What causes "unsupported version of Auto-Reconnect packet" in shadow1ng/fscan?

Confirm alignment: if other PDUs in the same session also fail to parse, treat it as desync and reconnect rather than chasing the version value

shadow1ng/fscan · warning

unsupported version of Auto-Reconnect packet

Error message

unsupported version of Auto-Reconnect packet

What it means

Immediately after the length check, logonInfoExtended validates the auto-reconnect cookie's version field, which per MS-RDPBCGR must be 1 (AUTORECONNECT_PACKET version). A different value returns this error. It means the server's auto-reconnect packet uses an unrecognized version — usually a malformed or misaligned read rather than a genuinely new version.

Source

Thrown at libs/grdp/protocol/pdu/data.go:723

}
func (s *SaveSessionInfo) logonPlainNotify(r io.Reader) (err error) {
	core.ReadBytes(576, r) /* pad (576 bytes) */
	return err
}
func (s *SaveSessionInfo) logonInfoExtended(r io.Reader) (err error) {
	s.Length, err = core.ReadUint16LE(r)
	s.FieldsPresent, err = core.ReadUInt32LE(r)
	//glog.Info("FieldsPresent:", s.FieldsPresent)
	// auto reconnect cookie
	if s.FieldsPresent&LOGON_EX_AUTORECONNECTCOOKIE != 0 {
		core.ReadUInt32LE(r)
		b, _ := core.ReadUInt32LE(r)
		if b != 28 {
			return errors.New(fmt.Sprintf("invalid length in Auto-Reconnect packet"))
		}
		b, _ = core.ReadUInt32LE(r)
		if b != 1 {
			return errors.New(fmt.Sprintf("unsupported version of Auto-Reconnect packet"))
		}
		b, _ = core.ReadUInt32LE(r)
		s.LogonId = b
		s.Random, _ = core.ReadBytes(16, r)
	} else { // logon error info
		core.ReadUInt32LE(r)
		core.ReadUInt32LE(r)
		b, _ := core.ReadUInt32LE(r)
		s.LogonId = b
	}
	core.ReadBytes(570, r)
	return err
}
func (s *SaveSessionInfo) Unpack(r io.Reader) (err error) {
	s.InfoType, err = core.ReadUInt32LE(r)
	switch s.InfoType {
	case INFOTYPE_LOGON:
		err = s.logonInfoV1(r)

View on GitHub (pinned to 95cc12e753)

Solutions

Confirm alignment: if other PDUs in the same session also fail to parse, treat it as desync and reconnect rather than chasing the version value
Relax/extend the check in data.go if your server legitimately emits a different version — log the value and skip the cookie instead of erroring
Update grdp for your server platform's SaveSessionInfo format
Disable auto-reconnect cookie exchange if reconnection support is not required

Defensive patterns

Strategy: try-catch

Try / catch

err := session.HandleSaveSessionInfo(pdu)
if err != nil {
    if strings.Contains(err.Error(), "unsupported version of Auto-Reconnect packet") {
        log.Printf("skipping reconnect cookie with unknown version: %v", err)
        return nil // proceed without auto-reconnect support
    }
    return err
}

Prevention

Log the actual version dword once to identify server-specific formats
Treat as non-fatal: only seamless reconnection is lost
Rule out desync — verify earlier PDUs parse correctly in the same session
Update grdp if your server build ships a newer auto-reconnect packet format

When it happens

Trigger: Server sends SaveSessionInfo with the auto-reconnect cookie flag set and the version dword read as != 1, typically during auto-reconnect flows or when the byte stream shifted after a prior parse error.

Common situations: Network blips triggering reconnect cookies against unusual server builds; middleboxes/gateways altering the PDU; cumulative stream desync so the version field reads garbage.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of shadow1ng/fscan@95cc12e753 (2026-09-06). Data as JSON: /api/errors/1716408e2be5cec2. Report an issue: GitHub.