4.7 Annotated Fast-Path Input Event PDU
The following is an annotated dump of a Fast-Path Input Event PDU (section 2.2.8.1.2) that was sent from a Microsoft RDP 5.1 client to a Microsoft RDP 5.1 server.
-
00000000 c4 11 30 35 6b 5b b5 34 c8 47 26 18 5e 76 0e de ..05k[.4.G&.^v.. 00000010 28 ( c4 -> TS_FP_INPUT_PDU::fpInputHeader = 0xc4 Binary of 0xc4 = 11 0001 00 action = FASTPATH_INPUT_ACTION_FASTPATH (0) numEvents = 1 flags = 0x3 0x3 = 0x1 | 0x2 = FASTPATH_INPUT_SECURE_CHECKSUM | FASTPATH_INPUT_ENCRYPTED 11 -> TS_FP_INPUT_PDU::length1 = 0x11 = 17 bytes 30 35 6b 5b b5 34 c8 47 -> TS_FP_INPUT_PDU::dataSignature 26 18 5e 76 0e de 28 -> Encrypted TS_FP_INPUT_PDU::fpInputEvents Decrypted TS_FP_INPUT_PDU::fpInputEvents: 00000000 20 00 08 ab 02 6f 01 ....o. 20 -> TS_FP_INPUT_EVENT::eventHeader = 0x20 Binary of 0x20 = 001 00000 eventFlags = 0 eventCode = 1 (FASTPATH_INPUT_EVENT_MOUSE) 00 08 -> TS_FP_POINTER_EVENT::pointerFlags = 0x0800 0x0800 = PTRFLAGS_MOVE ab 02 -> TS_FP_POINTER_EVENT::xPos = 0x02ab = 683 6f 01 -> TS_FP_POINTER_EVENT::yPos = 0x016f = 367