184.108.40.206.220.127.116.11.1 Keyboard Event (TS_KEYBOARD_EVENT)
The TS_KEYBOARD_EVENT structure is a standard T.128 Keyboard Event ([T128] section 8.18.2). RDP keyboard input is restricted to keyboard scancodes, unlike the code-point or virtual codes supported in T.128 (a scancode is an 8-bit value specifying a key location on the keyboard). The server accepts a scancode value and translates it into the correct character depending on the language locale and keyboard layout used in the session.
keyboardFlags (2 bytes): A 16-bit, unsigned integer. The flags describing the keyboard event.
Indicates that the keystroke message contains an extended scancode. For enhanced 101-key and 102-key keyboards, extended keys include the right ALT and right CTRL keys on the main section of the keyboard; the INS, DEL, HOME, END, PAGE UP, PAGE DOWN and ARROW keys in the clusters to the left of the numeric keypad; and the Divide ("/") and ENTER keys in the numeric keypad.
Used to send keyboard events triggered by the PAUSE key.
A PAUSE key press and release MUST be sent as the following sequence of keyboard events:
CTRL (0x1D) DOWN
NUMLOCK (0x45) DOWN
CTRL (0x1D) UP
NUMLOCK (0x45) UP
The CTRL DOWN and CTRL UP events MUST both include the KBDFLAGS_EXTENDED1 flag.
Indicates that the key was down prior to this event.
The absence of this flag indicates a key-down event, while its presence indicates a key-release event.
keyCode (2 bytes): A 16-bit, unsigned integer. The scancode of the key which triggered the event.
pad2Octets (2 bytes): A 16-bit, unsigned integer. Padding. Values in this field MUST be ignored.