starkiller
starkiller
PostsComments
CC#
Created by starkiller on 7/11/2023 in #help
❔ How to work with channel sinks in NET 3.5
I'm attempting to reverse engineer how an application written in NET 3.5 gets data from a server by looking at the traffic in Wireshark and piecing it together with parts that can be decompiled (mostly just interfaces). The trouble I'm currently having is that I'm having trouble understanding how to get the data the server sends. I have setup basic remoting and sinks 
TcpChannel clientRemotingChannel = new TcpChannel();
ChannelServices.RegisterChannel(clientRemotingChannel, false);
string objectUri;
System.Runtime.Remoting.Messaging.IMessageSink messageSink = clientRemotingChannel.CreateMessageSink(url + "/LLRemoteServerAccess", null, out objectUri);

System.Runtime.Remoting.Messaging.IMessageSink messageSink2 = clientRemotingChannel.CreateMessageSink(url + "/LLRemoteServer", null, out objectUri);
TcpChannel clientRemotingChannel = new TcpChannel();
ChannelServices.RegisterChannel(clientRemotingChannel, false);
string objectUri;
System.Runtime.Remoting.Messaging.IMessageSink messageSink = clientRemotingChannel.CreateMessageSink(url + "/LLRemoteServerAccess", null, out objectUri);

System.Runtime.Remoting.Messaging.IMessageSink messageSink2 = clientRemotingChannel.CreateMessageSink(url + "/LLRemoteServer", null, out objectUri);
and I'm able to call remote functions 
bool r = ((ILLRemoteServerAccess)Activator.GetObject(typeof(ILLRemoteServerAccess), url + "/LLRemoteServerAccess")).Test();

int alias = ((ILLRemoteServer)Activator.GetObject(typeof(ILLRemoteServer), url + "/LLRemoteServer")).DissolveAlias("", ref dbname, ref dbloc, ref dbtype);
bool r = ((ILLRemoteServerAccess)Activator.GetObject(typeof(ILLRemoteServerAccess), url + "/LLRemoteServerAccess")).Test();

int alias = ((ILLRemoteServer)Activator.GetObject(typeof(ILLRemoteServer), url + "/LLRemoteServer")).DissolveAlias("", ref dbname, ref dbloc, ref dbtype);
but alongside the return value there's additional data sent. I'm assuming I need to write a custom sink to get it, but I'm unable to figure out how.
2 replies