Unchain Nvidia RTX GPU heart

Guestbook

Unlock Nvidia RTX 4080 GPU’s all power potentials.

Install and confirm the stock NVIDIA driver first. Most test reports used NVIDIA’s open kernel modules, so the -open package is the safest choice:

1
2
3
4
5
6
7
$ sudo ubuntu-drivers list
nvidia-driver-595-open, (kernel modules provided by linux-modules-nvidia-595-open-generic-hwe-26.04)
nvidia-driver-580-open, (kernel modules provided by linux-modules-nvidia-580-open-generic-hwe-26.04)
nvidia-driver-615-open, (kernel modules provided by linux-modules-nvidia-615-open-generic-hwe-26.04)
...

$ sudo apt install nvidia-driver-595-open # pick the version listed

GPU - Driver Comparison

Find GPU’s PCI address and card information:

1
2
3
4
5
6
7
8
9
$ lspci -Dnn | grep -i nvidia
0000:06:00.0 VGA compatible controller [0300]: NVIDIA Corporation AD103 [GeForce RTX 4080] [10de:2704] (rev a1)
0000:06:00.1 Audio device [0403]: NVIDIA Corporation AD103 High Definition Audio Controller [10de:22bb] (rev a1)

$ lspci -nnk -s 0000:06:00.0
06:00.0 VGA compatible controller [0300]: NVIDIA Corporation AD103 [GeForce RTX 4080] [10de:2704] (rev a1)
	Subsystem: ASUSTeK Computer Inc. Device [1043:88c8]
	Kernel driver in use: nvidia
	Kernel modules: nvidiafb, nouveau, nvidia_drm, nvidia

Install build dependencies:

1
2
$ sudo apt update
$ sudo apt install git build-essential dpkg-dev debhelper dkms dh-dkms python3 zstd linux-headers-$(uname -r)

Build and isntall the packages:

1
2
3
4
5
$ git clone https://github.com/JustAResearcher/gpu-unlock-ada.git

$ cd gpu-unlock-ada

$ make install

This downloads the pinned NVIDIA 610.43.03 inputs, checks their SHA-256 hashes, generates the firmware locally, and builds and installs gpu-unlock-dkms and gpu-unlock-firmware.

The package’s post-install step runs update-initramfs -u -k all, so the module and firmware go into the initramfs. Can confirm that:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
$ sudo lsinitramfs /boot/initrd.img-$(uname -r) | grep -E 'gpu_unlock|gpu-unlock'
usr/lib/firmware/gpu-unlock
usr/lib/firmware/gpu-unlock/610.43.03
usr/lib/firmware/gpu-unlock/610.43.03/booter_load_ad102.bin
usr/lib/firmware/gpu-unlock/610.43.03/booter_load_ga100.bin
usr/lib/firmware/gpu-unlock/610.43.03/booter_load_ga102.bin
usr/lib/firmware/gpu-unlock/610.43.03/booter_load_tu102.bin
usr/lib/firmware/gpu-unlock/610.43.03/falcon_loader.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_ad102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_desc_ad102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_desc_ga100.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_desc_ga102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_desc_tu102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_ga100.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_ga102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_boot_tu102.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_ga10x.bin
usr/lib/firmware/gpu-unlock/610.43.03/gsp_tu10x.bin
usr/lib/firmware/gpu-unlock/610.43.03/sec2_bl_tu102.bin
usr/lib/modules/7.0.0-38-generic/updates/dkms/gpu_unlock.ko.zst

Print the exact boot option:

1
2
3
$ python3 tools/print_boot_option.py
RTX 4080 (experimental) at 0000:06:00.0 [10de:2704]:
gpu_unlock.targets=0000:06:00.0 gpu_unlock.rtx4080_experimental=1

Add above options to GRUB: GRUB_CMDLINE_LINUX_DEFAULT=”quiet splash gpu_unlock.targets=0000:06:00.0 gpu_unlock.rtx4080_experimental=1. Then appl the change:

1
$ sudo update-grub

Cold boot:

  1. Shut down.
  2. Switch off or unplug the AC power and wait about 30 seconds.
  3. Power on.

The module needs a card that hasn’t been initialised since power-on. If the card was already initialised, it refuses to run.

GPU - MOK

Verify:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
$ cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=0e66f11d-6081-4b8c-9321-821ea4c0a793 ro quiet splash gpu_unlock.targets=0000:06:00.0 gpu_unlock.rtx4080_experimental=1 crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M

$ journalctl -k -b --no-pager | grep -E 'gpu_unlock: unlocked|already unlocked|unlock failed|experimental|post-FLR SEC2'
Oct 27 22:47:22 Aorus kernel: Command line: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=0e66f11d-6081-4b8c-9321-821ea4c0a793 ro quiet splash gpu_unlock.targets=0000:06:00.0 gpu_unlock.rtx4080_experimental=1 crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
Oct 27 22:47:22 Aorus kernel: Kernel command line: BOOT_IMAGE=/boot/vmlinuz-7.0.0-38-generic root=UUID=0e66f11d-6081-4b8c-9321-821ea4c0a793 ro quiet splash gpu_unlock.targets=0000:06:00.0 gpu_unlock.rtx4080_experimental=1 crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
Oct 27 22:47:23 Aorus kernel: pci 0000:06:00.0: post-FLR SEC2 reset released, GSP halted, BME=0 pending=0 WPR2=1ffffe00:00000000 SS0=88888888 SS1=00000008
Oct 27 22:47:23 Aorus kernel: pci 0000:06:00.0: gpu_unlock: unlocked

$ nvidia-smi
Tue Oct 27 22:50:13 2026
+-----------------------------------------------------------------------------------------+
| NVIDIA-SMI 595.99.02              Driver Version: 595.99.02      CUDA Version: 13.2     |
+-----------------------------------------+------------------------+----------------------+
| GPU  Name                 Persistence-M | Bus-Id          Disp.A | Volatile Uncorr. ECC |
| Fan  Temp   Perf          Pwr:Usage/Cap |           Memory-Usage | GPU-Util  Compute M. |
|                                         |                        |               MIG M. |
|=========================================+========================+======================|
|   0  NVIDIA GeForce RTX 4080        Off |   00000000:06:00.0 Off |                  N/A |
|  0%   26C    P8              4W /  360W |      14MiB /  16376MiB |      0%      Default |
|                                         |                        |                  N/A |
+-----------------------------------------+------------------------+----------------------+

+-----------------------------------------------------------------------------------------+
| Processes:                                                                              |
|  GPU   GI   CI              PID   Type   Process name                        GPU Memory |
|        ID   ID                                                               Usage      |
|=========================================================================================|
|    0   N/A  N/A            2896      G   /usr/bin/gnome-shell                      3MiB |
+-----------------------------------------------------------------------------------------+

$ journalctl -k -b | grep -i xid # should print nothing

Success requires all three of these:

  • A gpu_unlock: unlocked line for your card’s address.
  • A healthy nvidia-smi.
  • A rate readback showing full rate:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
$ UUID=$(nvidia-smi --query-gpu=uuid --format=csv,noheader)

$ python3 tools/read_sm_rates.py --expect-uuid "$UUID"
{
  "gpu": "GPU-28b6243c-d078-fbba-a6ff-ea24c62d4ccf, NVIDIA GeForce RTX 4080, 00000000:06:00.0, 595.99.02, 360.00, 210, 405",
  "command": "0x20801230",
  "rates": {
    "imla0": 0,
    "fmla16": 0,
    "dp": 0,
    "fmla32": 0,
    "ffma": 0,
    "imla1": 0,
    "imla2": 0,
    "imla3": 0,
    "imla4": 0
  },
  "meaning": "0=full; 1=half; 2=quarter; higher values are further reductions",
  "hardware_changes": false
}

Look for fmla32 changing from 1 (stock) to 0 (unlocked).

Uninstall:

To roll back, remove the gpu_unlock.* options from /etc/default/grub, run sudo update-grub, and power-cycle.

To remove the software completely:

1
$ sudo apt remove gpu-unlock-dkms gpu-unlock-firmware

Benchmark test and run python benchmark.py:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
import torch, time

N, ITERS = 8192, 50
torch.backends.cuda.matmul.allow_tf32 = True

for name, dt in [("FP16", torch.float16), ("BF16", torch.bfloat16), ("TF32", torch.float32)]:
    a = torch.randn(N, N, device="cuda", dtype=dt)
    b = torch.randn(N, N, device="cuda", dtype=dt)
    for _ in range(10):
        a @ b
    torch.cuda.synchronize()
    t = time.perf_counter()
    for _ in range(ITERS):
        a @ b
    torch.cuda.synchronize()
    dt_s = time.perf_counter() - t
    print(f"{name}: {2 * N**3 * ITERS / dt_s / 1e12:.1f} TFLOPS")

GPU - File Structure

GPU - Sequence Diagram

References

M365 user and Open Authentication (OATH)

Guestbook

Prerequisites

A Microsoft M365 user, work / school account, with M365 Copilot, premium or not.

Setting up a customised Authentication, without using the Microsoft Authenticator:

Add a sign-in method

  • Install Microsoft Authenticator

Choose ‘Set up a different authentication app’.

Install Microsoft Authenticator

  • Set up your account in app

Click next.

Set up your account in app

  • Scan the QR code

Select ‘Can’t scan the QR code?’.

Scan the QR code

  • Enter the following into Authenticator

Copy the Secret key, which is a base32 encoded.

Enter the following into Authenticator

Generate a 6-digit code from the secret key to finish enrollment, with oathtool.

1
2
$ oathtool --totp -b "THE_BASE32_SECRET"
732501

Then paste the seed / secret key into the password manager, and enter that generated 6-digit code.

Concepts

  • oathtool is a command-line utility used to generate and validate Open Authentication (OATH) one-time passwords.
  • TOTP (Time-based One Time Password): Generates time variant codes (default 30-second steps, supports SHA1, SHA256, and SHA512).
  • HOTP (HMAC-based One Time Password): Generates event-based counters by default.

References

A blocking connect() to mDNS-resolved IPv6 addresses fails with errno 0 on macOS 27

Guestbook

A blocking connect() to mDNS-resolved IPv6 addresses fails with errno 0 on macOS 27, while a non-blocking connect to the same addresses succeeds.

1
2
3
4
5
$ ssh -l terrence Aorus.local
ssh: connect to host aorus.local port 22: Undefined error: 0

$ type -a ssh
ssh is /usr/bin/ssh

However,

1
2
3
4
5
6
7
8
9
$ nslookup Aorus.local
Server:  192.168.2.1
Address: 192.168.2.1#53

Name:    Aorus.local
Address: 192.168.2.229

$ nc -vz Aorus.local 22
Connection to Aorus.local port 22 [tcp/ssh] succeeded!

ssh IP address works fine:

1
$ ssh -l terrence 192.168.2.229

ssh on hostname without domain also works:

1
$ ssh -l terrence Aorus

ssh via proxy also works:

1
$ ssh -o ProxyCommand='nc %h %p' -l terrence Aorus.local

Why they differ: nslookup queries router’s DNS server (192.168.2.1) directly and returns the IPv4 address. ssh doesn’t use DNS for .local names. It goes through the macOS system resolver, which uses mDNS/Bonjour. That path can return a different answer, for example an IPv6 link-local address (fe80::…) advertised by Aorus (avahi, it’s Linux).

And local router also resolves a plain Aorus name, since that goes through unicast DNS and avoids mDNS entirely.

dscacheutil queries on Aorus.local only IPv6 no IPv4 addresses returned:

1
2
3
4
5
6
7
8
$ dscacheutil -q host -a name Aorus.local
name: aorus.local
ipv6_address: fda5:9d5d: ...
ipv6_address: 2401:d002: ...
ipv6_address: fda5:9d5d: ...
ipv6_address: fda5:9d5d: ...
ipv6_address: 2401:d002: ...
ipv6_address: 2401:d002: ...

Connect via IPv6 works fine:

1
2
3
$ ping6 -c2 2401:d002: ...

$ ssh -l terrence fda5:9d5d: ...

To monitor TCP/IP traffic:

1
$ sudo tcpdump -i en1 -n 'ip6 and tcp port 22'

Finally, try ConnectTimeout in ssh works:

1
$ ssh -o ConnectTimeout=5 -l terrence Aorus.local

Add the following configuration in .ssh/config file:

1
2
3
Host Aorus.local
    ConnectTimeout 10
    User terrence

ConnectTimeout changes how ssh opens the socket. With no timeout set, ssh calls a plain blocking connect(). With a timeout, it switches the socket to non-blocking mode and waits for it with poll(). nc connects the non-blocking way too, which is why it worked all along.

So the evidence points to the blocking connect() to these mDNS-resolved IPv6 addresses failing on current macOS build, while the non-blocking path works. This could be a bug in this macOS build’s handling of mDNS-resolved scoped addresses, or something in the Local Network privacy layer.

Only the hostname path failed, because Aorus.local resolves to IPv6 addresses with an interface scope, and literals and the IPv4 name don’t hit that.

ConnectTimeout is harmless, since it just makes unreachable hosts fail after 10 seconds instead of the system default. It also covers scp, rsync and git over ssh.

Windows 11 Remote Connection with Windows App for Mac

Guestbook

Windows 11 Pro for Workstations 24H2, with Remote Desktop enabled, by running SystemPropertiesRemote.exe:

Windows - Remote Desktop

In addition, remote desktop login have been verified with Microsoft Account. Open Windows Powershell, and run with winver (Windows Version):

1
2
3
PS C:\Users\terre> runas /u:MicrosoftAccount\terrence.miao@paradise.net winver
Enter the password for MicrosoftAccount\terrence.miao@paradise.net:
Attempting to start winver as user "MicrosoftAccount\terrence.miao@paradise.net" ...

However, Windows App for Mac Error 0x4:

Windows App - Error 0x4

Error 0x204:

Windows App - Error 0x204

thrown when try to connect.

Clear the Windows App’s cached connection data on the Mac — this is the fix that repeatedly resolves this specific symptom (port open, still Error 0x204).

Quit Windows App, then in Finder go to ~/Library/Group Containers/, and delete the UBF8T346G9.com.microsoft.rdc folder.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
$ cd ~/Library/Group Containers/

$ find UBF8T346G9.com.microsoft.rdc
UBF8T346G9.com.microsoft.rdc
UBF8T346G9.com.microsoft.rdc/Library
UBF8T346G9.com.microsoft.rdc/Library/Application Support
UBF8T346G9.com.microsoft.rdc/Library/Application Support/com.microsoft.rdc.macos.spotlight-data.sqlite
UBF8T346G9.com.microsoft.rdc/Library/Application Support/.com.microsoft.rdc.macos.spotlight-data_SUPPORT
UBF8T346G9.com.microsoft.rdc/Library/Application Support/.com.microsoft.rdc.macos.spotlight-data_SUPPORT/_EXTERNAL_DATA
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/60F6F8E6-5473-4487-B437-B1BCC23EEF5A
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/65A8F32C-3F7B-432F-A946-E97F722C8130
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/0737CEA8-2677-43CA-B662-438BDCAF5DEF
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/FD13A9BC-25C9-414F-89A1-11B846D8B8D5
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/3A4B24DC-F7A8-47FA-9AE4-57E3D7ABBCB2
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/36F64D9D-96BF-4191-9E98-7B6B91461D82
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/BE2BC0D9-3D69-4C36-86D6-C55D934A11AB
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/1706DE71-50EA-4527-A176-20A6AEF628CF
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/3DD0E565-26FC-4453-91D8-CEAE7C59F1DA
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/D48EB89B-8859-4CED-AC20-4D04EF771D0C
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/5256BC0C-1017-479B-BEE9-3C33C53644DA
UBF8T346G9.com.microsoft.rdc/Library/Application Support/SupportingImages/B7BA47B7-5D51-4841-8B5E-63AFFE6E8DBA
UBF8T346G9.com.microsoft.rdc/Library/Application Support/com.microsoft.rdc.macos.spotlight-data.sqlite-wal
UBF8T346G9.com.microsoft.rdc/Library/Application Support/com.microsoft.rdc.macos.spotlight-data.sqlite-shm
UBF8T346G9.com.microsoft.rdc/Library/Preferences
UBF8T346G9.com.microsoft.rdc/Library/Application Scripts
UBF8T346G9.com.microsoft.rdc/Library/Application Scripts/UBF8T346G9.com.microsoft.rdc
UBF8T346G9.com.microsoft.rdc/Library/Caches
UBF8T346G9.com.microsoft.rdc/.com.apple.containermanagerd.metadata.plist

$ rm -rf UBF8T346G9.com.microsoft.rdc

Now can connect Windows Remote Desktop, hostname is Aorus, but keep failing on the incorrect credentials with username Terrence Miao:

Windows App - Certificate

Windows App - Incorrect Credentials

Setting up username as Aorus\terrence.miao@paradise.net does the trick, with Windows-style local account.

References

Setting up 3x-ui server at home internet on IPv6 without dedicated VPS

Guestbook

Home internet with Native IPv6 on. Enable IPv6 on NBN provider at first, then test IPv6 by visiting https://test-ipv6.com/ or https://ipv6test.google.com/, checking IP info at https://ifconfig.co/.

Register your account at ClouDNS https://www.cloudns.net/ and receive a FREE DNS domain e.g. igloo-proxy.cloud-ip.cc. Then add a AAAA type DNS record points to your x3-ui https://github.com/MHSanaei/3x-ui server’s IPv6:

1
2
3
# x3-ui server
$ curl -6 https://ifconfig.co
2401:d002:c51c:1219:d5c2:e48d:73b5:976b

Install the latest version x3-ui:

1
$ bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh) v3.7.0

Generate Let’s Encrypt https://letsencrypt.org/ SSL certifidate:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
╔───────────────────────────────────────────────╗
│  3X-UI Panel Management Script                │
│  0. Exit Script                               │
│───────────────────────────────────────────────│
│  1. Install                                   │
│  2. Update                                    │
│  3. Update to Dev Channel (latest commit)     │
│  4. Update Menu                               │
│  5. Legacy Version                            │
│  6. Uninstall                                 │
│───────────────────────────────────────────────│
│  7. Reset Username & Password                 │
│  8. Reset Web Base Path                       │
│  9. Reset Settings                            │
│  10. Change Port                              │
│  11. View Current Settings                    │
│───────────────────────────────────────────────│
│  12. Start                                    │
│  13. Stop                                     │
│  14. Restart                                  │
|  15. Restart Xray                             │
│  16. Check Status                             │
│  17. Logs Management                          │
│───────────────────────────────────────────────│
│  18. Enable Autostart                         │
│  19. Disable Autostart                        │
│───────────────────────────────────────────────│
│  20. SSL Certificate Management               │
│  21. Cloudflare SSL Certificate               │
│  22. IP Limit Management                      │
│  23. Firewall Management                      │
│  24. SSH Port Forwarding Management           │
│  25. PostgreSQL Management                    │
│───────────────────────────────────────────────│
│  26. Enable BBR                               │
│  27. Update Geo Files                         │
│  28. Speedtest by Ookla                       │
╚───────────────────────────────────────────────╝

Panel state: Running
Start automatically: Yes
xray state: Running

Please enter your selection [0-28]: 20
    1. Get SSL (Domain)
    2. Revoke & Remove
    3. Force Renew
    4. Show Existing Domains
    5. Set Cert paths for the panel
    6. Get SSL for IP Address (6-day cert, auto-renews)
    0. Back to Main Menu
Choose an option: 1
acme.sh could not be found. we will install it
[INF] Installing acme.sh...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  270k  100  270k    0     0  1271k      0 --:--:-- --:--:-- --:--:-- 1277k
[Thu Aug 27 09:10:20 AM AEST 2026] Installing from online archive.
[Thu Aug 27 09:10:20 AM AEST 2026] Downloading https://github.com/acmesh-official/acme.sh/archive/master.tar.gz
[Thu Aug 27 09:10:20 AM AEST 2026] Extracting master.tar.gz
[Thu Aug 27 09:10:21 AM AEST 2026] Installing to /root/.acme.sh
[Thu Aug 27 09:10:21 AM AEST 2026] Installed to /root/.acme.sh/acme.sh
[Thu Aug 27 09:10:21 AM AEST 2026] Installing alias to '/root/.bashrc'
[Thu Aug 27 09:10:21 AM AEST 2026] Close and reopen your terminal to start using acme.sh
[Thu Aug 27 09:10:21 AM AEST 2026] Installing cron job
[Thu Aug 27 09:10:21 AM AEST 2026] bash has been found. Changing the shebang to use bash as preferred.
[Thu Aug 27 09:10:21 AM AEST 2026] OK
[Thu Aug 27 09:10:21 AM AEST 2026] Install success!
[INF] Installation of acme.sh succeeded.
[INF] install socat succeed...
Please enter your domain name: igloo-proxy.cloud-ip.cc
[DEG] Your domain is: igloo-proxy.cloud-ip.cc, checking it...
[INF] Your domain is ready for issuing certificates now...
Please choose which port to use (default is 80):
[INF] Will use port: 80 to issue certificates. Please make sure this port is open.
[Thu Aug 27 09:11:29 AM AEST 2026] Changed default CA to: https://acme-v02.api.letsencrypt.org/directory
[Thu Aug 27 09:11:30 AM AEST 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Thu Aug 27 09:11:30 AM AEST 2026] Standalone mode.
[Thu Aug 27 09:11:30 AM AEST 2026] Account key creation OK.
[Thu Aug 27 09:11:30 AM AEST 2026] Registering account: https://acme-v02.api.letsencrypt.org/directory
[Thu Aug 27 09:11:31 AM AEST 2026] Registered
[Thu Aug 27 09:11:31 AM AEST 2026] ACCOUNT_THUMBPRINT='b5K6u4GCPMvP6jtVrI78pAl9YUrShU2Z8porK76hyr8'
[Thu Aug 27 09:11:31 AM AEST 2026] Creating domain key
[Thu Aug 27 09:11:31 AM AEST 2026] The domain key is here: /root/.acme.sh/igloo-proxy.cloud-ip.cc_ecc/igloo-proxy.cloud-ip.cc.key
[Thu Aug 27 09:11:31 AM AEST 2026] Single domain='igloo-proxy.cloud-ip.cc'
[Thu Aug 27 09:11:33 AM AEST 2026] Getting webroot for domain='igloo-proxy.cloud-ip.cc'
[Thu Aug 27 09:11:33 AM AEST 2026] Verifying: igloo-proxy.cloud-ip.cc
[Thu Aug 27 09:11:33 AM AEST 2026] Standalone mode server
[Thu Aug 27 09:11:34 AM AEST 2026] Pending. The CA is processing your order, please wait. (1/30)
[Thu Aug 27 09:11:38 AM AEST 2026] Pending. The CA is processing your order, please wait. (2/30)
[Thu Aug 27 09:11:41 AM AEST 2026] Success
[Thu Aug 27 09:11:41 AM AEST 2026] Verification finished, beginning signing.
[Thu Aug 27 09:11:41 AM AEST 2026] Let's finalize the order.
[Thu Aug 27 09:11:41 AM AEST 2026] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/3489265815/549901388765'
[Thu Aug 27 09:11:44 AM AEST 2026] Downloading cert.
[Thu Aug 27 09:11:44 AM AEST 2026] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/06e0b6dbe51ac7d51573cf84994ca71741ad'
[Thu Aug 27 09:11:44 AM AEST 2026] Cert success.
-----BEGIN CERTIFICATE-----
MIIDnzCCAyWgAwIBAgISBuC22+UZGNUVc8+EmUynF0GtMAoGCCqGSM49BAMDMDMx
...
2Ao/mUvkOPylsT42LE2vRnQCMBpDXfkcxsNWkiiWZxogKC6lahRpe7yz873EZLfE
UUvAgAJ0INTMnqtKw15Eg8xyGw==
-----END CERTIFICATE-----
[Thu Aug 27 09:11:44 AM AEST 2026] Your cert is in: /root/.acme.sh/igloo-proxy.cloud-ip.cc_ecc/igloo-proxy.cloud-ip.cc.cer
[Thu Aug 27 09:11:44 AM AEST 2026] Your cert key is in: /root/.acme.sh/igloo-proxy.cloud-ip.cc_ecc/igloo-proxy.cloud-ip.cc.key
[Thu Aug 27 09:11:44 AM AEST 2026] The intermediate CA cert is in: /root/.acme.sh/igloo-proxy.cloud-ip.cc_ecc/ca.cer
[Thu Aug 27 09:11:44 AM AEST 2026] And the full-chain cert is in: /root/.acme.sh/igloo-proxy.cloud-ip.cc_ecc/fullchain.cer
[Thu Aug 27 09:11:45 AM AEST 2026] ARI suggestedWindow: 2026-10-25T00:57:16Z to 2026-10-26T20:08:06Z
[Thu Aug 27 09:11:45 AM AEST 2026] Next renewal time picked from ARI window: 2026-10-26T07:45:41Z
[INF] Your reloadcmd is: systemctl reload nginx ; x-ui restart
[Thu Aug 27 09:14:30 AM AEST 2026] The domain 'igloo-proxy.cloud-ip.cc' seems to already have an ECC cert, let's use it.
[Thu Aug 27 09:14:30 AM AEST 2026] Installing key to: /root/cert/igloo-proxy.cloud-ip.cc/privkey.pem
[Thu Aug 27 09:14:30 AM AEST 2026] Installing full chain to: /root/cert/igloo-proxy.cloud-ip.cc/fullchain.pem
[INF] Installing certificate succeeded, enabling auto renew...
[Thu Aug 27 09:14:30 AM AEST 2026] Already up to date!
[Thu Aug 27 09:14:30 AM AEST 2026] Upgrade successful!
[INF] Auto renew succeeded, certificate details:
cert/igloo-proxy.cloud-ip.cc:
total 20K
drwxr-xr-x 2 root root 4.0K Aug 27 09:14 .
drwxr-xr-x 5 root root 4.0K Aug 27 09:11 ..
-rw-r--r-- 1 root root 4.8K Aug 27 09:14 fullchain.pem
-rw------- 1 root root  227 Aug 27 09:14 privkey.pem
Would you like to set this certificate for the panel? (y/n): y
set certificate public key success
set certificate private key success
set certificate for subscription public key success
set certificate for subscription private key success
[INF] Panel paths set for domain: igloo-proxy.cloud-ip.cc
[INF]   - Certificate File: /root/cert/igloo-proxy.cloud-ip.cc/fullchain.pem
[INF]   - Private Key File: /root/cert/igloo-proxy.cloud-ip.cc/privkey.pem

Get the Dynamic URL of domain igloo-proxy.cloud-ip.cc, then add cron job to update DNS Server with the Dynamic IP Address:

1
2
3
4
# crontab -l
# ClouDNS - Update Dynamic IPv6 address for domain "igloo-proxy.cloud-ip.cc"
*/5 * * * * curl -6 -s "https://ipv6.cloudns.net/api/dynamicURL/?q=MTQ ... GE" >> /var/log/cloudns-ddns.log 2>&1
21 4,10,16,22 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null

Login x3-ui panel. Setup Inbound:

3x-ui Inbound Basics

Min Client Ver option needs to set to 1.0.0 to be compatible with OpenClash on mini router:

3x-ui Inbound Security

Setup Client:

3x-ui Client Basics

Flow option must be xtls-rprx-vision:

3x-ui Client Credentials

Finally, add 3x-ui Clash subscription URL e.g. https://igloo-proxy.cloud-ip.cc:2096/clash/y33m9a0rgih5z01 into OpenClash:

OpenClash Panel

OpenClash IPv6

References

  • 波仔分享 - 未来还能继续翻墙吗？2026最新VPS自建节点搭建教程！科学上网翻墙从零开始，VPS线路详解！VLESS+Reality，搬瓦工CN2 GIA实测8K/奈飞4K，V2RayN与Clash配置全流程！https://www.youtube.com/watch?v=D7huCXwVuLo
  • 2026最新VPS自建节点搭建教程！科学上网翻墙从零开始，VPS线路详解！VLESS+Reality，搬瓦工CN2 GIA实测8K/奈飞4K，V2RayN与Clash配置全流程，小白保姆级教程！https://v2rayssr.com/me-reality.html

Unlock GL.iNet GL-MT3600BE Beryl 7 Global firmware

Guestbook

GL.iNet GL-MT3600BE Beryl 7 Dual-Band Wi-Fi 7 Travel Router, coming with Chinese/CN firmware.

GL.iNet GL-MT3600BE Beryl 7 Dual-Band Wi-Fi 7 Travel Router

Start up router, and go to http://192.168.8.1/ and login.

GL.iNet GL-MT3600BE Dashboard

  • SSH into router
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
$ ssh -l root 192.168.8.1
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
root@192.168.8.1's password:

BusyBox v1.33.2 (2026-08-06 10:25:08 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 21.02-SNAPSHOT,
 -----------------------------------------------------
  • Identify the Factory Partition
1
2
3
4
5
6
7
8
9
10
root@GL-MT3600BE:~# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 20000000 00040000 "spi1.0"
mtd1: 00100000 00040000 "BL2"
mtd2: 00080000 00040000 "u-boot-env"
mtd3: 00400000 00040000 "Factory"
mtd4: 00200000 00040000 "FIP"
mtd5: 00040000 00040000 "log"
mtd6: 00040000 00040000 "CFG"
mtd7: 1d800000 00040000 "ubi"

The partition named “Factory” is mtd3, so the partition is mtdblock3.

  • Find the “CN” (Chinese) Offset
1
2
root@GL-MT3600BE:~# hexdump -v -e '"%_ad: " 16/1 "%02X " "\n"' /dev/mtdblock3 | grep "43 4E"
16512: 00 00 00 00 00 00 00 00 43 4E 00 00 00 00 00 00
  • Verify the “CN” Offset
1
2
root@GL-MT3600BE:~# dd if=/dev/mtdblock3 bs=1 skip=16520 count=2 2>/dev/null
CN
  • Overwrite region from “CN” to “US”
1
2
3
root@GL-MT3600BE:~# echo -n "US" | dd of=/dev/mtdblock3 bs=1 seek=16520 count=2 conv=notrunc
2+0 records in
2+0 records out
  • Sycn and Reboot
1
2
3
4
5
root@GL-MT3600BE:~# sync

root@GL-MT3600BE:~# reboot
root@GL-MT3600BE:~# Connection to 192.168.8.1 closed by remote host.
Connection to 192.168.8.1 closed.
  • Verify the “US” Offset
1
2
3
4
5
root@GL-MT3600BE:~# hexdump -v -e '"%_ad: " 16/1 "%02X " "\n"' /dev/mtdblock3 | grep ^16512:
16512: 00 00 00 00 00 00 00 00 55 53 00 00 00 00 00 00

root@GL-MT3600BE:~# dd if=/dev/mtdblock3 bs=1 skip=16520 count=2 2>/dev/null
US

GL.iNet GL-MT3600BE Applications

GL.iNet GL-MT3600BE Toggle Button Settings

GL.iNet GL-MT3600BE VPN

  • After the change on GL.iNet Mobile

GL.iNet GL-MT3600BE Plugins

GL.iNet GL-MT3600BE Toggle Button Settings Mobile

NOTE: Disable IPv6 when install iStoreOS, e.g. from GL-iNet 系列路由器一键 iStoreOS 风格化脚本 https://github.com/wukongdaily/gl-inet-onescript

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
$ sh -c "$(curl -fsSL https://cafe.cpolar.cn/wkdaily/gl/raw/branch/main/mt3600.sh)"

***********************************************************************
*      一键安装工具箱(for gl-inet MT3600BE)  by @wukongdaily
**********************************************************************
*******支持的机型列表***************************************************
*******GL-iNet MT3600BE********

 1. GL-iNet MT3600BE 一键iStoreOS风格化

 2. 安装argon紫色主题

 3. 单独安装iStore商店

 4. 隐藏首页格式化按钮

 5. 设置风扇工作温度

 6. 安装个性化UI辅助插件(by VMatrices)

 7. 恢复出厂设置/重置路由器

 Q. 退出本程序

请选择一个选项:

GL.iNet GL-MT3600BE Services

References

MediaTek MT7925 Bluetooth stops working / turning on on Ubuntu 26.04 LTS

Guestbook

MediaTek MT7925 is an M.2 Wi-Fi 7 and Bluetooth 5.4 wireless network card which Wireless and BlueTooth are both supported by the latest Linux Kernel.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
$ uname -r
7.0.0-22-generic

$ lspci -k | grep -i -A3 network
01:00.0 Network controller: MEDIATEK Corp. MT7925 802.11be 160MHz 2x2 PCIe Wireless Network Adapter [Filogic 360]
	Subsystem: MEDIATEK Corp. MT7925 802.11be 160MHz 2x2 PCIe Wireless Network Adapter [Filogic 360]
	Kernel driver in use: mt7925e
	Kernel modules: mt7925e
02:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8125 2.5GbE Controller (rev 0c)

$ lsusb | grep -i mediatek
Bus 003 Device 002: ID 0e8d:7925 MediaTek Inc. Wireless_Device

$ rfkill list
0: hci0: Bluetooth
	Soft blocked: no
	Hard blocked: no
1: phy0: Wireless LAN
	Soft blocked: no
	Hard blocked: no

$ ls -al /lib/firmware/mediatek/mt7925/
...
-rw-r--r--  1 root root  459528 Mar 19 23:32 BT_RAM_CODE_MT7925_1_1_hdr.bin.zst
-rw-r--r--  1 root root  197811 Mar 19 23:32 WIFI_MT7925_PATCH_MCU_1_1_hdr.bin.zst
-rw-r--r--  1 root root 1152702 Mar 19 23:32 WIFI_RAM_CODE_MT7925_1_1.bin.zst

MT7925 BlueTooth is usually exposed via USB (even though WiFi is PCIe).

1
2
3
4
$ dmesg | grep -i -E "bluetooth|mt7925|btmtk|firmware"
...
Bluetooth: hci0: Failed to get device id (-108) [   11.847463]
...

Failed to get device id (-108) is an ENOTUNIQ error from the USB/MMIO ID lookup in btusb/btmtk, often a known issue with MT7925 where the BlueTooth function doesn’t enumerate correctly or there’s a race during probe. This is a fairly common bug on MT7925 / 7925e cards on newer kernels.

The -108 error sometimes is caused by the BT USB device not being reset properly at boot. Try a full module reload in correct order:

1
2
3
4
5
6
7
8
9
10
11
$ sudo systemctl stop bluetooth

$ sudo lsof /dev/rfkill 2>/dev/null

$ sudo modprobe -r btusb
$ sudo modprobe -r btmtk

$ sudo modprobe btmtk
$ sudo modprobe btusb

$ sudo systemctl start bluetooth

Other like (-108) error:

1
2
3
4
5
$ dmesg | grep -i -E "bluetooth|mt7925|btmtk|firmware"
...
Bluetooth: hci0: Failed to get fw version (-108) [    8.050441] 
Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
...

can be addressed in the same approach above.

Other like (-110) error:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
$ dmesg | grep -i -E "bluetooth|mt7925|btmtk|firmware"
...
Bluetooth: hci0: Execution of wmt command timed out 
Bluetooth: hci0: Failed to send wmt patch dwnld (-110) 
Bluetooth: hci0: Failed to set up firmware (-110) 
Bluetooth: hci0: HCI Enhanced Setup Synchronous Connection command is advertised, but not supported.
...

$ rfkill unblock bluetooth

$ rfkill
ID TYPE      DEVICE      SOFT      HARD
 0 bluetooth hci0   unblocked unblocked
 1 wlan      phy0   unblocked unblocked

$ hciconfig
hci0:   Type: Primary  Bus: USB
        BD Address: 00:00:00:00:00:00  ACL MTU: 0:0  SCO MTU: 0:0
        DOWN
        RX bytes:0 acl:0 sco:0 events:0 errors:0
        TX bytes:61 acl:0 sco:0 commands:1 errors:0

$ sudo hciconfig -a hci0 up
Can't init device hci0: Connection timed out (110)

Fix it by Hardware Power Reset:

Often, MediaTek and other PCIe/USB combo cards get stuck in a low-power or un-responsive state that a simple reboot misses because power remains supplied to the motherboard.

  • Shut down your computer completely.
  • Unplug the power cable (and/or turn off the laptop and unplug the charger). Hold down the physical power button for 30 to 45 seconds to drain all residual charge from the system board.
  • Turn the machine back on and boot into Ubuntu.

References

Quick way convert Copilot skill/prompt to work with Kilo Code

Guestbook

Kilo Codedoesn't natively read **.github-based** Copilot skill/prompt/workflow/convention files — that format is specific toGitHub Copilot`’s custom instructions/prompts system.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
$ tree .github
.github
├── conventions
│   ├── component-test-patterns.md
│   ├── test-anti-patterns.md
│   └── unit-test-conventions.md
├── prompts
│   ├── gen-it-tests.prompt.md
│   ├── gen-unit-tests.prompt.md
│   ├── it-coverage-gap-analysis.prompt.md
│   ├── unit-test-coverage-gap-analysis.prompt.md
│   └── uplift-unit-tests.prompt.md
└── skills
    ├── integration-test-coverage-analysis
    │   ├── integration-test-coverage-classifier.md
    │   ├── integration-test-dependency-extractor.md
    │   ├── integration-test-evidence-collector.md
    │   ├── integration-test-freshness-checker.md
    │   ├── integration-test-gap-report-writer.md
    │   ├── integration-test-gateway-scanner.md
    │   ├── integration-test-scope-validator.md
    │   ├── SKILL.md
    │   └── templates
    │       ├── Component-test-analysis.md
    │       └── IT-analysis.md
    ├── integration-test-generator
    │   ├── integration-test-code-generator.md
    │   ├── integration-test-gap-discoverer.md
    │   ├── integration-test-option-selector.md
    │   ├── integration-test-plan-builder.md
    │   └── SKILL.md
    ├── shared
    │   ├── diff-analysis-ci.md
    │   ├── diff-analysis-ide.md
    │   ├── test-quality-rules.md
    │   └── tiered-model-strategy.md
    ├── unit-test-coverage-analysis
    │   ├── SKILL.md
    │   ├── templates
    │   │   └── unit-test-coverage-analysis-report.md
    │   ├── unit-test-codebase-analysis.md
    │   ├── unit-test-coverage-analysis-preflight.md
    │   ├── unit-test-diff-scope-analysis.md
    │   ├── unit-test-project-discovery.md
    │   └── unit-test-report-synthesis.md
    └── unit-test-generator
        ├── SKILL.md
        ├── unit-test-code-generator.md
        ├── unit-test-diff-coverage-resolver.md
        ├── unit-test-infrastructure-setup.md
        ├── unit-test-post-generation-verification.md
        └── unit-test-refactor-specialist.md

11 directories, 40 files

A quick way to convert to Kilo Code custom way:

  • Add Kilo Code directory structure
1
$ ln -s .github .kilo
  • Convert prompt to Kilo Code custom slash command
1
2
3
$ cd .github

$ ln -s prompts commands

In Kilo Code chat window, then can find and run command e.g. /gen-unit-tests.

Running remote X Window applications locally on Mac

Guestbook

On Mac, install XQuartz from https://www.xquartz.org/

On remote Linux host Aorus.local, make sure:

  • $DISPLAY
1
2
$ echo $DISPLAY
localhost:10.0
  • $XAUTHORITY
1
2
3
4
5
$ echo $XAUTHORITY
/home/terrence/.Xauthority

$ ls -al /home/terrence/.Xauthority
-rw------- 1 terrence terrence 51 Jun 13 20:11 /home/terrence/.Xauthority
  • sshd_config
1
2
3
4
5
$ grep -iE 'X11Forwarding|X11UseLocalhost|XAuthLocation' /etc/ssh/sshd_config
X11Forwarding yes
X11UseLocalhost yes

$ sudo systemctl restart sshd
  • xauth
1
2
3
4
5
6
7
$ which xauth
/usr/bin/xauth

$ xauth list
Aorus/unix:10  MIT-MAGIC-COOKIE-1  27e55a1edf7347d27957e71637f99ab2

$ xauth add localhost:10 MIT-MAGIC-COOKIE-1 27e55a1edf7347d27957e71637f99ab2

Then on Mac run:

1
$ ssh -Y Aorus.local

On Aorus.local:

1
$ firefox

Gnome Remote Desktop on Ubuntu 26.04

Guestbook

Latest Ubuntu 26.04 LTS has dropped the support of X11 Server and xRDP and moved to the adoption of Wayland Display Server. Old approach with xRDP doesn’t work anymore. The solution / fix is the new Gnome Remote Desktop.

Gnome Remote Desktop

Generate Remote Desktop Server self-signed certificate:

1
2
3
4
$ sudo openssl req -newkey rsa:2048 -nodes -keyout /var/lib/gnome-remote-desktop/rdp-tls.key -x509 -days 3650 -out /var/lib/gnome-remote-desktop/rdp-tls.crt -subj "/CN=$(hostname)"

$ sudo chown gnome-remote-desktop:gnome-remote-desktop /var/lib/gnome-remote-desktop/rdp-tls.key
$ sudo chown gnome-remote-desktop:gnome-remote-desktop /var/lib/gnome-remote-desktop/rdp-tls.crt

Register self-signed certificate with the system daemon:

1
2
3
4
5
6
7
$ sudo grdctl --system rdp set-tls-key /var/lib/gnome-remote-desktop/rdp-tls.key
$ sudo grdctl --system rdp set-tls-cert /var/lib/gnome-remote-desktop/rdp-tls.crt

$ sudo grdctl --system rdp set-credentials $(whoami) rdp-user-password

$ sudo grdctl --system rdp enable
$ sudo systemctl restart gnome-remote-desktop.service

After Gnome Remote Desktop restarted, in the log:

1
2
3
4
5
6
7
$ sudo journalctl -u gnome-remote-desktop.service -f
...
Jun 06 22:21:17 Aorus systemd[1]: Starting gnome-remote-desktop.service - GNOME Remote Desktop...
Jun 06 22:21:17 Aorus gnome-remote-desktop-daemon[24618]: Init TPM credentials failed because Failed to initialize transmission interface context: tcti:IO failure, using GKeyFile as fallback
Jun 06 22:21:17 Aorus systemd[1]: Started gnome-remote-desktop.service - GNOME Remote Desktop.
Jun 06 22:21:17 Aorus gnome-remote-desktop-daemon[24618]: RDP server started

Show Remote Desktop Server status:

1
2
3
4
5
6
7
8
9
10
11
12
13
$ sudo grdctl --system status --show-credentials
Overall:
        Unit status: active
RDP:
        Status: enabled
        Port: 3389
        Authentication methods: credentials
        TLS certificate: /var/lib/gnome-remote-desktop/rdp-tls.crt
        TLS fingerprint: 71:f1:20:64:fe:e3:58:97:95:8d
        TLS key: /var/lib/gnome-remote-desktop/rdp-tls.key
        Kerberos keytab: (null)
        Username: terrence
        Password: rdp-user-password

When connect from Windows App (Microsoft Remote Desktop), error thrown in log:

1
2
3
4
5
$ sudo journalctl -u gnome-remote-desktop.service -f
...
Jun 02 12:40:22 NucBox gnome-remote-desktop-daemon[58071]: [RDP] Sending server redirection
Jun 02 12:40:22 NucBox gnome-remote-desktop-daemon[58071]: [12:40:22:884] [58071:0004752e] [ERROR][com.freerdp.core.peer] - [rdp_set_error_info]: ERRINFO_LOGOFF_BY_USER [0x0001000C]
Jun 02 12:40:22 NucBox gnome-remote-desktop-daemon[58071]: [RDP] Network or intentional disconnect, stopping session

However, choose a different Remote Desktop Client like Royal TSX https://royalapps.com/ts/mac/features, works fine.

NOTE: This is a well-documented, well-known incompatibility between Windows App on macOS and GNOME Remote Desktop’s “server redirection” handshake — not something specific to 26.04, and there’s a widely confirmed fix.

What’s actually happening: in “Remote Login” (system) mode, GNOME Remote Desktop doesn’t hand you straight into a session. It first accepts the connection, then sends an RDP Server Redirection PDU telling the client “reconnect, here’s the real session token” (that’s [RDP] Sending server redirection line — this part is normal and means auth succeeded). Windows App on Mac has a bug/quirk where it doesn’t follow that redirection properly by default, so it just logs off immediately — hence ERRINFO_LOGOFF_BY_USER right after.

  1. Export the connection as an .rdp file

  2. Edit the file to force redirection handling - Find the line use redirection server name:i:0 and change the 0 to a 1. This is the specific setting Windows App needs to correctly follow GNOME’s server-redirection handshake instead of dropping the session.

  3. Delete old entry and import the edited .rdp file into Windows App

References