Source: projects/identity-management/oim-kb-update/local-app/2026-04-27-oim-full-decompile-index-evidence.md

> Source: projects/identity-management/oim-kb-update/local-app/2026-04-27-oim-full-decompile-index-evidence.md

Goal

Decompile the local One Identity Manager application file tree and build a browsable HTML index that relates object-layer method registrations, custom-generated events, generated Event_* references, and method/event call sites relevant to QBM_PJobCreate_HOCallMethod* and QBM_PJobCreate_HOFireEvent* processing.

Source and Outputs

Local application source root: F:/Claude/agent-tools/oim
Main installed application folder: F:/Claude/agent-tools/oim/One Identity Manager
Decompiler: F:/Claude/.tmp/tools/ilspycmd.exe (ilspycmd 9.1.0.7988)
Decompiled output root: F:/Claude/.tmp/oim-decompiled-full
Decompile manifest: F:/Claude/.tmp/oim-decompile-manifest.csv
Durable HTML index: F:/Claude/projects/identity-management/oim-kb-update/local-app/oim-decompile-index.html
Durable machine-readable index: F:/Claude/projects/identity-management/oim-kb-update/local-app/oim-decompile-index-data.json
Index builder script: F:/Claude/scripts/research/build-oim-decompile-index.mjs

The generated C# decompile output is kept under .tmp because it is large generated evidence. The durable research artifact is the searchable HTML/JSON index plus this note.

Coverage

Recursive assembly inventory under F:/Claude/agent-tools/oim found 1,348 .dll / .exe candidates.

Result	Count	Notes
Decompiled successfully	1,260	Managed assemblies decompiled by ILSpy and scanned.
Failed	88	Mostly native executables or files without managed metadata; three non-native failures were tool/PE edge cases.
Decompiled `.cs` files scanned	145,636	Full generated source scan for relation index.
Lines scanned	19,245,184	Search pass over decompiled C# output.

Extracted Relation Counts

Relation type	Count	Interpretation
Method/function registrations	226	`RegisterMethod`, `RegisterExtendedMethod`, and `RegisterFunction` registrations in decompiled customizer/object-layer code.
Custom-generated event registrations	28	`Event(...).CustomGenerated(...)` registrations found in generated/customizer code.
Call/generate sites	228	Direct `CallMethod`, `CallFunction`, `GenerateEvent`, or unit-of-work generation calls found in decompiled code.
`Event_*` references	26	Generated event method references. Treat these as evidence of generated event-code naming, not as the complete event catalog.

Processing Interpretation

The index supports the current working model:

QBM_PJobCreate_HOCallMethod* creates Job queue work that is later resolved by the object layer as a named object/customizer method call.
A callable name can come from a UI-visible DialogMethod, but it can also be a non-UI customizer method registered in assemblies such as QER.Customizer.dll or ATT.Customizer.dll.
QBM_PJobCreate_HOFireEvent* creates HandleObject event-fire jobs. The runtime still needs a valid (table, event) mapping and generated event/process code. QBMEvent alone is discovery metadata, not proof that a chain will execute.
Generated event code conventionally appears as Event_<EventName>, so the index includes these references alongside custom-generated event declarations and call sites.

High-Value Names Observed

Common registered methods/functions include:

CreateAttestations
CreateITShopOrder
ComplianceCheckSimple
MakeDecision
OrderShoppingCart
PrepareAttestations
Abort
Prolongate
Reserve
UpdateDecision

Common custom-generated event names include:

OverLimit
Granted
Denied
Aborted
AddAdditional
AddInsteadOf
AnswerFromPerson
Canceled
Deny
Escalate

Common call/generate target names include:

MakeDecision
AddItem
Abort
CreateAttestations
ResetFrozen
Unsubscribe
CanAssign
ComplianceCheckSimple
Run

Caveats

The index is static decompile evidence. It does not replace live DB checks against DialogMethod, QBMEvent, JobEventGen, JobChain, or process generator state.
The extraction is literal-pattern based. It finds common registration/call forms but can miss dynamically constructed names, multi-step indirection, or generated code that does not use the searched forms.
Event_* rows are references in generated/decompiled code. They should be correlated with QBMEvent and JobEventGen before treating them as executable process paths.
Method names are not sufficient proof that a call is valid for a row. State-machine guards, permissions, parameter overload resolution, and method behavior flags still matter.

Next Experiments

Correlate oim-decompile-index-data.json method registrations with live DialogMethod and DialogObjectHasMethod rows.
Correlate event names from the index with live QBMEvent, JobEventGen, and active JobChain rows.
Add a focused IT Shop view that filters the full index to PersonWantsOrg, ITShopOrg, AccProduct, ADSGroup, BaseTree, AccProductInBaseTree, and ShoppingRack-related assemblies.
Use the index to identify remaining non-DialogMethod customizer methods that shipped SQL can invoke through QBM_PJobCreate_HOCallMethod*.