{"record":{"id":"36ca0894c56e5d24","repo":"shadow1ng/fscan","slug":"unhandled-savesessioninfo-type-0x-x","errorCode":null,"errorMessage":"Unhandled saveSessionInfo type 0x%x","messagePattern":"Unhandled saveSessionInfo type 0x%x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"libs/grdp/protocol/pdu/data.go","lineNumber":750,"sourceCode":"\t\ts.LogonId = b\n\t}\n\tcore.ReadBytes(570, r)\n\treturn err\n}\nfunc (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {\n\ts.InfoType, err = core.ReadUInt32LE(r)\n\tswitch s.InfoType {\n\tcase INFOTYPE_LOGON:\n\t\terr = s.logonInfoV1(r)\n\tcase INFOTYPE_LOGON_LONG:\n\t\terr = s.logonInfoV2(r)\n\tcase INFOTYPE_LOGON_PLAINNOTIFY:\n\t\terr = s.logonPlainNotify(r)\n\tcase INFOTYPE_LOGON_EXTENDED_INFO:\n\t\terr = s.logonInfoExtended(r)\n\tdefault:\n\t\tglog.Errorf(\"Unhandled saveSessionInfo type 0x%x\", s.InfoType)\n\t\treturn fmt.Errorf(\"Unhandled saveSessionInfo type 0x%x\", s.InfoType)\n\t}\n\n\treturn err\n}\n\nfunc (*SaveSessionInfo) Type2() uint8 {\n\treturn PDUTYPE2_SAVE_SESSION_INFO\n}\n\ntype PersistKeyPDU struct {\n\tNumEntriesCache0   uint16 `struc:\"little\"`\n\tNumEntriesCache1   uint16 `struc:\"little\"`\n\tNumEntriesCache2   uint16 `struc:\"little\"`\n\tNumEntriesCache3   uint16 `struc:\"little\"`\n\tNumEntriesCache4   uint16 `struc:\"little\"`\n\tTotalEntriesCache0 uint16 `struc:\"little\"`\n\tTotalEntriesCache1 uint16 `struc:\"little\"`\n\tTotalEntriesCache2 uint16 `struc:\"little\"`","sourceCodeStart":732,"sourceCodeEnd":768,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/libs/grdp/protocol/pdu/data.go#L732-L768","documentation":"The SaveSessionInfo PDU parser handles only INFOTYPE_LOGON_PLAINNOTIFY and INFOTYPE_LOGON_EXTENDED_INFO. When the server sends a saveSessionInfo PDU with an unrecognized InfoType, the library logs and returns this error, aborting PDU processing. It indicates a server capability/data the client does not implement.","triggerScenarios":"Connecting to a Windows server that emits an infotype other than 0x3 (plain notify) or 0x9/0xA (extended info) in the logon data — e.g. newer/patched servers or unusual session-reconnect logon info types.","commonSituations":"RDP connections to newer Windows builds or nonstandard RDP servers/bastions that send unimplemented saveSessionInfo types during logon; library lagging behind server protocol features.","solutions":["Note the logged InfoType hex value and check Microsoft MS-RDPBCGR 2.2.10.1.1 to identify the missing infotype.","Update the grdp library to a version supporting the infotype.","Patch SaveSessionInfo.Unmarshal to parse (or skip by consuming the field) the new infotype instead of returning an error.","If only causing noise during credential probing, treat the connection result as 'credentials not validated' and retry with a different flow."],"exampleFix":"// before\ndefault:\n    return fmt.Errorf(\"Unhandled saveSessionInfo type 0x%x\", s.InfoType)\n// after\ndefault:\n    glog.Warnf(\"skipping saveSessionInfo type 0x%x (len=%d)\", s.InfoType, r.Count())\n    return nil","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"err := pduLayer.Run()\nvar parseErr error\nif errors.As(err, &parseErr) && strings.HasPrefix(err.Error(), \"Unhandled saveSessionInfo type\") {\n\t// unknown infotype from server: log the type and continue/ignore\n\tglog.Warnf(\"server sent unhandled saveSessionInfo: %v\", err)\n\treturn nil\n}","preventionTips":["Keep the grdp library updated for newer Windows server PDU types.","Log InfoType hex values to identify which servers send unknown types.","Patch the parser to skip unknown infotypes if you only need credential validation.","Test against target OS versions before broad scans."],"tags":["rdp","pdu","parsing","unsupported"],"backgroundTag":"unsupported-enum-value","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}