shadow1ng/fscan · error

Unsupport FastPathPDU type 0x%x

Error message

Unsupport FastPathPDU type 0x%x

What it means

In pdu/data.go, parseFastPathUpdate switches on the FastPath update code received from the RDP server. FASTPATH_UPDATETYPE_ORDERS (drawing/rendering order PDUs) is explicitly not implemented for this library's use case (credential-check connections don't need graphics), so it is rejected with 'Unsupport FastPathPDU type 0x%x' instead of being decoded.

Source

Thrown at libs/grdp/protocol/pdu/data.go:913

	FASTPATH_OUTPUT_COMPRESSION_USED = 0x2
)

const (
	FASTPATH_FRAGMENT_SINGLE = (0x0 << 4)
	FASTPATH_FRAGMENT_LAST   = (0x1 << 4)
	FASTPATH_FRAGMENT_FIRST  = (0x2 << 4)
	FASTPATH_FRAGMENT_NEXT   = (0x3 << 4)
)

func readFastPathUpdatePDU(r io.Reader, code uint8) (*FastPathUpdatePDU, error) {
	f := &FastPathUpdatePDU{}
	var err error
	var d UpdateData
	//glog.Debugf("FastPathPDU type %s(0x%x)", FastPathUpdateType(code), code)
	switch code {
	case FASTPATH_UPDATETYPE_ORDERS:
		// 绘图指令，认证检测不需要处理
		return nil, errors.New(fmt.Sprintf("Unsupport FastPathPDU type 0x%x", code))
	case FASTPATH_UPDATETYPE_BITMAP:
		d = &FastPathBitmapUpdateDataPDU{}
	case FASTPATH_UPDATETYPE_PALETTE:
	case FASTPATH_UPDATETYPE_SYNCHRONIZE:
	case FASTPATH_UPDATETYPE_SURFCMDS:
		//d = &FastPathSurfaceCmds{}
	case FASTPATH_UPDATETYPE_PTR_NULL:
	case FASTPATH_UPDATETYPE_PTR_DEFAULT:
	case FASTPATH_UPDATETYPE_PTR_POSITION:
	case FASTPATH_UPDATETYPE_COLOR:
		//d = &FastPathColorPdu{}
	case FASTPATH_UPDATETYPE_CACHED:
	case FASTPATH_UPDATETYPE_POINTER:
	case FASTPATH_UPDATETYPE_LARGE_POINTER:
	default:
		glog.Debugf("Unknown FastPathPDU type 0x%x", code)
		return f, errors.New(fmt.Sprintf("Unknown FastPathPDU type 0x%x", code))
	}

View on GitHub (pinned to 95cc12e753)

Solutions

  1. Treat this as expected for auth/cert-check usage: if you only need handshake validation, catch/ignore this specific error and treat the connection as verified.
  2. If you need graphics, prefer servers/scenarios that produce bitmap updates (FASTPATH_UPDATETYPE_BITMAP), which the parser handles.
  3. Implement a FastPathOrdersUpdateDataPDU: in data.go, replace the error return with a stub decoder that consumes/skips the orders PDU bytes.
  4. Check the server's RDP capability flags / graphics mode (e.g. disable 'draw GDI+' or orders-heavy modes) so it sends bitmap updates.

Example fix

// before (data.go ~913)
case FASTPATH_UPDATETYPE_ORDERS:
    return nil, errors.New(fmt.Sprintf("Unsupport FastPathPDU type 0x%x", code))
// after
case FASTPATH_UPDATETYPE_ORDERS:
    // consume the orders PDU without decoding
    return nil, nil
Defensive patterns

Strategy: try-catch

Try / catch

client.On("error", func(err error) {
    if strings.Contains(err.Error(), "Unsupport FastPathPDU type") {
        glog.Warn("ignoring unsupported fast-path update (orders): ", err)
        return
    }
    glog.Error("rdp error: ", err)
})

Prevention

When it happens

Trigger: Calling the client against an RDP server that sends a fast-path update with code FASTPATH_UPDATETYPE_ORDERS — i.e. the server starts transmitting drawing orders (GDI graphics orders) during or after session setup. The caller sees this via the library's 'error' event / returned error from the PDU update parser.

Common situations: Connecting to a full desktop RDP session that begins rendering GDI drawing orders instead of bitmap updates; servers configured with a low graphics mode or older GDI-first remoting; mismatch where the client capability negotiation led the server to choose orders-based encoding the library deliberately ignores.

Understand the failure class

Background: UnsupportedOperationException and "is not supported" errors: when a library deliberately refuses a call — this error's family across 30 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/252da048c4e42b3b. Report an issue: GitHub.