Files
histsdk/docs/reverse-engineering/cclientcommon-startquery-correlation-latest.json
T
dohertj2 c95824a65d Initial commit: managed .NET 10 AVEVA Historian SDK + reverse-engineering toolkit
Full read-only SDK (src/AVEVA.Historian.Client) implementing the CLAUDE.md required
surface against AVEVA Historian's binary WCF protocol — no native AVEVA runtime
dependency. All operations live-verified against a local Historian:

- ProbeAsync, ReadRawAsync, ReadAggregateAsync, ReadAtTimeAsync, ReadEventsAsync
- BrowseTagNamesAsync, GetTagMetadataAsync (17 native data-type codes mapped)
- GetConnectionStatusAsync, GetStoreForwardStatusAsync, GetSystemParameterAsync
- 108/108 unit + integration tests pass

Includes the reverse-engineering toolkit (tools/AVEVA.Historian.ReverseEngineering)
used to decode the protocol: WCF probes, IL inspection via dnlib, and IL-rewrite
instrumentation (instrument-wcf-{write,read}message etc.) plus the .NET Framework
trace harness (tools/AVEVA.Historian.NativeTraceHarness) for parity testing.

Sanitized handoff evidence under docs/reverse-engineering/. Native AVEVA binaries
(current/, aveva-install-x64/, aveva-install-x86/) are gitignored — fetch separately
from the AVEVA installer.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-04 06:31:48 -04:00

36 lines
2.1 KiB
JSON

{
"Scenario": "Local integrated full-history read",
"RawArtifact": "artifacts/reverse-engineering/instrumented-cclientcommon-startquery-correlation",
"InstrumentedTokens": {
"HistorianClient.OpenConnection": "0x060055D8",
"Query.StartDataQuery": "0x0600574B",
"aahClientCommon.CClientCommon.StartQuery": "0x06002E86",
"CRetrievalConnectionWCF.StartQuery2": "0x06004A0D",
"CRetrievalConnectionWCF.GetNextQueryResultBuffer2": "0x06004A0E",
"HistorianClient.GetNextRow<DataQueryResultRow>": "0x0600588D"
},
"Observed": {
"OpenConnectionSuccess": 1,
"LegacyClientHandle": 2,
"StartDataQueryClientHandleCandidate": 2,
"CClientCommonQueryHandleBeforeCall": 0,
"CClientCommonClientHandleForConnection": "<transient-redacted>",
"WcfStartQuery2ClientHandle": "<same-as-CClientCommonClientHandleForConnection>",
"WcfStartQuery2Success": 1,
"WcfStartQuery2QueryRequestType": 1,
"WcfStartQuery2RequestSize": 251,
"WcfStartQuery2ResponseSize": 31,
"WcfStartQuery2ResponseSha256": "4c062b5ce8181308f0f46bfd8c6088acb52e6ade94401651b7d3ccc8952edfb5",
"WcfStartQuery2ServerQueryHandle": "<transient-redacted>",
"CClientCommonCallSuccess": 1,
"CClientCommonQueryHandleAfterCall": "<same-as-WcfStartQuery2ServerQueryHandle>",
"WcfGetNextClientHandle": "<same-as-CClientCommonClientHandleForConnection>",
"WcfGetNextQueryHandle": "<same-as-WcfStartQuery2ServerQueryHandle>",
"WcfGetNextResultSize": 570,
"WcfGetNextResultSha256": "1bb1e1f55b226ed2e10f0a251d1a65be0daf6ecf7bff05ab9bd11e5870c5e615",
"ManagedGetNextRowQueryHandle": 1,
"ManagedGetNextRowMemorySha256": "96f4f04f56531d749f17e103f620f45a23d51f63dfcaba49b02a8e12a317efa4"
},
"Conclusion": "The successful read path does not use CRetrieval/CSrvRetrieval/CRetrievalConsoleClient for the WCF retrieval handle. aahClientCommon.CClientCommon.StartQuery obtains the accepted /Retr client handle from a CClient vtable call at IL offset 0x01A3, then passes it into the WCF StartQuery2 vtable call at IL offset 0x01BC. The server query handle written by WCF StartQuery2 is copied back through the same queryHandle pointer."
}