I'm working with some legacy piece of software that uses its own client implementation to db2 on top of TCP.
Is the protocol to access db2 via tcp/SSL open and documented somewhere? Or the only way to get some knowledge is to reverse engineer it by myself?
Most likely your legacy software implements some part of the DRDA specification, which is the set of protocols Db2 uses.
Apache Derby also implements DRDA, so you could use its source code as a starting point.