dohertj2/mxaccess
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
mxaccess/analysis/native/NmxSvcps.dll.md
T
Joseph Doherty fe2a6db786
rust / build / test / clippy / fmt (push) Has been cancelled
Details
Initial project state: .NET reference, design, Rust port (M0+M1), evidence 
Layout:
- src/                    .NET 10 x64 reference: MxNativeCodec, MxNativeClient,
                          MxAsbClient, probes, tests, harnesses. Executable spec.
- design/                 Architectural plan for the Rust port (M0–M6), error
                          model, protocol invariants, risks (R1–R16), adversarial
                          review log (review.md).
- rust/                   Rust workspace. M0 skeleton + M1 codec parity.
                          mxaccess-codec: 215 unit tests + 2 cross-implementation
                          parity tests (byte-identical against .NET reference).
                          Other crates are M0 stubs awaiting M2+.
- captures/               Frida + netsh + pcap evidence per CLAUDE.md
                          ("captures are evidence, not throwaway logs").
- analysis/               Decompiled C# (frida/proxy/decompiled-*),
                          Ghidra exports for native DLLs (`exports/` only —
                          working state at `projects/` and AVEVA's input
                          binaries at `input/` are gitignored).
- docs/                   Reverse-engineering reference docs.
- tools/                  Setup-LiveProbeEnv.ps1 (Infisical credential fetcher),
                          Compute-Crc.ps1 (.NET parity helper).
- .github/workflows/      Rust CI: fmt + build + test + clippy on Windows.
- LICENSE                 MIT (Joseph Doherty, 2026).

Verified:
- cargo test --workspace → 217 passed (215 unit + 2 .NET parity), 0 failed
- cargo clippy --workspace -- -D warnings → clean
- cargo fmt --all -- --check → clean
- cargo publish --dry-run -p mxaccess-codec → packages cleanly

Excluded from history (see .gitignore):
- **/bin, **/obj, **/target — build artifacts
- analysis/ghidra/projects/ — Ghidra working state (regenerable)
- analysis/ghidra/input/ — AVEVA proprietary DLLs (vendor IP)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 06:21:00 -04:00

3.0 KiB
Raw Permalink Blame History

NmxSvcps.dll

  • Path: C:\Program Files (x86)\ArchestrA\Framework\Bin\NmxSvcps.dll
  • Size: 46464 bytes
  • Machine: x86
  • PE timestamp: 2020-04-06T01:17:23+00:00
  • ImageBase: 0x10000000

Exports

Ordinal RVA Name
1 0x00001040 DllCanUnloadNow
2 0x00001000 DllGetClassObject
3 0x000010a0 DllRegisterServer
4 0x000010e0 DllUnregisterServer

Imports

  • RPCRT4.dll: NdrOleAllocate, NdrOleFree, IUnknown_QueryInterface_Proxy, IUnknown_AddRef_Proxy, IUnknown_Release_Proxy, CStdStubBuffer_QueryInterface, CStdStubBuffer_AddRef, CStdStubBuffer_Connect, CStdStubBuffer_Disconnect, CStdStubBuffer_Invoke, CStdStubBuffer_IsIIDSupported, CStdStubBuffer_CountRefs, CStdStubBuffer_DebugServerQueryInterface, CStdStubBuffer_DebugServerRelease, NdrDllUnregisterProxy, NdrDllRegisterProxy, NdrCStdStubBuffer_Release, NdrDllCanUnloadNow, NdrDllGetClassObject
  • KERNEL32.dll: ExitProcess, HeapSize, GetStringTypeW, MultiByteToWideChar, LCMapStringW, RtlUnwind, GetModuleFileNameW, WriteFile, GetCurrentProcess, TerminateProcess, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, LoadLibraryW, HeapReAlloc, HeapAlloc, DisableThreadLibraryCalls, IsValidCodePage, GetOEMCP, GetACP, GetCPInfo, EnterCriticalSection, GetCurrentThreadId, DecodePointer, GetCommandLineA, EncodePointer, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetModuleHandleW, SetLastError, GetLastError, InterlockedDecrement, GetProcAddress, HeapFree, Sleep, IsProcessorFeaturePresent, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, GetStartupInfoW, DeleteCriticalSection, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, HeapCreate, HeapDestroy, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LeaveCriticalSection
  • OLEAUT32.dll: BSTR_UserSize, BSTR_UserMarshal, BSTR_UserUnmarshal, BSTR_UserFree

Resources

Type ID/name Lang RVA Size
16 1 1033 0x0000c0a0 972
24 2 1033 0x0000c46c 346

GUID hits

(none)

Interesting strings

  • CStdStubBuffer_AddRef
  • CStdStubBuffer_Connect
  • CStdStubBuffer_CountRefs
  • CStdStubBuffer_DebugServerQueryInterface
  • CStdStubBuffer_DebugServerRelease
  • CStdStubBuffer_Disconnect
  • CStdStubBuffer_Invoke
  • CStdStubBuffer_IsIIDSupported
  • CStdStubBuffer_QueryInterface
  • INmxNotify
  • INmxService
  • INmxService2
  • INmxStatus
  • INmxSvcCallback
  • INmxSvcStatistics
  • IUnknown_AddRef_Proxy
  • IUnknown_QueryInterface_Proxy
  • IUnknown_Release_Proxy
  • NdrCStdStubBuffer_Release
  • NdrDllCanUnloadNow
  • NdrDllGetClassObject
  • NdrDllRegisterProxy
  • NdrDllUnregisterProxy
  • NdrOleAllocate
  • NdrOleFree
  • NmxSvcPS.dll
  • NmxSvc_v0032
  • NmxSvcps Module
  • NmxSvcps.dll
  • RPCRT4.dll
  • WriteFile
  • ``.orpc`
Reference in New Issue View Git Blame Copy Permalink