IronRDP

IronRDP is a modular Rust implementation of RDP, the protocol behind Windows Remote Desktop. It is not a monolithic client: its composable crates provide PDU codecs, connection and session state machines, virtual channels, and image codecs for native, WebAssembly, and .NET clients, servers, and proxies. The continuously fuzzed, no_std-compatible core performs no I/O, so applications supply the transport and runtime.

Highlights

• Sans-I/O core: Drive connection and session state machines with blocking I/O, tokio, futures, or your own event loop.
• Security first: Core crates are fuzzed, unsafe is heavily linted, and the workspace enforces strict correctness lints.
• Runs everywhere: The same protocol core powers native binaries, WebAssembly modules, and C#/.NET bindings.
• Client and server: Connect to Windows hosts or expose your own desktop through the acceptor and server skeleton.
• Modular: Enable only the crates and features you need without pulling in unrelated subsystems.

Features

Protocol and security

• RDP connection sequence: X.224 negotiation, MCS, capability exchange, licensing, reactivation
• Enhanced RDP Security with TLS (1.2 and 1.3)
• Network Level Authentication (NLA) via CredSSP, with NTLM and Kerberos
• KDC proxy and RDCleanPath support for gateway-mediated, just-in-time connections
• Terminal Services Gateway (MS-TSGU) transport
• .rdp file parsing and writing, plus a typed configuration property store

Graphics

• Client-side decoding: uncompressed raw bitmaps, Interleaved RLE, RDP 6.0 bitmap compression, and RemoteFX (RFX)
• Server-side encoding: RDP 6.0 bitmap compression, RemoteFX, optional NSCodec, and optional QOI / QOI+zstd
• Additional codec primitives available as libraries: ClearCodec, RemoteFX Progressive, ZGFX, and the graphics pipeline (EGFX) PDUs
• Bulk compression: MPPC, NCRUSH, and XCRUSH

Virtual channels

• Static (SVC) and dynamic (DVC / DRDYNVC) channel infrastructure
• Clipboard redirection (CLIPRDR), audio output (RDPSND), device and smart card redirection (RDPDR)
• Display control for dynamic resizing, echo (RTT probes), alternative input, and USB redirection
• Windows DVC COM plugin loader and a DVC named-pipe proxy for bridging external processes

Targets and bindings

• Native clients on Windows, macOS, and Linux
• WebAssembly bindings plus a protocol-agnostic web component (@devolutions/iron-remote-desktop)
• C#/.NET bindings generated with Diplomat (Devolutions.IronRdp)

Getting started

Prebuilt binaries

Checksummed .tar.gz archives are attached to each GitHub release, one per supported platform:

• ironrdp-viewer - a windowed RDP client (tags ironrdp-viewer-v*)
• ironrdp-agent - a daemon-backed CLI for automation (tags ironrdp-agent-v*)

Each release includes download, checksum, and extraction instructions.

Install with Cargo

cargo install ironrdp-viewer
cargo install ironrdp-agent

Both binaries link native audio, so Linux builds need the ALSA development headers (libasound2-dev on Debian/Ubuntu) and Windows builds need NASM.

ironrdp-viewer

ironrdp-viewer is a portable, windowed RDP client with asynchronous I/O and software rendering.

ironrdp-viewer <HOSTNAME> --username <USERNAME> --password <PASSWORD>

Omitted credentials are prompted for interactively. You can also load a .rdp file:

ironrdp-viewer --rdp-file ./my-server.rdp

Set IRONRDP_LOG to adjust logging, for example IRONRDP_LOG="info,ironrdp_connector=trace". See the viewer README for supported .rdp properties, TLS key logging, and the full option list.

ironrdp-agent

ironrdp-agent combines a long-lived RDP daemon with short-lived CLI invocations for scripts and LLM-driven automation:

ironrdp-agent daemon-start --overlay ./credentials.rdp        # in one terminal
ironrdp-agent connect --server <HOSTNAME> --username <USER>   # in another
ironrdp-agent screenshot ./desktop.png

connect fails with missing required fields unless credentials are available. Preload credentials with daemon-start --overlay <FILE> to keep secrets away from the IPC caller, or pass --password to connect. Run ironrdp-agent --help-agent for a machine-readable description of every operation. See the agent README for the IPC format, secret handling, and remote execution support.

Using IronRDP as a library

Add the meta crate and enable only the pieces you need:

[dependencies]
ironrdp = { version = "0.17", features = ["connector", "session", "graphics"] }

Each feature maps to a standalone crate, so you can depend on ironrdp-pdu, ironrdp-connector, ironrdp-session, and related crates directly. API documentation is available on docs.rs.

Two runnable examples ship with the meta crate:

# Connect, decode the desktop, and write a PNG. Blocking, synchronous I/O.
cargo run --example=screenshot -- --host <HOSTNAME> -u <USERNAME> -p <PASSWORD> -o out.png

# A minimal RDP server built on ironrdp-server.
cargo run --example=server -- --bind-addr 127.0.0.1:3389

Tips

Run the following PowerShell commands, then reboot:

Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services' -Name 'ColorDepth' -Type DWORD -Value 5
Set-ItemProperty -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\Terminal Services' -Name 'fEnableVirtualizedGraphics' -Type DWORD -Value 1

Alternatively, enable these group policies with gpedit.msc and reboot. They are under Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Remote Session Environment:

1. RemoteFX for Windows Server 2008 R2 → Configure RemoteFX
2. Enable RemoteFX encoding for RemoteFX clients designed for Windows Server 2008 R2 SP1
3. Limit maximum color depth

This is the beginning of the README. Read the rest at the original. Read the full README ↗