Search code examples
c#memoryviewcheat-engine

Why are process memory viewers reading byte arrays to strings?


I have 2 c# applications which communicate with each other through netPipe WCF. One application is sending to the other application an array of bytes. If I check the receiving application's memory map using a process memory viewer (like CheatEngine), I can read the received byte array as a string. Why is this happening?


Solution

  • Well the answer is pretty simple, an array is naturally a reference type, why ? because it cannot have a single value in the memory while it points to many differente memory locations which each have a specific value. That is why it should be a reference type. For that reason, the Object (Array) cannot be directly passed from one computer to another. Then what happens? All the values associated with the object must be fetched from the memory and they must be "Serialized" so that it can be transformed to its original form when received by the receiver. This is called deserialization. There are many different ways for serializing and desrializing data such as transforming the object to XML or JSON, or instead doing binary serialization which is very similar to what you are doing, I mean communicating the byte array.

    To elaborate more imagine the below model:

    public class MyModel{
       public string Name{get; set;}
       public string Email{get; set;}
    }
    

    if you wanna communicate the:

    MyModel Model = new MyModel{ Name ="Jack", Email = "Gmail"};
    

    This object will be translated to something like:

    <MyModel>
       <Name>Jack</Name>
       <Email>Gmail</Email>
    </MyModel>
    

    So that it can passed and when it is received, it will be cast back to its original form. However the MyModel class mist be available in both sides so my suggestion is to keep these types in a dll files for allowing reuse. You wanna know more, let me know to add more details.