histsdk/docs/reverse-engineering/native-open-capture-server.md

Native Open Capture Server

tools\AVEVA.Historian.WcfCaptureServer is a reverse-engineering-only WCF server that hosts:

net.tcp://localhost:33268/Hist

It implements the decompiled HistoryServiceContract.IHistoryServiceContract shape and logs OpenConnection/Open2 argument metadata as JSON. Credential and opaque input buffers are not printed; the tool records lengths and SHA-256 hashes only. This tool is not referenced by the production SDK.

Current result

The server builds and listens successfully:

dotnet build tools\AVEVA.Historian.WcfCaptureServer\AVEVA.Historian.WcfCaptureServer.csproj
tools\AVEVA.Historian.WcfCaptureServer\bin\Debug\net481\AVEVA.Historian.WcfCaptureServer.exe 33268

Calling ArchestrA.HistorianAccess.OpenConnection with TcpPort = 33268 against localhost returned success from the native wrapper but did not hit the capture server. A follow-up with TcpPort = 1 also connected successfully to the real local Historian, proving the wrapper ignores TcpPort for the local machine path. Calling 127.0.0.1:33268 did not connect.

Current interpretation: the public wrapper detects localhost as a local server name and uses the installed local Historian endpoint rather than the requested test port. The local mock server cannot intercept Open2 without redirecting or stopping the real local endpoint, which is outside the safe automated path.

Useful follow-up

To use this capture server, the native wrapper must be made to treat the target as remote while routing traffic to this machine on the real Historian port, or the lower-level native client export must be called directly. The most useful targets are:

• CHistoryConnectionWCF::OpenConnection3
• CClientInfo::SerializeOpenConnectionInParams3
• CClientInfo::EncryptWithClientKey
• CClientInfo::GetPwdString

Frida is installed on this machine and can attach to the native PowerShell process, but aahClientManaged.dll does not expose native symbols. The next step is address discovery for those internal functions, then Frida hooks for the serialized input buffer.