Yeah, Rockwell has a couple samples. One that gets installed with Studio, and another on the knowledge base. Both are horribly written and documented.
I have gone through them and wrote my own documentation on the messages, and was considering writing my own tool, but since Rockwell already had one I wanted to use it instead.
I'm also curious if the RME uses a different CIP object, since the object in the samples can only be messages from the controller on newer firmware. But it could also be that the RME does now work on newer versions since it was never updated from XP.
EDIT: If anyone knows what service 0x51 does on the filesystem object, it exists but is not in either sample, I would love to know.