The RDP_PRECONNECTION_PDU_V1 is used by the client to let the listening process know which RDP source the connection is intended for.
| 0
| 1
| 2
| 3
| 4
| 5
| 6
| 7
| 8
| 9
| 1
0
| 1
| 2
| 3
| 4
| 5
| 6
| 7
| 8
| 9
| 2
0
| 1
| 2
| 3
| 4
| 5
| 6
| 7
| 8
| 9
| 3
0
| 1
|
|---|
| cbSize |
| Flags |
| Version |
| Id |
cbSize (4 bytes): An unsigned 32-bit integer. This field identifies the total size, in bytes, of the RDP_PRECONNECTION_PDU_V1, or for a version 2 packet, the size of an RDP_PRECONNECTION_PDU_V2 packet.
Flags (4 bytes): An unsigned 32-bit integer. MUST be set to zero when sending and ignored on receipt.
Version (4 bytes): An unsigned 32-bit integer. This field is one of the values in the table that is based on the version of the PDU that is sent. The field is intended for future extensibility. The field SHOULD be initialized by the client and SHOULD be ignored by the server, as specified in sections 3.1.5.1 and 3.2.5.1.
| Value | Meaning |
|---|
RDP_PRECONNECTION_PDU_V1
0x00000001 | A version 1 connection PDU.
|
RDP_PRECONNECTION_PDU_V2
0x00000002 | A version 2 connection PDU.
|
Id (4 bytes): An unsigned 32-bit integer. The Id field is used to uniquely identify the RDP source. Although the Id can be as simple as a process ID, it is often client-specific or server-specific and may be obfuscated.