What causes "Unhandled saveSessionInfo type 0x%x" in shadow1ng/fscan?

Note the logged InfoType hex value and check Microsoft MS-RDPBCGR 2.2.10.1.1 to identify the missing infotype.

Unhandled saveSessionInfo type 0x%x

Error message

Unhandled saveSessionInfo type 0x%x

What it means

The SaveSessionInfo PDU parser handles only INFOTYPE_LOGON_PLAINNOTIFY and INFOTYPE_LOGON_EXTENDED_INFO. When the server sends a saveSessionInfo PDU with an unrecognized InfoType, the library logs and returns this error, aborting PDU processing. It indicates a server capability/data the client does not implement.

Source

Thrown at libs/grdp/protocol/pdu/data.go:750

		s.LogonId = b
	}
	core.ReadBytes(570, r)
	return err
}
func (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {
	s.InfoType, err = core.ReadUInt32LE(r)
	switch s.InfoType {
	case INFOTYPE_LOGON:
		err = s.logonInfoV1(r)
	case INFOTYPE_LOGON_LONG:
		err = s.logonInfoV2(r)
	case INFOTYPE_LOGON_PLAINNOTIFY:
		err = s.logonPlainNotify(r)
	case INFOTYPE_LOGON_EXTENDED_INFO:
		err = s.logonInfoExtended(r)
	default:
		glog.Errorf("Unhandled saveSessionInfo type 0x%x", s.InfoType)
		return fmt.Errorf("Unhandled saveSessionInfo type 0x%x", s.InfoType)
	}

	return err
}

func (*SaveSessionInfo) Type2() uint8 {
	return PDUTYPE2_SAVE_SESSION_INFO
}

type PersistKeyPDU struct {
	NumEntriesCache0   uint16 `struc:"little"`
	NumEntriesCache1   uint16 `struc:"little"`
	NumEntriesCache2   uint16 `struc:"little"`
	NumEntriesCache3   uint16 `struc:"little"`
	NumEntriesCache4   uint16 `struc:"little"`
	TotalEntriesCache0 uint16 `struc:"little"`
	TotalEntriesCache1 uint16 `struc:"little"`
	TotalEntriesCache2 uint16 `struc:"little"`

View on GitHub (pinned to 95cc12e753)

Solutions

Note the logged InfoType hex value and check Microsoft MS-RDPBCGR 2.2.10.1.1 to identify the missing infotype.
Update the grdp library to a version supporting the infotype.
Patch SaveSessionInfo.Unmarshal to parse (or skip by consuming the field) the new infotype instead of returning an error.
If only causing noise during credential probing, treat the connection result as 'credentials not validated' and retry with a different flow.

Example fix

// before
default:
    return fmt.Errorf("Unhandled saveSessionInfo type 0x%x", s.InfoType)
// after
default:
    glog.Warnf("skipping saveSessionInfo type 0x%x (len=%d)", s.InfoType, r.Count())
    return nil

Defensive patterns

Strategy: try-catch

Try / catch

err := pduLayer.Run()
var parseErr error
if errors.As(err, &parseErr) && strings.HasPrefix(err.Error(), "Unhandled saveSessionInfo type") {
	// unknown infotype from server: log the type and continue/ignore
	glog.Warnf("server sent unhandled saveSessionInfo: %v", err)
	return nil
}

Prevention

Keep the grdp library updated for newer Windows server PDU types.
Log InfoType hex values to identify which servers send unknown types.
Patch the parser to skip unknown infotypes if you only need credential validation.
Test against target OS versions before broad scans.

When it happens

Trigger: Connecting to a Windows server that emits an infotype other than 0x3 (plain notify) or 0x9/0xA (extended info) in the logon data — e.g. newer/patched servers or unusual session-reconnect logon info types.

Common situations: RDP connections to newer Windows builds or nonstandard RDP servers/bastions that send unimplemented saveSessionInfo types during logon; library lagging behind server protocol features.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/36ca0894c56e5d24. Report an issue: GitHub.