2.2.8.1.1.3.1.1.1 Keyboard Event (TS_KEYBOARD_EVENT)

The TS_KEYBOARD_EVENT structure is a standard T.128 Keyboard Event ([T128] section 8.18.2). RDP keyboard input is restricted to keyboard scancodes, unlike the code-point or virtual codes supported in T.128 (a scancode is an 8-bit value specifying a key location on the keyboard). The server accepts a scancode value and translates it into the correct character depending on the language locale and keyboard layout used in the session.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
keyboardFlags																keyCode
pad2Octets

keyboardFlags (2 bytes): A 16-bit, unsigned integer. The flags describing the keyboard event.

Flag	Meaning
KBDFLAGS_EXTENDED 0x0100	Indicates that the keystroke message contains an extended scancode. For enhanced 101-key and 102-key keyboards, extended keys include the right ALT and right CTRL keys on the main section of the keyboard; the INS, DEL, HOME, END, PAGE UP, PAGE DOWN and ARROW keys in the clusters to the left of the numeric keypad; and the Divide ("/") and ENTER keys in the numeric keypad.
KBDFLAGS_EXTENDED1 0x0200	Used to send keyboard events triggered by the PAUSE key. A PAUSE key press and release MUST be sent as the following sequence of keyboard events: CTRL (0x1D) DOWN NUMLOCK (0x45) DOWN CTRL (0x1D) UP NUMLOCK (0x45) UP The CTRL DOWN and CTRL UP events MUST both include the KBDFLAGS_EXTENDED1 flag.
KBDFLAGS_DOWN 0x4000	Indicates that the key was down prior to this event.
KBDFLAGS_RELEASE 0x8000	The absence of this flag indicates a key-down event, while its presence indicates a key-release event.

keyCode (2 bytes): A 16-bit, unsigned integer. The scancode of the key which triggered the event.

pad2Octets (2 bytes): A 16-bit, unsigned integer. Padding. Values in this field MUST be ignored.