1 |
Overview |
2 |
======== |
3 |
|
4 |
The RDPSND protocol is a binary, packet based protocol that maps |
5 |
Microsoft's legacy wave API to a RDP channel. |
6 |
|
7 |
All values are in little endian ordering. |
8 |
|
9 |
Responses are sent with the same opcode as the request, and usually |
10 |
also with the same packet structure. |
11 |
|
12 |
The basic structure of a packet is: |
13 |
|
14 |
0 1 2 3 |
15 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
16 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
17 |
| Opcode | Unknown | Payload size | |
18 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
19 |
| ... | |
20 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
21 |
|
22 |
Opcode |
23 |
|
24 |
Command or response type. Known values: |
25 |
|
26 |
0x01 RDPSND_CLOSE |
27 |
0x02 RDPSND_WRITE |
28 |
0x03 RDPSND_SET_VOLUME |
29 |
0x04 Unknown (4 bytes payload, no response) |
30 |
0x05 RDPSND_COMPLETION |
31 |
0x06 RDPSND_PING |
32 |
0x07 RDPSND_NEGOTIATE |
33 |
|
34 |
Unknown |
35 |
|
36 |
Usage not known. Not valid when message comes from server |
37 |
|
38 |
Payload size |
39 |
|
40 |
Number of bytes following the header. |
41 |
|
42 |
Opcodes |
43 |
======= |
44 |
|
45 |
Following is a list of all known opcodes and the contents in their |
46 |
payloads. |
47 |
|
48 |
RDPSND_CLOSE |
49 |
------------ |
50 |
|
51 |
Tells the client that all applications on the server have released |
52 |
control of the sound system, allowing the client to free any local |
53 |
resources. |
54 |
|
55 |
No payload and no response. |
56 |
|
57 |
RDPSND_WRITE |
58 |
------------ |
59 |
|
60 |
Request to play a chunk of data. The client is expected to queue up |
61 |
the data and send a RDPSND_COMPLETION when playback has finished. |
62 |
|
63 |
No response. |
64 |
|
65 |
0 1 2 3 |
66 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
67 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
68 |
| Tick | Format index | |
69 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
70 |
| Packet index | Pad | |
71 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
72 |
| Waveform data | |
73 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
74 |
| ... | |
75 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
76 |
|
77 |
Tick |
78 |
|
79 |
Low 16 bits of clock tick count when packet was scheduled for |
80 |
playback. |
81 |
|
82 |
Format index |
83 |
|
84 |
Waveform data format in the form of an index to the previously |
85 |
negotiated format list. |
86 |
|
87 |
Packet index |
88 |
|
89 |
Index number of this packet. |
90 |
|
91 |
Pad |
92 |
|
93 |
Unused padding. |
94 |
|
95 |
Waveform data |
96 |
|
97 |
Binary waveform data in the format specified by the format index. |
98 |
Size defined by the packet boundary. |
99 |
|
100 |
Because of a strange design in Microsoft's server, the length of |
101 |
the packet will be 4 bytes short and bytes 12 to 15 (4 bytes) of |
102 |
the payload should be removed. |
103 |
|
104 |
RDPSND_SET_VOLUME |
105 |
----------------- |
106 |
|
107 |
Request from the server to the client to change the output volume. |
108 |
No response. |
109 |
|
110 |
0 1 2 3 |
111 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
112 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
113 |
| Left channel | Right channel | |
114 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
115 |
|
116 |
Left channel |
117 |
|
118 |
Volume of left channel in the range [0, 65535]. |
119 |
|
120 |
Right channel |
121 |
|
122 |
Volume of right channel in the range [0, 65535]. |
123 |
|
124 |
RDPSND_COMPLETION |
125 |
----------------- |
126 |
|
127 |
Sent by the client to the server when a packet, queued by |
128 |
RDPSND_WRITE, has finished playing. |
129 |
|
130 |
No response is sent by the server. |
131 |
|
132 |
0 1 2 3 |
133 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
134 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
135 |
| Tick | Packet index | Reserved | |
136 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
137 |
|
138 |
Tick |
139 |
|
140 |
Clock tick count when packet finished playing on device. |
141 |
|
142 |
Packet index |
143 |
|
144 |
Index number of packet played. |
145 |
|
146 |
Reserved |
147 |
|
148 |
Reserved. Always 0. |
149 |
|
150 |
RDPSND_PING |
151 |
----------- |
152 |
|
153 |
Sent by the server to the client to determine transport latency. |
154 |
Response is identical to the request (including an unmodified tick). |
155 |
|
156 |
0 1 2 3 |
157 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
158 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
159 |
| Tick | Reserved | |
160 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
161 |
| Garbage | |
162 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
163 |
| ... | |
164 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
165 |
|
166 |
Tick |
167 |
|
168 |
Clock tick count when sent from server. |
169 |
|
170 |
Reserved |
171 |
|
172 |
Reserved. Always 0. |
173 |
|
174 |
Garbage |
175 |
|
176 |
1016 optional bytes of random data. Purpose unknown. |
177 |
Only sent from server. |
178 |
|
179 |
RDPSND_NEGOTIATE |
180 |
---------------- |
181 |
|
182 |
Initial packet sent by server when the client [re]connects. Allows |
183 |
the server to determine the capabilities of the client. |
184 |
|
185 |
The client should reply with an identical packet, with the relevant |
186 |
fields filled in, and a filtered list of formats (based on what the |
187 |
client supports). |
188 |
|
189 |
0 1 2 3 |
190 |
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 |
191 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
192 |
| Flags | |
193 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
194 |
| Left channel | Right channel | |
195 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
196 |
| Pitch | |
197 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
198 |
| UDP port | Format count | |
199 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
200 |
| Pad1 | Version | Pad2 | |
201 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
202 |
| ... | |
203 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
204 |
| Format tag | Channels | |
205 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
206 |
| Frames per sec. | |
207 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
208 |
| Bytes per sec. | |
209 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
210 |
| Block align | Bits per sample | |
211 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
212 |
| Extra size | Extra data ... | |
213 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
214 |
| ... | |
215 |
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ |
216 |
|
217 |
Flags |
218 |
|
219 |
Flags for client capabilities. Data not valid when from server. |
220 |
|
221 |
0000 0001 Do UDP song and dance (details unknown). |
222 |
|
223 |
Left channel |
224 |
|
225 |
Initial volume for left channel. Data not valid when from server. |
226 |
|
227 |
Right channel |
228 |
|
229 |
Initial volume for right channel. Data not valid when from server. |
230 |
|
231 |
Pitch |
232 |
|
233 |
Initial pitch of the sound device. Data not valid when from server. |
234 |
|
235 |
UDP port |
236 |
|
237 |
Port used for UDP transfers. Data not valid when from server. |
238 |
|
239 |
Format count |
240 |
|
241 |
Number of format structures following the header. |
242 |
|
243 |
Pad1 |
244 |
|
245 |
Usage not known. Offset 26 in secret protocol. Data not valid |
246 |
when from client. |
247 |
|
248 |
Version |
249 |
|
250 |
Software version. Server (XP & 2K3) sets this to 5. |
251 |
|
252 |
Pad2 |
253 |
|
254 |
Usage not known. Data not valid when from server, nor from |
255 |
client. |
256 |
|
257 |
Format tag |
258 |
|
259 |
Audio format type as registered at Microsoft. |
260 |
|
261 |
Channels |
262 |
|
263 |
Number of channels per frame. |
264 |
|
265 |
Frames per sec. |
266 |
|
267 |
Frames per second in Hz. |
268 |
|
269 |
Bytes per sec. |
270 |
|
271 |
Number of bytes per second. Should be the product of |
272 |
"Frames per sec." and "Block align". |
273 |
|
274 |
Block align |
275 |
|
276 |
The size of each frame. Note that not all bytes may contain |
277 |
useful data. |
278 |
|
279 |
Bits per sample |
280 |
|
281 |
Number of bits per sample. Commonly 8 or 16. |
282 |
|
283 |
Extra size |
284 |
|
285 |
Number of bytes of extra information following this format |
286 |
description. |
287 |
|
288 |
Extra data |
289 |
|
290 |
Optional extra format data. Contents specific to each format |
291 |
type. |