From 1cd5c4b7f3d2ccddc8facb43070b2f24f1cdc406 Mon Sep 17 00:00:00 2001 From: Vladyslav Nikonov Date: Fri, 8 Nov 2024 02:29:08 +0200 Subject: [PATCH] docs(now-proto): add missing NOW-PROTO docs (#575) --- .gitignore | 2 +- docs/NOW-spec.md | 1604 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1605 insertions(+), 1 deletion(-) create mode 100644 docs/NOW-spec.md diff --git a/.gitignore b/.gitignore index 3c76a5e1..5156a02b 100644 --- a/.gitignore +++ b/.gitignore @@ -8,7 +8,7 @@ *.log # Coverage -/docs +/docs/coverage # Editor/IDE files *~ diff --git a/docs/NOW-spec.md b/docs/NOW-spec.md new file mode 100644 index 00000000..9353b10a --- /dev/null +++ b/docs/NOW-spec.md @@ -0,0 +1,1604 @@ + +# NOW-PROTO + + + + +[[_TOC_]] + + +# Messages + +## Transport + +The NOW virtual channel protocol use an RDP dynamic virtual channel ("Devolutions::Now::Agent") as a transport type. + +## Message Syntax + +The following sections specify the NOW protocol message syntax. Unless otherwise specified, all fields defined in this document use the little-endian format. + +### Common Structures + +#### NOW_INTEGER + +Signed and unsigned integer encoding structures of various sizes. + +##### NOW_VARU16 + +The NOW_VARU16 structure is used to encode unsigned integer values in the range [0, 0x7FFF]. + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
cval1val2 (optional)
+ +**c (1 bit)**: A 1-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | + +**val1 (7 bits)**: A 7-bit integer containing the 7 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: A 8-bit integer containing the least significant bits of the integer value represented by this structure. + +##### NOW_VARI16 + +The NOW_VARI16 structure is used to encode signed integer values in the range [-0x3FFF, 0x3FFF]. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
csval1val2 (optional)
+ +**c (1 bit)**: A 1-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | + +**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value. + +| Value | Meaning | +|-------|---------| +| 0 | Positive value | +| 1 | Negative value | + +**val1 (6 bits)**: A 6-bit integer containing the 6 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: A 8-bit integer containing the least significant bits of the integer value represented by this structure. + +##### NOW_VARU32 + +The NOW_VARU32 structure is used to encode signed integer values in the range [0, 0x3FFFFFFF]. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
cval1val2 (optional)val3 (optional)val4 (optional)
+ +**c (2 bits)**: A 2-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | +| 2 | The val1, val2, val3 fields are present (3 bytes) | +| 3 | The val1, val2, val3, val4 fields are present (4 bytes) | + +**val1 (6 bits)**: A 6-bit integer containing the 6 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure. + +**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure. + +**val4 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure. + +##### NOW_VARI32 + +The NOW_VARI32 structure is used to encode signed integer values in the range [-0x1FFFFFFF, 0x1FFFFFFF]. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
csval1val2 (optional)val3 (optional)val4 (optional)
+ +**c (2 bits)**: A 2-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | +| 2 | The val1, val2, val3 fields are present (3 bytes) | +| 3 | The val1, val2, val3, val4 fields are present (4 bytes) | + +**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value. + +| Value | Meaning | +|-------|---------| +| 0 | Positive value | +| 1 | Negative value | + +**val1 (5 bits)**: A 5-bit integer containing the 6 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure. + +**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure. + +**val4 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure. + +##### NOW_VARU64 + +The NOW_VARU64 structure is used to encode signed integer values in the range [0, 0x3FFFFFFF]. + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
cval1val2 (optional)val3 (optional)val4 (optional)
val5 (optional)val6 (optional)val7 (optional)val8 (optional)
+ +**c (3 bits)**: A 3-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | +| 2 | The val1, val2, val3 fields are present (3 bytes) | +| 3 | The val1, val2, val3, val4 fields are present (4 bytes) | +| 4 | The val1, val2, val3, val4, val5 fields are present (5 bytes) | +| 5 | The val1, val2, val3, val4, val5, val6 fields are present (6 bytes) | +| 6 | The val1, val2, val3, val4, val5, val6, val7 fields are present (7 bytes) | +| 7 | The val1, val2, val3, val4, val5, val6, val7, val8 fields are present (8 bytes) | + +**val1 (5 bits)**: A 5-bit integer containing the 6 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure. + +**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure. + +**val4 (1 byte)**: An 8-bit integer containing the fourth significant bits of the integer value represented by this structure. + +**val5 (1 byte)**: An 8-bit integer containing the fifth significant bits of the integer value represented by this structure. + +**val6 (1 byte)**: An 8-bit integer containing the sixth significant bits of the integer value represented by this structure. + +**val7 (1 byte)**: An 8-bit integer containing the seventh significant bits of the integer value represented by this structure. + +**val8 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure. + +##### NOW_VARI64 + +The NOW_VARI64 structure is used to encode signed integer values in the range [-0x1FFFFFFF, 0x1FFFFFFF]. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
csval1val2 (optional)val3 (optional)val4 (optional)
+ +**c (3 bits)**: A 3-bit integer containing an encoded representation of the number of bytes in this structure. + +| Value | Meaning | +|-------|---------| +| 0 | The val1 field is present (1 byte) | +| 1 | The val1, val2 fields are present (2 bytes) | +| 2 | The val1, val2, val3 fields are present (3 bytes) | +| 3 | The val1, val2, val3, val4 fields are present (4 bytes) | +| 4 | The val1, val2, val3, val4, val5 fields are present (5 bytes) | +| 5 | The val1, val2, val3, val4, val5, val6 fields are present (6 bytes) | +| 6 | The val1, val2, val3, val4, val5, val6, val7 fields are present (7 bytes) | +| 7 | The val1, val2, val3, val4, val5, val6, val7, val8 fields are present (8 bytes) | + +**s (1 bit)**: A 1-bit integer containing the encoded sign representation of the integer value. + +| Value | Meaning | +|-------|---------| +| 0 | Positive value | +| 1 | Negative value | + +**val1 (4 bits)**: A 4-bit integer containing the 6 most significant bits of the integer value represented by this structure. + +**val2 (1 byte)**: An 8-bit integer containing the second most significant bits of the integer value represented by this structure. + +**val3 (1 byte)**: An 8-bit integer containing the third most significant bits of the integer value represented by this structure. + +**val4 (1 byte)**: An 8-bit integer containing the fourth significant bits of the integer value represented by this structure. + +**val5 (1 byte)**: An 8-bit integer containing the fifth significant bits of the integer value represented by this structure. + +**val6 (1 byte)**: An 8-bit integer containing the sixth significant bits of the integer value represented by this structure. + +**val7 (1 byte)**: An 8-bit integer containing the seventh significant bits of the integer value represented by this structure. + +**val8 (1 byte)**: An 8-bit integer containing the least significant bits of the integer value represented by this structure. + +#### NOW_STRING + +##### NOW_VARSTR + +The NOW_VARSTR structure is used to represent variable-length strings that could be large, while remaining compact in size for small strings. + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
len (variable)
str (variable)
+ +**len (variable)**: A NOW_VARU32 structure containing the string length, excluding the null terminator. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_LRGSTR + +The NOW_LRGSTR structure is used to represent large variable-length strings. + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
len
str (variable)
+ +**len (4 bytes)**: A 32-bit unsigned integer containing the string length, excluding the null terminator. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_STRING16 + +The NOW_STRING16 structure is used to represent variable-length strings of up to 15 characters that can easily fit within a fixed-size buffer of 16 bytes. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
lenstr (variable)
...
+ +**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 15. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_STRING32 + +The NOW_STRING32 structure is used to represent variable-length strings of up to 15 characters that can easily fit within a fixed-size buffer of 32 bytes. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
lenstr (variable)
...
+ +**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 31. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_STRING64 + +The NOW_STRING64 structure is used to represent variable-length strings of up to 63 characters that can easily fit within a fixed-size buffer of 64 bytes. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
lenstr (variable)
...
+ +**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 63. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_STRING128 + +The NOW_STRING128 structure is used to represent variable-length strings of up to 127 characters that can easily fit within a fixed-size buffer of 128 bytes. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
lenstr (variable)
...
+ +**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 127. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +##### NOW_STRING256 + +The NOW_STRING256 structure is used to represent variable-length strings of up to 255 characters that can easily fit within a fixed-size buffer of 256 bytes. + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
lenstr (variable)
...
+ +**len (1 byte)**: An unsigned 8-bit number containing the string length, excluding the null terminator. The maximum value is 255. + +**str (variable)**: The UTF-8 encoded string excluding the null terminator. + +#### NOW_BUFFER + +##### NOW_VARBUF + +The NOW_VARBUF structure is used to represent variable-length buffers. + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
size (variable)
data (variable)
+ +**size (variable)**: A NOW_VARU32 structure containing the buffer size. + +**data (variable)**: The buffer data, whose size is given by the size field. + +##### NOW_LRGBUF + +The NOW_LRGBUF structure is used to represent variable-length buffers. + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
size
data (variable)
+ +**size (4 bytes)**: A 32-bit unsigned integer containing the buffer size. + +**data (variable)**: The buffer data, whose size is given by the size field. + +#### NOW_HEADER + +The NOW_HEADER structure is the header common to all NOW protocol messages. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class. + +| Flag | Meaning | +|---------------------------------|----------------------| +| NOW_SYSTEM_MSG_CLASS_ID
0x11 | System message class | +| NOW_SESSION_MSG_CLASS_ID
0x12 | Session message class | +| NOW_EXEC_MSG_CLASS_ID
0x13 | Exec message class | + +**msgType (1 byte)**: The message type, specific to the message class. + +**msgFlags (2 bytes)**: The message flags, specific to the message type and class. + +#### NOW_STATUS +A status code, with a structure similar to HRESULT. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
SYZclasstypecode
+ +**S (2 bits)**: Severity level. + +| Value | Meaning | +|-------|---------| +| NOW_SEVERITY_INFO
0 | Informative status | +| NOW_SEVERITY_WARN
1 | Warning status | +| NOW_SEVERITY_ERROR
2 | Error status (recoverable) | +| NOW_SEVERITY_FATAL
3 | Error status (non-recoverable) | + +**Y (1 bit)**: Reserved. MUST be set to zero. + +**Z (1 bit)**: Reserved. MUST be set to zero. + +**class (4 bits)**: Reserved. MUST be set to zero. + +**type (8 bits)**: The status type. + +**code (16 bits)**: The status code. + +| Value | Meaning | +|-------|---------| +| NOW_CODE_SUCCESS
0x0000 | Success | +| NOW_CODE_FAILURE
0xFFFF | Failure | +| NOW_CODE_FILE_NOT_FOUND
0x0002 | File not found. | +| NOW_CODE_ACCESS_DENIED
0x0005 | File not found. | +| NOW_CODE_BAD_FORMAT
0x000B | The program has an incorrect or bad format. | + +### System Messages + +#### NOW_SYSTEM_MSG + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SYSTEM_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type. + +| Value | Meaning | +|---------------------------------|----------------------| +| NOW_SYSTEM_INFO_REQ_ID
0x01 | NOW_SYSTEM_INFO_REQ_MSG | +| NOW_SYSTEM_INFO_RSP_ID
0x02 | NOW_SYSTEM_INFO_RSP_MSG | +| NOW_SYSTEM_SHUTDOWN_ID
0x03 | NOW_SYSTEM_SHUTDOWN_MSG | + + + +#### NOW_SYSTEM_SHUTDOWN_MSG + +The NOW_SYSTEM_SHUTDOWN_MSG structure is used to request a system shutdown.NOW_SESSION_LOGOFF_MSG + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
timeout
message
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SYSTEM_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_SYSTEM_SHUTDOWN_MSG_ID) + +**msgFlags (2 bytes)**: The message flags. + +| Flag | Meaning | +|------|---------| +| NOW_SHUTDOWN_FLAG_FORCE
0x0001 | Force shutdown | +| NOW_SHUTDOWN_FLAG_REBOOT
0x0002 | Reboot after shutdown | + +**timeout (4 bytes)**: This system shutdown timeout, in seconds. + +**message (variable)**: A NOW_STRING structure containing an optional shutdown message. + +### Session Messages + +#### NOW_SESSION_MSG + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SESSION_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type. + +| Value | Meaning | +|---------------------------------|----------------------| +| NOW_SESSION_LOCK_MSG_ID
0x01 | NOW_SESSION_LOCK_MSG | +| NOW_SESSION_LOGOFF_MSG_ID
0x02 | NOW_SESSION_LOGOFF_MSG | +| NOW_SESSION_MESSAGE_BOX_MSG_REQ_ID
0x03 | NOW_SESSION_MESSAGE_BOX_MSG | +| NOW_SESSION_MESSAGE_BOX_RSP_MSG_ID
0x04 | NOW_SESSION_MESSAGE_RSP_MSG | + +**msgFlags (2 bytes)**: The message flags. + +#### NOW_SESSION_LOCK_MSG + +The NOW_SESSION_LOCK_MSG is used to request locking the user session. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SESSION_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_SESSION_LOCK_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +#### NOW_SESSION_LOGOFF_MSG + +The NOW_SESSION_LOGOFF_MSG is used to request a user session logoff. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SESSION_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_SESSION_LOGOFF_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +#### NOW_SESSION_MSGBOX_REQ_MSG + +The NOW_SESSION_MSGBOX_REQ_MSG is used to show a message box in the user session, similar to what the [WTSSendMessage function](https://learn.microsoft.com/en-us/windows/win32/api/wtsapi32/nf-wtsapi32-wtssendmessagew) does. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
requestId
style
timeout
title (variable)
text (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SESSION_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_SESSION_MESSAGE_BOX_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +| Flag | Meaning | +|-------------------------------------|-----------------------------------------| +| NOW_MSGBOX_FLAG_TITLE
0x00000001 | The title field contains a non-default value | +| NOW_MSGBOX_FLAG_STYLE
0x00000002 | The style field contains a non-default value | +| NOW_MSGBOX_FLAG_TIMEOUT
0x00000004 | The timeout field contains a non-default value | +| NOW_MSGBOX_FLAG_RESPONSE
0x00000008 | A response message is expected (don't fire and forget) | + +**requestId (4 bytes)**: the message request id, sent back in the response. + +**style (4 bytes)**: The message box style, ignored if NOW_MSGBOX_FLAG_STYLE is not set. MBOK is the default, refer to the [MessageBox function](https://learn.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-messagebox) for all possible styles. This field may be ignored on platforms other than Windows. + +**timeout (4 bytes)**: The timeout, in seconds, that the message box dialog should wait for the user response. This value is NOW_MSGBOX_FLAG_TIMEOUT is not set. + +**title (variable)**: The message box title, ignored if NOW_MSGBOX_FLAG_TITLE is not set. + +**text (variable)**: The message box text. + +#### NOW_SESSION_MSGBOX_RSP_MSG + +The NOW_SESSION_MSGBOX_RSP_MSG is a message sent in response to NOW_SESSION_MSGBOX_REQ_MSG if the NOW_MSGBOX_FLAG_RESPONSE has been set, and contains the result from the message box dialog. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
requestId
response
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_SESSION_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_SESSION_MESSAGE_RSP_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**requestId (4 bytes)**: The corresponding message box request id. + +**response (4 bytes)**: The message box response. + +| Value | Meaning | +|--------------|---------| +| IDABORT
3 | Abort | +| IDCANCEL
2 | Cancel | +| IDCONTINUE
11 | Continue | +| IDIGNORE
5 | Ignore | +| IDNO
7 | No | +| IDOK
1 | OK | +| IDRETRY
4 | Retry | +| IDTRYAGAIN
10 | Try Again | +| IDYES
6 | Yes | +| IDTIMEOUT
32000 | Timeout | + +### Execution Messages + +#### NOW_EXEC_MSG + +The NOW_EXEC_MSG message is used to execute remote commands or scripts. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type. + +| Value | Meaning | +|-------|---------| +| NOW_EXEC_CAPSET_MSG_ID
0x00 | NOW_EXEC_CAPSET_MSG | +| NOW_EXEC_ABORT_MSG_ID
0x01 | NOW_EXEC_ABORT_MSG | +| NOW_EXEC_CANCEL_REQ_MSG_ID
0x02 | NOW_EXEC_CANCEL_REQ_MSG | +| NOW_EXEC_CANCEL_RSP_MSG_ID
0x03 | NOW_EXEC_CANCEL_RSP_MSG | +| NOW_EXEC_RESULT_MSG_ID
0x04 | NOW_EXEC_RESULT_MSG | +| NOW_EXEC_DATA_MSG_ID
0x05 | NOW_EXEC_DATA_MSG | +| NOW_EXEC_RUN_MSG_ID
0x10 | NOW_EXEC_RUN_MSG | +| NOW_EXEC_CMD_MSG_ID
0x11 | NOW_EXEC_CMD_MSG | +| NOW_EXEC_PROCESS_MSG_ID
0x12 | NOW_EXEC_PROCESS_MSG | +| NOW_EXEC_SHELL_MSG_ID
0x13 | NOW_EXEC_SHELL_MSG | +| NOW_EXEC_BATCH_MSG_ID
0x14 | NOW_EXEC_BATCH_MSG | +| NOW_EXEC_WINPS_MSG_ID
0x15 | NOW_EXEC_WINPS_MSG | +| NOW_EXEC_PWSH_MSG_ID
0x16 | NOW_EXEC_PWSH_MSG | + +**msgFlags (2 bytes)**: The message flags. + +#### NOW_EXEC_CAPSET_MSG + +The NOW_EXEC_CAPSET_MSG message is sent to advertise capabilities. + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_CAPSET_MSG_ID). + +**msgFlags (2 bytes)**: A 16-bit unsigned integer containing the supported execution styles. + +| Flag | Meaning | +|-------|---------| +| NOW_EXEC_STYLE_RUN
0x0001 | Generic "Run" execution style. | +| NOW_EXEC_STYLE_CMD
0x0002 | Generic command execution style. | +| NOW_EXEC_STYLE_PROCESS
0x0004 | CreateProcess() execution style. | +| NOW_EXEC_STYLE_SHELL
0x0008 | System shell (.sh) execution style. | +| NOW_EXEC_STYLE_BATCH
0x0010 | Windows batch file (.bat) execution style. | +| NOW_EXEC_STYLE_WINPS
0x0020 | Windows PowerShell (.ps1) execution style. | +| NOW_EXEC_STYLE_PWSH
0x0040 | PowerShell 7 (.ps1) execution style. | +| NOW_EXEC_STYLE_APPLESCRIPT
0x0080 | Applescript (.scpt) execution style. | + + + +#### NOW_EXEC_ABORT_MSG + +The NOW_EXEC_ABORT_MSG message is used to abort a remote execution immediately due to an unrecoverable error. This message can be sent at any time without an explicit response message. The session is considered aborted as soon as this message is sent. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
status
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_ABORT_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**status (4 bytes)**: A NOW_STATUS error code. + +#### NOW_EXEC_CANCEL_REQ_MSG + +The NOW_EXEC_CANCEL_REQ_MSG message is used to cancel a remote execution session. + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_REQ_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +#### NOW_EXEC_CANCEL_RSP_MSG + +The NOW_EXEC_CANCEL_RSP_MSG message is used to respond to a remote execution cancel request. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
status
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_CANCEL_RSP_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**status (4 bytes)**: A NOW_STATUS error code. + +#### NOW_EXEC_RESULT_MSG + +The NOW_EXEC_RESULT_MSG message is used to return the result of an execution request. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
status
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_RESULT_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**status (4 bytes)**: A NOW_STATUS error code. + +#### NOW_EXEC_DATA_MSG + +The NOW_EXEC_DATA_MSG message is used to send input/output data as part of a remote execution. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
data (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_DATA_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +| Flag | Meaning | +|----------------------------------------|---------------------------------| +| NOW_EXEC_FLAG_DATA_FIRST
0x00000001 | This is the first data message. | +| NOW_EXEC_FLAG_DATA_LAST
0x00000002 | This is the last data message, the command completed execution. | +| NOW_EXEC_FLAG_DATA_STDIN
0x00000004 | The data is from the standard input. | +| NOW_EXEC_FLAG_DATA_STDOUT
0x00000008 | The data is from the standard output. | +| NOW_EXEC_FLAG_DATA_STDERR
0x00000010 | The data is from the standard error. | + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**data (variable)**: The input/output data represented as `NOW_VARBUF` + +#### NOW_EXEC_RUN_MSG + +The NOW_EXEC_RUN_MSG message is used to send a run request. This request type maps to starting a program by using the “Run” menu on operating systems (the Start Menu on Windows, the Dock on macOS etc.). The execution of programs started with NOW_EXEC_RUN_MSG is not followed and does not send back the output. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
command (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_RUN_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**command (variable)**: A NOW_VARSTR structure containing the command to execute. + +#### NOW_EXEC_CMD_MSG + + +#### NOW_EXEC_PROCESS_MSG + +The NOW_EXEC_PROCESS_MSG message is used to send a Windows [CreateProcess()](https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessw) request. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
filename (variable)
parameters (variable)
directory (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_PROCESS_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**filename (variable)**: A NOW_VARSTR structure containing the file name. Corresponds to the lpApplicationName parameter. + +**parameters (variable)**: A NOW_VARSTR structure containing the command parameters. Corresponds to the lpCommandLine parameter. + +**directory (variable)**: A NOW_VARSTR structure containing the command working directory. Corresponds to the lpCurrentDirectory parameter. + +#### NOW_EXEC_SHELL_MSG + +The NOW_EXEC_SHELL_MSG message is used to execute a remote shell command. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
command (variable)
shell (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_SHELL_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**command (variable)**: A NOW_VARSTR structure containing the command to execute. + +**shell (variable)**: A NOW_VARSTR structure containing the shell to use for execution. If no shell is specified, the default system shell (/bin/sh) will be used. + +#### NOW_EXEC_BATCH_MSG + +The NOW_EXEC_BATCH_MSG message is used to execute a remote batch command. + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
command (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_BATCH_MSG_ID). + +**msgFlags (2 bytes)**: The message flags. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**command (variable)**: A NOW_VARSTR structure containing the command to execute. + +#### NOW_EXEC_WINPS_MSG + +The NOW_EXEC_WINPS_MSG message is used to execute a remote Windows PowerShell (powershell.exe) command. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
command (variable)
executionPolicy (variable)
configurationName (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_WINPS_MSG_ID). + +**msgFlags (2 bytes)**: The message flags, specifying the PowerShell command-line arguments. + +| Flag | Meaning | +|----------------------------------------|---------------------------| +| NOW_EXEC_FLAG_PS_NO_LOGO
0x00000001 | PowerShell -NoLogo option | +| NOW_EXEC_FLAG_PS_NO_EXIT
0x00000002 | PowerShell -NoExit option | +| NOW_EXEC_FLAG_PS_STA
0x00000004 | PowerShell -Sta option | +| NOW_EXEC_FLAG_PS_MTA
0x00000008 | PowerShell -Mta option | +| NOW_EXEC_FLAG_PS_NO_PROFILE
0x00000010 | PowerShell -NoProfile option | +| NOW_EXEC_FLAG_PS_NON_INTERACTIVE
0x00000020 | PowerShell -NonInteractive option | +| NOW_EXEC_FLAG_PS_EXECUTION_POLICY
0x00000040 | The PowerShell -ExecutionPolicy parameter is specified with value in executionPolicy field | +| NOW_EXEC_FLAG_PS_CONFIGURATION_NAME
0x00000080 | The PowerShell -ConfigurationName parameter is specified with value in configurationName field | + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**executionPolicy (variable)**: A NOW_VARSTR structure containing the execution policy (-ExecutionPolicy) parameter value. This value is ignored if the NOW_EXEC_FLAG_PS_EXECUTION_POLICY flag is not set. + +**configurationName (variable)**: A NOW_VARSTR structure containing the configuration name (-ConfigurationName) parameter value. This value is ignored if the NOW_EXEC_FLAG_PS_CONFIGURATION_NAME flag is not set. + +**command (variable)**: A NOW_VARSTR structure containing the command to execute. + +#### NOW_EXEC_PWSH_MSG + +The NOW_EXEC_PWSH_MSG message is used to execute a remote PowerShell 7 (pwsh) command. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
01234567891012345678920123456789301
msgSize
msgClassmsgTypemsgFlags
sessionId
command (variable)
executionPolicy (variable)
configurationName (variable)
+ +**msgSize (4 bytes)**: The message size, excluding the header size (8 bytes). + +**msgClass (1 byte)**: The message class (NOW_EXEC_MSG_CLASS_ID). + +**msgType (1 byte)**: The message type (NOW_EXEC_PWSH_MSG_ID). + +**msgFlags (2 bytes)**: The message flags, specifying the PowerShell command-line arguments, same as with NOW_EXEC_WINPS_MSG. + +**sessionId (4 bytes)**: A 32-bit unsigned integer containing a unique remote execution session id. + +**executionPolicy (variable)**: A NOW_VARSTR structure, same as with NOW_EXEC_WINPS_MSG. + +**configurationName (variable)**: A NOW_VARSTR structure, same as with NOW_EXEC_WINPS_MSG. + +**command (variable)**: A NOW_VARSTR structure containing the command to execute.