Joseph Doherty 630295bd18 docs: QueryTag native-RE attempt — lightweight tooling insufficient, needs Ghidra ...

Recorded the native-disassembly attempt on aahClientManaged.dll (mixed-mode):
ilspycmd cannot decompile it; capstone byte-search can't locate the StartTagQuery
0x6751 marker (not a plain immediate — it's an .rdata constant loaded RIP-relative,
the .text "51 67 00 00" hits are coincidental jump-table data). Managed metadata
gives QueryTag field semantics but not the binary packet-id. Finishing QueryTag
needs Ghidra/IDA xref analysis or the live IL-rewrite capture.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6mcaT2PjRFKcogzp9UkfC

2026-06-21 15:46:54 -04:00

..

aahclient-exports-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

capture-manifest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

capture-workflow.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

cclientbase-open-correlation-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

cclientcommon-startquery-correlation-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

cserverclient-handle-correlation-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

data-query-request-ctor-il-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

debian-relay-history-latest.pid

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-historianclient-getnexteventrow-target-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-historianclient-getnextrow-target-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-historianclient-startdataquery-target-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-historyquery-movenext-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-historyquery-startquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-query-startdataquery-il-window-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-query-startdataquery-target-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-query-starteventquery-il-window-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-query-starteventquery-save-window-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-sbytestream-getdata-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-sbytestream-getlength-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dnlib-write-copy-probe-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dumpbin-aahclientmanaged-dependents-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dumpbin-aahclientmanaged-imports-filtered-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dumpbin-aahclientmanaged-imports-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

dumpbin-aahclientmanaged-ws2-imports-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

frida-aahclientmanaged-hook-pass.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

getnexteventrow-memory-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

getnextrow-dataqueryresultrow-memory-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

getnextrow-interpolated-memory-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

getnextrow-timeweightedaverage-memory-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

grpc-tag-query-odata.md

docs: QueryTag native-RE attempt — lightweight tooling insufficient, needs Ghidra

2026-06-21 15:46:54 -04:00

handoff.md

Cross-platform NegotiateAuthentication; StorageType field; docs polish

2026-05-04 22:19:37 -04:00

ildasm-classlist-filtered-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

ildasm-historyquery-movenext-excerpt-latest.il

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

ildasm-historyquery-startquery-excerpt-latest.il

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

implementation-status.md

Wire ApplyScaling, StorageRate; close out write-commands plan

2026-05-04 22:04:27 -04:00

instrument-getnexteventrow-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

instrument-getnextrow-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

instrument-startdataquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

instrument-starteventquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

instrument-starttagquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

instrument-wcf-readquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

like-tag-browse-response-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

loaded-modules-aahclientmanaged-read-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

managed-wrapper-findings.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

method-inventory-eventquery-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

method-inventory-scrtmemfile-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-addtag-frida-child.err

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-addtag-frida-child.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-remote-capture-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-vs-capture-server-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-wcf-capture-harness.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-event-wcf-capture-server.err

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-exports.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-open-capture-server.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-cyclic-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-event-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-full-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-integrated-read-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-interpolated-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-direct-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-direct-wildcard-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-odata-alt-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-odata-name-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-odata-tagname-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-prefix-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-tag-wildcard-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-timeweightedaverage-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-via-debian-relay-direct-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-via-debian-relay-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-via-debian-relay-rewrite-event-direct-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-via-debian-relay-rewrite-event-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

native-trace-harness-via-debian-relay-rewrite-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

openconnection3-correlation-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

pktmon-debian-relay-history-latest.harness.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

pktmon-debian-relay-history-latest.summary.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

pktmon-debian-relay-history-latest.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

query-handle-correlation-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

runtime-method-pointers-before-history-start-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

runtime-method-pointers-getnextrow-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

runtime-method-pointers-startdataquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

runtime-method-pointers-starteventquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

runtime-method-pointers-startquery-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

startdataquery-interpolated-request-buffer-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

startdataquery-request-buffer-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

startdataquery-timeweightedaverage-request-buffer-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

starteventquery-request-buffer-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

starttagquery-request-buffer-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

tagquery-gettaginfo-response-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-add-event-tag-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-capture-event-request-latest.err

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-capture-native-event-latest.err.txt

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-capture-remote-event-latest.err

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-cert-probe-localhost-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-cert-probe-remote-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-cert-probe-remote-localhost-identity-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-contract-evidence.md

Wire ApplyScaling, StorageRate; close out write-commands plan

2026-05-04 22:04:27 -04:00

wcf-open2-localhost.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-open2-remote-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-open-localhost.md

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-probe-localhost.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-probe-remote-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-register-event-tag-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-start-event-query-attempts-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-start-query-remote-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00

wcf-status-localhost.md

docs: reclassify M1a R1.1/R1.3 as blocked on 2020 WCF

2026-06-20 15:22:53 -04:00

wcf-string-handle-wall.md

docs: map the 2020 WCF string-handle wall (R1.4 GETHI blocked)

2026-06-20 15:32:15 -04:00

wcf-tag-info-remote-latest.json

Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit

2026-05-04 06:31:48 -04:00