wader · obilodeau · Jun 4, 2024 · Jun 4, 2024 · Jun 13, 2024 · Jun 13, 2024
diff --git a/README.md b/README.md
@@ -138,6 +138,7 @@ prores_frame,
 [protobuf](doc/formats.md#protobuf),
 protobuf_widevine,
 pssh_playready,
+[pyrdp](doc/formats.md#pyrdp),
 [rtmp](doc/formats.md#rtmp),
 sll2_packet,
 sll_packet,

diff --git a/doc/formats.md b/doc/formats.md
@@ -110,6 +110,7 @@
 |[`protobuf`](#protobuf)                                         |Protobuf                                                                                                     |<sub></sub>|
 |`protobuf_widevine`                                             |Widevine&nbsp;protobuf                                                                                       |<sub>`protobuf`</sub>|
 |`pssh_playready`                                                |PlayReady&nbsp;PSSH                                                                                          |<sub></sub>|
+|[`pyrdp`](#pyrdp)                                               |PyRDP&nbsp;Replay&nbsp;Files                                                                                 |<sub></sub>|
 |[`rtmp`](#rtmp)                                                 |Real-Time&nbsp;Messaging&nbsp;Protocol                                                                       |<sub>`amf0` `mpeg_asc`</sub>|
 |`sll2_packet`                                                   |Linux&nbsp;cooked&nbsp;capture&nbsp;encapsulation&nbsp;v2                                                    |<sub>`inet_packet`</sub>|
 |`sll_packet`                                                    |Linux&nbsp;cooked&nbsp;capture&nbsp;encapsulation                                                            |<sub>`inet_packet`</sub>|
@@ -1195,6 +1196,16 @@ $ fq -d protobuf '.fields[6].wire_value | protobuf | d' file
 ### References
 - https://developers.google.com/protocol-buffers/docs/encoding
 
+## pyrdp
+PyRDP Replay Files.
+
+### Authors
+- Olivier Bilodeau <[email protected]>, Maintainer
+- Lisandro Ubiedo, Author
+
+### References
+- https://github.com/GoSecure/pyrdp
+
 ## rtmp
 Real-Time Messaging Protocol.
 

diff --git a/format/all/all.fqtest b/format/all/all.fqtest
@@ -153,6 +153,7 @@ prores_frame         Apple ProRes frame
 protobuf             Protobuf
 protobuf_widevine    Widevine protobuf
 pssh_playready       PlayReady PSSH
+pyrdp                PyRDP Replay Files
 rtmp                 Real-Time Messaging Protocol
 sll2_packet          Linux cooked capture encapsulation v2
 sll_packet           Linux cooked capture encapsulation

diff --git a/format/all/all.go b/format/all/all.go
@@ -50,6 +50,7 @@ import (
 	_ "github.com/wader/fq/format/postgres"
 	_ "github.com/wader/fq/format/prores"
 	_ "github.com/wader/fq/format/protobuf"
+	_ "github.com/wader/fq/format/pyrdp"
 	_ "github.com/wader/fq/format/riff"
 	_ "github.com/wader/fq/format/rtmp"
 	_ "github.com/wader/fq/format/tar"

diff --git a/format/format.go b/format/format.go
@@ -162,6 +162,7 @@ var (
 	Protobuf            = &decode.Group{Name: "protobuf"}
 	ProtobufWidevine    = &decode.Group{Name: "protobuf_widevine"}
 	PSSH_Playready      = &decode.Group{Name: "pssh_playready"}
+	PYRDP               = &decode.Group{Name: "pyrdp"}
 	RTMP                = &decode.Group{Name: "rtmp"}
 	SLL_Packet          = &decode.Group{Name: "sll_packet"}
 	SLL2_Packet         = &decode.Group{Name: "sll2_packet"}

diff --git a/format/markdown/markdown.jq b/format/markdown/markdown.jq
@@ -57,7 +57,11 @@ def _markdown_children_to_text($width):
         | join("")
         ) as $text
       | if $text == .destination then $text
-        else "\($text) (\(.destination))"
+        else
+          if .destination | startswith("mailto:") then
+            "<\(.destination[7:])>"
+          else "\($text) (\(.destination))"
+          end
         end
       )
     elif .type == "code_block" then .literal | rtrimstr("\n") | split("\n") | "  " + join("\n  ")

diff --git a/format/pyrdp/pdu/client_data.go b/format/pyrdp/pdu/client_data.go
@@ -0,0 +1,109 @@
+// Copyright (c) 2022-2023 GoSecure Inc.
+// Copyright (c) 2024 Flare Systems
+// Licensed under the MIT License
+package pdu
+
+import (
+	"github.com/wader/fq/pkg/decode"
+	"github.com/wader/fq/pkg/scalar"
+)
+
+const (
+	RDP4     = 0x80001
+	RDP5     = 0x80004
+	RDP10    = 0x80005
+	RDP10_1  = 0x80006
+	RDP10_2  = 0x80007
+	RDP10_3  = 0x80008
+	RDP10_4  = 0x80009
+	RDP10_5  = 0x8000a
+	RDP10_6  = 0x8000b
+	RDP10_7  = 0x8000c
+	RDP10_8  = 0x8000d
+	RDP10_9  = 0x8000e
+	RDP10_10 = 0x8000f
+)
+
+var RDPVersionMap = scalar.UintMapSymStr{
+	RDP4:     "4",
+	RDP5:     "5",
+	RDP10:    "10",
+	RDP10_1:  "10_1",
+	RDP10_2:  "10_2",
+	RDP10_3:  "10_3",
+	RDP10_4:  "10_4",
+	RDP10_5:  "10_5",
+	RDP10_6:  "10_6",
+	RDP10_7:  "10_7",
+	RDP10_8:  "10_8",
+	RDP10_9:  "10_9",
+	RDP10_10: "10_10",
+}
+
+const (
+	CLIENT_CORE     = 0xc001
+	CLIENT_SECURITY = 0xc002
+	CLIENT_NETWORK  = 0xc003
+	CLIENT_CLUSTER  = 0xc004
+)
+
+var clientDataMap = scalar.UintMapSymStr{
+	CLIENT_CORE:     "core",
+	CLIENT_SECURITY: "security",
+	CLIENT_NETWORK:  "network",
+	CLIENT_CLUSTER:  "cluster",
+}
+
+func parseClientData(d *decode.D, length int64) {
+	d.FieldStruct("client_data", func(d *decode.D) {
+		header := d.FieldU16("header", clientDataMap)
+		dataLen := int64(d.FieldU16("length") - 4)
+
+		switch header {
+		case CLIENT_CORE:
+			ParseClientDataCore(d, dataLen)
+		case CLIENT_SECURITY:
+			ParseClientDataSecurity(d, dataLen)
+		case CLIENT_NETWORK:
+			ParseClientDataNetwork(d, dataLen)
+		case CLIENT_CLUSTER:
+			ParseClientDataCluster(d, dataLen)
+		default:
+			// Assert() once all functions are implemented and tested.
+			d.FieldRawLen("data", dataLen*8)
+			return
+		}
+	})
+}
+
+func ParseClientDataCore(d *decode.D, length int64) {
+	d.FieldU32("version", RDPVersionMap)
+	d.FieldU16("desktop_width")
+	d.FieldU16("desktop_height")
+	d.FieldU16("color_depth")
+	d.FieldU16("sas_sequence")
+	d.FieldU32("keyboard_layout")
+	d.FieldU32("client_build")
+	d.FieldUTF16LE("client_name", 32, scalar.StrActualTrim("\x00"))
+	d.FieldU32("keyboard_type")
+	d.FieldU32("keyboard_sub_type")
+	d.FieldU32("keyboard_function_key")
+	d.FieldRawLen("ime_file_name", 64*8)
+	d.FieldRawLen("code_data", 98*8)
+}
+
+func ParseClientDataSecurity(d *decode.D, length int64) {
+	d.FieldU32("encryption_methods")
+	d.FieldU32("ext_encryption_methods")
+}
+
+func ParseClientDataNetwork(d *decode.D, length int64) {
+	d.FieldU32("channel_count")
+	length -= 4
+	d.FieldRawLen("channel_def_array", length*8)
+}
+
+func ParseClientDataCluster(d *decode.D, length int64) {
+	d.FieldU32("flags")
+	d.FieldU32("redirected_session_id")
+}
diff --git a/format/pyrdp/pdu/client_info.go b/format/pyrdp/pdu/client_info.go
@@ -0,0 +1,117 @@
+// Copyright (c) 2022-2023 GoSecure Inc.
+// Copyright (c) 2024 Flare Systems
+// Licensed under the MIT License
+package pdu
+
+import (
+	"github.com/wader/fq/pkg/decode"
+	"github.com/wader/fq/pkg/scalar"
+)
+
+func parseClientInfo(d *decode.D, length int64) {
+	d.FieldStruct("client_info", func(d *decode.D) {
+		pos := d.Pos()
+		var (
+			isUnicode bool
+			hasNull   bool
+			nullN     uint64 = 0
+			unicodeN  uint64 = 0
+		)
+		codePage := d.FieldU32("code_page")
+		flags := d.U32()
+		d.SeekRel(-4 * 8)
+		d.FieldStruct("flags", decodeFlagsFn)
+
+		isUnicode = ((flags & INFO_UNICODE) != 0)
+		hasNull = (codePage == 1252 || isUnicode)
+
+		if hasNull {
+			nullN = 1
+		}
+		if isUnicode {
+			unicodeN = 2
+		}
+
+		domainLength := int(d.FieldU16("domain_length") + nullN*unicodeN)
+		usernameLength := int(d.FieldU16("username_length") + nullN*unicodeN)
+		passwordLength := int(d.FieldU16("password_length") + nullN*unicodeN)
+		alternateShellLength := int(d.FieldU16("alternate_shell_length") + nullN*unicodeN)
+		workingDirLength := int(d.FieldU16("working_dir_length") + nullN*unicodeN)
+
+		d.FieldUTF16LE("domain", domainLength, scalar.StrActualTrim("\x00"))
+		d.FieldUTF16LE("username", usernameLength, scalar.StrActualTrim("\x00"))
+		d.FieldUTF16LE("password", passwordLength, scalar.StrActualTrim("\x00"))
+		d.FieldUTF16LE("alternate_shell", alternateShellLength, scalar.StrActualTrim("\x00"))
+		d.FieldUTF16LE("working_dir", workingDirLength, scalar.StrActualTrim("\x00"))
+
+		extraLength := length - ((d.Pos() - pos) / 8)
+		if extraLength > 0 {
+			d.FieldStruct("extra_info", func(d *decode.D) {
+				d.FieldU16("address_family", scalar.UintHex)
+				addressLength := int(d.FieldU16("address_length"))
+				d.FieldUTF16LE("address", addressLength, scalar.StrActualTrim("\x00"))
+				clientDirLength := int(d.FieldU16("client_dir_length"))
+				d.FieldUTF16LE("client_dir", clientDirLength, scalar.StrActualTrim("\x00"))
+				// TS_TIME_ZONE_INFORMATION structure
+				// https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/526ed635-d7a9-4d3c-bbe1-4e3fb17585f4
+				d.FieldU32("timezone_bias")
+				d.FieldUTF16LE("timezone_standardname", 64, scalar.StrActualTrim("\x00"))
+			})
+
+			// XXX: there's more extra info but here's everything we need from the
+			//			client (other than UTC info)
+		}
+	})
+}
+
+const (
+	// flags
+	INFO_MOUSE                  = 0x00000001
+	INFO_DISABLECTRLALTDEL      = 0x00000002
+	INFO_AUTOLOGON              = 0x00000008
+	INFO_UNICODE                = 0x00000010
+	INFO_MAXIMIZESHELL          = 0x00000020
+	INFO_LOGONNOTIFY            = 0x00000040
+	INFO_COMPRESSION            = 0x00000080
+	INFO_ENABLEWINDOWSKEY       = 0x00000100
+	INFO_REMOTECONSOLEAUDIO     = 0x00002000
+	INFO_FORCE_ENCRYPTED_CS_PDU = 0x00004000
+	INFO_RAIL                   = 0x00008000
+	INFO_LOGONERRORS            = 0x00010000
+	INFO_MOUSE_HAS_WHEEL        = 0x00020000
+	INFO_PASSWORD_IS_SC_PIN     = 0x00040000
+	INFO_NOAUDIOPLAYBACK        = 0x00080000
+	INFO_USING_SAVED_CREDS      = 0x00100000
+	INFO_AUDIOCAPTURE           = 0x00200000
+	INFO_VIDEO_DISABLE          = 0x00400000
+	INFO_RESERVED1              = 0x00800000
+	INFO_RESERVED2              = 0x01000000
+	INFO_HIDEF_RAIL_SUPPORTED   = 0x02000000
+)
+
+func decodeFlagsFn(d *decode.D) {
+	d.FieldBool("mouse")
+	d.FieldBool("disabledctrlaltdel")
+	d.FieldRawLen("unused0", 1)
+	d.FieldBool("autologon")
+	d.FieldBool("unicode")
+	d.FieldBool("maximizeshell")
+	d.FieldBool("logonnotify")
+	d.FieldBool("compression")
+	d.FieldBool("enablewindowskey")
+	d.FieldRawLen("unused1", 4)
+	d.FieldBool("remoteconsoleaudio")
+	d.FieldBool("force_encrypted_cs_pdu")
+	d.FieldBool("rail")
+	d.FieldBool("logonerrors")
+	d.FieldBool("mouse_has_wheel")
+	d.FieldBool("password_is_sc_pin")
+	d.FieldBool("noaudioplayback")
+	d.FieldBool("using_saved_creds")
+	d.FieldBool("audiocapture")
+	d.FieldBool("video_disable")
+	d.FieldBool("reserved1")
+	d.FieldBool("reserved2")
+	d.FieldBool("hidef_rail_supported")
+	d.FieldRawLen("unused2", 6)
+}
diff --git a/format/pyrdp/pdu/clipboard_data.go b/format/pyrdp/pdu/clipboard_data.go
@@ -0,0 +1,80 @@
+// Copyright (c) 2022-2023 GoSecure Inc.
+// Copyright (c) 2024 Flare Systems
+// Licensed under the MIT License
+package pdu
+
+import (
+	"github.com/wader/fq/pkg/decode"
+	"github.com/wader/fq/pkg/scalar"
+)
+
+const (
+	// Message types.
+	CB_TYPE_MONITOR_READY         = 0x0001
+	CB_TYPE_FORMAT_LIST           = 0x0002
+	CB_TYPE_FORMAT_LIST_RESPONSE  = 0x0003
+	CB_TYPE_FORMAT_DATA_REQUEST   = 0x0004
+	CB_TYPE_FORMAT_DATA_RESPONSE  = 0x0005
+	CB_TYPE_TEMP_DIRECTORY        = 0x0006
+	CB_TYPE_CLIP_CAPS             = 0x0007
+	CB_TYPE_FILECONTENTS_REQUEST  = 0x0008
+	CB_TYPE_FILECONTENTS_RESPONSE = 0x0009
+	CB_TYPE_LOCK_CLIPDATA         = 0x000a
+	CB_TYPE_UNLOCK_CLIPDATA       = 0x000b
+)
+
+var cbTypesMap = scalar.UintMapSymStr{
+	CB_TYPE_MONITOR_READY:         "monitor_ready",
+	CB_TYPE_FORMAT_LIST:           "format_list",
+	CB_TYPE_FORMAT_LIST_RESPONSE:  "format_list_response",
+	CB_TYPE_FORMAT_DATA_REQUEST:   "format_data_request",
+	CB_TYPE_FORMAT_DATA_RESPONSE:  "format_data_response",
+	CB_TYPE_TEMP_DIRECTORY:        "temp_directory",
+	CB_TYPE_CLIP_CAPS:             "clip_caps",
+	CB_TYPE_FILECONTENTS_REQUEST:  "filecontents_request",
+	CB_TYPE_FILECONTENTS_RESPONSE: "filecontents_response",
+	CB_TYPE_LOCK_CLIPDATA:         "lock_clipdata",
+	CB_TYPE_UNLOCK_CLIPDATA:       "unlock_clipdata",
+}
+
+const (
+	// Message flags.
+	CB_FLAG_NONE          = 0
+	CB_FLAG_RESPONSE_OK   = 0x0001
+	CB_FLAG_RESPONSE_FAIL = 0x0002
+	CB_FLAG_ASCII_NAMES   = 0x0004
+)
+
+var cbFlagsMap = scalar.UintMapSymStr{
+	CB_FLAG_NONE:          "none",
+	CB_FLAG_RESPONSE_OK:   "response_ok",
+	CB_FLAG_RESPONSE_FAIL: "response_fail",
+	CB_FLAG_ASCII_NAMES:   "ascii_names",
+}
+
+var cbParseFnMap = map[uint16]interface{}{
+	CB_TYPE_FORMAT_DATA_RESPONSE: parseCbFormatDataResponse,
+}
+
+func parseClipboardData(d *decode.D, length int64) {
+	d.FieldStruct("clipboard_data", func(d *decode.D) {
+		msgType := uint16(d.FieldU16("msg_type", cbTypesMap))
+		d.FieldU16("msg_flags", cbFlagsMap)
+		dataLength := d.FieldU32("data_len")
+
+		cbParser, ok := cbParseFnMap[msgType]
+		if ok {
+			parseFn, ok := cbParser.(func(d *decode.D, length uint64))
+			if ok {
+				parseFn(d, dataLength)
+				return
+			}
+		}
+		// Assert() once all functions are implemented.
+		d.FieldRawLen("data", int64(dataLength*8))
+	})
+}
+
+func parseCbFormatDataResponse(d *decode.D, length uint64) {
+	d.FieldRawLen("data", int64(length*8))
+}