Files
histsdk/docs/reverse-engineering/cclientbase-open-correlation-latest.json
T
dohertj2 c95824a65d Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit
Full read-only SDK (src/AVEVA.Historian.Client) implementing the CLAUDE.md required
surface against AVEVA Historian's binary WCF protocol — no native AVEVA runtime
dependency. All operations live-verified against a local Historian:

- ProbeAsync, ReadRawAsync, ReadAggregateAsync, ReadAtTimeAsync, ReadEventsAsync
- BrowseTagNamesAsync, GetTagMetadataAsync (17 native data-type codes mapped)
- GetConnectionStatusAsync, GetStoreForwardStatusAsync, GetSystemParameterAsync
- 108/108 unit + integration tests pass

Includes the reverse-engineering toolkit (tools/AVEVA.Historian.ReverseEngineering)
used to decode the protocol: WCF probes, IL inspection via dnlib, and IL-rewrite
instrumentation (instrument-wcf-{write,read}message etc.) plus the .NET Framework
trace harness (tools/AVEVA.Historian.NativeTraceHarness) for parity testing.

Sanitized handoff evidence under docs/reverse-engineering/. Native AVEVA binaries
(current/, aveva-install-x64/, aveva-install-x86/) are gitignored — fetch separately
from the AVEVA installer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-04 06:31:48 -04:00

33 lines
2.0 KiB
JSON

{
"Scenario": "Local integrated full-history read",
"RawArtifact": "artifacts/reverse-engineering/instrumented-cclientbase-open-correlation",
"InstrumentedTokens": {
"HistorianClient.OpenConnection": "0x060055D8",
"aahClientCommon.CClientBase.OpenConnection": "0x0600388D",
"Query.StartDataQuery": "0x0600574B",
"aahClientCommon.CClientCommon.StartQuery": "0x06002E86",
"CRetrievalConnectionWCF.StartQuery2": "0x06004A0D"
},
"Observed": {
"OpenConnectionSuccess": 1,
"LegacyClientHandle": 2,
"CClientBaseInitialHandle": 0,
"CClientBasePrimaryOpenRecords": 0,
"CClientBaseSecondaryOpenSuccess": 1,
"CClientBaseHandleAfterSecondaryOpen": "<transient-redacted>",
"StartDataQueryClientHandleCandidate": 2,
"CClientCommonClientHandleForConnection": "<same-as-CClientBaseHandleAfterSecondaryOpen>",
"WcfStartQuery2ClientHandle": "<same-as-CClientBaseHandleAfterSecondaryOpen>",
"WcfStartQuery2Success": 1,
"WcfStartQuery2ServerQueryHandle": "<transient-redacted>",
"CClientCommonQueryHandleAfterCall": "<same-as-WcfStartQuery2ServerQueryHandle>",
"ManagedGetNextRowQueryHandle": 1
},
"Hashes": {
"WcfStartQuery2ResponseSha256": "4c062b5ce8181308f0f46bfd8c6088acb52e6ade94401651b7d3ccc8952edfb5",
"WcfGetNextResultSha256": "d90f74b9d83eb615a0c16d3241e5884e65abfb31d28cce110dbf37b35a17def5",
"ManagedGetNextRowMemorySha256": "316893e5f783819793b8a2f68c0c4b1d70bbbf5a3201b054d4b43ffbe6bed15c"
},
"Conclusion": "CClientBase.OpenConnection starts with the vtable offset 24 handle equal to zero. The primary-open instrumentation did not fire on this local integrated path. The secondary open branch succeeds and the vtable offset 24 handle after that branch exactly matches the later CClientCommon.StartQuery client handle and WCF StartQuery2 client handle. The next reverse-engineering target is the secondary open vtable call at CClientBase.OpenConnection IL offset 0x06D4 and its request/response contract."
}