View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000567 | file | General | public | 2024-10-28 16:02 | 2024-10-28 16:02 |
| Reporter | Albrecht | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | new | Resolution | open | ||
| Platform | PC | OS | Debian | OS Version | Bookworm |
| Product Version | 5.45 | ||||
| Summary | 0000567: Improve rule for detecting RDP control files | ||||
| Description | The rule for detecting RDP files (https://github.com/file/file/blob/5b004b5d76534a0969a50f6e4cf1be9a1e6ef87f/magic/Magdir/windows#L1858) is not correct IMHO as it tries to find a “screen mode id:i:” entry which is optional in such files. The only mandatory element is the “full address:s:<value>” statement (see https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-properties). I use the following rule which detects this statement in ASCII and UTF-16 LE and BE files, ensuring that ist starts at the beginning of the document or a line as to skip the (optional) “alternate full address” item and to reduce false-positives: --8<------------- # Microsoft Remote Desktop Protocol connection # We search for the only mandatory item in the rdp file: 'full address:s:<value>' # either at the start of the file or after a newline. # (see https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-properties) 0 string/t full\040address:s: >&0 string/t x Remote Desktop Protocol connection to '%-s' !:mime text/x-ms-rdp !:ext rdp 0 search/1024/t \012full\040address:s: >&0 string/t x Remote Desktop Protocol connection to '%-s' !:mime text/x-ms-rdp !:ext rdp --8<------------- I'm not sure if it could be improved, though. | ||||
| Steps To Reproduce | Create a text file just containing --8<------------- full address:s:some-remote.org --8<------------- which tries to open a RDP connection to some-remote.org. The current file git version reports it as “ASCII text”, whilst using the rule above returns “Remote Desktop Protocol connection to 'some-remote.org', ASCII text”. | ||||
| Additional Information | Feel free to use my rule if you think it's correct. | ||||
| Tags | No tags attached. | ||||
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-10-28 16:02 | Albrecht | New Issue |
