[kostozy]

Hey
I have a microclimate system controller for a production facility, which runs on Linux and has a specific program(С#) installed on a PC (they connected via ethernet).

However, we no longer have access to the distributor of this equipment (a license was previously purchased).

The current task is to develop a replacement for this software, or at the very least, to learn how to read data directly from the controller.
It can be done by different ways:
1) reverse code of bin files at controller
2) scan network and work with packages(the most difficult, suppose, some encryption there)
3) reverse C# program. Even started to check some stuff with dotpeek. But don't have enough experience. Seems could be done by adding some debuggers and rerun code.

The main difficult is -- the programm is working on certain PC. So access will be very limited. In my opinion the best way is to deal with PC program principles.

Any ideas/suggestions/ may be help by someone who knows what to do?

[Infinity.]

Ghidra and IDA pro are your best bet here given your limited access to
PC.
Network packet analysis in depth:
1. Place device on the same network as the controller and the PC, preferably between them. A network tap, a mirrored switch port, or simply capturing on the PC itself would help ensure you capture all relevant packets. You can use wireshark and tcpdump for this.
2. Add Filters: capture only traffic between the PC and controller. In wireshark or tcpdump, you can filter based on IP addresses or ports if you know them.
Then start capturing network traffic when the C# program starts or reconnects to the controller. The initial handshake will reveal connection details, and if encryption is present, the handshake may expose the encryption method or even include key exchange mechanisms.
Try to determine the app-layer protocol used like HTTP, MQTT, etc. If a standard protocol isn't used, look for patterns in packet structure, such as identifiable headers or consistent field sizes. By default, MQTT uses TCP which doesn't encrypt communication. However, many MQTT brokers allow users to use TLS instead of TCP to encrypt MQTT communication. Port 8883 is reserved for MQTT over TLS.
Fixed-size packets may suggest a structured message format, with specific fields holding certain data types like 8 bytes for timestamp, 4 bytes for sensor value.
Packet intervals could indicate data polling frequency or whether traffic is event-driven.
Fuck it i'd just focus on reversing the controller and continuing by journey down the dotpeek

but yeah your thing seems hard though. and you do need to combine both the network analysis and reversing part to achieve this.

[Doug Dimmadome]

Hey
I have a microclimate system controller for a production facility, which runs on Linux and has a specific program(С#) installed on a PC (they connected via ethernet).

However, we no longer have access to the distributor of this equipment (a license was previously purchased).

The current task is to develop a replacement for this software, or at the very least, to learn how to read data directly from the controller.
It can be done by different ways:
1) reverse code of bin files at controller
2) scan network and work with packages(the most difficult, suppose, some encryption there)
3) reverse C# program. Even started to check some stuff with dotpeek. But don't have enough experience. Seems could be done by adding some debuggers and rerun code.

The main difficult is -- the programm is working on certain PC. So access will be very limited. In my opinion the best way is to deal with PC program principles.

Any ideas/suggestions/ may be help by someone who knows what to do?

Are you able to make a code dump from the C# binary? I'm a professional C# dev, I could take a look for you (willing to sign an NDA)