGB mask (8 bits for red, 8 bits for green, and 8 bits for blue)

If this field is not present, all of the subsequent fields MUST NOT be present.

clientProductId (2 bytes): A 16-bit, unsigned integer. The client product ID. This field SHOULD be initialized to 1. If this field is present, then the postBeta2ColorDepth field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

serialNumber (4 bytes): A 32-bit, unsigned integer. Serial number. This field SHOULD be initialized to zero. If this field is present, then the clientProductId field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

highColorDepth (2 bytes): A 16-bit, unsigned integer. The requested color depth.

Value	Meaning
HIGH_COLOR_4BPP 0x0004	4 bpp
HIGH_COLOR_8BPP 0x0008	8 bpp
HIGH_COLOR_15BPP 0x000F	15-bit 555 RGB mask (5 bits for red, 5 bits for green, and 5 bits for blue)
HIGH_COLOR_16BPP 0x0010	16-bit 565 RGB mask (5 bits for red, 6 bits for green, and 5 bits for blue)
HIGH_COLOR_24BPP 0x0018	24-bit RGB mask (8 bits for red, 8 bits for green, and 8 bits for blue)

If this field is present, then the serialNumber field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

supportedColorDepths (2 bytes): A 16-bit, unsigned integer. Specifies the high color depths that the client is capable of supporting.

Flag	Meaning
RNS_UD_24BPP_SUPPORT 0x0001	24-bit RGB mask (8 bits for red, 8 bits for green, and 8 bits for blue)
RNS_UD_16BPP_SUPPORT 0x0002	16-bit 565 RGB mask (5 bits for red, 6 bits for green, and 5 bits for blue)
RNS_UD_15BPP_SUPPORT 0x0004	15-bit 555 RGB mask (5 bits for red, 5 bits for green, and 5 bits for blue)
RNS_UD_32BPP_SUPPORT 0x0008	32-bit RGB mask (8 bits for the alpha channel, 8 bits for red, 8 bits for green, and 8 bits for blue)

If this field is present, then the highColorDepth field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

earlyCapabilityFlags (2 bytes): A 16-bit, unsigned integer that specifies capabilities early in the connection sequence.

Flag	Meaning
RNS_UD_CS_SUPPORT_ERRINFO_PDU 0x0001	Indicates that the client supports the Set Error Info PDU (section 2.2.5.1).
RNS_UD_CS_WANT_32BPP_SESSION 0x0002	Indicates that the client is requesting a session color depth of 32 bpp. This flag is necessary because the highColorDepth field does not support a value of 32. If this flag is set, the highColorDepth field SHOULD be set to 24 to provide an acceptable fallback for the scenario where the server does not support 32 bpp color.
RNS_UD_CS_SUPPORT_STATUSINFO_PDU 0x0004	Indicates that the client supports the Server Status Info PDU (section 2.2.5.2).
RNS_UD_CS_STRONG_ASYMMETRIC_KEYS 0x0008	Indicates that the client supports asymmetric keys larger than 512 bits for use with the Server Certificate (section 2.2.1.4.3.1) sent in the Server Security Data block (section 2.2.1.4.3).
RNS_UD_CS_RELATIVE_MOUSE_INPUT 0x0010	This flag MUST be ignored by the server if the version field is less than 0x00080011. If the version field is greater than or equal to 0x0008001, then this flag indicates that the client supports relative mouse mode (section 2.2.8.1.1.3.1.1.7 and section 2.2.8.1.2.2.7).
RNS_UD_CS_VALID_CONNECTION_TYPE 0x0020	Indicates that the connectionType field contains valid data.
RNS_UD_CS_SUPPORT_MONITOR_LAYOUT_PDU 0x0040	Indicates that the client supports the Monitor Layout PDU (section 2.2.12.1).
RNS_UD_CS_SUPPORT_NETCHAR_AUTODETECT 0x0080	Indicates that the client supports network characteristics detection using the structures and PDUs described in section 2.2.14.
RNS_UD_CS_SUPPORT_DYNVC_GFX_PROTOCOL 0x0100	Indicates that the client supports the Graphics Pipeline Extension Protocol described in [MS-RDPEGFX] sections 1, 2, and 3.
RNS_UD_CS_SUPPORT_DYNAMIC_TIME_ZONE 0x0200	Indicates that the client supports Dynamic DST. Dynamic DST information is provided by the client in the cbDynamicDSTTimeZoneKeyName, dynamicDSTTimeZoneKeyName and dynamicDaylightTimeDisabled fields of the Extended Info Packet (section 2.2.1.11.1.1.1).
RNS_UD_CS_SUPPORT_HEARTBEAT_PDU 0x0400	Indicates that the client supports the Heartbeat PDU (section 2.2.16.1).
RNS_UD_CS_SUPPORT_SKIP_CHANNELJOIN 0x0800	Indicates that the client supports skipping the MCS Channel Join Request PDUs (section 2.2.1.8) and MCS Channel Join Confirm PDUs (section 2.2.1.9) in the Channel Connection phase of the RDP Connection Sequence (section 1.3.1.1). If this flag is set, the client considers all MCS channels as joined after the MCS Attach User Confirm PDU (section 2.2.1.7) has been received (section 3.2.5.3.8).

If this field is present, then the supportedColorDepths field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

clientDigProductId (64 bytes): Contains a value that uniquely identifies the client. If this field is present, then the earlyCapabilityFlags field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

connectionType (1 byte): An 8-bit, unsigned integer. Hints at the type of network connection being used by the client. This field only contains valid data if the RNS_UD_CS_VALID_CONNECTION_TYPE (0x0020) flag is present in the earlyCapabilityFlags field.

Value	Meaning
CONNECTION_TYPE_MODEM 0x01	Modem (56 Kbps)
CONNECTION_TYPE_BROADBAND_LOW 0x02	Low-speed broadband (256 Kbps - 2 Mbps)
CONNECTION_TYPE_SATELLITE 0x03	Satellite (2 Mbps - 16 Mbps with high latency)
CONNECTION_TYPE_BROADBAND_HIGH 0x04	High-speed broadband (2 Mbps - 10 Mbps)
CONNECTION_TYPE_WAN 0x05	WAN (10 Mbps or higher with high latency)
CONNECTION_TYPE_LAN 0x06	LAN (10 Mbps or higher)
CONNECTION_TYPE_AUTODETECT 0x07	The server SHOULD attempt to detect the connection type. If the connection type can be successfully determined then the performance flags, sent by the client in the performanceFlags field of the Extended Info Packet (section 2.2.1.11.1.1.1), SHOULD be ignored and the server SHOULD determine the appropriate set of performance flags to apply to the remote session (based on the detected connection type). If the RNS_UD_CS_SUPPORT_NETCHAR_AUTODETECT (0x0080) flag is not set in the earlyCapabilityFlags field, then this value SHOULD be ignored.

If this field is present, then the clientDigProductId field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

pad1octet (1 byte): An 8-bit, unsigned integer. Padding to align the serverSelectedProtocol field on the correct byte boundary. If this field is present, then the connectionType field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

serverSelectedProtocol (4 bytes): A 32-bit, unsigned integer that contains the value returned by the server in the selectedProtocol field of the RDP Negotiation Response (section 2.2.1.2.1). In the event that an RDP Negotiation Response was not received from the server, this field MUST be initialized to PROTOCOL_RDP (0). This field MUST be present if an RDP Negotiation Request (section 2.2.1.1.1) was sent to the server. If this field is present, then the pad1octet field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

desktopPhysicalWidth (4 bytes): A 32-bit, unsigned integer. The requested physical width of the desktop, in millimeters (mm). This value MUST be ignored if it is less than 10 mm or greater than 10,000 mm or desktopPhysicalHeight is less than 10 mm or greater than 10,000 mm. If this field is present, then the serverSelectedProtocol and desktopPhysicalHeight fields MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present. If the desktopPhysicalHeight field is not present, this field MUST be ignored.

desktopPhysicalHeight (4 bytes): A 32-bit, unsigned integer. The requested physical height of the desktop, in millimeters. This value MUST be ignored if it is less than 10 mm or greater than 10,000 mm or desktopPhysicalWidth is less than 10 mm or greater than 10,000 mm. If this field is present, then the desktopPhysicalWidth field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

desktopOrientation (2 bytes): A 16-bit, unsigned integer. The requested orientation of the desktop, in degrees.

Value	Meaning
ORIENTATION_LANDSCAPE 0	The desktop is not rotated.
ORIENTATION_PORTRAIT 90	The desktop is rotated clockwise by 90 degrees.
ORIENTATION_LANDSCAPE_FLIPPED 180	The desktop is rotated clockwise by 180 degrees.
ORIENTATION_PORTRAIT_FLIPPED 270	The desktop is rotated clockwise by 270 degrees.

This value MUST be ignored if it is invalid. If this field is present, then the desktopPhysicalHeight field MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present.

desktopScaleFactor (4 bytes): A 32-bit, unsigned integer. The requested desktop scale factor. This value MUST be ignored if it is less than 100% or greater than 500% or deviceScaleFactor is not 100%, 140%, or 180%. If this field is present, then the desktopOrientation and deviceScaleFactor fields MUST also be present. If this field is not present, all of the subsequent fields MUST NOT be present. If the deviceScaleFactor field is not present, this field MUST be ignored.

deviceScaleFactor (4 bytes): A 32-bit, unsigned integer. The requested device scale factor. This value MUST be ignored if it is not set to 100%, 140%, or 180% or desktopScaleFactor is less than 100% or greater than 500%. If this field is present, then the desktopScaleFactor field MUST also be present.<7>

2.2.1.3.2 Client Core Data (TS_UD_CS_CORE)

Additional resources