Decode C# binary serialization data

Question

I am trying to decode what seems to be simple C# binary serialization to disk:

1. https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw
2. https://github.com/malaterre/MMCPrivate/raw/master/sample2.raw

I do not have access to the original DLL that generates this binary blob so I fail to understand how to process this file unless I have a full definition of all C# structures. If I had access to the original DLL I could reverse engineer the C# binary to find the structures, so how should I do in this case ?

Code:

using System;
using System.IO;
using System.Collections;
using System.Runtime.Serialization.Formatters.Binary;
using System.Runtime.Serialization;

public class Dump
{
    [STAThread]
    static void Main() 
    {
        Deserialize();
    }

static void Deserialize() 
{
    // Declare the hashtable reference.
    Hashtable addresses  = null;

    // Open the file containing the data that you want to deserialize.
    FileStream fs = new FileStream("input.dat", FileMode.Open);
    try 
    {
        BinaryFormatter formatter = new BinaryFormatter();

        // Deserialize the hashtable from the file and 
        // assign the reference to the local variable.
        addresses = (Hashtable) formatter.Deserialize(fs);
    }
    catch (SerializationException e) 
    {
        Console.WriteLine("Failed to deserialize. Reason: " + e.Message);
        throw;
    }
    finally 
    {
        fs.Close();
    }

    // To prove that the table deserialized correctly, 
    // display the key/value pairs.
    foreach (DictionaryEntry de in addresses) 
    {
        Console.WriteLine("{0} lives at {1}.", de.Key, de.Value);
    }
}
}

Leads to:

$ mono ./Dump.exe
Failed to deserialize. Reason: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.

Unhandled Exception:
System.Runtime.Serialization.SerializationException: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.

Reference:

• BinaryFormatter.Deserialize Method
• [MS-NRBF]: .NET Remoting: Binary Format Data Structure

Answer 1

Turns out this was barely a reverse engineer task since everything is already available on internet. Mainly this post is a great read:

• How to analyse contents of binary serialization stream?

And then you can even play with a python implementation:

• nrbf.py - .NET Remoting Binary Format reading library for Python 3.6