{"id":18303480,"url":"https://github.com/gosecure/fq-pyrdp","last_synced_at":"2025-04-05T15:30:57.008Z","repository":{"id":187099791,"uuid":"676311323","full_name":"GoSecure/fq-pyrdp","owner":"GoSecure","description":"fq format for parsing PyRDP replays","archived":false,"fork":false,"pushed_at":"2024-06-04T18:22:34.000Z","size":1111,"stargazers_count":6,"open_issues_count":1,"forks_count":1,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-21T06:33:24.817Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GoSecure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-08T23:18:16.000Z","updated_at":"2025-02-26T05:52:28.000Z","dependencies_parsed_at":"2024-06-04T15:48:28.108Z","dependency_job_id":"aa809c3a-3b06-4ee4-bf73-e7a4ed97a2a4","html_url":"https://github.com/GoSecure/fq-pyrdp","commit_stats":null,"previous_names":["gosecure/fq-pyrdp"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2Ffq-pyrdp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2Ffq-pyrdp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2Ffq-pyrdp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GoSecure%2Ffq-pyrdp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GoSecure","download_url":"https://codeload.github.com/GoSecure/fq-pyrdp/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247358433,"owners_count":20926218,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-05T15:25:47.881Z","updated_at":"2025-04-05T15:30:56.606Z","avatar_url":"https://github.com/GoSecure.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# fq-pyrdp\n\n[`fq`](https://github.com/wader/fq) format for parsing PyRDP replays.\n\n_In progress._\n\n## How to use the format\n\n### Get the codebase\n\nYou will need Go \u003e= 1.17 installed. If present, clone the fq repository:\n\n```bash\n$ git clone git@github.com:wader/fq.git\n$ cd fq\n```\n\n\n### Add the format\n\nThen add the `pyrdp` format to the import list at `format/all/all.go`:\n\n```go\n_ \"github.com/wader/fq/format/pyrdp\"\n```\n\nAnd also to the constants at `format/format.go`:\n\n```go\n        PYRDP               = \"pyrdp\"\n```\n\nNow that the format was added to the list of available formats, the actual code needs to be copied or linked in the `format/` directory. Here's how you can do the later (as it can be updated independently):\n\n```bash\n$ cd format/\n$ ln -s /the/path/to/fq-pyrdp/pyrdp pyrdp\n```\n\n### Build\n\nTo build fq with the new format added just go to the root of the fq repository and use `make fq`. That should create an fq binary in the same directory with the new PyRDP replay format added.\n\n### Development\n\nTo enable this repository to resolve the `fq` code and reduce warnings, the configuration of a Go workspace is recommended.\nTo do so, at the root of this repository, type:\n\n```bash\ngo work init\ngo work use ./path-to-fq\n```\n\n### Run tests\n\nIn the  `fq` repository, run:\n\n```bash\ngo test ./format -run TestFormats/pyrdp\n```\n\nTesting won't work with `format/pyrdp` as a symbolic link to this repo so you will need to copy the files to test.\n\nRef: https://github.com/wader/fq/blob/b0025b64c94aa443e310647a4148c4c8015d7d1c/doc/dev.md#checklist\n\n\n## fq usage\n\nTo parse the replay files using fq you will need to specify the format using `-d` and a query, just as you will do with jq:\n\n```bash\n$ ./fq -d pyrdp '.events[]' /the/path/to/replay.pyrdp\n```\n\nMore complex information can be extracted depending on the PDUs that the pyrdp format can parse. For example, we can get the password used by the user that connected to the RDP service:\n\n```bash\n$ ./fq -d pyrdp '.events[1].client_info|{password:.password,username:.username}' /the/path/to/replay.pyrdp\n{\n  \"password\": \"admin\",\n  \"username\": \"administrator\"\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgosecure%2Ffq-pyrdp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgosecure%2Ffq-pyrdp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgosecure%2Ffq-pyrdp/lists"}