diff --git a/README.md b/README.md
index 46386b4b..9547b494 100644
--- a/README.md
+++ b/README.md
@@ -138,7 +138,7 @@ prores_frame,
[protobuf](doc/formats.md#protobuf),
protobuf_widevine,
pssh_playready,
-pyrdp,
+[pyrdp](doc/formats.md#pyrdp),
[rtmp](doc/formats.md#rtmp),
sll2_packet,
sll_packet,
diff --git a/doc/formats.md b/doc/formats.md
index 448dab81..afbc04ef 100644
--- a/doc/formats.md
+++ b/doc/formats.md
@@ -110,6 +110,7 @@
|[`protobuf`](#protobuf) |Protobuf ||
|`protobuf_widevine` |Widevine protobuf |`protobuf`|
|`pssh_playready` |PlayReady PSSH ||
+|[`pyrdp`](#pyrdp) |PyRDP Replay Files ||
|[`rtmp`](#rtmp) |Real-Time Messaging Protocol |`amf0` `mpeg_asc`|
|`sll2_packet` |Linux cooked capture encapsulation v2 |`inet_packet`|
|`sll_packet` |Linux cooked capture encapsulation |`inet_packet`|
@@ -1195,6 +1196,16 @@ $ fq -d protobuf '.fields[6].wire_value | protobuf | d' file
### References
- https://developers.google.com/protocol-buffers/docs/encoding
+## pyrdp
+PyRDP Replay Files.
+
+### Authors
+- Olivier Bilodeau , Maintainer
+- Lisandro Ubiedo, Author
+
+### References
+- https://github.com/GoSecure/pyrdp
+
## rtmp
Real-Time Messaging Protocol.
diff --git a/format/pyrdp/pyrdp.go b/format/pyrdp/pyrdp.go
index 8fc8e773..9bd2513c 100644
--- a/format/pyrdp/pyrdp.go
+++ b/format/pyrdp/pyrdp.go
@@ -10,6 +10,7 @@
package pyrdp
import (
+ "embed"
"time"
"github.com/wader/fq/format"
@@ -19,6 +20,19 @@ import (
"github.com/wader/fq/pkg/scalar"
)
+//go:embed pyrdp.md
+var pyrdpFS embed.FS
+
+func init() {
+ interp.RegisterFormat(
+ format.PYRDP,
+ &decode.Format{
+ Description: "PyRDP Replay Files",
+ DecodeFn: decodePYRDP,
+ })
+ interp.RegisterFS(pyrdpFS)
+}
+
const (
READ_EXTRA = true
@@ -91,15 +105,6 @@ var pduParsersMap = map[uint16]interface{}{
// PDU_FILE_DOWNLOAD_COMPLETE: pyrdp_pdu.ParseFileDownloadComplete,
}
-func init() {
- interp.RegisterFormat(
- format.PYRDP,
- &decode.Format{
- Description: "PyRDP Replay Files",
- DecodeFn: decodePYRDP,
- })
-}
-
func decodePYRDP(d *decode.D) any {
d.Endian = decode.LittleEndian
diff --git a/format/pyrdp/pyrdp.md b/format/pyrdp/pyrdp.md
new file mode 100644
index 00000000..f4163cfd
--- /dev/null
+++ b/format/pyrdp/pyrdp.md
@@ -0,0 +1,6 @@
+### Authors
+- Olivier Bilodeau , Maintainer
+- Lisandro Ubiedo, Author
+
+### References
+- https://github.com/GoSecure/pyrdp