Initial project state: .NET reference, design, Rust port (M0+M1), evidence

Layout:
- src/                    .NET 10 x64 reference: MxNativeCodec, MxNativeClient,
                          MxAsbClient, probes, tests, harnesses. Executable spec.
- design/                 Architectural plan for the Rust port (M0–M6), error
                          model, protocol invariants, risks (R1–R16), adversarial
                          review log (review.md).
- rust/                   Rust workspace. M0 skeleton + M1 codec parity.
                          mxaccess-codec: 215 unit tests + 2 cross-implementation
                          parity tests (byte-identical against .NET reference).
                          Other crates are M0 stubs awaiting M2+.
- captures/               Frida + netsh + pcap evidence per CLAUDE.md
                          ("captures are evidence, not throwaway logs").
- analysis/               Decompiled C# (frida/proxy/decompiled-*),
                          Ghidra exports for native DLLs (`exports/` only —
                          working state at `projects/` and AVEVA's input
                          binaries at `input/` are gitignored).
- docs/                   Reverse-engineering reference docs.
- tools/                  Setup-LiveProbeEnv.ps1 (Infisical credential fetcher),
                          Compute-Crc.ps1 (.NET parity helper).
- .github/workflows/      Rust CI: fmt + build + test + clippy on Windows.
- LICENSE                 MIT (Joseph Doherty, 2026).

Verified:
- cargo test --workspace → 217 passed (215 unit + 2 .NET parity), 0 failed
- cargo clippy --workspace -- -D warnings → clean
- cargo fmt --all -- --check → clean
- cargo publish --dry-run -p mxaccess-codec → packages cleanly

Excluded from history (see .gitignore):
- **/bin, **/obj, **/target — build artifacts
- analysis/ghidra/projects/ — Ghidra working state (regenerable)
- analysis/ghidra/input/ — AVEVA proprietary DLLs (vendor IP)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

analysis/scripts/extract_nmxsvcps_layout.py

@@ -0,0 +1,107 @@
+from __future__ import annotations
+
+import argparse
+import csv
+import uuid
+from pathlib import Path
+
+import pefile
+
+
+IMAGE_BASE = 0x10000000
+PROXY_VTBL_LIST = 0x10007CC8
+STUB_VTBL_LIST = 0x10007CE4
+NAME_LIST = 0x10007D00
+INTERFACE_COUNT = 6
+
+
+def u16(data: bytes, offset: int) -> int:
+    return int.from_bytes(data[offset:offset + 2], "little")
+
+
+def u32(data: bytes, offset: int) -> int:
+    return int.from_bytes(data[offset:offset + 4], "little")
+
+
+class PeView:
+    def __init__(self, path: Path):
+        self.pe = pefile.PE(str(path))
+        self.data = bytes(self.pe.__data__)
+        self.base = self.pe.OPTIONAL_HEADER.ImageBase
+
+    def offset(self, va: int) -> int:
+        return self.pe.get_offset_from_rva(va - self.base)
+
+    def u16(self, va: int) -> int:
+        return u16(self.data, self.offset(va))
+
+    def u32(self, va: int) -> int:
+        return u32(self.data, self.offset(va))
+
+    def guid(self, va: int) -> str:
+        return str(uuid.UUID(bytes_le=self.data[self.offset(va):self.offset(va) + 16])).upper()
+
+    def asciiz(self, va: int) -> str:
+        start = self.offset(va)
+        end = self.data.index(b"\x00", start)
+        return self.data[start:end].decode("ascii")
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--dll",
+        type=Path,
+        default=Path(r"C:\Program Files (x86)\ArchestrA\Framework\Bin\NmxSvcps.dll"),
+    )
+    parser.add_argument("--out", type=Path, default=Path("analysis/proxy/nmxsvcps-proxy-layout.tsv"))
+    args = parser.parse_args()
+
+    pe = PeView(args.dll)
+    args.out.parent.mkdir(parents=True, exist_ok=True)
+
+    with args.out.open("w", encoding="utf-8", newline="") as handle:
+        writer = csv.writer(handle, delimiter="\t", lineterminator="\n")
+        writer.writerow([
+            "interface_index",
+            "name",
+            "iid",
+            "iid_va",
+            "method_count",
+            "user_method_count",
+            "proxy_vtbl_va",
+            "stub_vtbl_va",
+            "proxy_info_va",
+            "proxy_info_words",
+        ])
+
+        for index in range(INTERFACE_COUNT):
+            name_va = pe.u32(NAME_LIST + index * 4)
+            name = pe.asciiz(name_va)
+            proxy_vtbl = pe.u32(PROXY_VTBL_LIST + index * 4)
+            stub_vtbl = pe.u32(STUB_VTBL_LIST + index * 4)
+            proxy_info = pe.u32(proxy_vtbl)
+            iid_va = pe.u32(proxy_vtbl + 4)
+            method_count = pe.u32(stub_vtbl + 8)
+            user_method_count = max(0, method_count - 3)
+            proxy_info_words = [pe.u32(proxy_info + i * 4) for i in range(8)]
+
+            writer.writerow([
+                index,
+                name,
+                pe.guid(iid_va),
+                f"0x{iid_va:08x}",
+                method_count,
+                user_method_count,
+                f"0x{proxy_vtbl:08x}",
+                f"0x{stub_vtbl:08x}",
+                f"0x{proxy_info:08x}",
+                ",".join(f"0x{word:08x}" for word in proxy_info_words),
+            ])
+
+    print(f"wrote {args.out}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())