Joseph Doherty
fe2a6db786
rust / build / test / clippy / fmt (push) Has been cancelled
Layout:
- src/ .NET 10 x64 reference: MxNativeCodec, MxNativeClient,
MxAsbClient, probes, tests, harnesses. Executable spec.
- design/ Architectural plan for the Rust port (M0–M6), error
model, protocol invariants, risks (R1–R16), adversarial
review log (review.md).
- rust/ Rust workspace. M0 skeleton + M1 codec parity.
mxaccess-codec: 215 unit tests + 2 cross-implementation
parity tests (byte-identical against .NET reference).
Other crates are M0 stubs awaiting M2+.
- captures/ Frida + netsh + pcap evidence per CLAUDE.md
("captures are evidence, not throwaway logs").
- analysis/ Decompiled C# (frida/proxy/decompiled-*),
Ghidra exports for native DLLs (`exports/` only —
working state at `projects/` and AVEVA's input
binaries at `input/` are gitignored).
- docs/ Reverse-engineering reference docs.
- tools/ Setup-LiveProbeEnv.ps1 (Infisical credential fetcher),
Compute-Crc.ps1 (.NET parity helper).
- .github/workflows/ Rust CI: fmt + build + test + clippy on Windows.
- LICENSE MIT (Joseph Doherty, 2026).
Verified:
- cargo test --workspace → 217 passed (215 unit + 2 .NET parity), 0 failed
- cargo clippy --workspace -- -D warnings → clean
- cargo fmt --all -- --check → clean
- cargo publish --dry-run -p mxaccess-codec → packages cleanly
Excluded from history (see .gitignore):
- **/bin, **/obj, **/target — build artifacts
- analysis/ghidra/projects/ — Ghidra working state (regenerable)
- analysis/ghidra/input/ — AVEVA proprietary DLLs (vendor IP)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
83 lines
2.8 KiB
Python
83 lines
2.8 KiB
Python
"""Probe NmxSvc.NmxService through raw DCOM without the AVEVA x86 proxy.
|
|
|
|
Credentials are read from MX_RPC_USER, MX_RPC_PASSWORD, and MX_RPC_DOMAIN.
|
|
Do not put passwords in this file or in checked-in probe output.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import os
|
|
import traceback
|
|
|
|
from impacket.dcerpc.v5 import dcomrt, rpcrt
|
|
from impacket.dcerpc.v5.dtypes import ULONG
|
|
from impacket.uuid import string_to_bin, uuidtup_to_bin
|
|
|
|
|
|
CLSID_NMX_SERVICE = string_to_bin("AE24BD51-2E80-44CC-905B-E5446C942BEB")
|
|
IID_INMXSERVICE2 = string_to_bin("2630A513-A974-4B1A-8025-457A9A7C56B8")
|
|
IID_INMXSERVICE2_BIND = uuidtup_to_bin(("2630A513-A974-4B1A-8025-457A9A7C56B8", "0.0"))
|
|
|
|
|
|
class GetPartnerVersion(dcomrt.DCOMCALL):
|
|
opnum = 11
|
|
structure = (
|
|
("lPartnerGalaxyId", ULONG),
|
|
("lPartnerPlatformId", ULONG),
|
|
("lPartnerEngineId", ULONG),
|
|
)
|
|
|
|
|
|
class GetPartnerVersionResponse(dcomrt.DCOMANSWER):
|
|
structure = (
|
|
("plPartnerVersion", ULONG),
|
|
("ErrorCode", dcomrt.error_status_t),
|
|
)
|
|
|
|
|
|
def main() -> int:
|
|
target = os.getenv("MX_RPC_TARGET", os.environ.get("COMPUTERNAME", "127.0.0.1"))
|
|
user = os.getenv("MX_RPC_USER", "")
|
|
password = os.getenv("MX_RPC_PASSWORD", "")
|
|
domain = os.getenv("MX_RPC_DOMAIN", "")
|
|
|
|
dcom = None
|
|
try:
|
|
dcom = dcomrt.DCOMConnection(
|
|
target,
|
|
username=user,
|
|
password=password,
|
|
domain=domain,
|
|
authLevel=rpcrt.RPC_C_AUTHN_LEVEL_PKT_PRIVACY,
|
|
)
|
|
iface = dcom.CoCreateInstanceEx(CLSID_NMX_SERVICE, IID_INMXSERVICE2)
|
|
print("cocreate_ok")
|
|
print("target=" + iface.get_target())
|
|
print("oxid=0x%016x" % iface.get_oxid())
|
|
print("oid=0x%016x" % iface.get_oid())
|
|
print("ipid=" + iface.get_iPid().hex())
|
|
print("ipidRemUnknown=" + iface.get_ipidRemUnknown().hex())
|
|
print("bindings=" + "|".join(binding["aNetworkAddr"].rstrip("\x00") for binding in iface.get_cinstance().get_string_bindings()))
|
|
|
|
request = GetPartnerVersion()
|
|
request["lPartnerGalaxyId"] = int(os.getenv("MX_PARTNER_GALAXY", "1"), 0)
|
|
request["lPartnerPlatformId"] = int(os.getenv("MX_PARTNER_PLATFORM", "1"), 0)
|
|
request["lPartnerEngineId"] = int(os.getenv("MX_PARTNER_ENGINE", "0x7ffd"), 0)
|
|
response = iface.request(request, IID_INMXSERVICE2_BIND, iface.get_iPid())
|
|
|
|
print("get_partner_version_ok")
|
|
print("partner_version=%d" % response["plPartnerVersion"])
|
|
print("error_code=0x%08x" % response["ErrorCode"])
|
|
return 0
|
|
except Exception as exc: # noqa: BLE001 - probe should print exact failure class.
|
|
print("probe_error=%s: %s" % (type(exc).__name__, exc))
|
|
traceback.print_exc()
|
|
return 1
|
|
finally:
|
|
if dcom is not None:
|
|
dcom.disconnect()
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|