dohertj2/histsdk
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

feat(grpc-events): implement aahCryptV2 token — v8 ExchangeKey auth now passes live

Browse Source 
Implements the reverse-engineered v8 credential token in pure managed code and
wires the full event-connection auth chain. Live result: the v8 OpenConnection
now AUTHENTICATES against the 2023 R2 server (past the 132/171 AuthenticationFailed
wall) — the crypto is solved.

- HistorianNativeHandshake.DeriveExchangeKeyClientKey: client key = SHA256(ECDH
  shared secret) via ECDiffieHellman.DeriveKeyFromHash(SHA256), matching the native
  ECDiffieHellmanCng{Hash,SHA256}.DeriveKeyMaterial.
- BuildExchangeKeyCredentialToken + Rc4: token = RC4(password-UTF16LE, key=MD5(clientKey)).
  Reproduces a live-captured token EXACTLY (verified offline) — the native
  HistorianCrypto.NRC4_V2.aahCryptV2 scheme (MD5-keyed RC4). Pure managed; nothing
  AVEVA shipped. RC4 pinned by the standard test vector.
- OpenSession(eventConnection:true): ExchangeKey -> derive client key -> token ->
  v8 OpenConnection with ConnectionType=Event + the token. Orchestrator re-armed.
- HistorianAddTagsProtocol.SerializeCmEventEnsureTagsGrpc: the 86-byte native gRPC
  CM_EVENT EnsureTags (8-byte header + ...2f27 event-type GUID), replacing the
  2020 WCF 83-byte CTagMetadata on the gRPC event registration.

Goldens: RC4 standard vector + token construction. 326/326 offline.

KNOWN REMAINING: the event query still returns zero rows (GetNext yields a 10-byte
zero-row buffer). Auth + StartEventQuery succeed; the query-layer detail (vs the
native row-returning capture) is the last step. Gated test still pins the no-row
throw; opt-in diagnostic (HISTORIAN_GRPC_EVENT_DIAG) surfaces the journey.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC
This commit is contained in:
Joseph Doherty
2026-06-23 11:46:00 -04:00
parent c45f1a957b
commit 6d0f5c4b8f
6 changed files with 160 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/AVEVA.Historian.Client/Wcf/HistorianAddTagsProtocol.cs
+34
View File
@@ -44,6 +44,40 @@ internal static class HistorianAddTagsProtocol
/// </remarks>
public static readonly Guid CommonArchestraEventTypeId = new("5f59ae42-3bb6-4760-91a5-ab0be01f9f02");
/// <summary>
/// The CM_EVENT event-type GUID used by the 2023 R2 <b>gRPC</b> EnsureTags (captured ending
/// <c>…e0 1f 2f 27</c>) — distinct from the 2020 WCF capture's <see cref="CommonArchestraEventTypeId"/>
/// (<c>…9f02</c>).
/// </summary>
public static readonly Guid CommonArchestraEventTypeIdGrpc = new("5f59ae42-3bb6-4760-91a5-ab0be01f2f27");
/// <summary>
/// Builds the native 2023 R2 <b>gRPC</b> CM_EVENT <c>EnsureTags.tagInfos</c> buffer (86 bytes,
/// captured byte-for-byte). Differs from the 2020 WCF <see cref="SerializeCmEventCTagMetadata"/>:
/// it is wrapped in an 8-byte EnsureTags header (<c>4E 67 03 00 01 00 00 00</c>), uses the
/// <see cref="CommonArchestraEventTypeIdGrpc"/> event-type GUID, and has no trailing bytes after it.
/// Used by the gRPC event registration so the server actually establishes CM_EVENT and the event
/// query returns rows.
/// </summary>
public static byte[] SerializeCmEventEnsureTagsGrpc(DateTime createdUtc)
{
using MemoryStream stream = new();
using BinaryWriter writer = new(stream, Encoding.Unicode, leaveOpen: true);
writer.Write(new byte[] { 0x4E, 0x67, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00 }); // EnsureTags header (count 1)
writer.Write((byte)3);
writer.Write((ushort)0x0086);
writer.Write((byte)5);
writer.Write(CmEventTagId.ToByteArray());
WriteCompressedHistorianString(writer, "CM_EVENT");
WriteCompressedHistorianString(writer, "AnE Event");
writer.Write(new byte[] { 0x02, 0x02, 0x01, 0x00, 0x00, 0x00, 0x01 });
writer.Write(0u);
writer.Write(createdUtc.ToUniversalTime().ToFileTimeUtc());
writer.Write(CommonArchestraEventTypeIdGrpc.ToByteArray());
return stream.ToArray();
}
public static byte[] SerializeCmEventCTagMetadata(DateTime createdUtc)
{
using MemoryStream stream = new();
src/AVEVA.Historian.Client/Wcf/HistorianNativeHandshake.cs
+48 -5
View File
@@ -56,9 +56,11 @@ internal static class HistorianNativeHandshake
/// <summary>
/// Parses the server's <c>ExchangeKey</c> hello (same <c>"ECK1" + u32 + X + Y</c> shape) and
/// derives the raw ECDH shared secret against <paramref name="ecdh"/>.
/// derives the 32-byte client key = <b>SHA256(ECDH shared secret)</b>. This matches the native
/// client, which uses <c>ECDiffieHellmanCng { KeyDerivationFunction=Hash, HashAlgorithm=SHA256 }
/// .DeriveKeyMaterial(...)</c> — i.e. the hash KDF over the raw agreement.
/// </summary>
public static byte[] DeriveExchangeKeySecret(ECDiffieHellman ecdh, byte[] serverHello)
public static byte[] DeriveExchangeKeyClientKey(ECDiffieHellman ecdh, byte[] serverHello)
{
const int headerLength = 8; // 4-byte magic + 4-byte coordinate length
int needed = headerLength + (2 * ExchangeKeyCoordinateBytes);
@@ -76,7 +78,48 @@ internal static class HistorianNativeHandshake
Q = new ECPoint { X = x, Y = y },
};
using ECDiffieHellman serverKey = ECDiffieHellman.Create(serverParameters);
return ecdh.DeriveRawSecretAgreement(serverKey.PublicKey);
return ecdh.DeriveKeyFromHash(serverKey.PublicKey, HashAlgorithmName.SHA256);
}
/// <summary>
/// Builds the v8 credential token: <c>RC4(password-UTF16LE, key = MD5(clientKey))</c>, where
/// <paramref name="clientKey"/> is the <see cref="DeriveExchangeKeyClientKey"/> result
/// (SHA256 of the ECDH secret). Reverse-engineered from the native <c>HistorianCrypto.NRC4_V2
/// .aahCryptV2</c> scheme (MD5-keyed RC4) and verified to reproduce a live-captured token exactly.
/// The server, sharing the ECDH secret, RC4-decrypts this to recover and validate the password.
/// Pure managed; nothing AVEVA is shipped.
/// </summary>
public static byte[] BuildExchangeKeyCredentialToken(byte[] clientKey, string password)
{
byte[] rc4Key = MD5.HashData(clientKey);
byte[] plaintext = System.Text.Encoding.Unicode.GetBytes(password ?? string.Empty);
return Rc4(rc4Key, plaintext);
}
internal static byte[] Rc4(byte[] key, byte[] data)
{
int[] s = new int[256];
for (int i = 0; i < 256; i++)
{
s[i] = i;
}
for (int i = 0, j = 0; i < 256; i++)
{
j = (j + s[i] + key[i % key.Length]) & 0xFF;
(s[i], s[j]) = (s[j], s[i]);
}
byte[] output = new byte[data.Length];
for (int i = 0, j = 0, n = 0; n < data.Length; n++)
{
i = (i + 1) & 0xFF;
j = (j + s[i]) & 0xFF;
(s[i], s[j]) = (s[j], s[i]);
output[n] = (byte)(data[n] ^ s[(s[i] + s[j]) & 0xFF]);
}
return output;
}
private static byte[] LeftPadCoordinate(byte[] coordinate)
@@ -218,7 +261,7 @@ internal static class HistorianNativeHandshake
/// the v6 path already relies on (it sends a zeroed credential block). See
/// docs/reverse-engineering/grpc-event-query-capture.md.
/// </summary>
public static byte[] BuildEventOpenConnectionVersion8Request(Guid contextKey, string userName)
public static byte[] BuildEventOpenConnectionVersion8Request(Guid contextKey, string userName, byte[] credentialToken)
{
Process current = Process.GetCurrentProcess();
string machineName = Environment.MachineName;
@@ -244,7 +287,7 @@ internal static class HistorianNativeHandshake
NativeConnectionTypeEvent,
NativeConnectionFlagEvent,
userName ?? string.Empty,
credentialToken: new byte[CredentialTokenSizeBytes]);
credentialToken ?? []);
}
/// <summary>