2

I am trying to decode what seems to be simple C# binary serialization to disk:

  1. https://github.com/malaterre/MMCPrivate/raw/master/sample1.raw
  2. https://github.com/malaterre/MMCPrivate/raw/master/sample2.raw

I do not have access to the original DLL that generates this binary blob so I fail to understand how to process this file unless I have a full definition of all C# structures. If I had access to the original DLL I could reverse engineer the C# binary to find the structures, so how should I do in this case ?

Code:

using System;
using System.IO;
using System.Collections;
using System.Runtime.Serialization.Formatters.Binary;
using System.Runtime.Serialization;

public class Dump
{
    [STAThread]
    static void Main() 
    {
        Deserialize();
    }

static void Deserialize() 
{
    // Declare the hashtable reference.
    Hashtable addresses  = null;

    // Open the file containing the data that you want to deserialize.
    FileStream fs = new FileStream("input.dat", FileMode.Open);
    try 
    {
        BinaryFormatter formatter = new BinaryFormatter();

        // Deserialize the hashtable from the file and 
        // assign the reference to the local variable.
        addresses = (Hashtable) formatter.Deserialize(fs);
    }
    catch (SerializationException e) 
    {
        Console.WriteLine("Failed to deserialize. Reason: " + e.Message);
        throw;
    }
    finally 
    {
        fs.Close();
    }

    // To prove that the table deserialized correctly, 
    // display the key/value pairs.
    foreach (DictionaryEntry de in addresses) 
    {
        Console.WriteLine("{0} lives at {1}.", de.Key, de.Value);
    }
}
}

Leads to:

$ mono ./Dump.exe
Failed to deserialize. Reason: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.

Unhandled Exception:
System.Runtime.Serialization.SerializationException: Unable to find assembly 'ApplicationObjects, Version=1.0.4073.26998, Culture=neutral, PublicKeyToken=null'.

Reference:

2

Turns out this was barely a reverse engineer task since everything is already available on internet. Mainly this post is a great read:

And then you can even play with a python implementation:

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.