DeepCharts Portable

A self-contained, portable DeepCharts trading environment. Clone → build → one signed installer → double-click DeepChartsLauncher.exe → everything starts. No console windows, no Python installs, no manual scripting.

Quick Start

git clone https://github.com/sires11017/DeepCharts-Portable.git
cd DeepCharts-Portable
.\build.ps1                    # builds launcher + proxy + installer

Run the signed installer from output\ → Next → Next → Finish → launch from Start Menu.

What You Get

Component	Source	Purpose
DeepChartsLauncher.exe	src/Launcher/*.cs (C# .NET 8.0)	One-click tray launcher — credential dialog, spawns all children, Job Object kill-on-close, heartbeat, crash logging, update check
DeepChartsProxy.exe	src/proxy/entrypoint.py + proxy/mitm/*.py (PyInstaller)	Combined MITM proxy (port 443) + Vol Hist mock server (port 12010). Handles TLS interception, credential patching, BBA quote injection, historical data mocking
Deepchart.Core.exe	Closed-source third-party binary	Patched Deepchart trading platform
VolumetricaBridge.exe	Closed-source third-party binary	CQG protocol bridge

Closed-source components

This repository includes compiled binaries (app/Deepchart.Core.exe, app/bridge/VolumetricaBridge.exe, and their supporting DLLs) that are the property of their respective owners. These are redistributed here as part of a self-contained portable environment. No source code, modification, or reverse engineering of these binaries is provided.

Architecture

DeepChartsLauncher.exe
  ├── spawns → DeepChartsProxy.exe (MITM on 443 + Vol Hist on 12010)
  ├── spawns → VolumetricaBridge.exe (CQG bridge via proxy)
  └── spawns → Deepchart.Core.exe (trading UI)

All children are assigned to a Windows Job Object — if the launcher exits, every child dies. Single-instance mutex prevents duplicate sessions. Heartbeat file at %LOCALAPPDATA%\DeepCharts\heartbeat.txt for stale-session detection.

Credentials stored in Windows Credential Manager (CredWrite/CredRead) and passed to the proxy via CQG_USERNAME/CQG_PASSWORD environment variables. No plaintext credential files.

TLS Interception & Hosts Modification Notice

The proxy performs TLS man-in-the-middle interception of the Bridge↔CQG WebSocket connection. This requires:

1. CA certificate installation — a locally-generated self-signed root CA is installed to the Windows Trusted Root store. This cert is generated per-machine and never shared or transmitted.
2. Hosts file modification — the installer adds entries to %SYSTEMROOT%\System32\drivers\etc\hosts redirecting demoapi.cqg.com, api.cqg.com, depth-it.historical.deepcharts.com, and data-b.historical.deepcharts.com to 127.0.0.1. This routes traffic through the local proxy instead of reaching the real upstream servers.

Both modifications are automatically applied by the installer and reverted on uninstall. By using this software, you are modifying your system's certificate trust store and network routing configuration for the purpose of local TLS interception.

Repository Structure

DeepCharts-Portable/
├── src/
│   ├── Launcher/               # C# source (DeepChartsLauncher.exe)
│   │   ├── Program.cs          # Entry point, credential dialog, child process startup
│   │   ├── Logger.cs           # Rolling log at %LOCALAPPDATA%\DeepCharts\logs\
│   │   ├── NativeMethods.cs    # P/Invoke: Job Object, Mutex, Credential Manager
│   │   ├── ProcessManager.cs   # Process lifecycle, heartbeat, crash logging
│   │   ├── TrayIcon.cs         # System tray, update check, exit
│   │   └── CredentialManager.cs# CredWrite/CredRead with DPAPI fallback
│   └── proxy/
│       ├── entrypoint.py       # Combined proxy entry point
│       └── build_proxy.ps1     # PyInstaller build script
├── proxy/
│   ├── mitm/                   # Python MITM proxy + vol_hist server
│   │   ├── bridge_mitm_proxy.py
│   │   ├── vol_hist_server.py
│   │   └── config.py           # Central config (env-var overridable)
│   └── cqg/                    # CQG protobuf Python definitions
├── app/                        # Runtime binaries (Core + Bridge + DLLs)
├── installer/
│   ├── build.ps1               # Full installer build (launcher + proxy + payload)
│   ├── DeepCharts.iss          # Inno Setup script
│   └── signing-config.md       # Azure Trusted Signing setup
├── certs/mitm_ca/              # TLS certificates (generated per-machine)
├── scripts/
│   └── toggle-hosts.ps1        # Toggle CQG hosts entries for troubleshooting
├── userdata/                   # Templates, workspaces, settings
├── build.ps1                   # Root build orchestrator
└── docs/                       # Implementation plans, signing docs

Build

Requires: .NET SDK 8.0, Python 3.14+, Inno Setup 6 (for installer).

.\build.ps1                     # Full build: launcher → proxy → installer

Individual component builds:

dotnet build src\Launcher\DeepChartsLauncher.csproj -c Release
.\src\proxy\build_proxy.ps1

Configuration

All proxy settings in proxy/mitm/config.py, overridable via environment variables.

Variable	Default	Description
CQG_USERNAME	""	CQG login (set by launcher from Credential Manager)
CQG_PASSWORD	""	CQG password (set by launcher from Credential Manager)
LOG_LEVEL	DEBUG	Logging verbosity
BRIDGE_PROXY_PORT	443	MITM proxy port
SNI_HOST	demoapi.cqg.com	Upstream CQG SNI

Logs

• %LOCALAPPDATA%\DeepCharts\logs\deepcharts.log — Launcher activity
• %LOCALAPPDATA%\DeepCharts\logs\bridge_mitm_*.log — Full protobuf trace
• %LOCALAPPDATA%\DeepCharts\logs\vol_hist_*.log — Historical server activity

First-Run Credential Dialog

On first launch, a dialog prompts for CQG username/password. These are stored via Windows Credential Manager (CredWrite). Subsequent launches read from Credential Manager automatically. The launcher sets CQG_USERNAME and CQG_PASSWORD environment variables for the proxy child process.

Code Signing

For production deployment, configure Azure Trusted Signing (see installer/signing-config.md). Build with:

.\installer\build.ps1 -Sign -CertPath <cert.pfx> -CertPassword <password>

The root build.ps1 also contains a Sign-File function for CI/CD integration.

Production Readiness

Before publishing to end users, complete these checks:

• EDR/AV testing — The installer installs a CA cert and modifies the hosts file to redirect CQG domains to localhost. This combination is heuristically suspicious beyond what code signing solves. Test on machines with real EDR (CrowdStrike, Defender for Endpoint, SentinelOne) — not just consumer Windows Defender.
• Clean VM full walkthrough — Run the signed installer on a fresh Windows VM with no pre-installed .NET, Python, or repo checkout. Verify: .NET Runtime installer triggers correctly, CA cert is trusted, hosts entries are applied, app launches without console windows. Critically, check the proxy log at %LOCALAPPDATA%\DeepCharts\logs\bridge_mitm_*.log for the line [COMBINED] CQG_USERNAME=set — this confirms the credential handoff worked through the real install tree, which the manual staging test at %TEMP% did not exercise.
• GitHub release + update check — Publish the installer to GitHub Releases so the tray icon's update-check resolves instead of returning 404.

Disclaimer

For educational and testing purposes only. Use with your own CQG demo account. The proxy intercepts TLS traffic and modifies the hosts file to redirect CQG/DeepCharts domains to localhost. See "TLS Interception & Hosts Modification Notice" above.