Is it possible for someone to extract data from a serialized object in binary format?

Question

If I serialize an object (a class in C#) to binary format (file), is it possible for someone to recover the data from the object, without using the original application to deserialize it back into the object?

(i.e. like say the class I serialized contained reference to another class that contained an array of integer values, would they somehow be able to get to that array of integer values)

http://stackoverflow.com/questions/3052202/how-to-analyse-contents-of-binary-serialization-stream — Daniel A. White, Jun 12 '14 at 01:19
The format of the file that you created when you serialized the object. — Blorgbeard, Jun 12 '14 at 01:27
Indeed it is possible (and somewhat trivial when standard serializers are used). I marked question as duplicate of partial list of existing tools to help with reverse engineering (I know that it is not direct duplicate, but I think existing tools show that activity is quite possible). — Alexei Levenkov, Jun 12 '14 at 01:39

score 1 · Answer 1 · answered Jun 12 '14 at 01:18

1

If "they" can find out the original layout of the serialized object, nothing prevent "them" to rewrite their own deserializer.

So the answer is yes, it is possible.

answered Jun 12 '14 at 01:18

quantdev

23,517
5
55
88

Is it possible for someone to extract data from a serialized object in binary format?

1 Answers1