Dispose a variable

The best thing to do would be to zero out its memory once you've finished using it.

You can do this quite easily using unsafe code but, so you don't have to compile with the /unsafe switch on, I'll show you another way which uses P/Invoke to call the API function RtlZeroMemory:

using System;

using System.Runtime.InteropServices;

class Program

{

[DllImport("Kernel32.dll", EntryPoint="RtlZeroMemory")]

static extern void ZeroMemory(IntPtr dest, int size);

static void Main()

{

string myCode = "password";

Console.WriteLine("myCode contains {0}", myCode);

GCHandle gch = GCHandle.Alloc(myCode, GCHandleType.Pinned);

int size = myCode.Length * 2;

ZeroMemory(gch.AddrOfPinnedObject(), size);

gch.Free();

Console.WriteLine("myCode now contains {0}", myCode);

Console.ReadKey(true);

}

}

The output is:

myCode contains password

myCode now contains

There's also something called a SecureString but whether it would be suitable here depends on how the string is being constructed in the first place. Check out:

http://msdn.microsoft.com/en-us/library/system.security.securestring(v=vs.110).aspx

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Vulpes11y ago
Accepted answer
The best thing to do would be to zero out its memory once you've finished using it.

You can do this quite easily using unsafe code but, so you don't have to compile with the /unsafe switch on, I'll show you another way which uses P/Invoke to call the API function RtlZeroMemory:

using System;
using System.Runtime.InteropServices;

class Program
{
[DllImport("Kernel32.dll", EntryPoint="RtlZeroMemory")]
static extern void ZeroMemory(IntPtr dest, int size);

static void Main()
{
string myCode = "password";
Console.WriteLine("myCode contains {0}", myCode);
GCHandle gch = GCHandle.Alloc(myCode, GCHandleType.Pinned);
int size = myCode.Length * 2;
ZeroMemory(gch.AddrOfPinnedObject(), size);
gch.Free();
Console.WriteLine("myCode now contains {0}", myCode);
Console.ReadKey(true);
}
}

The output is:

myCode contains password
myCode now contains

There's also something called a SecureString but whether it would be suitable here depends on how the string is being constructed in the first place. Check out:

http://msdn.microsoft.com/en-us/library/system.security.securestring(v=vs.110).aspx