0

I programmed a program in Windows form in C # language and to secure it and not to see the program variables, I have used the following three solutions, but some variables are still observed in memory using the WinHex program.

1.obfuscating with ConfuserEx

2.using SecureString

3.Put the strings in the section of App.config

The related codes are as follows:

Main Code:

SecureString ss1 = ConvertToSecureString(ConfigurationManager.AppSettings["SKB"]);
byte[] SKB = System.Text.Encoding.UTF8.GetBytes(new NetworkCredential("", ss1).Password);
ss1.Dispose();

SKB's value in App.Config:

<appSettings>
   <add key="SKB" value="0164Kfm*" />
</appSettings>

ConvertToSecureString() Function:

public SecureString ConvertToSecureString(string password)
{
   if (password == null)
      throw new ArgumentNullException("psw");

   var securePassword = new SecureString();
   Array.ForEach(password.ToCharArray(), securePassword.AppendChar);

   securePassword.MakeReadOnly();
   return securePassword;
}

The value of SKB is visible in memory by using WinHex:

WinHex

How can I delete variables value in memory?

Mohammad Imani
  • 1
  • 3
    you can't. However you can easily encrypt your data to prevent it from being read. That assumes you decrypt it when checking the password of course. – MakePeaceGreatAgain Apr 12 '22 at 07:15
  • 4
    the gist of it: if your program is to use the data (whatever data), it needs to have it unencrypted at _some_ point. at that point, an attacker can read it. there's nothing anyone can do about this. – Franz Gleichmann Apr 12 '22 at 07:16
  • What specifically are you trying to protect against? Passwords should *never* be stored in clear text, they should *always* be hashed. See [how to hash passwords](https://stackoverflow.com/questions/4181198/how-to-hash-a-password) for more information. You *cannot* protect against an attacker that has control of the execution environment. At best you can delegate sensitive operations to a special secure hardware chip. – JonasH Apr 12 '22 at 08:54
  • If the user has admin access then there is **nothing** you can do to fully prevent them – Charlieface Apr 12 '22 at 14:11

0 Answers0