Skip to content

A–Z

Glossary

Plain-language definitions of the RDP bitmap cache and Remote Desktop client terms used across the blog.

mstsc.exe
The Remote Desktop Connection client built into Windows, which writes the RDP bitmap cache in the profile of the user who runs it.
RDPClient Operational log
The Microsoft-Windows-TerminalServices-RDPClient/Operational event log on the source host; event 1024 records connection attempts with the target name.
Terminal Server Client registry keys
Per-user registry keys of the Remote Desktop client: Servers\<host> with UsernameHint, and Default with the MRU0 to MRU9 list of recent targets.
Tile collage
A single image that lays out every RDP cache tile in cache order, N tiles per row, used to spot windows whose rows line up.
bmc-tools
ANSSI's open-source Python parser for the RDP bitmap cache, the reference decoder for bcache*.bmc and Cache*.bin files.
bcache*.bmc
The legacy RDP bitmap cache files bcache2, bcache22 and bcache24.bmc: fixed-size slots of 8, 16 or 32 bpp tiles, some compressed with interleaved RLE.
Cache*.bin (RDP 8 persistent cache)
The Cache0000.bin, Cache0001.bin files written by newer Remote Desktop clients: an RDP8bmp header followed by uncompressed 32-bit tiles.
Cache key
The 64-bit identifier stored with each RDP bitmap cache tile, formed by two 32-bit values (key1 and key2) in the tile header.
Interleaved RLE
The RDP bitmap compression codec documented in MS-RDPBCGR, used for compressed tiles in legacy bcache*.bmc files.
Slot remnant
Leftover pixels of an older tile in a legacy bcache*.bmc slot, visible when a smaller tile was later written into the same slot.
Bitmap tile
One small bitmap in the RDP cache, typically 64×64 pixels, holding a piece of the remote screen with a key and size but no position or timestamp.
Persistent bitmap caching
The Remote Desktop Connection option that writes the bitmap cache to disk, stored in .rdp files as bitmapcachepersistenable:i:1 and on by default.
RDP bitmap cache
Files written by the Remote Desktop client that store small bitmaps of what the remote screen displayed, kept on the host the user connected from.