Program parameters

We start off by comparing the usage output (we run the program instead of looking at the strings dump to make sure we get the order right):

$ ./lindesk -h
linux  client for windows terminal services.
See http://www.terminal-services.net / for more information.

Usage: ./lindesk [options] server[:port]
   -u:  user name
   -d:  domain
   -s:  start program
   -c:  start directory
   -p:  password
   -n:  client hostname
   -z0: disable sound
   -z1: normal quaility sound
   -z2: high quaility sound
   -t:  color depth
   -f:  full-screen mode
   -g:  desktop width & height (WxH)
   -k:  keyboard language layout 1033=en_us,1034=Spanish,1031=Germany,1036=French
   -k help: keyboard language layout seting
   -K:  disable grab keyboard
   -i: ="printer name;printer driver;local print command"
   -D: ="map drive path;drive name"
   -M: ="map drive path(with auto mount);drive name"
   -S: ="Serial port name;local serial path"
   example:
   lindesk -g800x600 -k1034 -z2 -t16 -i="printer;EPSON Stylus C41 Series;lpr -l -p" -D="/root;H" -M="/mnt/cdrom;F" -S="COM1;/dev/ttyS0" 192.168.0.1

$ ./rdesktop -h
rdesktop: A Remote Desktop Protocol client.
Version 1.4.1. Copyright (C) 1999-2005 Matt Chapman.
See http://www.rdesktop.org/ for more information.

Usage: ./rdesktop [options] server[:port]
   -u: user name
   -d: domain
   -s: shell
   -c: working directory
   -p: password (- to prompt)
   -n: client hostname
   -k: keyboard layout on server (en-us, de, sv, etc.)
   -g: desktop geometry (WxH)
   -f: full-screen mode
   -b: force bitmap updates
   -L: local codepage
   -B: use BackingStore of X-server (if available)
   -e: disable encryption (French TS)
   -E: disable encryption from client to server
   -m: do not send motion events
   -C: use private colour map
   -D: hide window manager decorations
   -K: keep window manager key bindings
   -S: caption button size (single application mode)
   -T: window title
   -N: enable numlock syncronization
   -X: embed into another window with a given id.
   -a: connection colour depth
   -z: enable rdp compression
   -x: RDP5 experience (m[odem 28.8], b[roadband], l[an] or hex nr.)
   -P: use persistent bitmap caching
   -r: enable specified device redirection (this flag can be repeated)
         '-r comport:COM1=/dev/ttyS0': enable serial redirection of /dev/ttyS0 to COM1
             or      COM1=/dev/ttyS0,COM2=/dev/ttyS1
         '-r disk:floppy=/mnt/floppy': enable redirection of /mnt/floppy to 'floppy' share
             or   'floppy=/mnt/floppy,cdrom=/mnt/cdrom'
         '-r clientname=<client name>': Set the client name displayed
             for redirected disks
         '-r lptport:LPT1=/dev/lp0': enable parallel redirection of /dev/lp0 to LPT1
             or      LPT1=/dev/lp0,LPT2=/dev/lp1
         '-r printer:mydeskjet': enable printer redirection
             or      mydeskjet="HP LaserJet IIIP" to enter server driver as well
         '-r sound:[local|off|remote]': enable sound redirection
                     remote would leave sound on server
   -0: attach to console
   -4: use RDP version 4
   -5: use RDP version 5 (default)

Some similarities, some differences. Highly suspicious but not that conclusive since the commonalities are fairly common expressions.

But lets have a look at the string passed to getopt():

• lindesk: "u:d:s:S:c:p:n:k:g:t:z:i:fbeEmCKT:D:M:0h?"
• rdesktop: "u:L:d:s:c:p:n:k:g:fbBeEmzCDKS:T:NX:a:x:Pr:045h?"

Now things aren't that innocent anymore. Feel free to note that many of the options in lindesk's string isn't even mentioned in the usage output.

If we check out an older version of rdesktop.c, closer to the time that lindesk was first seen, we see this string:

• old rdesktop (Thu Oct 9 04:21:19 2003 UTC): "u:d:s:S:c:p:n:k:g:a:fbeEmCKT:D045h"

The chance of getting almost identical order of getopt() flags and flags that are only present in rdesktop is left as an exercise to the reader.

Keysym mappings

A large portion of the strings in lindesk are mappings between X11 keysyms and scan codes:

dead_cedilla 0x29
ssharp 0x28 altgr
Cacute 0x28 shift
Cyrillic_SOFTSIGN 0x32 shift altgr
F6 0x40 localstate
s 0x1f addupper

These can not be found in the rdesktop binary, but they can be found in included keysyms files included with rdesktop:

keymaps/sl:dead_cedilla 0x29
keymaps/sl:ssharp 0x28 altgr
keymaps/sl:Cacute 0x28 shift
keymaps/ru:Cyrillic_SOFTSIGN 0x32 shift altgr
keymaps/common:F6 0x40 localstate
keymaps/common:s 0x1f addupper

This is a unique syntax developed for rdesktop and not inherited from some previous source. Although the syntax is simple it is not probable that lindesk would happen to develop the exact same keywords and the same order of multiple keywords.

Swedish strings in lindesk

lindesk contains two strings in Swedish (meaning "normal time" and "summer time"):

GTB, normaltid
GTB, sommartid

Very strange for a company based in Malta that, until recently, had no connection with Sweden (they now have a Swedish reseller).

The same strings appear in rdesktop and was added there by a developer here at Cendio AB. This string was seen during reverse engineering of Microsoft's RDP client and its meaning is not fully understood. It only appears if you're running a Swedish version of Windows though.

So if Terminal-Services.Net got this string through similar reverse engineering, they must have been running a Swedish Windows. Not impossible but not very probable for a company based in Malta.

Assorted strings

It should be fairly obvious where lindesk got most of its code from by now, but we'll do a few more just to drive the point home.

• lindesk: "We don't support INCR transfers at this time. Try cutting less data."
• rdesktop/xclip.c (until Mon Jun 27 12:18:48 2005 UTC): "warning("We don't support INCR transfers at this time. Try cutting less data.\n");"
• lindesk: "Failed to get atom _MOTIF_WM_HINTS: probably your window manager does not support MWM hints"
• rdesktop/xwin.c: "warning("Failed to get atom _MOTIF_WM_HINTS: probably your window manager does not support MWM hints\n");"
• lindesk: "this shouldn't be happening"
• rdesktop/vnc/vnc.c: "error("this shouldn't be happening\n");"

Swedish strings in G2

There is one part that is present in both the DOS and Linux client though, the suspicious Swedish strings. Considering how these strings were found, it is likely that the DOS client is also derived from rdesktop.

Symbol names

The linker used for the DOS executable doesn't seem to strip symbols from the final binary so the file is filled with names of global functions and variables.

Comparing with rdesktop, we can find a lot of common names:

_iso_init
_iso_send
_iso_recv
_iso_disconnect
_cache_put_cursor
_cache_get_cursor
_cache_get_text
_cache_put_text
_cache_put_font
_cache_get_font
_rdp_connect
_rdp_disconnect
_licence_generate_keys
_licence_process
_sec_hash_48
_sec_hash_16
_buf_out_uint32
_sec_sign
_sec_init
_sec_send
_sec_recv
_sec_connect
_sec_disconnect
_mcs_init
_mcs_send
_mcs_recv
_mcs_connect
_mcs_disconnect
_MD5_Init
_MD5_Update
_MD5_Final
_xtcp_init
_xtcp_send
_xtcp_recv
_xtcp_connect
_generate_random
_bitmap_decompress
_ui_set_colourmap
_ui_draw_glyph
_ui_draw_text
_ui_set_cursor
_ui_rect
_ui_line
_ui_patblt
_RC4_set_key
_SHA1_Init
_SHA1_Update
_SHA1_Final

That's 48 occurences right there. For those of you unfamiliar with C name mangling, all symbols get prefixed with "_" by the C compiler. So to find "_ui_set_cursor" you search for "ui_set_cursor".

The "xtcp_*" can not be found in rdesktop, but if you remove the "x" then all four can be found. It is likely that these were renamed to avoid conflicts with the TCP library required for the DOS client.

There is also a series of symbol names that match global variables in rdesktop:

_rdp_shareid
_next_packet
_licence_issued
_out_sig
_crypt_hwid
_hwid
_decrypt_token
_out_token
_sealed_buffer
_username
_hostname
_password
_keylayout
_bitmap_compression
_orders
_encryption
_desktop_save

That's another 17 common names there. rdesktop recently added the prefix "g_" to all global names, so take this into account when comparing.