RDP协议简介与通讯数据加密等级及设置说明

来源：互联网发布：linux查看snmp版本编辑：程序博客网时间：2024/04/28 02:10

RDP协议简介
RDP是一个多层多虚通道通讯协议，它在一个TCP连接中虚拟出若干个通道，分别进行各种信息的传输。
各个层次数据包说明：
RDP层：RDP客户端任何的用户操作，都将形成RDP数据包，并以数据包类型形成RDP包头，然后将数据包传给Secure Connection层，由Secure Connection负责将数据往下传递。
Secure Connection层：该层再收到RDP层数据包后，在RDP数据包中添加Sec层的包头，将对RDP数据进行加密，然后传给MCS层。
MCS层：在收到Sec层传来的数据包后，在该数据包中添加MCS层数据包包头信息，然后将数据包传给ISO层。
ISO层：收到MCS层的数据后，在该数据包中添加ISO包头，并将数据包传给TCP层，由TCP层负责将数据通过网络发送出去。
TCP层：这是我们常说的传输层，在收到ISO层传输过来的数据后，将通过原建立好的SOCK将数据发送出去。
注：（a）、以上所述是数据的发送过程，是一层一层往下进行处理，接收过程则相反，一层一层往上对数据组合并上传。
(b)、初始化数据包时，是从下往上先调用TCP_init开辟空间并初始化，然后再由ISO层对ISO层的内容进行初始化，依此往上类推。
首先在建立连接时，会与服务器之间建立一条TCP连接，再在该TCP连接中虚拟出若干条通道。这些虚通道主要有：
全局通道。
剪贴板通道。
声音映射通道。
其它设备通道（如Serial、Disk、Print、Parallel等）等等。

RDP数据包的类型：
接收端在接收到数据包，并经过各层的处理后最终形成明文RDP数据包后，在每个数据包的包头都含有数据包的类型说明字段，该字段指明本数据包是什么类型，如：
终端服务传向客户端的数据包类型举例：
显示区域更新包；
鼠标指针位置变动包；
剪站板操作数据包；
声音数据包；
RDP打印数据包；
磁盘读写请求包及写数据包；
串口读写请求包及写数据包；
并口读写请求包及写数据包等等
客户端传向终端服务器的数据包类型举例：
按键信息数据包；
鼠标操作数据包；
用户登录用户名及密码数据包；
外设输入数据包；
从本地磁盘及外设读出的数据包等等。
各种类型数据包的处理：
客户端在接收到终端服务器发送下来的数据包后，将从包头中解释出数据包类型，并根据包类型进行不同的操作，如收到串口操作数据包，则将该数据包交给串口数据处理程序进行处理。
当RDP客户端程序收到终端输入信息（如按键信息）后，会将该信息组成数据包并发给服务器（如将按键扫描码发给终端服务器，由服务器进行相应的操作）。

RDP通讯数据加密级别设置说明
Window终端通过RDP协议与终端服务器连接时，所有在网络中传输的数据都将经过加密，具体加密等级的设置有两种方法：
通过终端服务配置进行配置：
可以在"管理工具"—》"终端服配置"—》"连接"—》"右击"并选择属性—》在其中的"常规"选项卡中的"加密级别"进行设置，具体选项说明如下：

通过组策略进行设置：
打开组策略并在"计算机配置"—》"管理模板"—》"Windows 组件"—》"终端服务"—》"加密与安全性"上，双击"设置客户端连接加密级别"设置，然后单击"已启用"。

加密级别说明：
对于其中的加密级别，在这里简单给予说明。
"符合 FIPS 标准"级别通过使用 Microsoft 加密模块的联邦信息处理标准（FIPS）加密算法，对客户端和服务器之间相互发送的数据进行加密和解密。对于终端服务，它只支持 Triple DES 加密算法，以便对终端服务网络通信加密。
要点：如果通过系统加密：使用FIPS兼容的算法来加密、哈希和签名组策略或终端服务"设置客户端连接加密级别"组策略，已经启用了 FIPS 兼容算法，就不能使用终端服务配置更改加密级别。

"高"级别使用 128 位的强加密RC4算法，对客户端和服务器之间发送的数据进行加密。当终端服务器运行在仅包含 128 位客户端（例如运行 Windows Server 2003 家族操作系统之一的客户端）的环境中时，才使用该级别。不支持该加密级别的客户端将无法进行连接。 "客户端兼容"级别以客户端所支持的最大密钥强度来加密客户端和服务器之间发送的数据。如果终端服务器的运行环境包含混合或旧的客户端，请使用此级别。 "低"级别将使用 56 位加密对从客户端传输到服务器的数据进行加密。对从服务器传输到客户端的数据不进行加密。需要抓包分析时请将加密级别设置为"低"。

本文立足于rdesktop的架构层次进行解析，算是抛砖引玉，国内对RDP协议深入解析的资料到本文发布时为空白！

调用层次：

rdp_--->sec_--->mcs_--->iso_--->tcp_

协议包编解码层次：

rdp_hdr->sec_hdr->mcs_hdr->iso_hdr->data，所有这些指针组成一个STREAM.

view plaincopy to clipboardprint?
01./* Parser state */
02.typedef struct stream
03.{
04.    unsigned char *p;
05.    unsigned char *end;
06.    unsigned char *data;
07.    unsigned int size;
08.    /* Offsets of various headers */
09.    unsigned char *iso_hdr;
10.    unsigned char *mcs_hdr;
11.    unsigned char *sec_hdr;
12.    unsigned char *rdp_hdr;
13.}
14. *STREAM;
/* Parser state */
typedef struct stream
{
unsigned char *p;
unsigned char *end;
unsigned char *data;
unsigned int size;
/* Offsets of various headers */
unsigned char *iso_hdr;
unsigned char *mcs_hdr;
unsigned char *sec_hdr;
unsigned char *rdp_hdr;
}
*STREAM;

主过程：

1.rdp_connect：按照调用层次依次调用sec_connect……，然后调用rdp_send_logon_info发送登录请求验证信息.其中rdp_send_logon_info调用sec_init初始化数据包,调用sec_send发送数据包，根据flags（包含加密标识）调用加密处理逻辑.
2.然后进入rdp_main_loop循环，调用rdp_recv,根据触发的事件类型做相应处理。
3.rdp_disconnect，按照调用层次依次调用sec_disconnect……断开。特殊的，在iso_disconnect中首先调用iso_send_msg(ISO_PDU_DR)发送PDU消息包，然后再调用tcp_disconnect 断开连接。
view plaincopy to clipboardprint?
01./* ISO PDU codes */
02.enum ISO_PDU_CODE
03.{
04.    ISO_PDU_CR = 0xE0, /* Connection Request */
05.    ISO_PDU_CC = 0xD0, /* Connection Confirm */
06.    ISO_PDU_DR = 0x80, /* Disconnect Request */
07.    ISO_PDU_DT = 0xF0, /* Data */
08.    ISO_PDU_ER = 0x70   /* Error */
09.};
10./* MCS PDU codes */
11.enum MCS_PDU_TYPE
12.{
13.    MCS_EDRQ = 1,       /* Erect Domain Request */
14.    MCS_DPUM = 8,       /* Disconnect Provider Ultimatum */
15.    MCS_AURQ = 10,      /* Attach User Request */
16.    MCS_AUCF = 11,      /* Attach User Confirm */
17.    MCS_CJRQ = 14,      /* Channel Join Request */
18.    MCS_CJCF = 15,      /* Channel Join Confirm */
19.    MCS_SDRQ = 25,      /* Send Data Request */
20.    MCS_SDIN = 26       /* Send Data Indication */
21.};
/* ISO PDU codes */
enum ISO_PDU_CODE
{
ISO_PDU_CR = 0xE0, /* Connection Request */
ISO_PDU_CC = 0xD0, /* Connection Confirm */
ISO_PDU_DR = 0x80, /* Disconnect Request */
ISO_PDU_DT = 0xF0, /* Data */
ISO_PDU_ER = 0x70 /* Error */
};
/* MCS PDU codes */
enum MCS_PDU_TYPE
{
MCS_EDRQ = 1,  /* Erect Domain Request */
MCS_DPUM = 8,  /* Disconnect Provider Ultimatum */
MCS_AURQ = 10,  /* Attach User Request */
MCS_AUCF = 11,  /* Attach User Confirm */
MCS_CJRQ = 14,  /* Channel Join Request */
MCS_CJCF = 15,  /* Channel Join Confirm */
MCS_SDRQ = 25,  /* Send Data Request */
MCS_SDIN = 26  /* Send Data Indication */
};

protocal interface(协议接口)：

view plaincopy to clipboardprint?
01./* rdp.c */
02.void rdp_out_unistr(STREAM s, char *string, int len);
03.void rdp_send_input(uint32 time, uint16 message_type, uint16 device_flags, uint16 param1,
04.            uint16 param2);
05.void rdp_main_loop(void);
06.BOOL rdp_connect(char *server, uint32 flags, char *domain, char *password, char *command,
07.         char *directory);
08.void rdp_disconnect(void);
09./* secure.c */
10.void sec_hash_48(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2, uint8 salt);
11.void sec_hash_16(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2);
12.void buf_out_uint32(uint8 * buffer, uint32 value);
13.void sec_sign(uint8 * signature, int siglen, uint8 * session_key, int keylen, uint8 * data,
14.          int datalen);
15.STREAM sec_init(uint32 flags, int maxlen);
16.void sec_send(STREAM s, uint32 flags);
17.STREAM sec_recv(void);
18.BOOL sec_connect(char *server);
19.void sec_disconnect(void);
20./* mcs.c */
21.STREAM mcs_init(int length);
22.void mcs_send(STREAM s);
23.STREAM mcs_recv(void);
24.BOOL mcs_connect(char *server, STREAM mcs_data);
25.void mcs_disconnect(void);
26./* iso.c */
27.STREAM iso_init(int length);
28.void iso_send(STREAM s);
29.STREAM iso_recv(void);
30.BOOL iso_connect(char *server);
31.void iso_disconnect(void);
32./* tcp.c */
33.STREAM tcp_init(int maxlen);
34.void tcp_send(STREAM s);
35.STREAM tcp_recv(int length);
36.BOOL tcp_connect(char *server);
37.void tcp_disconnect(void);
/* rdp.c */
void rdp_out_unistr(STREAM s, char *string, int len);
void rdp_send_input(uint32 time, uint16 message_type, uint16 device_flags, uint16 param1,
      uint16 param2);
void rdp_main_loop(void);
BOOL rdp_connect(char *server, uint32 flags, char *domain, char *password, char *command,
   char *directory);
void rdp_disconnect(void);
/* secure.c */
void sec_hash_48(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2, uint8 salt);
void sec_hash_16(uint8 * out, uint8 * in, uint8 * salt1, uint8 * salt2);
void buf_out_uint32(uint8 * buffer, uint32 value);
void sec_sign(uint8 * signature, int siglen, uint8 * session_key, int keylen, uint8 * data,
       int datalen);
STREAM sec_init(uint32 flags, int maxlen);
void sec_send(STREAM s, uint32 flags);
STREAM sec_recv(void);
BOOL sec_connect(char *server);
void sec_disconnect(void);
/* mcs.c */
STREAM mcs_init(int length);
void mcs_send(STREAM s);
STREAM mcs_recv(void);
BOOL mcs_connect(char *server, STREAM mcs_data);
void mcs_disconnect(void);
/* iso.c */
STREAM iso_init(int length);
void iso_send(STREAM s);
STREAM iso_recv(void);
BOOL iso_connect(char *server);
void iso_disconnect(void);
/* tcp.c */
STREAM tcp_init(int maxlen);
void tcp_send(STREAM s);
STREAM tcp_recv(int length);
BOOL tcp_connect(char *server);
void tcp_disconnect(void);

ui interface（UI接口）

view plaincopy to clipboardprint?
01./* xkeymap.c */
02.void xkeymap_init(void);
03.BOOL handle_special_keys(uint32 keysym, unsigned int state, uint32 ev_time, BOOL pressed);
04.key_translation xkeymap_translate_key(uint32 keysym, unsigned int keycode, unsigned int state);
05.uint16 xkeymap_translate_button(unsigned int button);
06.char *get_ksname(uint32 keysym);
07.void ensure_remote_modifiers(uint32 ev_time, key_translation tr);
08.void reset_modifier_keys(unsigned int state);
09.void rdp_send_scancode(uint32 time, uint16 flags, uint8 scancode);
10./* xwin.c */
11.void mwm_hide_decorations(void);
12.BOOL get_key_state(unsigned int state, uint32 keysym);
13.BOOL ui_init(void);
14.void ui_deinit(void);
15.BOOL ui_create_window(void);
16.void ui_destroy_window(void);
17.void xwin_toggle_fullscreen(void);
18.int ui_select(int rdp_socket);
19.void ui_move_pointer(int x, int y);
20.HBITMAP ui_create_bitmap(int width, int height, uint8 * data);
21.void ui_paint_bitmap(int x, int y, int cx, int cy, int width, int height, uint8 * data);
22.void ui_destroy_bitmap(HBITMAP bmp);
23.HGLYPH ui_create_glyph(int width, int height, uint8 * data);
24.void ui_destroy_glyph(HGLYPH glyph);
25.HCURSOR ui_create_cursor(unsigned int x, unsigned int y, int width, int height, uint8 * andmask,
26.             uint8 * xormask);
27.void ui_set_cursor(HCURSOR cursor);
28.void ui_destroy_cursor(HCURSOR cursor);
29.HCOLOURMAP ui_create_colourmap(COLOURMAP * colours);
30.void ui_destroy_colourmap(HCOLOURMAP map);
31.void ui_set_colourmap(HCOLOURMAP map);
32.void ui_set_clip(int x, int y, int cx, int cy);
33.void ui_reset_clip(void);
34.void ui_bell(void);
35.void ui_destblt(uint8 opcode, int x, int y, int cx, int cy);
36.void ui_patblt(uint8 opcode, int x, int y, int cx, int cy, BRUSH * brush, int bgcolour,
37.           int fgcolour);
38.void ui_screenblt(uint8 opcode, int x, int y, int cx, int cy, int srcx, int srcy);
39.void ui_memblt(uint8 opcode, int x, int y, int cx, int cy, HBITMAP src, int srcx, int srcy);
40.void ui_triblt(uint8 opcode, int x, int y, int cx, int cy, HBITMAP src, int srcx, int srcy,
41.           BRUSH * brush, int bgcolour, int fgcolour);
42.void ui_line(uint8 opcode, int startx, int starty, int endx, int endy, PEN * pen);
43.void ui_rect(int x, int y, int cx, int cy, int colour);
44.void ui_draw_glyph(int mixmode, int x, int y, int cx, int cy, HGLYPH glyph, int srcx, int srcy,
45.           int bgcolour, int fgcolour);
46.void ui_draw_text(uint8 font, uint8 flags, int mixmode, int x, int y, int clipx, int clipy,
47.          int clipcx, int clipcy, int boxx, int boxy, int boxcx, int boxcy, int bgcolour,
48.          int fgcolour, uint8 * text, uint8 length);
49.void ui_desktop_save(uint32 offset, int x, int y, int cx, int cy);
50.void ui_desktop_restore(uint32 offset, int x, int y, int cx, int cy);
/* xkeymap.c */
void xkeymap_init(void);
BOOL handle_special_keys(uint32 keysym, unsigned int state, uint32 ev_time, BOOL pressed);
key_translation xkeymap_translate_key(uint32 keysym, unsigned int keycode, unsigned int state);
uint16 xkeymap_translate_button(unsigned int button);
char *get_ksname(uint32 keysym);
void ensure_remote_modifiers(uint32 ev_time, key_translation tr);
void reset_modifier_keys(unsigned int state);
void rdp_send_scancode(uint32 time, uint16 flags, uint8 scancode);
/* xwin.c */
void mwm_hide_decorations(void);
BOOL get_key_state(unsigned int state, uint32 keysym);
BOOL ui_init(void);
void ui_deinit(void);
BOOL ui_create_window(void);
void ui_destroy_window(void);
void xwin_toggle_fullscreen(void);
int ui_select(int rdp_socket);
void ui_move_pointer(int x, int y);
HBITMAP ui_create_bitmap(int width, int height, uint8 * data);
void ui_paint_bitmap(int x, int y, int cx, int cy, int width, int height, uint8 * data);
void ui_destroy_bitmap(HBITMAP bmp);
HGLYPH ui_create_glyph(int width, int height, uint8 * data);
void ui_destroy_glyph(HGLYPH glyph);
HCURSOR ui_create_cursor(unsigned int x, unsigned int y, int width, int height, uint8 * andmask,
    uint8 * xormask);
void ui_set_cursor(HCURSOR cursor);
void ui_destroy_cursor(HCURSOR cursor);
HCOLOURMAP ui_create_colourmap(COLOURMAP * colours);
void ui_destroy_colourmap(HCOLOURMAP map);
void ui_set_colourmap(HCOLOURMAP map);
void ui_set_clip(int x, int y, int cx, int cy);
void ui_reset_clip(void);
void ui_bell(void);
void ui_destblt(uint8 opcode, int x, int y, int cx, int cy);
void ui_patblt(uint8 opcode, int x, int y, int cx, int cy, BRUSH * brush, int bgcolour,
        int fgcolour);
void ui_screenblt(uint8 opcode, int x, int y, int cx, int cy, int srcx, int srcy);
void ui_memblt(uint8 opcode, int x, int y, int cx, int cy, HBITMAP src, int srcx, int srcy);
void ui_triblt(uint8 opcode, int x, int y, int cx, int cy, HBITMAP src, int srcx, int srcy,
        BRUSH * brush, int bgcolour, int fgcolour);
void ui_line(uint8 opcode, int startx, int starty, int endx, int endy, PEN * pen);
void ui_rect(int x, int y, int cx, int cy, int colour);
void ui_draw_glyph(int mixmode, int x, int y, int cx, int cy, HGLYPH glyph, int srcx, int srcy,
     int bgcolour, int fgcolour);
void ui_draw_text(uint8 font, uint8 flags, int mixmode, int x, int y, int clipx, int clipy,
    int clipcx, int clipcy, int boxx, int boxy, int boxcx, int boxcy, int bgcolour,
    int fgcolour, uint8 * text, uint8 length);
void ui_desktop_save(uint32 offset, int x, int y, int cx, int cy);
void ui_desktop_restore(uint32 offset, int x, int y, int cx, int cy);

其中，ui_select是整个UI的核心，负责UI调度。

cache interface(缓存接口）

view plaincopy to clipboardprint?
01./* bitmap.c */
02.BOOL bitmap_decompress(unsigned char *output, int width, int height, unsigned char *input,
03.               int size);
04./* cache.c */
05.HBITMAP cache_get_bitmap(uint8 cache_id, uint16 cache_idx);
06.void cache_put_bitmap(uint8 cache_id, uint16 cache_idx, HBITMAP bitmap);
07.FONTGLYPH *cache_get_font(uint8 font, uint16 character);
08.void cache_put_font(uint8 font, uint16 character, uint16 offset, uint16 baseline, uint16 width,
09.            uint16 height, HGLYPH pixmap);
10.DATABLOB *cache_get_text(uint8 cache_id);
11.void cache_put_text(uint8 cache_id, void *data, int length);
12.uint8 *cache_get_desktop(uint32 offset, int cx, int cy, int bytes_per_pixel);
13.void cache_put_desktop(uint32 offset, int cx, int cy, int scanline, int bytes_per_pixel,
14.               uint8 * data);
15.HCURSOR cache_get_cursor(uint16 cache_idx);
16.void cache_put_cursor(uint16 cache_idx, HCURSOR cursor);
17./* ewmhints.c */
18.int get_current_workarea(uint32 * x, uint32 * y, uint32 * width, uint32 * height);
/* bitmap.c */
BOOL bitmap_decompress(unsigned char *output, int width, int height, unsigned char *input,
         int size);
/* cache.c */
HBITMAP cache_get_bitmap(uint8 cache_id, uint16 cache_idx);
void cache_put_bitmap(uint8 cache_id, uint16 cache_idx, HBITMAP bitmap);
FONTGLYPH *cache_get_font(uint8 font, uint16 character);
void cache_put_font(uint8 font, uint16 character, uint16 offset, uint16 baseline, uint16 width,
      uint16 height, HGLYPH pixmap);
DATABLOB *cache_get_text(uint8 cache_id);
void cache_put_text(uint8 cache_id, void *data, int length);
uint8 *cache_get_desktop(uint32 offset, int cx, int cy, int bytes_per_pixel);
void cache_put_desktop(uint32 offset, int cx, int cy, int scanline, int bytes_per_pixel,
         uint8 * data);
HCURSOR cache_get_cursor(uint16 cache_idx);
void cache_put_cursor(uint16 cache_idx, HCURSOR cursor);
/* ewmhints.c */
int get_current_workarea(uint32 * x, uint32 * y, uint32 * width, uint32 * height);

licence证书处理

view plaincopy to clipboardprint?
01./* licence.c */
02.void licence_process(STREAM s);
/* licence.c */
void licence_process(STREAM s);

主进程函数

view plaincopy to clipboardprint?
01./* rdesktop.c */
02.int main(int argc, char *argv[]);
03.void generate_random(uint8 * random);
04.void *xmalloc(int size);
05.void *xrealloc(void *oldmem, int size);
06.void xfree(void *mem);
07.void error(char *format, ...);
08.void warning(char *format, ...);
09.void unimpl(char *format, ...);
10.void hexdump(unsigned char *p, unsigned int len);
/* rdesktop.c */
int main(int argc, char *argv[]);
void generate_random(uint8 * random);
void *xmalloc(int size);
void *xrealloc(void *oldmem, int size);
void xfree(void *mem);
void error(char *format, ...);
void warning(char *format, ...);
void unimpl(char *format, ...);
void hexdump(unsigned char *p, unsigned int len);

次序处理：

view plaincopy to clipboardprint?
01./* orders.c */
02.void process_orders(STREAM s);
03.void reset_order_state(void);
/* orders.c */
void process_orders(STREAM s);
void reset_order_state(void);

协议数据包：

view plaincopy to clipboardprint?
01.128-bit encryption enabled
02.Sending encrypted packet:
03.0000 00 00 00 00 33 00 00 00 00 00 1a 00 00 00 00 00 ....3...........
04.0010 00 00 00 00 41 00 64 00 6d 00 69 00 6e 00 69 00 ....A.d.m.i.n.i.
05.0020 73 00 74 00 72 00 61 00 74 00 6f 00 72 00 00 00 s.t.r.a.t.o.r...
06.0030 00 00 00 00 00 00                               ......
07.Connection successful.
08.Sending encrypted packet:
09.0000 22 00 17 00 ec 03 00 00 00 00 00 01 14 00 1c 00 "...............
10.0010 00 00 01 00 00 00 11 4e 7a 4b 01 80 00 08 cf 01 .......NzK......
11.0020 91 00                                           ..
12.Sending encrypted packet:
13.0000 22 00 17 00 ec 03 00 00 00 00 00 01 14 00 1c 00 "...............
14.0010 00 00 01 00 00 00 12 4e 7a 4b 01 80 00 08 cf 01 .......NzK......
15.0020 91 00                                           ..
16.RDP packet (type 1):
17.0000 67 01 11 00 ea 03 ea 03 01 00 04 00 51 01 52 44 g...........Q.RD
18.0010 50 00 0d 00 00 00 09 00 08 00 ea 03 65 e3 01 00 P...........e...
19.0020 18 00 01 00 03 00 00 02 00 00 00 00 1d 04 00 00 ................
20.0030 00 00 00 00 01 01 14 00 08 00 02 00 00 00 16 00 ................
21.0040 28 00 01 00 00 00 6c 96 33 b7 01 00 00 00 95 a4 (.....l.3.......
22.0050 84 80 b0 7d 38 84 b8 5b c4 e1 f4 96 33 b7 ea e8 ...}8..[....3...
23.0060 84 80 20 02 c9 85 0e 00 04 00 02 00 1c 00 08 00 .. .............
24.0070 01 00 01 00 01 00 c0 03 e9 02 00 00 01 00 01 00 ................
25.0080 00 00 01 00 00 00 03 00 58 00 00 00 00 00 00 00 ........X.......
26.0090 00 00 00 00 00 00 00 00 00 00 40 42 0f 00 01 00 ..........@B....
27.00a0 14 00 00 00 01 00 00 00 22 00 01 01 01 01 01 00 ........".......
28.00b0 00 01 01 01 01 01 00 00 00 01 01 01 01 01 01 01 ................
29.00c0 01 00 01 01 01 01 00 00 00 00 a1 06 00 00 40 42 ..............@B
30.00d0 0f 00 40 42 0f 00 01 00 00 00 00 00 00 00 0a 00 ..@B............
31.00e0 08 00 06 00 00 00 12 00 08 00 01 00 00 00 08 00 ................
32.00f0 0a 00 01 00 19 00 19 00 0d 00 58 00 35 00 00 00 ..........X.5...
33.0100 a1 06 00 00 40 42 0f 00 0c 96 33 b7 75 7a 6f b7 ....@B....3.uzo.
34.0110 00 40 43 e1 48 3c 70 b7 40 96 33 b7 04 00 00 00 .@C.H<p.@.3.....
35.0120 4c 34 65 e3 08 30 65 e3 01 00 00 00 08 30 65 e3 L4e..0e......0e.
36.0130 00 00 00 00 38 96 33 b7 42 25 70 b7 08 30 65 e3 ....8.3.B%p..0e.
37.0140 2c 96 33 b7 00 00 00 00 08 00 0a 00 01 00 19 00 ,.3.............
38.0150 17 00 08 00 00 00 00 00 18 00 0b 00 00 00 00 00 ................
39.0160 00 00 00 00 00 00 00                            .......
40.DEMAND_ACTIVE(id=0x103ea)
41.Sending encrypted packet:
42.0000 9a 01 13 00 ec 03 ea 03 01 00 ea 03 06 00 84 01 ................
43.0010 4d 53 54 53 43 00 0d 00 00 00 01 00 18 00 01 00 MSTSC...........
44.0020 03 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 ................
45.0030 00 00 02 00 1c 00 08 00 01 00 01 00 01 00 20 03 .............. .
46.0040 58 02 00 00 00 00 01 00 00 00 01 00 00 00 03 00 X...............
47.0050 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 X...............
48.0060 00 00 00 00 00 00 01 00 14 00 00 00 01 00 47 01 ..............G.
49.0070 2a 00 01 01 01 01 00 00 00 00 01 01 01 01 00 01 *...............
50.0080 01 00 00 00 00 00 00 00 01 00 00 00 00 01 00 00 ................
51.0090 00 00 a1 06 00 00 00 00 00 00 00 84 03 00 00 00 ................
52.00a0 00 00 e4 04 00 00 04 00 28 00 00 00 00 00 00 00 ........(.......
53.00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
54.00c0 00 00 58 02 00 01 2c 01 00 04 06 01 00 10 0a 00 ..X...,.........
55.00d0 08 00 06 00 00 00 07 00 0c 00 00 00 00 00 00 00 ................
56.00e0 00 00 05 00 0c 00 00 00 00 00 02 00 02 00 08 00 ................
57.00f0 08 00 00 00 14 00 09 00 08 00 00 00 00 00 0d 00 ................
58.0100 58 00 01 00 00 00 09 04 00 00 04 00 00 00 00 00 X...............
59.0110 00 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
60.0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
61.0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
62.0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
63.0150 00 00 00 00 00 00 0c 00 08 00 01 00 00 00 0e 00 ................
64.0160 08 00 01 00 00 00 10 00 34 00 fe 00 04 00 fe 00 ........4.......
65.0170 04 00 fe 00 08 00 fe 00 08 00 fe 00 10 00 fe 00 ................
66.0180 20 00 fe 00 40 00 fe 00 80 00 fe 00 00 01 40 00 ...@.........@.
67.0190 00 08 00 01 00 01 02 00 00 00                   ..........
68.RDP packet (type 7):
69.0000 6d 00 17 00 ea 03 ea 03 01 00 3b 02 6d 00 02 00 m.........;.m...
70.0010 00 00 00 00 75 20 08 00 bb 3e 15 4a 01 50 21 44 ....u ...>.J.P!D
71.0020 21 23 01 00 00 15 4a 01 50 3f 40 3f 01 ff 01 00 !#....J.P?@?....
72.0030 15 02 01 50 40 40 40 02 00 15 02 01 50 40 40 40 ...P@@@.....P@@@
73.0040 03 00 15 02 01 50 40 40 40 01 00 15 0a 01 50 40 .....P@@@.....P@
74.0050 2f 40 ef 04 00 45 4a 05 12 01 22 01 12 01 11 00 /@...EJ...".....
75.0060 2f 00 15 4a 01 50 11 1c 11 0b d1 05 00          /..J.P.......
76.MEMBLT(op=0xcc,x=319,y=297,cx=63,cy=5,id=1,idx=0)
77.MEMBLT(op=0xcc,x=382,y=297,cx=64,cy=5,id=1,idx=1)
78.MEMBLT(op=0xcc,x=446,y=297,cx=64,cy=5,id=1,idx=2)
79.MEMBLT(op=0xcc,x=510,y=297,cx=64,cy=5,id=1,idx=3)
80.MEMBLT(op=0xcc,x=574,y=297,cx=64,cy=5,id=1,idx=1)
81.MEMBLT(op=0xcc,x=638,y=297,cx=47,cy=5,id=1,idx=4)
82.MEMBLT(op=0xcc,x=274,y=297,cx=17,cy=5,id=1,idx=4)
83.MEMBLT(op=0xcc,x=291,y=297,cx=28,cy=5,id=1,idx=5)
84.RDP packet (type 7):
85.0000 1e 00 17 00 ea 03 ea 03 01 00 04 02 1e 00 02 00 ................
86.0010 00 00 00 00 85 7e 01 00 d5 f5 19 0b 20 01       .....~...... .
87.DESKSAVE(l=271,t=200,r=687,b=343,off=0,op=1)
88.RDP packet (type 6):
89.0000 0d 00 16 00 ea 03 ea 03 01 00 01 00 00          .............
90.Disconnecting...