Files
mxaccess/analysis/proxy/resolve-oxid-managed-fullntlm-integrity-probe.txt
Joseph Doherty fe2a6db786
rust / build / test / clippy / fmt (push) Has been cancelled
Initial project state: .NET reference, design, Rust port (M0+M1), evidence
Layout:
- src/                    .NET 10 x64 reference: MxNativeCodec, MxNativeClient,
                          MxAsbClient, probes, tests, harnesses. Executable spec.
- design/                 Architectural plan for the Rust port (M0–M6), error
                          model, protocol invariants, risks (R1–R16), adversarial
                          review log (review.md).
- rust/                   Rust workspace. M0 skeleton + M1 codec parity.
                          mxaccess-codec: 215 unit tests + 2 cross-implementation
                          parity tests (byte-identical against .NET reference).
                          Other crates are M0 stubs awaiting M2+.
- captures/               Frida + netsh + pcap evidence per CLAUDE.md
                          ("captures are evidence, not throwaway logs").
- analysis/               Decompiled C# (frida/proxy/decompiled-*),
                          Ghidra exports for native DLLs (`exports/` only —
                          working state at `projects/` and AVEVA's input
                          binaries at `input/` are gitignored).
- docs/                   Reverse-engineering reference docs.
- tools/                  Setup-LiveProbeEnv.ps1 (Infisical credential fetcher),
                          Compute-Crc.ps1 (.NET parity helper).
- .github/workflows/      Rust CI: fmt + build + test + clippy on Windows.
- LICENSE                 MIT (Joseph Doherty, 2026).

Verified:
- cargo test --workspace → 217 passed (215 unit + 2 .NET parity), 0 failed
- cargo clippy --workspace -- -D warnings → clean
- cargo fmt --all -- --check → clean
- cargo publish --dry-run -p mxaccess-codec → packages cleanly

Excluded from history (see .gitignore):
- **/bin, **/obj, **/target — build artifacts
- analysis/ghidra/projects/ — Ghidra working state (regenerable)
- analysis/ghidra/input/ — AVEVA proprietary DLLs (vendor IP)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 06:21:00 -04:00

11 lines
2.4 KiB
Plaintext

process=x64:True
engine_id=32750
engine_name=MxNativeClient.Probe.42348
resolve_oxid_managed_ntlm_integrity_stub_size=640
resolve_oxid_managed_ntlm_integrity_stub_prefix=00 00 02 00 29 01 00 00 29 01 a2 00 07 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 36 00
resolve_oxid_managed_ntlm_integrity_stub_hex=00000200290100002901A20007004400450053004B0054004F0050002D0036004A004C0033004B004B004F005B00360030003200340031005D0000000700310030002E003100300030002E0030002E00340038005B00360030003200340031005D00000007003100370032002E00320039002E003200320034002E0031005B00360030003200340031005D000000070066006400650031003A0061006500340031003A0038006100300030003A0034003500320061003A0062006200340031003A0065006500370065003A0035006600640034003A0064006300310038005B00360030003200340031005D000000070066006400650031003A0061006500340031003A0038006100300030003A0034003500320061003A0035003000310061003A0032006400610034003A0061006200640030003A0066003500300061005B00360030003200340031005D00000000000A00FFFF4E005400200041005500540048004F0052004900540059005C00530059005300540045004D0000001E00FFFF4E005400200041005500540048004F0052004900540059005C00530059005300540045004D0000001000FFFF68006F00730074002F004400450053004B0054004F0050002D0036004A004C0033004B004B004F0000000900FFFF68006F00730074002F004400450053004B0054004F0050002D0036004A004C0033004B004B004F0000001600FFFF4E005400200041005500540048004F0052004900540059005C00530059005300540045004D0000001F00FFFF4E005400200041005500540048004F0052004900540059005C00530059005300540045004D00000000000000004C00007836000010A0BC391315CF3604000000000000000000000000000000
resolve_oxid_managed_ntlm_integrity_remunknown_ipid=00004c00-3678-0000-10a0-bc391315cf36
resolve_oxid_managed_ntlm_integrity_authn_hint=4
resolve_oxid_managed_ntlm_integrity_bindings=string:0x0007:ncacn_ip_tcp:DESKTOP-6JL3KKO[60241]|string:0x0007:ncacn_ip_tcp:10.100.0.48[60241]|string:0x0007:ncacn_ip_tcp:172.29.224.1[60241]|string:0x0007:ncacn_ip_tcp:fde1:ae41:8a00:452a:bb41:ee7e:5fd4:dc18[60241]|string:0x0007:ncacn_ip_tcp:fde1:ae41:8a00:452a:501a:2da4:abd0:f50a[60241]|security:0x000a:protseq_0x000a:?NT AUTHORITY\SYSTEM|security:0x001e:protseq_0x001e:?NT AUTHORITY\SYSTEM|security:0x0010:protseq_0x0010:?host/DESKTOP-6JL3KKO|security:0x0009:protseq_0x0009:?host/DESKTOP-6JL3KKO|security:0x0016:protseq_0x0016:?NT AUTHORITY\SYSTEM|security:0x001f:protseq_0x001f:?NT AUTHORITY\SYSTEM
resolve_oxid_managed_ntlm_integrity_tail_status=0x00000000