mstscdump: MSTSC Packet Dump Utility
====================================

The mstscdump utility allows unencrypted RDP packets being sent or received by
MSTSC.EXE (or any other application that loads MSTSCAX.DLL) to be captured into
a PCAP file for later analysis in various tools such as Microsoft Message Analyzer,
Microsoft Network Monitor, or WireShark.  It also demonstrates how to hook into the
ActiveX interfaces exposed by MSTSCAX.DLL.


How to use the utility
----------------------

Precompiled binaries for x86 and x64 are provided in the bin\x86 and bin\x64
directories, respectively.  Open a Command Prompt window and change directories
to the appropriate directory.  Two binaries are provided.

    mstscdump.exe    - Main binary for the utility
    mstschook.dll    - Hook module for hooking MSTSCAX.DLL

When executed, the utility will create a mstscdump.pcap file containing the
captured packets.  This file will get written to the current directory.

The following examples will cause mstscdump to execute MSTSC.EXE.

    mstscdump			- runs MSTSC.EXE with no arguments
    mstscdump /v:MikeM-Win2012	- runs MSTSC.EXE with specified arguments
    mstscdump MikeM-Win2012.rdp	- runs MSTSC.EXE with an RDP file as the argument

The following example will cause mstscdump to execute VMCONNECT.EXE.

    mstscdump vmconnect localhost MikeM-Win2012

Any application loading MSTSCAX.DLL can be analyzed by running "mstscdump <program>"
where <program> is the application (plus command line arguments) to be analyzed.


Building the utility from sources
---------------------------------

A build.bat and Makefile have been provided to assist in building the software
from sources.  A proper installation of Visual Studio is required.  Visual Studio
2012 was used for testing purposes.

To build the software:

    1.  Open a Developer Command Prompt window for Visual Studio.
    2.  Change directories to the root directory for mstscdump.
    3.  Type "build" to execute the build.bat script.

Resulting binaries are written to the bin\x86 and bin\x64 directories.


Additional Information
----------------------

Feature requests, bug reports, or kudos can be sent to Mike McDonald at
mikem@nogginware.com.