4.7 Annotated Fast-Path Input Event PDU

The following is an annotated dump of a Fast-Path Input Event PDU (section 2.2.8.1.2) that was sent from a Microsoft RDP 5.1 client to a Microsoft RDP 5.1 server.

 00000000 c4 11 30 35 6b 5b b5 34 c8 47 26 18 5e 76 0e de ..05k[.4.G&.^v..
 00000010 28                                              (
  
 c4 -> TS_FP_INPUT_PDU::fpInputHeader = 0xc4
 Binary of 0xc4 = 11 0001 00
 action = FASTPATH_INPUT_ACTION_FASTPATH (0)
 numEvents = 1
 flags = 0x3 
 0x3
 = 0x1 | 0x2
 = FASTPATH_INPUT_SECURE_CHECKSUM | FASTPATH_INPUT_ENCRYPTED
  
 11 -> TS_FP_INPUT_PDU::length1 = 0x11 = 17 bytes
  
 30 35 6b 5b b5 34 c8 47 -> TS_FP_INPUT_PDU::dataSignature
  
 26 18 5e 76 0e de 28 -> Encrypted TS_FP_INPUT_PDU::fpInputEvents
  
 Decrypted TS_FP_INPUT_PDU::fpInputEvents:
 00000000 20 00 08 ab 02 6f 01                             ....o.
  
 20 -> TS_FP_INPUT_EVENT::eventHeader = 0x20
 Binary of 0x20 = 001 00000
 eventFlags = 0
 eventCode = 1 (FASTPATH_INPUT_EVENT_MOUSE)
  
 00 08 -> TS_FP_POINTER_EVENT::pointerFlags = 0x0800
 0x0800
 = PTRFLAGS_MOVE
  
 ab 02 -> TS_FP_POINTER_EVENT::xPos = 0x02ab = 683
 6f 01 -> TS_FP_POINTER_EVENT::yPos = 0x016f = 367
Show: