BinaryFormatter Serialize DirectCast Class

[JZ]

Hi,

I'm using a class and binary formatter to store data in files.

For example..

Dim FPs As New StuctureDataFil e()
Dim FileStream As Stream = File.Open(pfile , FileMode.Open)
Dim FileFormatter As New BinaryFormatter ()
FPs = DirectCast(File Formatter.Deser ialize(FileStre am), StuctureDataFil e)
FileStream.Clos e()

How secure is the the data file, is it easy for someone to re-create my
class by analysis the datafile?

I want to stop people creating their own data files.

Also, is there anyway I can provide extra security? For example, encryption?

Thanks in advance!!

--
JZ

[Tom Shelton]

On Wed, 22 Sep 2004 21:18:32 +0100, JZ wrote:

Hi,

I'm using a class and binary formatter to store data in files.

For example..

Dim FPs As New StuctureDataFil e()
Dim FileStream As Stream = File.Open(pfile , FileMode.Open)
Dim FileFormatter As New BinaryFormatter ()
FPs = DirectCast(File Formatter.Deser ialize(FileStre am), StuctureDataFil e)
FileStream.Clos e()

How secure is the the data file, is it easy for someone to re-create my
class by analysis the datafile?

I want to stop people creating their own data files.

Also, is there anyway I can provide extra security? For example, encryption?

Thanks in advance!!

Sure, you can serialize to a MemoryStream, and then use one of the various
encryption classes in System.Security .Cryptography to encrypt the byte
array before writting it to the file... Obviously, the process would be
thre reverse to recover the data :)
--
Tom Shelton [MVP]

[Jay B. Harlow [MVP - Outlook]]

JZ,

How secure is the the data file, is it easy for someone to re-create my
class by analysis the datafile? I'm not sure how easy it would be but you could open the file in VS.NET to
see how readable it is. You will notice that strings are immediately
readable, plus the Assembly, Class & Field names...

As Tom suggests you can use a System.Security .Cryptography.C ryptoStream to
encrypt & decrypt the file.

You can chain the streams, so you don't need to use a MemoryStream per se.

Try something like:

Public Shared Sub Main()

Dim rijndael As New RijndaelManaged
rijndael.Genera teKey() ' create random key
rijndael.Genera teIV() ' create random initialization vector
Dim encryptor As ICryptoTransfor m =
rijndael.Create Encryptor(rijnd ael.Key, rijndael.IV)
Dim decryptor As ICryptoTransfor m =
rijndael.Create Decryptor(rijnd ael.Key, rijndael.IV)

Dim FPs As New StuctureDataFil e
Encrypt("Stuctu reDataFile.bin" , FPs, encryptor)
FPs = Decrypt("Stuctu reDataFile.bin" , decryptor)

End Sub

Private Shared Sub Encrypt(ByVal path As String, ByVal fps As
StuctureDataFil e, ByVal transform As ICryptoTransfor m)
Dim formatter As New BinaryFormatter
Dim output As Stream = File.Open(path, FileMode.Create )
Dim cryptoOutput As New CryptoStream(ou tput, transform,
CryptoStreamMod e.Write)
formatter.Seria lize(cryptoOutp ut, fps)
cryptoOutput.Fl ushFinalBlock()
cryptoOutput.Cl ose()
output.Close()
End Sub

Private Shared Function Decrypt(ByVal path As String, ByVal transform As
ICryptoTransfor m) As StuctureDataFil e
Dim formatter As New BinaryFormatter
Dim input As Stream = File.Open(path, FileMode.Open)
Dim cryptoInput As New CryptoStream(in put, transform,
CryptoStreamMod e.Read)
Dim fps As StuctureDataFil e =
DirectCast(form atter.Deseriali ze(cryptoInput) , StuctureDataFil e)
cryptoInput.Clo se()
input.Close()
Return fps
End Function
Note in the above I am using the Rijndael algorithm to encrypt & decrypt the
file. You can use other algorithms if you so choose, just remember to use
the exact same key & iv for decryption that you use for encryption! The
RijndaelManaged .GenerateKey & GenerateIV creates a random key &
initialization vector, good for testing, not good for production...

Hope this helps
Jay

"JZ" <[e-mail].c om> wrote in message
news:41******** *************** @news-text.dial.pipex .com... Hi,

I'm using a class and binary formatter to store data in files.

For example..

Dim FPs As New StuctureDataFil e()
Dim FileStream As Stream = File.Open(pfile , FileMode.Open)
Dim FileFormatter As New BinaryFormatter ()
FPs = DirectCast(File Formatter.Deser ialize(FileStre am), StuctureDataFil e)
FileStream.Clos e()

How secure is the the data file, is it easy for someone to re-create my
class by analysis the datafile?

I want to stop people creating their own data files.

Also, is there anyway I can provide extra security? For example,
encryption?

Thanks in advance!!

--
JZ

[Tom Shelton]

On Wed, 22 Sep 2004 17:22:29 -0500, Jay B. Harlow [MVP - Outlook] wrote:

JZ,

How secure is the the data file, is it easy for someone to re-create my
class by analysis the datafile?

I'm not sure how easy it would be but you could open the file in VS.NET to
see how readable it is. You will notice that strings are immediately
readable, plus the Assembly, Class & Field names...

As Tom suggests you can use a System.Security .Cryptography.C ryptoStream to
encrypt & decrypt the file.

You can chain the streams, so you don't need to use a MemoryStream per se.

Dang it! I knew that was possible, but for some reason the memorystream
thing stuck in my head... Good one Jay.

--
Tom Shelton [MVP]

[JZ]

Hi,

Thanks thats exactly what I was looking for.

Really quick too.

Cheers
--
JZ

[JZ]

Hi,

Thanks thats exactly what I was looking for.

Really quick too.

Cheers
--
JZ

[JZ]

Hi,

Is there any reason why this shouldn't work on Windows 98.

I have the code working fine on XP Pro.
But it has an error on 98 :
serializationex ception 'type is not resolved'

I've tried a rebuild of my data files.

Any suggestions?

--
JZ

[JZ]

Hi,

Is there any reason why this shouldn't work on Windows 98.

I have the code working fine on XP Pro.
But it has an error on 98 :
serializationex ception 'type is not resolved'

I've tried a rebuild of my data files.

Any suggestions?

--
JZ

[JZ]

Actually it doesn't work on Windows 2000 either.

--
JZ

[JZ]

Actually it doesn't work on Windows 2000 either.

--
JZ