Yasso更新大改动，更新扫描方式，去除不常用功能，增加指纹和协议识别，修补bug等

2026-11-06 07:27:41 +08:00 · 2022-05-29 09:11:07 +08:00
parent a6cd80f8e8
commit cb72f18edd
129 changed files with 16619 additions and 6278 deletions
--- a/pkg/grdp/protocol/pdu/caps.go
+++ b/pkg/grdp/protocol/pdu/caps.go
@@ -0,0 +1,656 @@
+package pdu
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+
+	"Yasso/pkg/grdp/glog"
+
+	"Yasso/pkg/grdp/core"
+	"Yasso/pkg/grdp/protocol/t125/gcc"
+	"github.com/lunixbochs/struc"
+)
+
+type CapsType uint16
+
+const (
+	CAPSTYPE_GENERAL                 CapsType = 0x0001
+	CAPSTYPE_BITMAP                           = 0x0002
+	CAPSTYPE_ORDER                            = 0x0003
+	CAPSTYPE_BITMAPCACHE                      = 0x0004
+	CAPSTYPE_CONTROL                          = 0x0005
+	CAPSTYPE_ACTIVATION                       = 0x0007
+	CAPSTYPE_POINTER                          = 0x0008
+	CAPSTYPE_SHARE                            = 0x0009
+	CAPSTYPE_COLORCACHE                       = 0x000A
+	CAPSTYPE_SOUND                            = 0x000C
+	CAPSTYPE_INPUT                            = 0x000D
+	CAPSTYPE_FONT                             = 0x000E
+	CAPSTYPE_BRUSH                            = 0x000F
+	CAPSTYPE_GLYPHCACHE                       = 0x0010
+	CAPSTYPE_OFFSCREENCACHE                   = 0x0011
+	CAPSTYPE_BITMAPCACHE_HOSTSUPPORT          = 0x0012
+	CAPSTYPE_BITMAPCACHE_REV2                 = 0x0013
+	CAPSTYPE_VIRTUALCHANNEL                   = 0x0014
+	CAPSTYPE_DRAWNINEGRIDCACHE                = 0x0015
+	CAPSTYPE_DRAWGDIPLUS                      = 0x0016
+	CAPSTYPE_RAIL                             = 0x0017
+	CAPSTYPE_WINDOW                           = 0x0018
+	CAPSETTYPE_COMPDESK                       = 0x0019
+	CAPSETTYPE_MULTIFRAGMENTUPDATE            = 0x001A
+	CAPSETTYPE_LARGE_POINTER                  = 0x001B
+	CAPSETTYPE_SURFACE_COMMANDS               = 0x001C
+	CAPSETTYPE_BITMAP_CODECS                  = 0x001D
+	CAPSSETTYPE_FRAME_ACKNOWLEDGE             = 0x001E
+)
+
+type MajorType uint16
+
+const (
+	OSMAJORTYPE_UNSPECIFIED MajorType = 0x0000
+	OSMAJORTYPE_WINDOWS               = 0x0001
+	OSMAJORTYPE_OS2                   = 0x0002
+	OSMAJORTYPE_MACINTOSH             = 0x0003
+	OSMAJORTYPE_UNIX                  = 0x0004
+	OSMAJORTYPE_IOS                   = 0x0005
+	OSMAJORTYPE_OSX                   = 0x0006
+	OSMAJORTYPE_ANDROID               = 0x0007
+)
+
+type MinorType uint16
+
+const (
+	OSMINORTYPE_UNSPECIFIED    MinorType = 0x0000
+	OSMINORTYPE_WINDOWS_31X              = 0x0001
+	OSMINORTYPE_WINDOWS_95               = 0x0002
+	OSMINORTYPE_WINDOWS_NT               = 0x0003
+	OSMINORTYPE_OS2_V21                  = 0x0004
+	OSMINORTYPE_POWER_PC                 = 0x0005
+	OSMINORTYPE_MACINTOSH                = 0x0006
+	OSMINORTYPE_NATIVE_XSERVER           = 0x0007
+	OSMINORTYPE_PSEUDO_XSERVER           = 0x0008
+	OSMINORTYPE_WINDOWS_RT               = 0x0009
+)
+
+const (
+	FASTPATH_OUTPUT_SUPPORTED  uint16 = 0x0001
+	NO_BITMAP_COMPRESSION_HDR         = 0x0400
+	LONG_CREDENTIALS_SUPPORTED        = 0x0004
+	AUTORECONNECT_SUPPORTED           = 0x0008
+	ENC_SALTED_CHECKSUM               = 0x0010
+)
+
+type OrderFlag uint16
+
+const (
+	NEGOTIATEORDERSUPPORT   OrderFlag = 0x0002
+	ZEROBOUNDSDELTASSUPPORT           = 0x0008
+	COLORINDEXSUPPORT                 = 0x0020
+	SOLIDPATTERNBRUSHONLY             = 0x0040
+	ORDERFLAGS_EXTRA_FLAGS            = 0x0080
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240556.aspx
+ */
+type Order uint8
+
+const (
+	TS_NEG_DSTBLT_INDEX             Order = 0x00
+	TS_NEG_PATBLT_INDEX                   = 0x01
+	TS_NEG_SCRBLT_INDEX                   = 0x02
+	TS_NEG_MEMBLT_INDEX                   = 0x03
+	TS_NEG_MEM3BLT_INDEX                  = 0x04
+	TS_NEG_DRAWNINEGRID_INDEX             = 0x07
+	TS_NEG_LINETO_INDEX                   = 0x08
+	TS_NEG_MULTI_DRAWNINEGRID_INDEX       = 0x09
+	TS_NEG_SAVEBITMAP_INDEX               = 0x0B
+	TS_NEG_MULTIDSTBLT_INDEX              = 0x0F
+	TS_NEG_MULTIPATBLT_INDEX              = 0x10
+	TS_NEG_MULTISCRBLT_INDEX              = 0x11
+	TS_NEG_MULTIOPAQUERECT_INDEX          = 0x12
+	TS_NEG_FAST_INDEX_INDEX               = 0x13
+	TS_NEG_POLYGON_SC_INDEX               = 0x14
+	TS_NEG_POLYGON_CB_INDEX               = 0x15
+	TS_NEG_POLYLINE_INDEX                 = 0x16
+	TS_NEG_FAST_GLYPH_INDEX               = 0x18
+	TS_NEG_ELLIPSE_SC_INDEX               = 0x19
+	TS_NEG_ELLIPSE_CB_INDEX               = 0x1A
+	TS_NEG_INDEX_INDEX                    = 0x1B
+)
+
+type OrderEx uint16
+
+const (
+	ORDERFLAGS_EX_CACHE_BITMAP_REV3_SUPPORT   OrderEx = 0x0002
+	ORDERFLAGS_EX_ALTSEC_FRAME_MARKER_SUPPORT         = 0x0004
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240563.aspx
+ */
+
+const (
+	INPUT_FLAG_SCANCODES       uint16 = 0x0001
+	INPUT_FLAG_MOUSEX                 = 0x0004
+	INPUT_FLAG_FASTPATH_INPUT         = 0x0008
+	INPUT_FLAG_UNICODE                = 0x0010
+	INPUT_FLAG_FASTPATH_INPUT2        = 0x0020
+	INPUT_FLAG_UNUSED1                = 0x0040
+	INPUT_FLAG_UNUSED2                = 0x0080
+	INPUT_FLAG_MOUSE_HWHEEL           = 0x0100
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240564.aspx
+ */
+type BrushSupport uint32
+
+const (
+	BRUSH_DEFAULT    BrushSupport = 0x00000000
+	BRUSH_COLOR_8x8               = 0x00000001
+	BRUSH_COLOR_FULL              = 0x00000002
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240565.aspx
+ */
+type GlyphSupport uint16
+
+const (
+	GLYPH_SUPPORT_NONE    GlyphSupport = 0x0000
+	GLYPH_SUPPORT_PARTIAL              = 0x0001
+	GLYPH_SUPPORT_FULL                 = 0x0002
+	GLYPH_SUPPORT_ENCODE               = 0x0003
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240550.aspx
+ */
+type OffscreenSupportLevel uint32
+
+const (
+	OSL_FALSE OffscreenSupportLevel = 0x00000000
+	OSL_TRUE                        = 0x00000001
+)
+
+/**
+ * @see http://msdn.microsoft.com/en-us/library/cc240551.aspx
+ */
+type VirtualChannelCompressionFlag uint32
+
+const (
+	VCCAPS_NO_COMPR    VirtualChannelCompressionFlag = 0x00000000
+	VCCAPS_COMPR_SC                                  = 0x00000001
+	VCCAPS_COMPR_CS_8K                               = 0x00000002
+)
+
+type SoundFlag uint16
+
+const (
+	SOUND_NONE       SoundFlag = 0x0000
+	SOUND_BEEPS_FLAG           = 0x0001
+)
+
+type RailsupportLevel uint32
+
+const (
+	RAIL_LEVEL_SUPPORTED                           = 0x00000001
+	RAIL_LEVEL_DOCKED_LANGBAR_SUPPORTED            = 0x00000002
+	RAIL_LEVEL_SHELL_INTEGRATION_SUPPORTED         = 0x00000004
+	RAIL_LEVEL_LANGUAGE_IME_SYNC_SUPPORTED         = 0x00000008
+	RAIL_LEVEL_SERVER_TO_CLIENT_IME_SYNC_SUPPORTED = 0x00000010
+	RAIL_LEVEL_HIDE_MINIMIZED_APPS_SUPPORTED       = 0x00000020
+	RAIL_LEVEL_WINDOW_CLOAKING_SUPPORTED           = 0x00000040
+	RAIL_LEVEL_HANDSHAKE_EX_SUPPORTED              = 0x00000080
+)
+
+const (
+	INPUT_EVENT_SYNC     = 0x0000
+	INPUT_EVENT_UNUSED   = 0x0002
+	INPUT_EVENT_SCANCODE = 0x0004
+	INPUT_EVENT_UNICODE  = 0x0005
+	INPUT_EVENT_MOUSE    = 0x8001
+	INPUT_EVENT_MOUSEX   = 0x8002
+)
+
+const (
+	PTRFLAGS_HWHEEL         = 0x0400
+	PTRFLAGS_WHEEL          = 0x0200
+	PTRFLAGS_WHEEL_NEGATIVE = 0x0100
+	WheelRotationMask       = 0x01FF
+	PTRFLAGS_MOVE           = 0x0800
+	PTRFLAGS_DOWN           = 0x8000
+	PTRFLAGS_BUTTON1        = 0x1000
+	PTRFLAGS_BUTTON2        = 0x2000
+	PTRFLAGS_BUTTON3        = 0x4000
+)
+
+const (
+	KBDFLAGS_EXTENDED = 0x0100
+	KBDFLAGS_DOWN     = 0x4000
+	KBDFLAGS_RELEASE  = 0x8000
+)
+
+type Capability interface {
+	Type() CapsType
+}
+
+type GeneralCapability struct {
+	// 010018000100030000020000000015040000000000000000
+	OSMajorType             MajorType `struc:"little"`
+	OSMinorType             MinorType `struc:"little"`
+	ProtocolVersion         uint16    `struc:"little"`
+	Pad2octetsA             uint16    `struc:"little"`
+	GeneralCompressionTypes uint16    `struc:"little"`
+	ExtraFlags              uint16    `struc:"little"`
+	UpdateCapabilityFlag    uint16    `struc:"little"`
+	RemoteUnshareFlag       uint16    `struc:"little"`
+	GeneralCompressionLevel uint16    `struc:"little"`
+	RefreshRectSupport      uint8     `struc:"little"`
+	SuppressOutputSupport   uint8     `struc:"little"`
+}
+
+func (*GeneralCapability) Type() CapsType {
+	return CAPSTYPE_GENERAL
+}
+
+type BitmapCapability struct {
+	// 02001c00180001000100010000052003000000000100000001000000
+	PreferredBitsPerPixel    gcc.HighColor `struc:"little"`
+	Receive1BitPerPixel      uint16        `struc:"little"`
+	Receive4BitsPerPixel     uint16        `struc:"little"`
+	Receive8BitsPerPixel     uint16        `struc:"little"`
+	DesktopWidth             uint16        `struc:"little"`
+	DesktopHeight            uint16        `struc:"little"`
+	Pad2octets               uint16        `struc:"little"`
+	DesktopResizeFlag        uint16        `struc:"little"`
+	BitmapCompressionFlag    uint16        `struc:"little"`
+	HighColorFlags           uint8         `struc:"little"`
+	DrawingFlags             uint8         `struc:"little"`
+	MultipleRectangleSupport uint16        `struc:"little"`
+	Pad2octetsB              uint16        `struc:"little"`
+}
+
+func (*BitmapCapability) Type() CapsType {
+	return CAPSTYPE_BITMAP
+}
+
+type BitmapCacheCapability struct {
+	// 04002800000000000000000000000000000000000000000000000000000000000000000000000000
+	Pad1                  uint32 `struc:"little"`
+	Pad2                  uint32 `struc:"little"`
+	Pad3                  uint32 `struc:"little"`
+	Pad4                  uint32 `struc:"little"`
+	Pad5                  uint32 `struc:"little"`
+	Pad6                  uint32 `struc:"little"`
+	Cache0Entries         uint16 `struc:"little"`
+	Cache0MaximumCellSize uint16 `struc:"little"`
+	Cache1Entries         uint16 `struc:"little"`
+	Cache1MaximumCellSize uint16 `struc:"little"`
+	Cache2Entries         uint16 `struc:"little"`
+	Cache2MaximumCellSize uint16 `struc:"little"`
+}
+
+func (*BitmapCacheCapability) Type() CapsType {
+	return CAPSTYPE_BITMAPCACHE
+}
+
+type OrderCapability struct {
+	// 030058000000000000000000000000000000000000000000010014000000010000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000008403000000000000000000
+	TerminalDescriptor      [16]byte
+	Pad4octetsA             uint32    `struc:"little"`
+	DesktopSaveXGranularity uint16    `struc:"little"`
+	DesktopSaveYGranularity uint16    `struc:"little"`
+	Pad2octetsA             uint16    `struc:"little"`
+	MaximumOrderLevel       uint16    `struc:"little"`
+	NumberFonts             uint16    `struc:"little"`
+	OrderFlags              OrderFlag `struc:"little"`
+	OrderSupport            [32]byte
+	TextFlags               uint16 `struc:"little"`
+	OrderSupportExFlags     uint16 `struc:"little"`
+	Pad4octetsB             uint32 `struc:"little"`
+	DesktopSaveSize         uint32 `struc:"little"`
+	Pad2octetsC             uint16 `struc:"little"`
+	Pad2octetsD             uint16 `struc:"little"`
+	TextANSICodePage        uint16 `struc:"little"`
+	Pad2octetsE             uint16 `struc:"little"`
+}
+
+func (*OrderCapability) Type() CapsType {
+	return CAPSTYPE_ORDER
+}
+
+type PointerCapability struct {
+	ColorPointerFlag      uint16 `struc:"little"`
+	ColorPointerCacheSize uint16 `struc:"little"`
+	// old version of rdp doesn't support ...
+	// PointerCacheSize uint16 `struc:"little"` // only server need
+}
+
+func (*PointerCapability) Type() CapsType {
+	return CAPSTYPE_POINTER
+}
+
+type InputCapability struct {
+	// 0d005c001500000009040000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000
+	Flags       uint16 `struc:"little"`
+	Pad2octetsA uint16 `struc:"little"`
+	// same value as gcc.ClientCoreSettings.kbdLayout
+	KeyboardLayout gcc.KeyboardLayout `struc:"little"`
+	// same value as gcc.ClientCoreSettings.keyboardType
+	KeyboardType uint32 `struc:"little"`
+	// same value as gcc.ClientCoreSettings.keyboardSubType
+	KeyboardSubType uint32 `struc:"little"`
+	// same value as gcc.ClientCoreSettings.keyboardFnKeys
+	KeyboardFunctionKey uint32 `struc:"little"`
+	// same value as gcc.ClientCoreSettingrrs.imeFileName
+	ImeFileName [64]byte
+	//need add 0c000000 in the end
+}
+
+func (*InputCapability) Type() CapsType {
+	return CAPSTYPE_INPUT
+}
+
+type BrushCapability struct {
+	// 0f00080000000000
+	SupportLevel BrushSupport `struc:"little"`
+}
+
+func (*BrushCapability) Type() CapsType {
+	return CAPSTYPE_BRUSH
+}
+
+type cacheEntry struct {
+	Entries         uint16 `struc:"little"`
+	MaximumCellSize uint16 `struc:"little"`
+}
+
+type GlyphCapability struct {
+	// 10003400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+	GlyphCache   [10]cacheEntry `struc:"little"`
+	FragCache    uint32         `struc:"little"`
+	SupportLevel GlyphSupport   `struc:"little"`
+	Pad2octets   uint16         `struc:"little"`
+}
+
+func (*GlyphCapability) Type() CapsType {
+	return CAPSTYPE_GLYPHCACHE
+}
+
+type OffscreenBitmapCacheCapability struct {
+	// 11000c000000000000000000
+	SupportLevel OffscreenSupportLevel `struc:"little"`
+	CacheSize    uint16                `struc:"little"`
+	CacheEntries uint16                `struc:"little"`
+}
+
+func (*OffscreenBitmapCacheCapability) Type() CapsType {
+	return CAPSTYPE_OFFSCREENCACHE
+}
+
+type VirtualChannelCapability struct {
+	// 14000c000000000000000000
+	Flags       VirtualChannelCompressionFlag `struc:"little"`
+	VCChunkSize uint32                        `struc:"little"` // optional
+}
+
+func (*VirtualChannelCapability) Type() CapsType {
+	return CAPSTYPE_VIRTUALCHANNEL
+}
+
+type SoundCapability struct {
+	// 0c00080000000000
+	Flags      SoundFlag `struc:"little"`
+	Pad2octets uint16    `struc:"little"`
+}
+
+func (*SoundCapability) Type() CapsType {
+	return CAPSTYPE_SOUND
+}
+
+type ControlCapability struct {
+	ControlFlags     uint16 `struc:"little"`
+	RemoteDetachFlag uint16 `struc:"little"`
+	ControlInterest  uint16 `struc:"little"`
+	DetachInterest   uint16 `struc:"little"`
+}
+
+func (*ControlCapability) Type() CapsType {
+	return CAPSTYPE_CONTROL
+}
+
+type WindowActivationCapability struct {
+	HelpKeyFlag          uint16 `struc:"little"`
+	HelpKeyIndexFlag     uint16 `struc:"little"`
+	HelpExtendedKeyFlag  uint16 `struc:"little"`
+	WindowManagerKeyFlag uint16 `struc:"little"`
+}
+
+func (*WindowActivationCapability) Type() CapsType {
+	return CAPSTYPE_ACTIVATION
+}
+
+type FontCapability struct {
+	SupportFlags uint16 `struc:"little"`
+	Pad2octets   uint16 `struc:"little"`
+}
+
+func (*FontCapability) Type() CapsType {
+	return CAPSTYPE_FONT
+}
+
+type ColorCacheCapability struct {
+	CacheSize  uint16 `struc:"little"`
+	Pad2octets uint16 `struc:"little"`
+}
+
+func (*ColorCacheCapability) Type() CapsType {
+	return CAPSTYPE_COLORCACHE
+}
+
+type ShareCapability struct {
+	NodeId     uint16 `struc:"little"`
+	Pad2octets uint16 `struc:"little"`
+}
+
+func (*ShareCapability) Type() CapsType {
+	return CAPSTYPE_SHARE
+}
+
+type MultiFragmentUpdate struct {
+	// 1a00080000000000
+	MaxRequestSize uint32 `struc:"little"`
+}
+
+func (*MultiFragmentUpdate) Type() CapsType {
+	return CAPSETTYPE_MULTIFRAGMENTUPDATE
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpegdi/52635737-d144-4f47-9c88-b48ceaf3efb4
+
+type DrawGDIPlusCapability struct {
+	SupportLevel             uint32
+	GdipVersion              uint32
+	CacheLevel               uint32
+	GdipCacheEntries         [10]byte
+	GdipCacheChunkSize       [8]byte
+	GdipImageCacheProperties [6]byte
+}
+
+func (*DrawGDIPlusCapability) Type() CapsType {
+	return CAPSTYPE_DRAWGDIPLUS
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/86507fed-a0ee-4242-b802-237534a8f65e
+type BitmapCodec struct {
+	GUID             [16]byte
+	ID               uint8
+	PropertiesLength uint16 `struc:"little,sizeof=Properties"`
+	Properties       []byte
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/408b1878-9f6e-4106-8329-1af42219ba6a
+type BitmapCodecS struct {
+	Count uint8 `struc:"sizeof=Array"`
+	Array []BitmapCodec
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/17e80f50-d163-49de-a23b-fd6456aa472f
+type BitmapCodecsCapability struct {
+	SupportedBitmapCodecs BitmapCodecS // A variable-length field containing a TS_BITMAPCODECS structure (section 2.2.7.2.10.1).
+}
+
+func (*BitmapCodecsCapability) Type() CapsType {
+	return CAPSETTYPE_BITMAP_CODECS
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/fc05c385-46c3-42cb-9ed2-c475a3990e0b
+type BitmapCacheHostSupportCapability struct {
+	CacheVersion uint8
+	Pad1         uint8
+	Pad2         uint16
+}
+
+func (*BitmapCacheHostSupportCapability) Type() CapsType {
+	return CAPSTYPE_BITMAPCACHE_HOSTSUPPORT
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/41323437-c753-460e-8108-495a6fdd68a8
+type LargePointerCapability struct {
+	SupportFlags uint16 `struc:"little"`
+}
+
+func (*LargePointerCapability) Type() CapsType {
+	return CAPSETTYPE_LARGE_POINTER
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdperp/36a25e21-25e1-4954-aae8-09aaf6715c79
+type RemoteProgramsCapability struct {
+	RailSupportLevel uint32 `struc:"little"`
+}
+
+func (*RemoteProgramsCapability) Type() CapsType {
+	return CAPSTYPE_RAIL
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdperp/82ec7a69-f7e3-4294-830d-666178b35d15
+type WindowListCapability struct {
+	WndSupportLevel     uint32 `struc:"little"`
+	NumIconCaches       uint8
+	NumIconCacheEntries uint16 `struc:"little"`
+}
+
+func (*WindowListCapability) Type() CapsType {
+	return CAPSTYPE_WINDOW
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/9132002f-f133-4a0f-ba2f-2dc48f1e7f93
+type DesktopCompositionCapability struct {
+	CompDeskSupportLevel uint16 `struc:"little"`
+}
+
+func (*DesktopCompositionCapability) Type() CapsType {
+	return CAPSETTYPE_COMPDESK
+}
+
+// see https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rdpbcgr/aa953018-c0a8-4761-bb12-86586c2cd56a
+type SurfaceCommandsCapability struct {
+	CmdFlags uint32 `struc:"little"`
+	Reserved uint32 `struc:"little"`
+}
+
+func (*SurfaceCommandsCapability) Type() CapsType {
+	return CAPSETTYPE_SURFACE_COMMANDS
+}
+
+func readCapability(r io.Reader) (Capability, error) {
+	capType, err := core.ReadUint16LE(r)
+	if err != nil {
+		return nil, err
+	}
+	capLen, err := core.ReadUint16LE(r)
+	if err != nil {
+		return nil, err
+	}
+	if int(capLen)-4 <= 0 {
+		return nil, err
+	}
+
+	capBytes, err := core.ReadBytes(int(capLen)-4, r)
+	if err != nil {
+		return nil, err
+	}
+	capReader := bytes.NewReader(capBytes)
+	var c Capability
+	glog.Debugf("Capability type 0x%04x", capType)
+	switch CapsType(capType) {
+	case CAPSTYPE_GENERAL:
+		c = &GeneralCapability{}
+	case CAPSTYPE_BITMAP:
+		c = &BitmapCapability{}
+	case CAPSTYPE_ORDER:
+		c = &OrderCapability{}
+	case CAPSTYPE_BITMAPCACHE:
+		c = &BitmapCacheCapability{}
+	case CAPSTYPE_POINTER:
+		c = &PointerCapability{}
+	case CAPSTYPE_INPUT:
+		c = &InputCapability{}
+	case CAPSTYPE_BRUSH:
+		c = &BrushCapability{}
+	case CAPSTYPE_GLYPHCACHE:
+		c = &GlyphCapability{}
+	case CAPSTYPE_OFFSCREENCACHE:
+		c = &OffscreenBitmapCacheCapability{}
+	case CAPSTYPE_VIRTUALCHANNEL:
+		c = &VirtualChannelCapability{}
+	case CAPSTYPE_SOUND:
+		c = &SoundCapability{}
+	case CAPSTYPE_CONTROL:
+		c = &ControlCapability{}
+	case CAPSTYPE_ACTIVATION:
+		c = &WindowActivationCapability{}
+	case CAPSTYPE_FONT:
+		c = &FontCapability{}
+	case CAPSTYPE_COLORCACHE:
+		c = &ColorCacheCapability{}
+	case CAPSTYPE_SHARE:
+		c = &ShareCapability{}
+	case CAPSETTYPE_MULTIFRAGMENTUPDATE:
+		c = &MultiFragmentUpdate{}
+	case CAPSTYPE_DRAWGDIPLUS:
+		c = &DrawGDIPlusCapability{}
+	case CAPSETTYPE_BITMAP_CODECS:
+		c = &BitmapCodecsCapability{}
+	case CAPSTYPE_BITMAPCACHE_HOSTSUPPORT:
+		c = &BitmapCacheHostSupportCapability{}
+	case CAPSETTYPE_LARGE_POINTER:
+		c = &LargePointerCapability{}
+	case CAPSTYPE_RAIL:
+		c = &RemoteProgramsCapability{}
+	case CAPSTYPE_WINDOW:
+		c = &WindowListCapability{}
+	case CAPSETTYPE_COMPDESK:
+		c = &DesktopCompositionCapability{}
+	case CAPSETTYPE_SURFACE_COMMANDS:
+		c = &SurfaceCommandsCapability{}
+	//case CAPSSETTYPE_FRAME_ACKNOWLEDGE:
+	//c =
+	//glog.Error("CAPSSETTYPE_FRAME_ACKNOWLEDGE")
+	default:
+		err := errors.New(fmt.Sprintf("unsupported Capability type 0x%04x", capType))
+		glog.Error(err)
+		return nil, err
+	}
+	if err := struc.Unpack(capReader, c); err != nil {
+		glog.Error("Capability unpack error", err, fmt.Sprintf("0x%04x", capType), hex.EncodeToString(capBytes))
+		return nil, err
+	}
+	glog.Debugf("Capability: %+v", c)
+	return c, nil
+}
--- a/pkg/grdp/protocol/pdu/cliprdr.go
+++ b/pkg/grdp/protocol/pdu/cliprdr.go
@@ -0,0 +1,339 @@
+package pdu
+
+import (
+	"bytes"
+
+	"Yasso/pkg/grdp/core"
+	"Yasso/pkg/grdp/glog"
+)
+
+/**
+ *                                    Initialization Sequence\n
+ *     Client                                                                    Server\n
+ *        |                                                                         |\n
+ *        |<----------------------Server Clipboard Capabilities PDU-----------------|\n
+ *        |<-----------------------------Monitor Ready PDU--------------------------|\n
+ *        |-----------------------Client Clipboard Capabilities PDU---------------->|\n
+ *        |---------------------------Temporary Directory PDU---------------------->|\n
+ *        |-------------------------------Format List PDU-------------------------->|\n
+ *        |<--------------------------Format List Response PDU----------------------|\n
+ *
+ */
+
+/**
+ *                                    Data Transfer Sequences\n
+ *     Shared                                                                     Local\n
+ *  Clipboard Owner                                                           Clipboard Owner\n
+ *        |                                                                         |\n
+ *        |-------------------------------------------------------------------------|\n _
+ *        |-------------------------------Format List PDU-------------------------->|\n  |
+ *        |<--------------------------Format List Response PDU----------------------|\n _| Copy
+ * Sequence
+ *        |<---------------------Lock Clipboard Data PDU (Optional)-----------------|\n
+ *        |-------------------------------------------------------------------------|\n
+ *        |-------------------------------------------------------------------------|\n _
+ *        |<--------------------------Format Data Request PDU-----------------------|\n  | Paste
+ * Sequence Palette,
+ *        |---------------------------Format Data Response PDU--------------------->|\n _| Metafile,
+ * File List Data
+ *        |-------------------------------------------------------------------------|\n
+ *        |-------------------------------------------------------------------------|\n _
+ *        |<------------------------Format Contents Request PDU---------------------|\n  | Paste
+ * Sequence
+ *        |-------------------------Format Contents Response PDU------------------->|\n _| File
+ * Stream Data
+ *        |<---------------------Lock Clipboard Data PDU (Optional)-----------------|\n
+ *        |-------------------------------------------------------------------------|\n
+ *
+ */
+
+type MsgType uint16
+
+const (
+	CB_MONITOR_READY         = 0x0001
+	CB_FORMAT_LIST           = 0x0002
+	CB_FORMAT_LIST_RESPONSE  = 0x0003
+	CB_FORMAT_DATA_REQUEST   = 0x0004
+	CB_FORMAT_DATA_RESPONSE  = 0x0005
+	CB_TEMP_DIRECTORY        = 0x0006
+	CB_CLIP_CAPS             = 0x0007
+	CB_FILECONTENTS_REQUEST  = 0x0008
+	CB_FILECONTENTS_RESPONSE = 0x0009
+	CB_LOCK_CLIPDATA         = 0x000A
+	CB_UNLOCK_CLIPDATA       = 0x000B
+)
+
+type MsgFlags uint16
+
+const (
+	CB_RESPONSE_OK   = 0x0001
+	CB_RESPONSE_FAIL = 0x0002
+	CB_ASCII_NAMES   = 0x0004
+)
+
+type DwFlags uint32
+
+const (
+	FILECONTENTS_SIZE  = 0x00000001
+	FILECONTENTS_RANGE = 0x00000002
+)
+
+type CliprdrPDUHeader struct {
+	MsgType  uint16 `struc:"little"`
+	MsgFlags uint16 `struc:"little"`
+	DataLen  uint32 `struc:"little"`
+}
+
+func NewCliprdrPDUHeader(mType, flags uint16, ln uint32) *CliprdrPDUHeader {
+	return &CliprdrPDUHeader{
+		MsgType:  mType,
+		MsgFlags: flags,
+		DataLen:  ln,
+	}
+}
+
+/*func (c *CliprdrPDU) serialize() []byte {
+	b := &bytes.Buffer{}
+
+	return b.Bytes()
+}
+func (c *CliprdrPDU) SendCliprdrGeneralCapability() {
+
+}
+func (c *CliprdrPDU) RecvCliprdrCaps() {
+
+}
+
+func (c *CliprdrPDU) RecvMonitorReady() {
+
+}
+
+func (c *CliprdrPDU) SendCliprdrFileContentsRequest() {
+
+}
+func (c *CliprdrPDU) SendCliprdrFileContentsResponse() {
+
+}
+func (c *CliprdrPDU) SendCliprdrClientFormatList() {
+
+}
+
+func (c *CliprdrPDU) RecvCliprdrClientFormatListResponse() {
+
+}
+*/
+type CliprdrClient struct {
+	useLongFormatNames    bool
+	streamFileClipEnabled bool
+	fileClipNoFilePaths   bool
+	canLockClipData       bool
+	hasHugeFileSupport    bool
+}
+
+func process_message(s []byte) {
+	r := bytes.NewReader(s)
+
+	msgType, _ := core.ReadUint16LE(r)
+	flag, _ := core.ReadUint16LE(r)
+	length, _ := core.ReadUInt32LE(r)
+
+	glog.Debug("cliprdr: type=%d flag=%d length=%d", msgType, flag, length)
+
+	switch msgType {
+	case CB_MONITOR_READY:
+		//clipboard_sync(plugin->device_data);
+		break
+	case CB_FORMAT_LIST:
+		//clipboard_format_list(plugin->device_data, flag,
+		//	data + 8, length);
+		//cliprdr_send_packet(plugin, CB_FORMAT_LIST_RESPONSE,
+		//	CB_RESPONSE_OK, NULL, 0);
+		break
+	case CB_FORMAT_LIST_RESPONSE:
+		//clipboard_format_list_response(plugin->device_data, flag);
+		break
+	case CB_FORMAT_DATA_REQUEST:
+		//format = GET_UINT32(data, 8);
+		//clipboard_request_data(plugin->device_data, format);
+		break
+	case CB_FORMAT_DATA_RESPONSE:
+		//clipboard_handle_data(plugin->device_data, flag,
+		//data + 8, length);
+		//break;
+	case CB_CLIP_CAPS:
+		//clipboard_handle_caps(plugin->device_data, flag,
+		//data + 8, length);
+		break
+	default:
+		glog.Error("type %d not supported", msgType)
+		break
+	}
+
+}
+
+type CliprdrGeneralCapabilitySet struct {
+	CapabilitySetType   uint16 `struc:"little"`
+	CapabilitySetLength uint16 `struc:"little"`
+	Version             uint32 `struc:"little"`
+	GeneralFlags        uint32 `struc:"little"`
+}
+type CliprdrCapabilitySets struct {
+	CapabilitySetType uint16 `struc:"little"`
+	LengthCapability  uint16 `struc:"little,sizeof=CapabilityData"`
+	CapabilityData    []byte `struc:"little"`
+}
+type CliprdrCapabilitiesPDU struct {
+	*CliprdrPDUHeader `struc:"little"`
+	CCapabilitiesSets uint16                      `struc:"little"`
+	Pad1              uint16                      `struc:"little"`
+	CapabilitySets    CliprdrGeneralCapabilitySet `struc:"little"`
+}
+
+type CliprdrMonitorReady struct {
+	*CliprdrPDUHeader `struc:"little"`
+}
+
+type GeneralFlags uint32
+
+const (
+	/* CLIPRDR_GENERAL_CAPABILITY.generalFlags */
+	CB_USE_LONG_FORMAT_NAMES     = 0x00000002
+	CB_STREAM_FILECLIP_ENABLED   = 0x00000004
+	CB_FILECLIP_NO_FILE_PATHS    = 0x00000008
+	CB_CAN_LOCK_CLIPDATA         = 0x00000010
+	CB_HUGE_FILE_SUPPORT_ENABLED = 0x00000020
+)
+
+const (
+	/* CLIPRDR_GENERAL_CAPABILITY.version */
+	CB_CAPS_VERSION_1 = 0x00000001
+	CB_CAPS_VERSION_2 = 0x00000002
+)
+const (
+	CB_CAPSTYPE_GENERAL_LEN = 12
+)
+
+func CliprdrInit(context CliprdrClient) {
+	var (
+		generalFlags         uint32
+		generalCapabilitySet CliprdrGeneralCapabilitySet
+		monitorReady         CliprdrMonitorReady
+		capabilities         CliprdrCapabilitiesPDU
+	)
+
+	generalFlags = 0
+	monitorReady.MsgType = CB_MONITOR_READY
+	capabilities.MsgType = CB_CLIP_CAPS
+
+	if context.useLongFormatNames {
+		generalFlags |= CB_USE_LONG_FORMAT_NAMES
+	}
+
+	if context.streamFileClipEnabled {
+		generalFlags |= CB_STREAM_FILECLIP_ENABLED
+	}
+
+	if context.fileClipNoFilePaths {
+		generalFlags |= CB_FILECLIP_NO_FILE_PATHS
+	}
+
+	if context.canLockClipData {
+		generalFlags |= CB_CAN_LOCK_CLIPDATA
+	}
+
+	if context.hasHugeFileSupport {
+		generalFlags |= CB_HUGE_FILE_SUPPORT_ENABLED
+	}
+
+	capabilities.MsgType = CB_CLIP_CAPS
+	capabilities.MsgFlags = 0
+	capabilities.DataLen = 4 + CB_CAPSTYPE_GENERAL_LEN
+	capabilities.CCapabilitiesSets = 1
+
+	generalCapabilitySet.CapabilitySetType = 0x0001
+	generalCapabilitySet.CapabilitySetLength = CB_CAPSTYPE_GENERAL_LEN
+	generalCapabilitySet.Version = CB_CAPS_VERSION_2
+	generalCapabilitySet.GeneralFlags = generalFlags
+	capabilities.CapabilitySets = generalCapabilitySet
+
+	/*	if ((err= context->ServerCapabilities(context, &capabilities))){
+			//glog.Error(TAG, "ServerCapabilities failed with error %" PRIu32 "!", err);
+			return err
+		}
+
+		if ((err = context->MonitorReady(context, &monitorReady))){
+			//glog.Error("MonitorReady failed with error %" PRIu32 "!", err);
+			return err
+		}*/
+
+	//return err
+}
+
+// temp dir
+type CliprdrTempDirectory struct {
+	Header    *CliprdrPDUHeader
+	SzTempDir string
+}
+
+// format list
+type CliprdrFormat struct {
+	FormatId   uint32
+	FormatName string
+}
+type CliprdrFormatList struct {
+	Header     *CliprdrPDUHeader
+	NumFormats uint32
+	Formats    []CliprdrFormat
+}
+type ClipboardFormats uint16
+
+const (
+	CB_FORMAT_HTML             = 0xD010
+	CB_FORMAT_PNG              = 0xD011
+	CB_FORMAT_JPEG             = 0xD012
+	CB_FORMAT_GIF              = 0xD013
+	CB_FORMAT_TEXTURILIST      = 0xD014
+	CB_FORMAT_GNOMECOPIEDFILES = 0xD015
+	CB_FORMAT_MATECOPIEDFILES  = 0xD016
+)
+
+// lock or unlock
+type CliprdrCtrlClipboardData struct {
+	Header     *CliprdrPDUHeader
+	ClipDataId uint32
+}
+
+// format data
+type CliprdrFormatDataRequest struct {
+	Header            *CliprdrPDUHeader
+	RequestedFormatId uint32
+}
+type CliprdrFormatDataResponse struct {
+	Header              *CliprdrPDUHeader
+	RequestedFormatData []byte
+}
+
+// file contents
+type CliprdrFileContentsRequest struct {
+	Header        *CliprdrPDUHeader
+	StreamId      uint32
+	Lindex        int32
+	DwFlags       uint32
+	NPositionLow  uint32
+	NPositionHigh uint32
+	CbRequested   uint32
+	ClipDataId    uint32
+}
+
+func NewCliprdrFileContentsRequest() *CliprdrFileContentsRequest {
+	return &CliprdrFileContentsRequest{
+		Header: NewCliprdrPDUHeader(CB_FILECONTENTS_REQUEST, 0, 0),
+	}
+}
+
+type CliprdrFileContentsResponse struct {
+	Header        *CliprdrPDUHeader
+	StreamId      uint32
+	CbRequested   uint32
+	RequestedData []byte
+}
--- a/pkg/grdp/protocol/pdu/data.go
+++ b/pkg/grdp/protocol/pdu/data.go
@@ -0,0 +1,824 @@
+package pdu
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+
+	"Yasso/pkg/grdp/core"
+	"Yasso/pkg/grdp/glog"
+	"github.com/lunixbochs/struc"
+)
+
+const (
+	PDUTYPE_DEMANDACTIVEPDU  = 0x11
+	PDUTYPE_CONFIRMACTIVEPDU = 0x13
+	PDUTYPE_DEACTIVATEALLPDU = 0x16
+	PDUTYPE_DATAPDU          = 0x17
+	PDUTYPE_SERVER_REDIR_PKT = 0x1A
+)
+
+const (
+	PDUTYPE2_UPDATE                      = 0x02
+	PDUTYPE2_CONTROL                     = 0x14
+	PDUTYPE2_POINTER                     = 0x1B
+	PDUTYPE2_INPUT                       = 0x1C
+	PDUTYPE2_SYNCHRONIZE                 = 0x1F
+	PDUTYPE2_REFRESH_RECT                = 0x21
+	PDUTYPE2_PLAY_SOUND                  = 0x22
+	PDUTYPE2_SUPPRESS_OUTPUT             = 0x23
+	PDUTYPE2_SHUTDOWN_REQUEST            = 0x24
+	PDUTYPE2_SHUTDOWN_DENIED             = 0x25
+	PDUTYPE2_SAVE_SESSION_INFO           = 0x26
+	PDUTYPE2_FONTLIST                    = 0x27
+	PDUTYPE2_FONTMAP                     = 0x28
+	PDUTYPE2_SET_KEYBOARD_INDICATORS     = 0x29
+	PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST = 0x2B
+	PDUTYPE2_BITMAPCACHE_ERROR_PDU       = 0x2C
+	PDUTYPE2_SET_KEYBOARD_IME_STATUS     = 0x2D
+	PDUTYPE2_OFFSCRCACHE_ERROR_PDU       = 0x2E
+	PDUTYPE2_SET_ERROR_INFO_PDU          = 0x2F
+	PDUTYPE2_DRAWNINEGRID_ERROR_PDU      = 0x30
+	PDUTYPE2_DRAWGDIPLUS_ERROR_PDU       = 0x31
+	PDUTYPE2_ARC_STATUS_PDU              = 0x32
+	PDUTYPE2_STATUS_INFO_PDU             = 0x36
+	PDUTYPE2_MONITOR_LAYOUT_PDU          = 0x37
+)
+
+const (
+	CTRLACTION_REQUEST_CONTROL = 0x0001
+	CTRLACTION_GRANTED_CONTROL = 0x0002
+	CTRLACTION_DETACH          = 0x0003
+	CTRLACTION_COOPERATE       = 0x0004
+)
+
+const (
+	STREAM_UNDEFINED = 0x00
+	STREAM_LOW       = 0x01
+	STREAM_MED       = 0x02
+	STREAM_HI        = 0x04
+)
+
+const (
+	FASTPATH_UPDATETYPE_ORDERS       = 0x0
+	FASTPATH_UPDATETYPE_BITMAP       = 0x1
+	FASTPATH_UPDATETYPE_PALETTE      = 0x2
+	FASTPATH_UPDATETYPE_SYNCHRONIZE  = 0x3
+	FASTPATH_UPDATETYPE_SURFCMDS     = 0x4
+	FASTPATH_UPDATETYPE_PTR_NULL     = 0x5
+	FASTPATH_UPDATETYPE_PTR_DEFAULT  = 0x6
+	FASTPATH_UPDATETYPE_PTR_POSITION = 0x8
+	FASTPATH_UPDATETYPE_COLOR        = 0x9
+	FASTPATH_UPDATETYPE_CACHED       = 0xA
+	FASTPATH_UPDATETYPE_POINTER      = 0xB
+)
+
+const (
+	BITMAP_COMPRESSION = 0x0001
+	//NO_BITMAP_COMPRESSION_HDR = 0x0400
+)
+
+type ShareDataHeader struct {
+	SharedId           uint32 `struc:"little"`
+	Padding1           uint8  `struc:"little"`
+	StreamId           uint8  `struc:"little"`
+	UncompressedLength uint16 `struc:"little"`
+	PDUType2           uint8  `struc:"little"`
+	CompressedType     uint8  `struc:"little"`
+	CompressedLength   uint16 `struc:"little"`
+}
+
+func NewShareDataHeader(size int, type2 uint8, shareId uint32) *ShareDataHeader {
+	return &ShareDataHeader{
+		SharedId:           shareId,
+		PDUType2:           type2,
+		StreamId:           STREAM_LOW,
+		UncompressedLength: uint16(size + 4),
+	}
+}
+
+type PDUMessage interface {
+	Type() uint16
+	Serialize() []byte
+}
+
+type DemandActivePDU struct {
+	SharedId                   uint32       `struc:"little"`
+	LengthSourceDescriptor     uint16       `struc:"little,sizeof=SourceDescriptor"`
+	LengthCombinedCapabilities uint16       `struc:"little"`
+	SourceDescriptor           []byte       `struc:"sizefrom=LengthSourceDescriptor"`
+	NumberCapabilities         uint16       `struc:"little,sizeof=CapabilitySets"`
+	Pad2Octets                 uint16       `struc:"little"`
+	CapabilitySets             []Capability `struc:"sizefrom=NumberCapabilities"`
+	SessionId                  uint32       `struc:"little"`
+}
+
+func (d *DemandActivePDU) Type() uint16 {
+	return PDUTYPE_DEMANDACTIVEPDU
+}
+
+func (d *DemandActivePDU) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	core.WriteUInt32LE(d.SharedId, buff)
+	core.WriteUInt16LE(d.LengthSourceDescriptor, buff)
+	core.WriteUInt16LE(d.LengthCombinedCapabilities, buff)
+	core.WriteBytes([]byte(d.SourceDescriptor), buff)
+	core.WriteUInt16LE(uint16(len(d.CapabilitySets)), buff)
+	core.WriteUInt16LE(d.Pad2Octets, buff)
+	for _, cap := range d.CapabilitySets {
+		core.WriteUInt16LE(uint16(cap.Type()), buff)
+		capBuff := &bytes.Buffer{}
+		struc.Pack(capBuff, cap)
+		capBytes := capBuff.Bytes()
+		core.WriteUInt16LE(uint16(len(capBytes)+4), buff)
+		core.WriteBytes(capBytes, buff)
+	}
+	core.WriteUInt32LE(d.SessionId, buff)
+	return buff.Bytes()
+}
+
+func readDemandActivePDU(r io.Reader) (*DemandActivePDU, error) {
+	d := &DemandActivePDU{}
+	var err error
+	d.SharedId, err = core.ReadUInt32LE(r)
+	if err != nil {
+		return nil, err
+	}
+	d.LengthSourceDescriptor, err = core.ReadUint16LE(r)
+	d.LengthCombinedCapabilities, err = core.ReadUint16LE(r)
+	sourceDescriptorBytes, err := core.ReadBytes(int(d.LengthSourceDescriptor), r)
+	if err != nil {
+		return nil, err
+	}
+	d.SourceDescriptor = sourceDescriptorBytes
+	d.NumberCapabilities, err = core.ReadUint16LE(r)
+	d.Pad2Octets, err = core.ReadUint16LE(r)
+	d.CapabilitySets = make([]Capability, 0)
+	glog.Debug("NumberCapabilities is", d.NumberCapabilities)
+	for i := 0; i < int(d.NumberCapabilities); i++ {
+		c, err := readCapability(r)
+		if err != nil {
+			//return nil, err
+			continue
+		}
+		d.CapabilitySets = append(d.CapabilitySets, c)
+	}
+	d.NumberCapabilities = uint16(len(d.CapabilitySets))
+	d.SessionId, err = core.ReadUInt32LE(r)
+	//glog.Info("SessionId:", d.SessionId)
+	if err != nil {
+		return nil, err
+	}
+	return d, nil
+}
+
+type ConfirmActivePDU struct {
+	SharedId                   uint32       `struc:"little"`
+	OriginatorId               uint16       `struc:"little"`
+	LengthSourceDescriptor     uint16       `struc:"little,sizeof=SourceDescriptor"`
+	LengthCombinedCapabilities uint16       `struc:"little"`
+	SourceDescriptor           []byte       `struc:"sizefrom=LengthSourceDescriptor"`
+	NumberCapabilities         uint16       `struc:"little,sizeof=CapabilitySets"`
+	Pad2Octets                 uint16       `struc:"little"`
+	CapabilitySets             []Capability `struc:"sizefrom=NumberCapabilities"`
+}
+
+func (*ConfirmActivePDU) Type() uint16 {
+	return PDUTYPE_CONFIRMACTIVEPDU
+}
+
+func (c *ConfirmActivePDU) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	core.WriteUInt32LE(c.SharedId, buff)
+	core.WriteUInt16LE(c.OriginatorId, buff)
+	core.WriteUInt16LE(uint16(len(c.SourceDescriptor)), buff)
+
+	capsBuff := &bytes.Buffer{}
+	for _, capa := range c.CapabilitySets {
+		core.WriteUInt16LE(uint16(capa.Type()), capsBuff)
+		capBuff := &bytes.Buffer{}
+		struc.Pack(capBuff, capa)
+		if capa.Type() == CAPSTYPE_INPUT {
+			core.WriteBytes([]byte{0x0c, 0x00, 0x00, 0x00}, capBuff)
+		}
+		capBytes := capBuff.Bytes()
+		core.WriteUInt16LE(uint16(len(capBytes)+4), capsBuff)
+		core.WriteBytes(capBytes, capsBuff)
+	}
+	capsBytes := capsBuff.Bytes()
+
+	core.WriteUInt16LE(uint16(2+2+len(capsBytes)), buff)
+	core.WriteBytes([]byte(c.SourceDescriptor), buff)
+	core.WriteUInt16LE(uint16(len(c.CapabilitySets)), buff)
+	core.WriteUInt16LE(c.Pad2Octets, buff)
+	core.WriteBytes(capsBytes, buff)
+	return buff.Bytes()
+}
+
+// 9401 => share control header
+// 1300 => share control header
+// ec03 => share control header
+// ea030100  => shareId 66538
+// ea03 => OriginatorId
+// 0400
+// 8001 => LengthCombinedCapabilities
+// 72647079
+// 0c00 => NumberCapabilities 12
+// 0000
+// caps below
+// 010018000100030000020000000015040000000000000000
+// 02001c00180001000100010000052003000000000100000001000000
+// 030058000000000000000000000000000000000000000000010014000000010000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000008403000000000000000000
+// 04002800000000000000000000000000000000000000000000000000000000000000000000000000
+// 0800080000001400
+// 0c00080000000000
+// 0d005c001500000009040000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000000
+// 0f00080000000000
+// 10003400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
+// 11000c000000000000000000
+// 14000c000000000000000000
+// 1a00080000000000
+
+func NewConfirmActivePDU() *ConfirmActivePDU {
+	return &ConfirmActivePDU{
+		OriginatorId:     0x03EA,
+		CapabilitySets:   make([]Capability, 0),
+		SourceDescriptor: []byte("rdpy"),
+	}
+}
+
+func readConfirmActivePDU(r io.Reader) (*ConfirmActivePDU, error) {
+	p := &ConfirmActivePDU{}
+	var err error
+	p.SharedId, err = core.ReadUInt32LE(r)
+	if err != nil {
+		return nil, err
+	}
+	p.OriginatorId, err = core.ReadUint16LE(r)
+	p.LengthSourceDescriptor, err = core.ReadUint16LE(r)
+	p.LengthCombinedCapabilities, err = core.ReadUint16LE(r)
+
+	sourceDescriptorBytes, err := core.ReadBytes(int(p.LengthSourceDescriptor), r)
+	if err != nil {
+		return nil, err
+	}
+	p.SourceDescriptor = sourceDescriptorBytes
+	p.NumberCapabilities, err = core.ReadUint16LE(r)
+	p.Pad2Octets, err = core.ReadUint16LE(r)
+
+	p.CapabilitySets = make([]Capability, 0)
+	for i := 0; i < int(p.NumberCapabilities); i++ {
+		c, err := readCapability(r)
+		if err != nil {
+			return nil, err
+		}
+		p.CapabilitySets = append(p.CapabilitySets, c)
+	}
+	s, _ := core.ReadUInt32LE(r)
+	glog.Info("sessionid:", s)
+	return p, nil
+}
+
+type DeactiveAllPDU struct {
+	ShareId                uint32 `struc:"little"`
+	LengthSourceDescriptor uint16 `struc:"little,sizeof=SourceDescriptor"`
+	SourceDescriptor       []byte
+}
+
+func (*DeactiveAllPDU) Type() uint16 {
+	return PDUTYPE_DEACTIVATEALLPDU
+}
+
+func (d *DeactiveAllPDU) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, d)
+	return buff.Bytes()
+}
+
+func readDeactiveAllPDU(r io.Reader) (*DeactiveAllPDU, error) {
+	p := &DeactiveAllPDU{}
+	err := struc.Unpack(r, p)
+	return p, err
+}
+
+type DataPDU struct {
+	Header *ShareDataHeader
+	Data   DataPDUData
+}
+
+func (*DataPDU) Type() uint16 {
+	return PDUTYPE_DATAPDU
+}
+
+func (d *DataPDU) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, d.Header)
+	struc.Pack(buff, d.Data)
+	return buff.Bytes()
+}
+
+func NewDataPDU(data DataPDUData, shareId uint32) *DataPDU {
+	dataBuff := &bytes.Buffer{}
+	struc.Pack(dataBuff, data)
+	return &DataPDU{
+		Header: NewShareDataHeader(len(dataBuff.Bytes()), data.Type2(), shareId),
+		Data:   data,
+	}
+}
+
+func readDataPDU(r io.Reader) (*DataPDU, error) {
+	header := &ShareDataHeader{}
+	err := struc.Unpack(r, header)
+	if err != nil {
+		glog.Error("read data pdu header error", err)
+		return nil, err
+	}
+	var d DataPDUData
+	glog.Debugf("header=%02x", header.PDUType2)
+	switch header.PDUType2 {
+	case PDUTYPE2_SYNCHRONIZE:
+		d = &SynchronizeDataPDU{}
+	case PDUTYPE2_CONTROL:
+		d = &ControlDataPDU{}
+	case PDUTYPE2_FONTLIST:
+		d = &FontListDataPDU{}
+	case PDUTYPE2_SET_ERROR_INFO_PDU:
+		d = &ErrorInfoDataPDU{}
+	case PDUTYPE2_FONTMAP:
+		d = &FontMapDataPDU{}
+	case PDUTYPE2_SAVE_SESSION_INFO:
+		s := &SaveSessionInfo{}
+		s.Unpack(r)
+		d = s
+	default:
+		err = errors.New(fmt.Sprintf("Unknown data pdu type2 0x%02x", header.PDUType2))
+		glog.Error(err)
+		return nil, err
+	}
+
+	if header.PDUType2 != PDUTYPE2_SAVE_SESSION_INFO {
+		err = struc.Unpack(r, d)
+		if err != nil {
+			glog.Error("read data pdu error", err)
+			return nil, err
+		}
+	}
+
+	glog.Debugf("d=%+v", d)
+	p := &DataPDU{
+		Header: header,
+		Data:   d,
+	}
+	return p, nil
+}
+
+type DataPDUData interface {
+	Type2() uint8
+}
+
+type SynchronizeDataPDU struct {
+	MessageType uint16 `struc:"little"`
+	TargetUser  uint16 `struc:"little"`
+}
+
+func (*SynchronizeDataPDU) Type2() uint8 {
+	return PDUTYPE2_SYNCHRONIZE
+}
+
+func NewSynchronizeDataPDU(targetUser uint16) *SynchronizeDataPDU {
+	return &SynchronizeDataPDU{
+		MessageType: 1,
+		TargetUser:  targetUser,
+	}
+}
+
+type ControlDataPDU struct {
+	Action    uint16 `struc:"little"`
+	GrantId   uint16 `struc:"little"`
+	ControlId uint32 `struc:"little"`
+}
+
+func (*ControlDataPDU) Type2() uint8 {
+	return PDUTYPE2_CONTROL
+}
+
+type FontListDataPDU struct {
+	NumberFonts   uint16 `struc:"little"`
+	TotalNumFonts uint16 `struc:"little"`
+	ListFlags     uint16 `struc:"little"`
+	EntrySize     uint16 `struc:"little"`
+}
+
+func (*FontListDataPDU) Type2() uint8 {
+	return PDUTYPE2_FONTLIST
+}
+
+type ErrorInfoDataPDU struct {
+	ErrorInfo uint32 `struc:"little"`
+}
+
+func (*ErrorInfoDataPDU) Type2() uint8 {
+	return PDUTYPE2_SET_ERROR_INFO_PDU
+}
+
+type FontMapDataPDU struct {
+	NumberEntries   uint16 `struc:"little"`
+	TotalNumEntries uint16 `struc:"little"`
+	MapFlags        uint16 `struc:"little"`
+	EntrySize       uint16 `struc:"little"`
+}
+
+func (*FontMapDataPDU) Type2() uint8 {
+	return PDUTYPE2_FONTMAP
+}
+
+type InfoType uint32
+
+const (
+	INFOTYPE_LOGON               = 0x00000000
+	INFOTYPE_LOGON_LONG          = 0x00000001
+	INFOTYPE_LOGON_PLAINNOTIFY   = 0x00000002
+	INFOTYPE_LOGON_EXTENDED_INFO = 0x00000003
+)
+const (
+	LOGON_EX_AUTORECONNECTCOOKIE = 0x00000001
+	LOGON_EX_LOGONERRORS         = 0x00000002
+)
+
+type LogonFields struct {
+	CbFileData uint32   `struc:"little"`
+	Len        uint32   //28 `struc:"little"`
+	Version    uint32   // 1 `struc:"little"`
+	LogonId    uint32   `struc:"little"`
+	random     [16]byte //16 `struc:"little"`
+}
+type SaveSessionInfo struct {
+	InfoType      uint32
+	Length        uint16
+	FieldsPresent uint32
+	LogonId       uint32
+	Random        []byte
+}
+
+func (s *SaveSessionInfo) logonInfoV1(r io.Reader) (err error) {
+	core.ReadUInt32LE(r) // cbDomain
+	b, _ := core.ReadBytes(52, r)
+	domain := core.UnicodeDecode(b)
+
+	core.ReadUInt32LE(r) // cbUserName
+	b, _ = core.ReadBytes(512, r)
+	userName := core.UnicodeDecode(b)
+
+	sessionId, _ := core.ReadUInt32LE(r)
+	s.LogonId = sessionId
+	glog.Infof("SessionId:[%d] UserName:[%s] Domain:[%s]", s.LogonId, userName, domain)
+	return err
+}
+func (s *SaveSessionInfo) logonInfoV2(r io.Reader) (err error) {
+	core.ReadUint16LE(r)
+	core.ReadUInt32LE(r)
+	sessionId, _ := core.ReadUInt32LE(r)
+	s.LogonId = sessionId
+	cbDomain, _ := core.ReadUInt32LE(r)
+	cbUserName, _ := core.ReadUInt32LE(r)
+	core.ReadBytes(558, r)
+
+	b, _ := core.ReadBytes(int(cbDomain), r)
+	domain := core.UnicodeDecode(b)
+	b, _ = core.ReadBytes(int(cbUserName), r)
+	userName := core.UnicodeDecode(b)
+	glog.Infof("SessionId:[%d] UserName:[%s] Domain:[%s]", s.LogonId, userName, domain)
+
+	return err
+}
+func (s *SaveSessionInfo) logonPlainNotify(r io.Reader) (err error) {
+	core.ReadBytes(576, r) /* pad (576 bytes) */
+	return err
+}
+func (s *SaveSessionInfo) logonInfoExtended(r io.Reader) (err error) {
+	s.Length, err = core.ReadUint16LE(r)
+	s.FieldsPresent, err = core.ReadUInt32LE(r)
+	glog.Info("FieldsPresent:", s.FieldsPresent)
+	// auto reconnect cookie
+	if s.FieldsPresent&LOGON_EX_AUTORECONNECTCOOKIE != 0 {
+		core.ReadUInt32LE(r)
+		b, _ := core.ReadUInt32LE(r)
+		if b != 28 {
+			return errors.New(fmt.Sprintf("invalid length in Auto-Reconnect packet"))
+		}
+		b, _ = core.ReadUInt32LE(r)
+		if b != 1 {
+			return errors.New(fmt.Sprintf("unsupported version of Auto-Reconnect packet"))
+		}
+		b, _ = core.ReadUInt32LE(r)
+		s.LogonId = b
+		s.Random, _ = core.ReadBytes(16, r)
+	} else { // logon error info
+		core.ReadUInt32LE(r)
+		b, _ := core.ReadUInt32LE(r)
+		b, _ = core.ReadUInt32LE(r)
+		s.LogonId = b
+	}
+	core.ReadBytes(570, r)
+	return err
+}
+func (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {
+	s.InfoType, err = core.ReadUInt32LE(r)
+	switch s.InfoType {
+	case INFOTYPE_LOGON:
+		err = s.logonInfoV1(r)
+	case INFOTYPE_LOGON_LONG:
+		err = s.logonInfoV2(r)
+	case INFOTYPE_LOGON_PLAINNOTIFY:
+		err = s.logonPlainNotify(r)
+	case INFOTYPE_LOGON_EXTENDED_INFO:
+		err = s.logonInfoExtended(r)
+	default:
+		glog.Error("Unhandled saveSessionInfo type 0x%", s.InfoType)
+		return fmt.Errorf("Unhandled saveSessionInfo type 0x%", s.InfoType)
+	}
+
+	return err
+}
+
+func (*SaveSessionInfo) Type2() uint8 {
+	return PDUTYPE2_SAVE_SESSION_INFO
+}
+
+type PersistKeyPDU struct {
+	NumEntriesCache0   uint16 `struc:"little"`
+	NumEntriesCache1   uint16 `struc:"little"`
+	NumEntriesCache2   uint16 `struc:"little"`
+	NumEntriesCache3   uint16 `struc:"little"`
+	NumEntriesCache4   uint16 `struc:"little"`
+	TotalEntriesCache0 uint16 `struc:"little"`
+	TotalEntriesCache1 uint16 `struc:"little"`
+	TotalEntriesCache2 uint16 `struc:"little"`
+	TotalEntriesCache3 uint16 `struc:"little"`
+	TotalEntriesCache4 uint16 `struc:"little"`
+	BBitMask           uint8  `struc:"little"`
+	Pad1               uint8  `struc:"little"`
+	Ppad3              uint16 `struc:"little"`
+}
+
+func (*PersistKeyPDU) Type2() uint8 {
+	return PDUTYPE2_BITMAPCACHE_PERSISTENT_LIST
+}
+
+type UpdateData interface {
+	FastPathUpdateType() uint8
+	Unpack(io.Reader) error
+}
+
+type BitmapCompressedDataHeader struct {
+	CbCompFirstRowSize uint16 `struc:"little"`
+	CbCompMainBodySize uint16 `struc:"little"`
+	CbScanWidth        uint16 `struc:"little"`
+	CbUncompressedSize uint16 `struc:"little"`
+}
+
+type BitmapData struct {
+	DestLeft         uint16 `struc:"little"`
+	DestTop          uint16 `struc:"little"`
+	DestRight        uint16 `struc:"little"`
+	DestBottom       uint16 `struc:"little"`
+	Width            uint16 `struc:"little"`
+	Height           uint16 `struc:"little"`
+	BitsPerPixel     uint16 `struc:"little"`
+	Flags            uint16 `struc:"little"`
+	BitmapLength     uint16 `struc:"little,sizeof=BitmapDataStream"`
+	BitmapComprHdr   *BitmapCompressedDataHeader
+	BitmapDataStream []byte
+}
+
+func (b *BitmapData) IsCompress() bool {
+	return b.Flags&BITMAP_COMPRESSION != 0
+}
+
+type FastPathBitmapUpdateDataPDU struct {
+	Header           uint16 `struc:"little"`
+	NumberRectangles uint16 `struc:"little,sizeof=Rectangles"`
+	Rectangles       []BitmapData
+}
+
+func (f *FastPathBitmapUpdateDataPDU) Unpack(r io.Reader) error {
+	var err error
+	f.Header, err = core.ReadUint16LE(r)
+	f.NumberRectangles, err = core.ReadUint16LE(r)
+	f.Rectangles = make([]BitmapData, 0, f.NumberRectangles)
+	for i := 0; i < int(f.NumberRectangles); i++ {
+		rect := BitmapData{}
+		rect.DestLeft, err = core.ReadUint16LE(r)
+		rect.DestTop, err = core.ReadUint16LE(r)
+		rect.DestRight, err = core.ReadUint16LE(r)
+		rect.DestBottom, err = core.ReadUint16LE(r)
+		rect.Width, err = core.ReadUint16LE(r)
+		rect.Height, err = core.ReadUint16LE(r)
+		rect.BitsPerPixel, err = core.ReadUint16LE(r)
+		rect.Flags, err = core.ReadUint16LE(r)
+		rect.BitmapLength, err = core.ReadUint16LE(r)
+		ln := rect.BitmapLength
+		if rect.Flags&BITMAP_COMPRESSION != 0 && (rect.Flags&NO_BITMAP_COMPRESSION_HDR == 0) {
+			rect.BitmapComprHdr = new(BitmapCompressedDataHeader)
+			rect.BitmapComprHdr.CbCompFirstRowSize, err = core.ReadUint16LE(r)
+			rect.BitmapComprHdr.CbCompMainBodySize, err = core.ReadUint16LE(r)
+			rect.BitmapComprHdr.CbScanWidth, err = core.ReadUint16LE(r)
+			rect.BitmapComprHdr.CbUncompressedSize, err = core.ReadUint16LE(r)
+			ln = rect.BitmapComprHdr.CbCompMainBodySize
+		}
+
+		rect.BitmapDataStream, err = core.ReadBytes(int(ln), r)
+		f.Rectangles = append(f.Rectangles, rect)
+	}
+	return err
+}
+
+func (*FastPathBitmapUpdateDataPDU) FastPathUpdateType() uint8 {
+	return FASTPATH_UPDATETYPE_BITMAP
+}
+
+type FastPathUpdatePDU struct {
+	UpdateHeader     uint8
+	CompressionFlags uint8
+	Size             uint16
+	Data             UpdateData
+}
+
+const (
+	FASTPATH_OUTPUT_COMPRESSION_USED = 0x2
+)
+
+func readFastPathUpdatePDU(r io.Reader) (*FastPathUpdatePDU, error) {
+	f := &FastPathUpdatePDU{}
+	var err error
+	f.UpdateHeader, err = core.ReadUInt8(r)
+	if err != nil {
+		return nil, err
+	}
+	if (f.UpdateHeader>>4)&FASTPATH_OUTPUT_COMPRESSION_USED != 0 {
+		f.CompressionFlags, err = core.ReadUInt8(r)
+	}
+
+	f.Size, err = core.ReadUint16LE(r)
+	if err != nil {
+		return nil, err
+	}
+	if f.Size == 0 {
+		return f, nil
+	}
+	dataBytes, err := core.ReadBytes(int(f.Size), r)
+	if err != nil {
+		glog.Info(err)
+		return nil, err
+	}
+
+	var d UpdateData
+	switch f.UpdateHeader & 0xf {
+	case FASTPATH_UPDATETYPE_BITMAP:
+		d = &FastPathBitmapUpdateDataPDU{}
+
+	default:
+		glog.Debugf("Unknown Fast Path PDU type 0x%x", f.UpdateHeader)
+		return f, errors.New(fmt.Sprintf("Unknown Fast Path PDU type 0x%x", f.UpdateHeader))
+		//d = nil
+	}
+	if d != nil {
+		err = d.Unpack(bytes.NewReader(dataBytes))
+		if err != nil {
+			glog.Error("Unpack:", err)
+			return nil, err
+		}
+	}
+
+	f.Data = d
+	return f, nil
+}
+
+type ShareControlHeader struct {
+	TotalLength uint16 `struc:"little"`
+	PDUType     uint16 `struc:"little"`
+	PDUSource   uint16 `struc:"little"`
+}
+
+type PDU struct {
+	ShareCtrlHeader *ShareControlHeader
+	Message         PDUMessage
+}
+
+func NewPDU(userId uint16, message PDUMessage) *PDU {
+	pdu := &PDU{}
+	pdu.ShareCtrlHeader = &ShareControlHeader{
+		TotalLength: uint16(len(message.Serialize()) + 6),
+		PDUType:     message.Type(),
+		PDUSource:   userId,
+	}
+	pdu.Message = message
+	return pdu
+}
+
+func readPDU(r io.Reader) (*PDU, error) {
+	pdu := &PDU{}
+	var err error
+	header := &ShareControlHeader{}
+	err = struc.Unpack(r, header)
+	if err != nil {
+		return nil, err
+	}
+
+	pdu.ShareCtrlHeader = header
+
+	var d PDUMessage
+	switch pdu.ShareCtrlHeader.PDUType {
+	case PDUTYPE_DEMANDACTIVEPDU:
+		glog.Debug("PDUTYPE_DEMANDACTIVEPDU")
+		d, err = readDemandActivePDU(r)
+	case PDUTYPE_DATAPDU:
+		glog.Debug("PDUTYPE_DATAPDU")
+		d, err = readDataPDU(r)
+	case PDUTYPE_CONFIRMACTIVEPDU:
+		glog.Debug("PDUTYPE_CONFIRMACTIVEPDU")
+		d, err = readConfirmActivePDU(r)
+	case PDUTYPE_DEACTIVATEALLPDU:
+		glog.Debug("PDUTYPE_DEACTIVATEALLPDU")
+		d, err = readDeactiveAllPDU(r)
+	default:
+		glog.Errorf("PDU invalid pdu type: 0x%02x", pdu.ShareCtrlHeader.PDUType)
+	}
+	if err != nil {
+		return nil, err
+	}
+	pdu.Message = d
+	return pdu, err
+}
+
+func (p *PDU) serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, p.ShareCtrlHeader)
+	core.WriteBytes(p.Message.Serialize(), buff)
+	return buff.Bytes()
+}
+
+type SlowPathInputEvent struct {
+	EventTime         uint32 `struc:"little"`
+	MessageType       uint16 `struc:"little"`
+	Size              int    `struc:"skip"`
+	SlowPathInputData []byte `struc:"sizefrom=Size"`
+}
+
+type PointerEvent struct {
+	PointerFlags uint16 `struc:"little"`
+	XPos         uint16 `struc:"little"`
+	YPos         uint16 `struc:"little"`
+}
+
+func (p *PointerEvent) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, p)
+	return buff.Bytes()
+}
+
+type SynchronizeEvent struct {
+	Pad2Octets  uint16 `struc:"little"`
+	ToggleFlags uint32 `struc:"little"`
+}
+
+func (p *SynchronizeEvent) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, p)
+	return buff.Bytes()
+}
+
+type ScancodeKeyEvent struct {
+	KeyboardFlags uint16 `struc:"little"`
+	KeyCode       uint16 `struc:"little"`
+	Pad2Octets    uint16 `struc:"little"`
+}
+
+func (p *ScancodeKeyEvent) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, p)
+	return buff.Bytes()
+}
+
+type UnicodeKeyEvent struct {
+	KeyboardFlags uint16 `struc:"little"`
+	Unicode       uint16 `struc:"little"`
+	Pad2Octets    uint16 `struc:"little"`
+}
+
+func (p *UnicodeKeyEvent) Serialize() []byte {
+	buff := &bytes.Buffer{}
+	struc.Pack(buff, p)
+	return buff.Bytes()
+}
+
+type ClientInputEventPDU struct {
+	NumEvents           uint16               `struc:"little,sizeof=SlowPathInputEvents"`
+	Pad2Octets          uint16               `struc:"little"`
+	SlowPathInputEvents []SlowPathInputEvent `struc:"little"`
+}
+
+func (*ClientInputEventPDU) Type2() uint8 {
+	return PDUTYPE2_INPUT
+}
--- a/pkg/grdp/protocol/pdu/pdu.go
+++ b/pkg/grdp/protocol/pdu/pdu.go
@@ -0,0 +1,370 @@
+package pdu
+
+import (
+	"bytes"
+	"encoding/hex"
+	"errors"
+	"fmt"
+
+	"Yasso/pkg/grdp/core"
+	"Yasso/pkg/grdp/emission"
+	"Yasso/pkg/grdp/glog"
+	"Yasso/pkg/grdp/protocol/t125/gcc"
+)
+
+type PDULayer struct {
+	emission.Emitter
+	transport          core.Transport
+	sharedId           uint32
+	userId             uint16
+	channelId          uint16
+	serverCapabilities map[CapsType]Capability
+	clientCapabilities map[CapsType]Capability
+	fastPathSender     core.FastPathSender
+	demandActivePDU    *DemandActivePDU
+}
+
+func NewPDULayer(t core.Transport) *PDULayer {
+	p := &PDULayer{
+		Emitter:   *emission.NewEmitter(),
+		transport: t,
+		sharedId:  0x103EA,
+		serverCapabilities: map[CapsType]Capability{
+			CAPSTYPE_GENERAL: &GeneralCapability{
+				ProtocolVersion: 0x0200,
+			},
+			CAPSTYPE_BITMAP: &BitmapCapability{
+				Receive1BitPerPixel:      0x0001,
+				Receive4BitsPerPixel:     0x0001,
+				Receive8BitsPerPixel:     0x0001,
+				BitmapCompressionFlag:    0x0001,
+				MultipleRectangleSupport: 0x0001,
+			},
+			CAPSTYPE_ORDER: &OrderCapability{
+				DesktopSaveXGranularity: 1,
+				DesktopSaveYGranularity: 20,
+				MaximumOrderLevel:       1,
+				OrderFlags:              NEGOTIATEORDERSUPPORT,
+				DesktopSaveSize:         480 * 480,
+			},
+			CAPSTYPE_POINTER:        &PointerCapability{ColorPointerCacheSize: 20},
+			CAPSTYPE_INPUT:          &InputCapability{},
+			CAPSTYPE_VIRTUALCHANNEL: &VirtualChannelCapability{},
+			CAPSTYPE_FONT:           &FontCapability{SupportFlags: 0x0001},
+			CAPSTYPE_COLORCACHE:     &ColorCacheCapability{CacheSize: 0x0006},
+			CAPSTYPE_SHARE:          &ShareCapability{},
+		},
+		clientCapabilities: map[CapsType]Capability{
+			CAPSTYPE_GENERAL: &GeneralCapability{
+				ProtocolVersion: 0x0200,
+			},
+			CAPSTYPE_BITMAP: &BitmapCapability{
+				Receive1BitPerPixel:      0x0001,
+				Receive4BitsPerPixel:     0x0001,
+				Receive8BitsPerPixel:     0x0001,
+				BitmapCompressionFlag:    0x0001,
+				MultipleRectangleSupport: 0x0001,
+			},
+			CAPSTYPE_ORDER: &OrderCapability{
+				DesktopSaveXGranularity: 1,
+				DesktopSaveYGranularity: 20,
+				MaximumOrderLevel:       1,
+				OrderFlags:              NEGOTIATEORDERSUPPORT,
+				DesktopSaveSize:         480 * 480,
+			},
+			CAPSTYPE_BITMAPCACHE:           &BitmapCacheCapability{},
+			CAPSTYPE_POINTER:               &PointerCapability{ColorPointerCacheSize: 20},
+			CAPSTYPE_INPUT:                 &InputCapability{},
+			CAPSTYPE_BRUSH:                 &BrushCapability{},
+			CAPSTYPE_GLYPHCACHE:            &GlyphCapability{},
+			CAPSTYPE_OFFSCREENCACHE:        &OffscreenBitmapCacheCapability{},
+			CAPSTYPE_VIRTUALCHANNEL:        &VirtualChannelCapability{},
+			CAPSTYPE_SOUND:                 &SoundCapability{},
+			CAPSETTYPE_MULTIFRAGMENTUPDATE: &MultiFragmentUpdate{},
+			CAPSTYPE_RAIL: &RemoteProgramsCapability{
+				RailSupportLevel: RAIL_LEVEL_SUPPORTED |
+					RAIL_LEVEL_SHELL_INTEGRATION_SUPPORTED |
+					RAIL_LEVEL_LANGUAGE_IME_SYNC_SUPPORTED |
+					RAIL_LEVEL_SERVER_TO_CLIENT_IME_SYNC_SUPPORTED |
+					RAIL_LEVEL_HIDE_MINIMIZED_APPS_SUPPORTED |
+					RAIL_LEVEL_WINDOW_CLOAKING_SUPPORTED |
+					RAIL_LEVEL_HANDSHAKE_EX_SUPPORTED |
+					RAIL_LEVEL_DOCKED_LANGBAR_SUPPORTED,
+			},
+		},
+	}
+
+	t.On("close", func() {
+		p.Emit("close")
+	}).On("error", func(err error) {
+		p.Emit("error", err)
+	})
+	return p
+}
+
+func (p *PDULayer) sendPDU(message PDUMessage) {
+	pdu := NewPDU(p.userId, message)
+	p.transport.Write(pdu.serialize())
+}
+
+func (p *PDULayer) sendDataPDU(message DataPDUData) {
+	dataPdu := NewDataPDU(message, p.sharedId)
+	p.sendPDU(dataPdu)
+}
+
+func (p *PDULayer) SetFastPathSender(f core.FastPathSender) {
+	p.fastPathSender = f
+}
+
+type Client struct {
+	*PDULayer
+	clientCoreData *gcc.ClientCoreData
+	remoteAppMode  bool
+	enableCliprdr  bool
+}
+
+func NewClient(t core.Transport) *Client {
+	c := &Client{
+		PDULayer: NewPDULayer(t),
+	}
+	c.transport.Once("connect", c.connect)
+	return c
+}
+
+func (c *Client) connect(data *gcc.ClientCoreData, userId uint16, channelId uint16) {
+	glog.Debug("pdu connect:", userId, ",", channelId)
+	c.clientCoreData = data
+	c.userId = userId
+	c.channelId = channelId
+	c.transport.Once("data", c.recvDemandActivePDU)
+}
+
+func (c *Client) recvDemandActivePDU(s []byte) {
+	defer func() {
+		if e := recover(); e != nil {
+			err := errors.New(fmt.Sprint("recv demand active pdu error: ", e))
+			glog.Debug(err, e)
+			return
+		}
+	}()
+
+	glog.Debug("PDU recvDemandActivePDU", hex.EncodeToString(s))
+	r := bytes.NewReader(s)
+	pdu, err := readPDU(r)
+	if err != nil {
+		glog.Error(err)
+		return
+	}
+	if pdu.ShareCtrlHeader.PDUType != PDUTYPE_DEMANDACTIVEPDU {
+		glog.Info("PDU ignore message during connection sequence, type is", pdu.ShareCtrlHeader.PDUType)
+		c.transport.Once("data", c.recvDemandActivePDU)
+		return
+	}
+	c.sharedId = pdu.Message.(*DemandActivePDU).SharedId
+	c.demandActivePDU = pdu.Message.(*DemandActivePDU)
+	for _, caps := range pdu.Message.(*DemandActivePDU).CapabilitySets {
+		c.serverCapabilities[caps.Type()] = caps
+	}
+
+	c.sendConfirmActivePDU()
+	c.sendClientFinalizeSynchronizePDU()
+	c.transport.Once("data", c.recvServerSynchronizePDU)
+}
+
+func (c *Client) sendConfirmActivePDU() {
+	glog.Debug("PDU start sendConfirmActivePDU")
+
+	pdu := NewConfirmActivePDU()
+
+	generalCapa := c.clientCapabilities[CAPSTYPE_GENERAL].(*GeneralCapability)
+	generalCapa.OSMajorType = OSMAJORTYPE_WINDOWS
+	generalCapa.OSMinorType = OSMINORTYPE_WINDOWS_NT
+	generalCapa.ExtraFlags = LONG_CREDENTIALS_SUPPORTED | NO_BITMAP_COMPRESSION_HDR | ENC_SALTED_CHECKSUM
+	//if not self._fastPathSender is None:
+	generalCapa.ExtraFlags |= FASTPATH_OUTPUT_SUPPORTED
+
+	bitmapCapa := c.clientCapabilities[CAPSTYPE_BITMAP].(*BitmapCapability)
+	bitmapCapa.PreferredBitsPerPixel = c.clientCoreData.HighColorDepth
+	bitmapCapa.DesktopWidth = c.clientCoreData.DesktopWidth
+	bitmapCapa.DesktopHeight = c.clientCoreData.DesktopHeight
+
+	orderCapa := c.clientCapabilities[CAPSTYPE_ORDER].(*OrderCapability)
+	orderCapa.OrderFlags |= ZEROBOUNDSDELTASSUPPORT
+
+	inputCapa := c.clientCapabilities[CAPSTYPE_INPUT].(*InputCapability)
+	inputCapa.Flags = INPUT_FLAG_SCANCODES | INPUT_FLAG_MOUSEX | INPUT_FLAG_UNICODE
+	inputCapa.KeyboardLayout = c.clientCoreData.KbdLayout
+	inputCapa.KeyboardType = c.clientCoreData.KeyboardType
+	inputCapa.KeyboardSubType = c.clientCoreData.KeyboardSubType
+	inputCapa.KeyboardFunctionKey = c.clientCoreData.KeyboardFnKeys
+	inputCapa.ImeFileName = c.clientCoreData.ImeFileName
+
+	pdu.SharedId = c.sharedId
+	pdu.NumberCapabilities = c.demandActivePDU.NumberCapabilities
+	for _, v := range c.clientCapabilities {
+		glog.Debugf("clientCapabilities: 0x%04x", v.Type())
+		pdu.CapabilitySets = append(pdu.CapabilitySets, v)
+	}
+	if c.remoteAppMode {
+		pdu.CapabilitySets = append(pdu.CapabilitySets, c.serverCapabilities[CAPSTYPE_RAIL])
+		pdu.CapabilitySets = append(pdu.CapabilitySets, c.serverCapabilities[CAPSTYPE_WINDOW])
+	}
+	pdu.LengthSourceDescriptor = c.demandActivePDU.LengthSourceDescriptor
+	pdu.SourceDescriptor = c.demandActivePDU.SourceDescriptor
+	pdu.LengthCombinedCapabilities = c.demandActivePDU.LengthCombinedCapabilities
+
+	c.sendPDU(pdu)
+}
+
+func (c *Client) sendClientFinalizeSynchronizePDU() {
+	glog.Debug("PDU start sendClientFinalizeSynchronizePDU")
+	c.sendDataPDU(NewSynchronizeDataPDU(c.channelId))
+	c.sendDataPDU(&ControlDataPDU{Action: CTRLACTION_COOPERATE})
+	c.sendDataPDU(&ControlDataPDU{Action: CTRLACTION_REQUEST_CONTROL})
+	//c.sendDataPDU(&PersistKeyPDU{BBitMask: 0x03})
+	c.sendDataPDU(&FontListDataPDU{ListFlags: 0x0003, EntrySize: 0x0032})
+}
+
+func (c *Client) recvServerSynchronizePDU(s []byte) {
+	glog.Debug("PDU recvServerSynchronizePDU")
+	r := bytes.NewReader(s)
+	pdu, err := readPDU(r)
+	if err != nil {
+		glog.Error(err)
+		return
+	}
+	dataPdu, ok := pdu.Message.(*DataPDU)
+	if !ok || dataPdu.Header.PDUType2 != PDUTYPE2_SYNCHRONIZE {
+		if ok {
+			glog.Error("recvServerSynchronizePDU ignore datapdu type2", dataPdu.Header.PDUType2)
+		} else {
+			glog.Error("recvServerSynchronizePDU ignore message type", pdu.ShareCtrlHeader.PDUType)
+		}
+		glog.Infof("%+v", dataPdu)
+		c.transport.Once("data", c.recvServerSynchronizePDU)
+		return
+	}
+	c.transport.Once("data", c.recvServerControlCooperatePDU)
+}
+
+func (c *Client) recvServerControlCooperatePDU(s []byte) {
+	glog.Debug("PDU recvServerControlCooperatePDU")
+	r := bytes.NewReader(s)
+	pdu, err := readPDU(r)
+	if err != nil {
+		glog.Error(err)
+		return
+	}
+	dataPdu, ok := pdu.Message.(*DataPDU)
+	if !ok || dataPdu.Header.PDUType2 != PDUTYPE2_CONTROL {
+		if ok {
+			glog.Error("recvServerControlCooperatePDU ignore datapdu type2", dataPdu.Header.PDUType2)
+		} else {
+			glog.Error("recvServerControlCooperatePDU ignore message type", pdu.ShareCtrlHeader.PDUType)
+		}
+		c.transport.Once("data", c.recvServerControlCooperatePDU)
+		return
+	}
+	if dataPdu.Data.(*ControlDataPDU).Action != CTRLACTION_COOPERATE {
+		glog.Error("recvServerControlCooperatePDU ignore action", dataPdu.Data.(*ControlDataPDU).Action)
+		c.transport.Once("data", c.recvServerControlCooperatePDU)
+		return
+	}
+	c.transport.Once("data", c.recvServerControlGrantedPDU)
+}
+
+func (c *Client) recvServerControlGrantedPDU(s []byte) {
+	glog.Debug("PDU recvServerControlGrantedPDU")
+	r := bytes.NewReader(s)
+	pdu, err := readPDU(r)
+	if err != nil {
+		glog.Error(err)
+		return
+	}
+	dataPdu, ok := pdu.Message.(*DataPDU)
+	if !ok || dataPdu.Header.PDUType2 != PDUTYPE2_CONTROL {
+		if ok {
+			glog.Error("recvServerControlGrantedPDU ignore datapdu type2", dataPdu.Header.PDUType2)
+		} else {
+			glog.Error("recvServerControlGrantedPDU ignore message type", pdu.ShareCtrlHeader.PDUType)
+		}
+		c.transport.Once("data", c.recvServerControlGrantedPDU)
+		return
+	}
+	if dataPdu.Data.(*ControlDataPDU).Action != CTRLACTION_GRANTED_CONTROL {
+		glog.Error("recvServerControlGrantedPDU ignore action", dataPdu.Data.(*ControlDataPDU).Action)
+		c.transport.Once("data", c.recvServerControlGrantedPDU)
+		return
+	}
+	c.transport.Once("data", c.recvServerFontMapPDU)
+}
+
+func (c *Client) recvServerFontMapPDU(s []byte) {
+	glog.Debug("PDU recvServerFontMapPDU")
+	r := bytes.NewReader(s)
+	pdu, err := readPDU(r)
+	if err != nil {
+		glog.Error(err)
+		return
+	}
+	dataPdu, ok := pdu.Message.(*DataPDU)
+	if !ok || dataPdu.Header.PDUType2 != PDUTYPE2_FONTMAP {
+		if ok {
+			glog.Error("recvServerFontMapPDU ignore datapdu type2", dataPdu.Header.PDUType2)
+		} else {
+			glog.Error("recvServerFontMapPDU ignore message type", pdu.ShareCtrlHeader.PDUType)
+		}
+		return
+	}
+	c.transport.On("data", c.recvPDU)
+	c.Emit("ready")
+}
+
+func (c *Client) recvPDU(s []byte) {
+	glog.Debug("PDU recvPDU", hex.EncodeToString(s))
+	r := bytes.NewReader(s)
+	if r.Len() > 0 {
+		p, err := readPDU(r)
+		if err != nil {
+			glog.Error(err)
+			return
+		}
+		if p.ShareCtrlHeader.PDUType == PDUTYPE_DEACTIVATEALLPDU {
+			c.transport.On("data", c.recvDemandActivePDU)
+		}
+	}
+}
+
+func (c *Client) RecvFastPath(secFlag byte, s []byte) {
+	//glog.Debug("PDU RecvFastPath", hex.EncodeToString(s))
+	glog.Debug("PDU RecvFastPath", secFlag&0x2 != 0)
+	r := bytes.NewReader(s)
+	for r.Len() > 0 {
+		p, err := readFastPathUpdatePDU(r)
+		if err != nil {
+			glog.Debug("readFastPathUpdatePDU:", err)
+			//continue
+			return
+		}
+		if p.UpdateHeader == FASTPATH_UPDATETYPE_BITMAP {
+			c.Emit("update", p.Data.(*FastPathBitmapUpdateDataPDU).Rectangles)
+		}
+	}
+}
+
+type InputEventsInterface interface {
+	Serialize() []byte
+}
+
+func (c *Client) SendInputEvents(msgType uint16, events []InputEventsInterface) {
+	pdu := &ClientInputEventPDU{}
+	pdu.NumEvents = uint16(len(events))
+	pdu.SlowPathInputEvents = make([]SlowPathInputEvent, 0, pdu.NumEvents)
+	for _, in := range events {
+		seria := in.Serialize()
+		s := SlowPathInputEvent{0, msgType, len(seria), seria}
+		pdu.SlowPathInputEvents = append(pdu.SlowPathInputEvents, s)
+	}
+
+	c.sendDataPDU(pdu)
+}