{
  "Scenario": "Local integrated full-history read",
  "RawArtifact": "artifacts/reverse-engineering/instrumented-cclientcommon-startquery-correlation",
  "InstrumentedTokens": {
    "HistorianClient.OpenConnection": "0x060055D8",
    "Query.StartDataQuery": "0x0600574B",
    "aahClientCommon.CClientCommon.StartQuery": "0x06002E86",
    "CRetrievalConnectionWCF.StartQuery2": "0x06004A0D",
    "CRetrievalConnectionWCF.GetNextQueryResultBuffer2": "0x06004A0E",
    "HistorianClient.GetNextRow<DataQueryResultRow>": "0x0600588D"
  },
  "Observed": {
    "OpenConnectionSuccess": 1,
    "LegacyClientHandle": 2,
    "StartDataQueryClientHandleCandidate": 2,
    "CClientCommonQueryHandleBeforeCall": 0,
    "CClientCommonClientHandleForConnection": "<transient-redacted>",
    "WcfStartQuery2ClientHandle": "<same-as-CClientCommonClientHandleForConnection>",
    "WcfStartQuery2Success": 1,
    "WcfStartQuery2QueryRequestType": 1,
    "WcfStartQuery2RequestSize": 251,
    "WcfStartQuery2ResponseSize": 31,
    "WcfStartQuery2ResponseSha256": "4c062b5ce8181308f0f46bfd8c6088acb52e6ade94401651b7d3ccc8952edfb5",
    "WcfStartQuery2ServerQueryHandle": "<transient-redacted>",
    "CClientCommonCallSuccess": 1,
    "CClientCommonQueryHandleAfterCall": "<same-as-WcfStartQuery2ServerQueryHandle>",
    "WcfGetNextClientHandle": "<same-as-CClientCommonClientHandleForConnection>",
    "WcfGetNextQueryHandle": "<same-as-WcfStartQuery2ServerQueryHandle>",
    "WcfGetNextResultSize": 570,
    "WcfGetNextResultSha256": "1bb1e1f55b226ed2e10f0a251d1a65be0daf6ecf7bff05ab9bd11e5870c5e615",
    "ManagedGetNextRowQueryHandle": 1,
    "ManagedGetNextRowMemorySha256": "96f4f04f56531d749f17e103f620f45a23d51f63dfcaba49b02a8e12a317efa4"
  },
  "Conclusion": "The successful read path does not use CRetrieval/CSrvRetrieval/CRetrievalConsoleClient for the WCF retrieval handle. aahClientCommon.CClientCommon.StartQuery obtains the accepted /Retr client handle from a CClient vtable call at IL offset 0x01A3, then passes it into the WCF StartQuery2 vtable call at IL offset 0x01BC. The server query handle written by WCF StartQuery2 is copied back through the same queryHandle pointer."
}