public StackPacket DecodeSlowPathInputEventPDU(
byte[] data,
byte[] decryptedUserData,
SecurityHeaderType type)
{
TS_INPUT_PDU pdu = new TS_INPUT_PDU();
// data index
int dataIndex = 0;
// SlowPathOutputPDU: commonHeader
pdu.commonHeader = ParseMcsCommonHeader(data, ref dataIndex, type);
// user data index
int userDataIndex = 0;
// SlowPathOutputPDU: slowPathUpdates
pdu.shareDataHeader = ParseTsShareDataHeader(decryptedUserData, ref userDataIndex);
pdu.numberEvents = ParseUInt16(decryptedUserData, ref userDataIndex, false);
pdu.pad2Octets = ParseUInt16(decryptedUserData, ref userDataIndex, false);
pdu.slowPathInputEvents = new Collection<TS_INPUT_EVENT>();
// ETW Provider Dump Message
if (pdu.commonHeader.securityHeader != null)
{
// RDP Standard Security
string messageName = "RDPBCGR:" + pdu.GetType().Name;
ExtendedLogger.DumpMessage(messageName, RdpbcgrUtility.DumpLevel_Layer3, pdu.GetType().Name, decryptedUserData);
}
while (userDataIndex < decryptedUserData.Length)
{
pdu.slowPathInputEvents.Add(ParseSlowPathInputEvent(decryptedUserData, ref userDataIndex));
}
// Check if data length exceeded expectation
VerifyDataLength(decryptedUserData.Length, userDataIndex, ConstValue.ERROR_MESSAGE_DATA_LENGTH_EXCEEDED);
return pdu;
}