4.3.1 TS_RAIL_ORDER_EXEC

The following is a network capture of the Client Execute PDU (TS_RAIL_ORDER_EXEC, as specified in 2.2.2.3.1).

  00000000 01 00 5e 00 08 00 14 00 26 00 18 00 7c 00 7c 00 ..^.....&...|.|.
  00000010 69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 i.e.x.p.l.o.r.e.
  00000020 66 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 f.:.\.w.i.n.d.o.
  00000030 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 w.s.\.s.y.s.t.e.
  00000040 6d 00 33 00 32 00 77 00 77 00 77 00 2e 00 62 00 m.3.2.w.w.w...b.
  00000050 69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 00 00 i.n.g...c.o.m...
  
 Header:
 01 00 -> TS_RAIL_PDU_HEADER::orderType = TS_RAIL_ORDER_EXEC (1) (2 Bytes)
 5e 00 -> TS_RAIL_PDU_HEADER::orderLength   = 94                 (2 Bytes)
 08 00 -> Flags            : TS_RAIL_EXEC_FLAG_EXPAND_ARGUMENTS  (2 Bytes)            
 14 00 -> ExeOrFileLength  : 0x14                                (2 Bytes)  
 26 00 -> WorkingDirLength : 0x26                                (2 Bytes)  
 18 00 -> ArgumentsLen     : 0x18                                (2 Bytes)  
 7c 00 7c 00 69 00 65 00 78 00 70 00 6c 00 6f 00 72 00 65 00 -> ExeOrFile : ||iexplore  (20 Bytes) 
 66 00 3a 00 5c 00 77 00 69 00 6e 00 64 00 6f 00 77 00 73 00 5c 00 73 00 79 00 73 00 74 00 65 00 6d 00 33 00 32 00 -> WorkingDir: f:\windows\system32 (38 bytes)
 77 00 77 00 77 00 2e 00 62 00 69 00 6e 00 67 00 2e 00 63 00 6f 00 6d 00 -> Arguments (24 bytes)