# VNC consoles: first runs against QEMU

**Claim.** A driver for any console that speaks the VNC protocol (RFB) shows a virtual machine's screen exactly and sends keys into its firmware. It has been run against QEMU's own VNC server only. No hardware management controller has been tried, so this is not yet evidence about a server's BMC.

**Method.** The client was written from the protocol specification (RFC 6143) with no VNC library. It was run against QEMU 10.2.1 on the operator's workstation, with a legacy BIOS (SeaBIOS, text mode) and with UEFI firmware (OVMF, a graphical screen). QEMU is a separate implementation of the protocol, and its own screen dump of the guest is the reference the client's picture was compared with.

**Result.**
- The picture the client rebuilt was identical to QEMU's screen dump in all three encodings it decodes (raw, Hextile and ZRLE), on the text BIOS screen and on the graphical UEFI screen. The only difference ever seen was the blinking text cursor, a patch of about 9 by 2 pixels, in a dump taken a moment earlier.
- Escape, sent as a key code during the BIOS boot-menu window, opened SeaBIOS's "Select boot device" menu. The text was read back with OCR.
- Ctrl+Alt+Delete reached the guest, and QEMU reported a guest reset.
- The password check agreed with QEMU, including QEMU's rule that only the first eight characters count. A wrong password and a missing password were refused.
- Fetching the whole screen over loopback took a median of about 145 ms at 720 by 400 and about 310 ms at 1280 by 800, similar in every encoding. That time is mostly the server's frame pacing. It is one machine and eight grabs per figure.
- The tests were also run with two decoder bugs introduced on purpose, to see whether they would notice. They did, and the code was then restored.

**Bugs found on the way.** On the first pointer move, before the client had connected, the screen size was unknown, so every first move landed in the top-left corner. After a dropped connection the client wrote into the dead socket once before reconnecting. Both are fixed.

**Sample size.** Two virtual screens, one QEMU version, one run of each check.

**Not tested.** Any hardware controller (OpenBMC, or the VNC server of a Dell iDRAC). Servers that send only Tight or JPEG pictures, which this client does not decode. TLS-wrapped VNC. Keyboard layouts other than US. Performance over a real network. Two clients at once.

**Limits.**
- Classic VNC authentication is an eight-character password through a weak cipher, with no encryption of the session. The protocol's own specification says it is unfit for untrusted networks. Use a management network, a loopback, or an ssh tunnel.
- VNC has no power control and no virtual media, so the driver offers neither.
- Four keys are refused on purpose, including the power key.
- A virtual machine is not a server controller. Controllers differ in what they send and in how many sessions they allow.