原文 http://codeseekah.com/2013/07/05/consuming-hidden-wcf-ria-services/
A Silverlight application made it to my desk yesterday, an application that consumed a remote WCF RIA service running on a Microsoft IIS. The service did not provide a public API, nor did disassembly with dotPeek help get the service manifests to construct a WCF client with. WSDL files weren’t exposed either. A new, custom client was to be written by reverse engineering what was available without any fancy configurations.
A bit of Wiresharking around and the protocol details became exposed for some low-level replication. The payloads were encoded, and the Content-Type> header hinted at application/msbin1, which made it pretty clear that it was in .NET Binary Format. Decoding was simple by switching to Fiddler and a WCF Binary Inspector. Having retrieved the payloads sending binary to the private service was quite straight-forward in C#.
... using System.Xml;
using System.Net; ... /* Write .NET Binary XML */
System.IO.Stream s = new System.IO.MemoryStream();
XmlWriter binarywriter = XmlDictionaryWriter.CreateBinaryWriter(s); binarywriter.WriteStartElement("Action1", "http://tempuri.org/");
...
binarywriter.Flush(); s.Seek(0, System.IO.SeekOrigin.Begin);
byte[] b = new byte[s.Length];
s.Read(b, 0, (int)s.Length); HttpWebRequest request = (HttpWebRequest)WebRequest.Create("hidden.svc/binary/Action1");
request.Method = "POST";
request.ContentType = "application/msbin1";
request.GetRequestStream().Write(b, 0, b.Length);
HttpWebResponse response = (HttpWebResponse)request.GetResponse(); /* Read .NET XML */
b = new byte[response.ContentLength];
response.GetResponseStream().Read(b, 0, b.Length); XmlReader binaryreader = XmlDictionaryReader.CreateBinaryReader(b, XmlDictionaryReaderQuotas.Max);
XmlDocument xdoc = new XmlDocument();
xdoc.Load(binaryreader);
...
Needs the System, System.Net, System.Runtime.Serialization and System.XML assemblies.
To consume hidden WCF RIA services on other platforms check out xml2wcf.py