Compact peer card facts and full synthesised representation (deductive + inductive observations).
No peer card
No biographical facts have been written for this peer yet.
## Explicit Observations
[2026-05-16 17:47:20] claude's proto/ directory contains cqg.proto (700 lines, extracted from DLLs) and compiled Python protobuf module
[2026-05-16 17:47:20] .ncd encryption key source is unknown and blocked by obfuscation
[2026-05-16 17:47:20] claude's main scripting language is Python 3.12
[2026-05-16 17:47:20] claude's project has separate virtualenvs for Python (venv/) and Frida (venv-frida/)
[2026-05-16 17:47:20] The target runtime for NT8 DLLs is .NET Framework 4.8
[2026-05-16 17:47:20] claude's tools/ directory includes a decompiler using ICSharpCode and a string decryptor for Agile.NET
[2026-05-16 17:47:20] Agile.NET obfuscation affects all strings, crypto calls, and control flow in NinjaTrader.Core.dll
[2026-05-16 17:47:20] claude's project directory includes scripts/ with cqg_client.py, tv_client.py, pipeline.py, parse_nrd.py, and other Python tooling
[2026-05-16 17:47:20] claude's replay/ directory contains sample .nrd market replay files for ES 06-26 and NQ 06-26 (E-mini S&P 500 and E-mini Nasdaq futures)
[2026-05-16 17:47:20] Tradovate JSON WebSocket uses endpoints: wss://{live|demo}.tradovateapi.com/v1/websocket and wss://md-{live|demo}.tradovateapi.com/v1/websocket
[2026-05-16 17:47:20] claude uses Frida 17.x for dynamic instrumentation on Windows VM
[2026-05-16 17:47:20] The .nrd file format has 12×80-byte headers + delta-compressed tick stream
[2026-05-16 17:47:20] .ncd encryption cipher is unknown (likely AES via BouncyCastle)
[2026-05-16 17:47:20] NinjaTrader's obfuscation uses Agile.NET (CliSecure)
[2026-05-16 17:47:20] claude is working on a NinjaTrader 8 reverse engineering project
[2026-05-16 17:47:20] claude's decompiled/ directory contains readable source for NinjaTrader.Core/ (4.8 MB), NinjaTrader.Gui/ (6.7 MB), NinjaTrader.Client/ (23 KB), and NinjaTrader.CQG/ (131 KB)
[2026-05-16 17:47:20] Static decompilation of NinjaTrader.Core.dll yields empty method bodies due to obfuscation
[2026-05-16 17:47:20] claude's project includes a ReplayLogger.cs NinjaScript indicator that logs replay events to CSV
[2026-05-16 17:47:20] claude uses pytest as test runner
[2026-05-16 17:47:20] claude's project has two data paths: CQG/Tradovate (live + historical bars via WebSocket JSON text frames) and NinjaTrader HDS (encrypted .ncd files + unencrypted .nrd replay files via raw TCP+SSL)
[2026-05-16 17:47:20] .nrd header layout has been fully confirmed
[2026-05-16 17:47:20] claude uses C# / .NET 8 for decompiler tool and string decryptor
[2026-05-16 17:47:20] claude's frida/ directory contains scripts for SSPI TLS interception, .NET HttpClient auth request capture, and HDS WebSocket binary traffic capture
[2026-05-16 17:47:20] .nrd tick compression is partially understood using infoByte-driven variable-length records averaging ~5 bytes/event
[2026-05-16 17:47:20] NinjaTrader HDS servers are located at hds-us-nt-{004,008,016}.ninjatrader.com