findings: GET_RELATION / PUT_RELATION script call API catalog #1

Merged

cozyGalvinism merged 1 commit from findings/relation-api into master

2026-09-16 13:39:09 +02:00

cozyGalvinism commented

2026-09-16 13:39:04 +02:00

Owner

findings/relation-api.md: what the calls are, where the catalog lives, the
",,,,"-delimited record grammar, the 2048-byte block structure that splices
boundary bytes mid-word, validation against an independent call-site corpus,
coverage gaps and open questions
findings/relation-api-catalog.md: 1993 extracted definitions (GET 1532 /
PUT 461, ids 0-9072) with parameters, enum values and return values
findings/relation-api-index.tsv: flat index (kind, id, params, title)

Confirms the read/write split from the vendor's own in-app tester
(DefXml/FunktionTesten.xml): GET_RELATION returns a value, PUT_RELATION does
not. The API is also exposed over the web service as GET_RELATION.EXEC /
PUT_RELATION.EXEC.

Validation: of 421 ids appearing both in the catalog and in 20481
independently collected call sites, 327 match the documented arity exactly and
69 use fewer args (optional trailing params), leaving 25 that exceed the
documented maximum.

Known gaps: 203 ids are called but uncatalogued (5.8% of call volume);
PUTADD_RELATION and PUTV_RELATION are undocumented entirely; 22 of 1993
extracted sections (1.1%) retain residual block-boundary characters and 6
entries are call-site echoes rather than definitions. Both are flagged in-file.

Note: stripping the block boundary uniformly across all blocks destroys
payload - only 6.8% of blocks carry it. Strip at the signature only.

Read-only analysis: file content, record grammar and PE strings; no disassembly.

Co-Authored-By: Claude Opus 5 (1M context) noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01SMfjq7F6zwbmxDNW6kuerx

Located the vendor's own catalog of the GET_RELATION / PUT_RELATION script calls, embedded in the program-level variable store BASIS_R00.SEDBVAR (identical content in SE_C20FI_R00.SEDBVAR), and extracted it. - findings/relation-api.md: what the calls are, where the catalog lives, the ",,,,"-delimited record grammar, the 2048-byte block structure that splices boundary bytes mid-word, validation against an independent call-site corpus, coverage gaps and open questions - findings/relation-api-catalog.md: 1993 extracted definitions (GET 1532 / PUT 461, ids 0-9072) with parameters, enum values and return values - findings/relation-api-index.tsv: flat index (kind, id, params, title) Confirms the read/write split from the vendor's own in-app tester (DefXml/FunktionTesten.xml): GET_RELATION returns a value, PUT_RELATION does not. The API is also exposed over the web service as GET_RELATION.EXEC / PUT_RELATION.EXEC. Validation: of 421 ids appearing both in the catalog and in 20481 independently collected call sites, 327 match the documented arity exactly and 69 use fewer args (optional trailing params), leaving 25 that exceed the documented maximum. Known gaps: 203 ids are called but uncatalogued (5.8% of call volume); PUTADD_RELATION and PUTV_RELATION are undocumented entirely; 22 of 1993 extracted sections (1.1%) retain residual block-boundary characters and 6 entries are call-site echoes rather than definitions. Both are flagged in-file. Note: stripping the block boundary uniformly across all blocks destroys payload - only 6.8% of blocks carry it. Strip at the signature only. Read-only analysis: file content, record grammar and PE strings; no disassembly. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SMfjq7F6zwbmxDNW6kuerx

cozyGalvinism added 1 commit

2026-09-16 13:39:04 +02:00

findings: GET_RELATION / PUT_RELATION script call API catalog db3dd80d8f

Located the vendor's own catalog of the GET_RELATION / PUT_RELATION script
calls, embedded in the program-level variable store BASIS_R00.SEDBVAR
(identical content in SE_C20FI_R00.SEDBVAR), and extracted it.

- findings/relation-api.md: what the calls are, where the catalog lives, the
  ",,,,"-delimited record grammar, the 2048-byte block structure that splices
  boundary bytes mid-word, validation against an independent call-site corpus,
  coverage gaps and open questions
- findings/relation-api-catalog.md: 1993 extracted definitions (GET 1532 /
  PUT 461, ids 0-9072) with parameters, enum values and return values
- findings/relation-api-index.tsv: flat index (kind, id, params, title)

Confirms the read/write split from the vendor's own in-app tester
(DefXml/FunktionTesten.xml): GET_RELATION returns a value, PUT_RELATION does
not. The API is also exposed over the web service as GET_RELATION.EXEC /
PUT_RELATION.EXEC.

Validation: of 421 ids appearing both in the catalog and in 20481
independently collected call sites, 327 match the documented arity exactly and
69 use fewer args (optional trailing params), leaving 25 that exceed the
documented maximum.

Known gaps: 203 ids are called but uncatalogued (5.8% of call volume);
PUTADD_RELATION and PUTV_RELATION are undocumented entirely; 22 of 1993
extracted sections (1.1%) retain residual block-boundary characters and 6
entries are call-site echoes rather than definitions. Both are flagged in-file.

Note: stripping the block boundary uniformly across all blocks destroys
payload - only 6.8% of blocks carry it. Strip at the signature only.

Read-only analysis: file content, record grammar and PE strings; no disassembly.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SMfjq7F6zwbmxDNW6kuerx

cozyGalvinism merged commit 686037aaa5 into master

2026-09-16 13:39:09 +02:00

cozyGalvinism referenced this pull request from a commit

2026-09-16 13:39:11 +02:00

Merge pull request 'findings: GET_RELATION / PUT_RELATION script call API catalog' (#1) from findings/relation-api into master

cozyGalvinism deleted branch findings/relation-api

2026-09-16 13:39:13 +02:00