Question

I’m trying to read base block from windows HIVE file. First 4 bytes of file contain “regf” magic number. This string is ANSI, but there are unicode strings as well.
If I specify MarshalAs attribute and set type to ByValTStr it works fine, however it doesn’t read unicode strings. MSDN says that if you use ByValTStr, then array’s type is determined by the character set of the containing structure. The problem is if I set character set to unicode for the whole structure, then I’m not able to read magic number (first 4 bytes).

[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 5)]
public string MagicNumber;

How can I change character set for particular string, not for the whole structure?

I’m also trying to use LPStr type, but it doesn’t work at all.

[MarshalAs(UnmanagedType.LPStr, SizeConst = 5)]
public String MagicNumber;

With this type of marshalign instead of “regf” magic number I get unreadable characters.

How to fix that?

Thanks in advance.

Answer 1

Marshal it as a ByValArray instead:

[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4)]
public byte[] MagicNumber;

You don’t need it as a string and the Marshaller will probably fail if you set it to a string. In your definition you have it defined as a 5 character string (the 4 characters plus a null terminator) – but the HIVE file won’t have a null terminator after magic number the 5th byte of the file is another field.

Trying to directly map a file to a struct may not work anyway. A struct defines an in memory layout (with appropriate padding and assumptions like null terminated strings) and a disk format usually doesn’t directly map to a well laid out structure. You will probably be better off reading the file into a byte[] buffer and manually parsing it.