Solved

Marshal.ReadInt32(...) function

Posted on 2007-04-10
12
662 Views
Last Modified: 2010-05-18
Hello,

I am really confused about Marshal.ReadInt32(...) function. I have this code which reads binary data from the registry and distinguishes real values from junk by using this function... Here's the sample project:

http://www.frozendev.com/HttpRequestSimulator.zip

I don't understand what Marshal.ReadInt32(...) function does. Here's what MSDN says, but I don't understand what importance it has with that sample code...

This is what the byte array looks like after it is converted to string...

"<\0\0\0\t\0\0\0\0\0\0\0\0\0\0\t\0\0\0127.0.0.1\0\0\0\0\0\0\0\0\0\0\0\0 \v\0\0\0\n3uJ\0\0\0\0\0\0\0\0"
0
Comment
Question by:davidlars99
  • 7
  • 5
12 Comments
 
LVL 13

Author Comment

by:davidlars99
ID: 18886358
This is the function where Marshal.ReadInt32 is called...

public unsafe int ReadInt32()
{
      int num = 0;
      int num2 = 4;
      int num3 = this.m_RegistryBytes.Length - this.m_ByteOffset;
      if (num2 <= num3)
      {
            fixed (byte* numRef = this.m_RegistryBytes)
            {
                  num = Marshal.ReadInt32((IntPtr)numRef, this.m_ByteOffset);
            }
            this.m_ByteOffset += num2;
      }
      return num;
}
0
 
LVL 13

Author Comment

by:davidlars99
ID: 18886360
Can someone also show me what would be the equivalent for Marshal.ReadInt32 function in this case?

Thanks!
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18891303
What problem are you having with the description (it seems pretty simple to me)?

    Reads a 32-bit signed integer from unmanaged memory.

You get an IntPtr to a memory location, and it converts the bytes found there into an int variable type.

Bob
0
Resolve Critical IT Incidents Fast

If your data, services or processes become compromised, your organization can suffer damage in just minutes and how fast you communicate during a major IT incident is everything. Learn how to immediately identify incidents & best practices to resolve them quickly and effectively.

 
LVL 13

Author Comment

by:davidlars99
ID: 18895196
Thanks Bob.

blob.ReadInt32() (not Marshal.ReadInt32()) is called about 6 times while reading bytes from the byte array from the registry key and even at one point its return value is compared to number 60:

if (blob.ReadRegSettings() && (blob.ReadInt32() >= 60))
{
      ....
}

Can you show me this done without using Marshal.ReadInt32 function..?
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18897141
Do you mean something like this?

      RegistryKey key = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Control\GroupOrderList");
      byte[] baseValue = (byte[])key.GetValue("Base");
      decimal value = (decimal)BitConverter.ToDouble(baseValue, 0);

Bob
0
 
LVL 13

Author Comment

by:davidlars99
ID: 18901887
This is the string converted from the byte array below..

F\0\0\0[\0\0\0\0\0\0\0\0\0project_fw1.project.com:80\r\0\0*.projectconnect;lals*.*.*;*.ie.dell.com;uat.*.*;CRP*.project.COM;206.232.189.*;163.198.*.*;166.73.*.*;163.244.*.*;doculogic*.*;*.projectnet.project.com;jupiter*.*;dev.*.*;135.169.128.222;198.152.6.*;126.14.24.*;*.adphc.com;159.3.*.*;pluto.*.*;172.18.*.*;orl10*.*;137.172.226.*;<local>\0\0\0\0\0\0\0\0\0\0\0\0\aTY\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\0

Below is the byte array itself... So lets get this right - ReadInt32 function reads all of the integer values found in the small portion of a byte array correct?

And as I understand, this isn't Int32 --> F\0\0\0[\0\0\0\0\0\0\0\0\0p

But this is --> project_fw1.project.com:80

[0] - 70
[1] - 0
[2] - 0
[3] - 0
[4] - 91
[5] - 0
[6] - 0
[7] - 0
[8] - 3
[9] - 0
[10] - 0
[11] - 0
[12] - 18
[13] - 0
[14] - 0
[15] - 0
[16] - 99
[17] - 105
[18] - 116
[19] - 95
[20] - 102
[21] - 119
[22] - 49
[23] - 46
[24] - 99
[25] - 105
[26] - 116
[27] - 46
[28] - 99
[29] - 111
[30] - 109
[31] - 58
[32] - 56
[33] - 48
[34] - 13
[35] - 1
[36] - 0
[37] - 0
[38] - 42
[39] - 46
[40] - 99
[41] - 105
[42] - 116
[43] - 99
[44] - 111
[45] - 110
[46] - 110
[47] - 101
[48] - 99
[49] - 116
[50] - 59
[51] - 108
[52] - 97
[53] - 108
[54] - 115
[55] - 42
[56] - 46
[57] - 42
[58] - 46
[59] - 42
[60] - 59
[61] - 42
[62] - 46
[63] - 105
[64] - 101
[65] - 46
[66] - 100
[67] - 101
[68] - 108
[69] - 108
[70] - 46
[71] - 99
[72] - 111
[73] - 109
[74] - 59
[75] - 117
[76] - 97
[77] - 116
[78] - 46
[79] - 42
[80] - 46
[81] - 42
[82] - 59
[83] - 67
[84] - 82
[85] - 80
[86] - 42
[87] - 46
[88] - 67
[89] - 73
[90] - 84
[91] - 46
[92] - 67
[93] - 79
[94] - 77
[95] - 59
[96] - 50
[97] - 48
[98] - 54
[99] - 46
[100] - 50
[101] - 51
[102] - 50
[103] - 46
[104] - 49
[105] - 56
[106] - 57
[107] - 46
[108] - 42
[109] - 59
[110] - 49
[111] - 54
[112] - 51
[113] - 46
[114] - 49
[115] - 57
[116] - 56
[117] - 46
[118] - 42
[119] - 46
[120] - 42
[121] - 59
[122] - 49
[123] - 54
[124] - 54
[125] - 46
[126] - 55
[127] - 51
[128] - 46
[129] - 42
[130] - 46
[131] - 42
[132] - 59
[133] - 49
[134] - 54
[135] - 51
[136] - 46
[137] - 50
[138] - 52
[139] - 52
[140] - 46
[141] - 42
[142] - 46
[143] - 42
[144] - 59
[145] - 100
[146] - 111
[147] - 99
[148] - 117
[149] - 108
[150] - 111
[151] - 103
[152] - 105
[153] - 99
[154] - 42
[155] - 46
[156] - 42
[157] - 59
[158] - 42
[159] - 46
[160] - 99
[161] - 105
[162] - 116
[163] - 110
[164] - 101
[165] - 116
[166] - 46
[167] - 99
[168] - 105
[169] - 116
[170] - 46
[171] - 99
[172] - 111
[173] - 109
[174] - 59
[175] - 106
[176] - 117
[177] - 112
[178] - 105
[179] - 116
[180] - 101
[181] - 114
[182] - 42
[183] - 46
[184] - 42
[185] - 59
[186] - 100
[187] - 101
[188] - 118
[189] - 46
[190] - 42
[191] - 46
[192] - 42
[193] - 59
[194] - 49
[195] - 51
[196] - 53
[197] - 46
[198] - 49
[199] - 54
[200] - 57
[201] - 46
[202] - 49
[203] - 50
[204] - 56
[205] - 46
[206] - 50
[207] - 50
[208] - 50
[209] - 59
[210] - 49
[211] - 57
[212] - 56
[213] - 46
[214] - 49
[215] - 53
[216] - 50
[217] - 46
[218] - 54
[219] - 46
[220] - 42
[221] - 59
[222] - 49
[223] - 50
[224] - 54
[225] - 46
[226] - 49
[227] - 52
[228] - 46
[229] - 50
[230] - 52
[231] - 46
[232] - 42
[233] - 59
[234] - 42
[235] - 46
[236] - 97
[237] - 100
[238] - 112
[239] - 104
[240] - 99
[241] - 46
[242] - 99
[243] - 111
[244] - 109
[245] - 59
[246] - 49
[247] - 53
[248] - 57
[249] - 46
[250] - 51
[251] - 46
[252] - 42
[253] - 46
[254] - 42
[255] - 59
[256] - 112
[257] - 108
[258] - 117
[259] - 116
[260] - 111
[261] - 46
[262] - 42
[263] - 46
[264] - 42
[265] - 59
[266] - 49
[267] - 55
[268] - 50
[269] - 46
[270] - 49
[271] - 56
[272] - 46
[273] - 42
[274] - 46
[275] - 42
[276] - 59
[277] - 111
[278] - 114
[279] - 108
[280] - 49
[281] - 48
[282] - 42
[283] - 46
[284] - 42
[285] - 59
[286] - 49
[287] - 51
[288] - 55
[289] - 46
[290] - 49
[291] - 55
[292] - 50
[293] - 46
[294] - 50
[295] - 50
[296] - 54
[297] - 46
[298] - 42
[299] - 59
[300] - 60
[301] - 108
[302] - 111
[303] - 99
[304] - 97
[305] - 108
[306] - 62
[307] - 0
[308] - 0
[309] - 0
[310] - 0
[311] - 0
[312] - 0
[313] - 0
[314] - 0
[315] - 0
[316] - 0
[317] - 0
[318] - 0
[319] - 192
[320] - 7
[321] - 84
[322] - 22
[323] - 187
[324] - 89
[325] - 198
[326] - 1
[327] - 1
[328] - 0
[329] - 0
[330] - 0
[331] - 206
[332] - 212
[333] - 126
[334] - 26
[335] - 0
[336] - 0
[337] - 0
[338] - 0
[339] - 0
[340] - 0
[341] - 0
[342] - 0
[343] - 0
[344] - 0
[345] - 0
[346] - 0
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18902666
1) Marshal.ReadInt32 uses 4 bytes to make up a number, and it uses what values it sees in the byte array.

2) Are you having problems with the DefaultProxy class?

3) Or, are you just trying to understand what is going on.

Bob
0
 
LVL 13

Author Comment

by:davidlars99
ID: 18903471
I'm just trying to understand how ReadInt32 works... Everything else is crystal clear. :)
0
 
LVL 96

Expert Comment

by:Bob Learned
ID: 18904696
If you are trying to understand Marshal.ReadInt32, just think about how an integer is defined (4 bytes of up to 255):

Examples of decimal integers into a byte array:
   10 = {10, 0, 0, 0}
   255 = {0, 1, 0, 0}
   4096 = {0, 16, 0, 0}
   65536 = {0, 0, 1, 0} or 256 ^ 2
   16777216 = {0 , 0,  0,  1} or 256 ^ 3

Marshal.ReadInt32 reverses the process of reading the byte array, and converting the 4 bytes back into an integer, starting at the IntPtr, plus an offset.   The default offset is 0--ReadInt32(IntPtr).  You can specify an offset:  ReadInt32(IntPtr, 8)

Bob

0
 
LVL 13

Author Comment

by:davidlars99
ID: 18905384
> 4 bytes of up to 255

Is this same for all the platforms out there..? How is this calculated..? Is there some algorithm that converts an int value to its byte representation..?
0
 
LVL 13

Author Comment

by:davidlars99
ID: 18905441
I really want to know what the crap this is --> F\0\0\0[\0\0\0\0\0\0\0\0\0  

:-)
0
 
LVL 96

Accepted Solution

by:
Bob Learned earned 500 total points
ID: 18943245
The string representation doesn't always have to make sense.  It would be better to look at the byte data

   Example:
   0F 00 00 00 00 0D 00 00 00 0D

and try to figure out what the number means.  Sometimes it is difficult to understand what the bytes mean without a context.  Numbers can be represented in different ways, such as big endian and little endian (reversed order bytes).  It is all a function of how the code is generated as to how data is stored.

Integer numbers are stored in memory differently depending on the platform.  32-bit operating systems store integers as 32 bits (or 4 bytes).  64-bit operating systems use 64 bits (or 8 bytes).

Here is one way to convert bytes to an integer (C++):

unsigned int Byte2Int(char *buff) //module to convert 4 bytes to an
unsigned integer value
{
unsigned char* byte = reinterpret_cast<unsigned char*(buff);
return ((byte[0]<<24)|(byte[1]<<16)|(byte[2]<<8)|(byte[3]));
}

Bob
0

Featured Post

Space-Age Communications Transitions to DevOps

ViaSat, a global provider of satellite and wireless communications, securely connects businesses, governments, and organizations to the Internet. Learn how ViaSat’s Network Solutions Engineer, drove the transition from a traditional network support to a DevOps-centric model.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us here at EE write code. Many of us write exceptional code; just as many of us write exception-prone code. As we all should know, exceptions are a mechanism for handling errors which are typically out of our control. From database errors, t…
Real-time is more about the business, not the technology. In day-to-day life, to make real-time decisions like buying or investing, business needs the latest information(e.g. Gold Rate/Stock Rate). Unlike traditional days, you need not wait for a fe…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question