2 out of 2 rated this helpful - Rate this topic

ProtectedMemory Class

Provides methods for protecting and unprotecting memory. This class cannot be inherited.

Namespace:  System.Security.Cryptography
Assembly:  System.Security (in System.Security.dll)
public sealed class ProtectedMemory

This class provides access to the Data Protection API (DPAPI) available in Microsoft Windows XP and later operating systems. This is a service that is provided by the operating system and does not require additional libraries. It provides encryption for sensitive data in memory.

The class consists of two wrappers for the unmanaged DPAPI, Protect and Unprotect. These two methods can be used to encrypt and decrypt data in memory.

The following code example shows how to use data protection.

using System;
using System.Security.Cryptography;

public class MemoryProtectionSample
{

	public static void Main()
	{
// Create the original data to be encrypted (The data length should be a multiple of 16).
		
byte [] secret = { 1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3, 4 };

// Encrypt the data in memory. The result is stored in the same same array as the original data.
		ProtectedMemory.Protect( secret, MemoryProtectionScope.SameLogon );
	
// Decrypt the data in memory and store in the original array.
		ProtectedMemory.Unprotect( secret, MemoryProtectionScope.SameLogon );
	}

}


System.Object
  System.Security.Cryptography.ProtectedMemory
Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Windows 7, Windows Vista, Windows XP SP2, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP Starter Edition, Windows Server 2008 R2, Windows Server 2008, Windows Server 2003, Windows Server 2000 SP4, Windows Millennium Edition, Windows 98

The .NET Framework and .NET Compact Framework do not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.

.NET Framework

Supported in: 3.5, 3.0, 2.0
Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ
Full article can be found at: http://www.hexadecimal.se/2009/02/14/NotSoProtectedMemory.aspx
what is the solution for protected memory then??undo then repaste then recycle /uncycle then repeat. while in shared mulyiple registrys .accessability code as protection

 

this is a security issue!Imports System
Imports System.Security.Cryptography
 
Public Class MemoryProtectionSample
    Public Shared Sub Main()
        ' Create the original data to be encrypted (The data length should be a multiple of 16).
        Dim secret As Byte() = {1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3, 4}
        ' Encrypt the data in memory. The result is stored in the same same array as the original data.
        ProtectedMemory.Protect(secret, MemoryProtectionScope.SameLogon)
        ' Decrypt the data in memory and store in the original array.
        ProtectedMemory.Unprotect(secret, MemoryProtectionScope.SameLogon)
    End Sub
End Class

Sample recoded using PowerShell
  

<#
.SYNOPSIS
This script encrpyts then decrypts a byte string
.DESCRIPTION
This script uses System.Security to encrpyt a byte
string, then decrypts it.
.NOTES
File Name : Protect-ByteArray.ps1
Author : Thomas Lee - tfl@psp.co.uk
Requires : PowerShell V2
.LINK
This script posted to:
http://www.pshscripts.blogspot.com
MSDN Sample posted at:
http://msdn.microsoft.com/en-us/library/system.security.cryptography.protectedmemory.aspx
.EXAMPLE
PSH [C:\foo]: .Protect-ByteArray.ps1'
Unencrpyted byte string
1
2
3
4
1
2
3
4
1
2
3
4
1
2
3
6
Encrpyted byte string
199
52
177
169
162
117
118
127
180
16
230
70
19
89
85
168
Unencrpyted byte string
1
2
3
4
1
2
3
4
1
2
3
4
1
2
3
6
#>

##
# Start of script
##

# Load System.Security
[void] [reflection.Assembly]::LoadWithPartialName("System.Security")

# Create and display a byte string
[byte[]] $Secret = 1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3, 4, 1, 2, 3,6
"Unencrpyted byte string"
$Secret

# now encrypt it and display the encrpyted string
[System.Security.Cryptography.ProtectedMemory]::Protect($secret,[Ssystem.Security.Cryptography.MemoryProtectionScope]::SameLogon)
"Encrpyted byte string"
$Secret

# Now decrypt it and re-display it - it's the same byte array we started with
[System.Security.Cryptography.ProtectedMemory]::UnProtect($secret,[System.Security.Cryptography.MemoryProtectionScope]::SameLogon)
"Unencrpyted byte string"
$Secret

Limitations of ProtectedMemory
Although it does encrypt the memory, securing the secret from memory scans and memory dumps, it does not protect it very well against intrusions.

It's a lot better than not protecting the secrets stored in memory at all, but it's not a complete protection.

I wrote an article that demonstrates reading protected memory in clear text from another process, even when using the protection scope SameProcess.