2.2.8.1.1.3.1.1.1 Keyboard Event (TS_KEYBOARD_EVENT)

The TS_KEYBOARD_EVENT structure is a standard T.128 Keyboard Event ([T128] section 8.18.2). RDP keyboard input is restricted to keyboard scancodes, unlike the code-point or virtual codes supported in T.128 (a scancode is an 8-bit value specifying a key location on the keyboard). The server accepts a scancode value and translates it into the correct character depending on the language locale and keyboard layout used in the session.


0


1


2


3


4


5


6


7


8


9

1
0


1


2


3


4


5


6


7


8


9

2
0


1


2


3


4


5


6


7


8


9

3
0


1

keyboardFlags

keyCode

pad2Octets

keyboardFlags (2 bytes): A 16-bit, unsigned integer. The flags describing the keyboard event.

Flag

Meaning

KBDFLAGS_EXTENDED

0x0100

Indicates that the keystroke message contains an extended scancode. For enhanced 101-key and 102-key keyboards, extended keys include the right ALT and right CTRL keys on the main section of the keyboard; the INS, DEL, HOME, END, PAGE UP, PAGE DOWN and ARROW keys in the clusters to the left of the numeric keypad; and the Divide ("/") and ENTER keys in the numeric keypad.

KBDFLAGS_EXTENDED1

0x0200

Used to send keyboard events triggered by the PAUSE key.

A PAUSE key press and release MUST be sent as the following sequence of keyboard events:

  • CTRL (0x1D) DOWN

  • NUMLOCK (0x45) DOWN

  • CTRL (0x1D) UP

  • NUMLOCK (0x45) UP

The CTRL DOWN and CTRL UP events MUST both include the KBDFLAGS_EXTENDED1 flag.

KBDFLAGS_DOWN

0x4000

Indicates that the key was down prior to this event.

KBDFLAGS_RELEASE

0x8000

The absence of this flag indicates a key-down event, while its presence indicates a key-release event.

keyCode (2 bytes): A 16-bit, unsigned integer. The scancode of the key which triggered the event.

pad2Octets (2 bytes): A 16-bit, unsigned integer. Padding. Values in this field MUST be ignored.