dohertj2/mxaccess
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
eb6c689f0916a5fbd2fc1dfd005b2ce418e8bf29
mxaccess/captures/022-frida-write-test-int-sequence-106-108/frida-events.tsv
T
Joseph Doherty fe2a6db786
rust / build / test / clippy / fmt (push) Has been cancelled
Details
Initial project state: .NET reference, design, Rust port (M0+M1), evidence 
Layout:
- src/                    .NET 10 x64 reference: MxNativeCodec, MxNativeClient,
                          MxAsbClient, probes, tests, harnesses. Executable spec.
- design/                 Architectural plan for the Rust port (M0–M6), error
                          model, protocol invariants, risks (R1–R16), adversarial
                          review log (review.md).
- rust/                   Rust workspace. M0 skeleton + M1 codec parity.
                          mxaccess-codec: 215 unit tests + 2 cross-implementation
                          parity tests (byte-identical against .NET reference).
                          Other crates are M0 stubs awaiting M2+.
- captures/               Frida + netsh + pcap evidence per CLAUDE.md
                          ("captures are evidence, not throwaway logs").
- analysis/               Decompiled C# (frida/proxy/decompiled-*),
                          Ghidra exports for native DLLs (`exports/` only —
                          working state at `projects/` and AVEVA's input
                          binaries at `input/` are gitignored).
- docs/                   Reverse-engineering reference docs.
- tools/                  Setup-LiveProbeEnv.ps1 (Infisical credential fetcher),
                          Compute-Crc.ps1 (.NET parity helper).
- .github/workflows/      Rust CI: fmt + build + test + clippy on Windows.
- LICENSE                 MIT (Joseph Doherty, 2026).

Verified:
- cargo test --workspace → 217 passed (215 unit + 2 .NET parity), 0 failed
- cargo clippy --workspace -- -D warnings → clean
- cargo fmt --all -- --check → clean
- cargo publish --dry-run -p mxaccess-codec → packages cleanly

Excluded from history (see .gitignore):
- **/bin, **/obj, **/target — build artifacts
- analysis/ghidra/projects/ — Ghidra working state (regenerable)
- analysis/ghidra/input/ — AVEVA proprietary DLLs (vendor IP)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-05 06:21:00 -04:00

16 KiB
Raw Blame History

1timeeventmodulenameecxretvalargscandidate_indexcandidate_sizecandidate_ptrvalue_hitshex
22026-04-25T06:17:48.379Zhook.installedLmxProxy.dllCLMXProxyServer.Write.variantA[]
32026-04-25T06:17:48.380Zhook.installedLmxProxy.dllCLMXProxyServer.Write.variantB[]
42026-04-25T06:17:48.380Zhook.installedLmxProxy.dllCLMXProxyServer.WriteSecured.variantA[]
52026-04-25T06:17:48.381Zhook.installedLmxProxy.dllCLMXProxyServer.WriteSecured.variantB[]
62026-04-25T06:17:48.381Zhook.installedLmxProxy.dllCLMXProxyServer.AdviseSupervisory[]
72026-04-25T06:17:55.321Zhook.installedNmxAdptr.dllCNmxAdapter.TransferData[]
82026-04-25T06:17:55.322Zhook.installedNmxAdptr.dllCNmxAdapter.ProcessDataReceived[]
92026-04-25T06:17:55.322Zhook.installedNmxAdptr.dllCNmxAdapter.PutRequest[]
102026-04-25T06:17:55.323Zhook.installedNmxAdptr.dllCNmxAdapter.PutRequestEx[]
112026-04-25T06:17:55.378Zcall.enterLmxProxy.dllCLMXProxyServer.AdviseSupervisory0xf3ebcc["0x6418ff0","0x1","0x1","0x7b7c3c71","0x74794704"]
122026-04-25T06:17:55.379Zcall.leaveLmxProxy.dllCLMXProxyServer.AdviseSupervisory0x0[]
132026-04-25T06:17:55.503Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x1","0x2","0x0","0x13a","0x9640648","0xf3e890","0xdd21334b"]010x2
142026-04-25T06:17:55.503Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x1","0x2","0x0","0x13a","0x9640648","0xf3e890","0xdd21334b"]13140x9640648
152026-04-25T06:17:55.504Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x1","0x168","0x9fc8020","0x7786906e","0x9640214","0x9640204","0x641add04","0x0"]03600x9fc8020
162026-04-25T06:17:55.505Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
172026-04-25T06:17:55.505Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
182026-04-25T06:17:55.506Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x27","0x970e4e0","0xf3e890","0xdd21334b"]020x2
192026-04-25T06:17:55.506Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x27","0x970e4e0","0xf3e890","0xdd21334b"]1390x970e4e0
202026-04-25T06:17:55.508Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x55","0x9fc8020","0x7786906e","0x971a39c","0x971a38c","0x641add04","0x0"]0850x9fc8020
212026-04-25T06:17:55.509Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
222026-04-25T06:17:55.509Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
232026-04-25T06:17:55.547Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x2c2","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x2c2","0x818c120","0x206","0x3","0x7d51664"]07060x818c120
242026-04-25T06:17:55.547Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x2c2","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x2c2","0x818c120","0x206","0x3","0x7d51664"]15180x3
252026-04-25T06:17:55.547Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x2c2","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x2c2","0x818c120","0x206","0x3","0x7d51664"]230x7d51664
262026-04-25T06:17:55.548Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
272026-04-25T06:17:55.549Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x97","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x97","0x811fb70","0x206","0x3","0x7d51664"]01510x811fb70
282026-04-25T06:17:55.549Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x97","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x97","0x811fb70","0x206","0x3","0x7d51664"]15180x3
292026-04-25T06:17:55.549Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x97","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x97","0x811fb70","0x206","0x3","0x7d51664"]230x7d51664
302026-04-25T06:17:55.549Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
312026-04-25T06:17:55.557Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x5c","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x5c","0x818b018","0x206","0x3","0x7d51664"]0920x818b018
322026-04-25T06:17:55.557Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x5c","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x5c","0x818b018","0x206","0x3","0x7d51664"]15180x3
332026-04-25T06:17:55.557Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x5c","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x5c","0x818b018","0x206","0x3","0x7d51664"]230x7d51664
342026-04-25T06:17:55.557Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
352026-04-25T06:17:55.558Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x6c","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x6c","0x814a460","0x206","0x3","0x7d51664"]01080x814a460
362026-04-25T06:17:55.558Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x6c","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x6c","0x814a460","0x206","0x3","0x7d51664"]15180x3
372026-04-25T06:17:55.558Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x6c","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x6c","0x814a460","0x206","0x3","0x7d51664"]230x7d51664
382026-04-25T06:17:55.559Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
392026-04-25T06:17:55.613Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x1","0x2e","0x9fc8020","0x77869082","0x9637010","0x0","0x0","0x0"]0460x9fc8020
402026-04-25T06:17:55.614Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
412026-04-25T06:17:55.635Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x2e","0x9fc8020","0x77869082","0x9637010","0x0","0x0","0x0"]0460x9fc8020
422026-04-25T06:17:55.636Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
432026-04-25T06:17:56.407Zcall.enterLmxProxy.dllCLMXProxyServer.Write.variantA0xf3ebc0["0x6418ff0","0x1","0x1","0x3","0x0","0x6a","0x0","0x1","0x7b7c3c71","0x74794704"]
442026-04-25T06:17:56.408Zcall.leaveLmxProxy.dllCLMXProxyServer.Write.variantA0x0[]
452026-04-25T06:17:56.511Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e3c0","0xf3e890","0xdd21334b"]020x2
462026-04-25T06:17:56.511Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e3c0","0xf3e890","0xdd21334b"]1400x970e3c0
472026-04-25T06:17:56.512Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x56","0x9fc8020","0x7786906e","0x96377f4","0x96377e4","0x641add04","0x0"]0860x9fc8020
482026-04-25T06:17:56.513Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
492026-04-25T06:17:56.513Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
502026-04-25T06:17:56.566Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]0510x818c120
512026-04-25T06:17:56.566Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]15180x3
522026-04-25T06:17:56.566Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]230x7d51664
532026-04-25T06:17:56.566Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
542026-04-25T06:17:56.567Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]0880x811fb70
552026-04-25T06:17:56.567Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]15180x3
562026-04-25T06:17:56.567Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]230x7d51664
572026-04-25T06:17:56.568Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
582026-04-25T06:17:56.618Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x2e","0x9fc8020","0x77869082","0x9637010","0x0","0x0","0x0"]0460x9fc8020
592026-04-25T06:17:56.619Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
602026-04-25T06:17:57.136Zcall.enterLmxProxy.dllCLMXProxyServer.Write.variantA0xf3ebc0["0x6418ff0","0x1","0x1","0x3","0x0","0x6b","0x0","0x1","0x7b7c3c71","0x74794704"]
612026-04-25T06:17:57.136Zcall.leaveLmxProxy.dllCLMXProxyServer.Write.variantA0x0[]
622026-04-25T06:17:57.238Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e690","0xf3e890","0xdd21334b"]020x2
632026-04-25T06:17:57.238Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e690","0xf3e890","0xdd21334b"]1400x970e690
642026-04-25T06:17:57.239Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x56","0x9fc8020","0x7786906e","0x971a7f4","0x971a7e4","0x641add04","0x0"]0860x9fc8020
652026-04-25T06:17:57.240Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
662026-04-25T06:17:57.240Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
672026-04-25T06:17:57.260Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818b018","0x206","0x3","0x7d51664"]0510x818b018
682026-04-25T06:17:57.260Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818b018","0x206","0x3","0x7d51664"]15180x3
692026-04-25T06:17:57.260Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818b018","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818b018","0x206","0x3","0x7d51664"]230x7d51664
702026-04-25T06:17:57.260Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
712026-04-25T06:17:57.261Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x814a460","0x206","0x3","0x7d51664"]0880x814a460
722026-04-25T06:17:57.261Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x814a460","0x206","0x3","0x7d51664"]15180x3
732026-04-25T06:17:57.261Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x814a460","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x814a460","0x206","0x3","0x7d51664"]230x7d51664
742026-04-25T06:17:57.261Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
752026-04-25T06:17:57.344Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x2e","0x9fc8020","0x77869082","0x9637010","0x0","0x0","0x0"]0460x9fc8020
762026-04-25T06:17:57.345Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
772026-04-25T06:17:57.861Zcall.enterLmxProxy.dllCLMXProxyServer.Write.variantA0xf3ebc0["0x6418ff0","0x1","0x1","0x3","0x0","0x6c","0x0","0x1","0x7b7c3c71","0x74794704"]
782026-04-25T06:17:57.861Zcall.leaveLmxProxy.dllCLMXProxyServer.Write.variantA0x0[]
792026-04-25T06:17:57.913Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e2e8","0xf3e890","0xdd21334b"]020x2
802026-04-25T06:17:57.913Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x28","0x970e2e8","0xf3e890","0xdd21334b"]1400x970e2e8
812026-04-25T06:17:57.914Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x56","0x9fc8020","0x7786906e","0x96377f4","0x96377e4","0x641add04","0x0"]0860x9fc8020
822026-04-25T06:17:57.915Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
832026-04-25T06:17:57.915Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
842026-04-25T06:17:57.950Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]0510x818c120
852026-04-25T06:17:57.950Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]15180x3
862026-04-25T06:17:57.950Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x33","0x818c120","0x798e8f8","0x76ffedd8","0x963c744","0x33","0x818c120","0x206","0x3","0x7d51664"]230x7d51664
872026-04-25T06:17:57.950Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
882026-04-25T06:17:57.952Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]0880x811fb70
892026-04-25T06:17:57.952Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]15180x3
902026-04-25T06:17:57.952Znmx.enterNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x963c738["0x58","0x811fb70","0x798e8f8","0x76ffedd8","0x963c744","0x58","0x811fb70","0x206","0x3","0x7d51664"]230x7d51664
912026-04-25T06:17:57.952Znmx.leaveNmxAdptr.dllCNmxAdapter.ProcessDataReceived0x1[]
922026-04-25T06:17:58.019Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x2e","0x9fc8020","0x77869082","0x9637010","0x0","0x0","0x0"]0460x9fc8020
932026-04-25T06:17:58.020Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
942026-04-25T06:18:01.924Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x1","0x2","0x0","0x3a","0x970e258","0xf3ea4c","0xdd213d87"]010x2
952026-04-25T06:18:01.924Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x1","0x2","0x0","0x3a","0x970e258","0xf3ea4c","0xdd213d87"]1580x970e258
962026-04-25T06:18:01.925Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x1","0x68","0x9fc8020","0x77869e12","0x96377f4","0x96377e4","0x641add04","0x64"]01040x9fc8020
972026-04-25T06:18:01.925Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
982026-04-25T06:18:01.925Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
992026-04-25T06:18:01.926Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x25","0x970e8d0","0xf3ea4c","0xdd213d87"]020x2
1002026-04-25T06:18:01.926Znmx.enterNmxAdptr.dllCNmxAdapter.PutRequest0x1["0x963c738","0x1","0x1","0x2","0x2","0x0","0x25","0x970e8d0","0xf3ea4c","0xdd213d87"]1370x970e8d0
1012026-04-25T06:18:01.927Znmx.enterNmxAdptr.dllCNmxAdapter.TransferData0x963c738["0x1","0x1","0x2","0x53","0x9fc8020","0x77869e12","0x971a39c","0x971a38c","0x641add04","0x64"]0830x9fc8020
1022026-04-25T06:18:01.928Znmx.leaveNmxAdptr.dllCNmxAdapter.TransferData0x0[]
1032026-04-25T06:18:01.928Znmx.leaveNmxAdptr.dllCNmxAdapter.PutRequest0x0[]
Reference in New Issue View Git Blame Copy Permalink