Are you able to use PtrToStringAuto to decrypt a secure string in Powershell 7 on macOS?

by

Note that [securestring] is not recommended for new code anymore.

While on Windows secure strings offer limited protection – by storing the string encrypted in memory – via the DPAPI – and by shortening the window during which the plain-text representation is held in memory, no encryption at all is used on Unix-like platforms.[1]

The only way around this I have found is to use PtrToStringBSTR.

That is not only a way around the problem, PtrToStringBSTR is the method that should have been used to begin with, given that the input string is a BSTR.[2]

Do note that converting a secure string to and from a regular [string] instance defeats the very purpose of using [securestring] to begin with: you’ll end up with a plain-text representation of your sensitive data in your process’ memory whose lifetime you cannot control.

If you really want to do this, a simpler, cross-platform-compatible approach is:

[System.Net.NetworkCredential]::new('dummy', $string).Password

[1] This is especially problematic when you save a secure string in a file, via ConvertFrom-SecureString or Export-CliXml – see this answer.

[2] The Auto in PtrToStringAuto() means that the unmanaged input string is assumed to use a platform-appropriate character encoding, whereas BSTR is
a “Unicode” (UTF-16) string on all platforms. On Windows, an unmanaged string is assumed to have UTF-16 encoding (which is why the code works), whereas on Unix-like platforms it is UTF-8 since .NET Core 3.0 (PowerShell [Core] 7.0 is based on .NET Core 3.1), which explains your symptoms: the NUL chars. in the BSTR instance’s UTF-16 code units are interpreted as characters in their own right when (mis)interpreted as UTF-8. Note that .NET Core 2.x (which is what PowerShell [Core] 6.x is based on) (inappropriately) defaulted to UTF-16, which this PR fixed, amounting to a breaking change.

More Related Contents:

  1. Using PowerShell credentials without being prompted for a password
  2. PowerShell and the -contains operator
  3. Running a powershell command using full path and arguments from command line [duplicate]
  4. Character-encoding problem with string literal in source code
  5. How to handle failed variable assignments in powershell? [duplicate]
  6. Redirecting standard input\output in Windows PowerShell
  7. Reload the path in PowerShell
  8. INI file parsing in PowerShell
  9. Parameter interpretation when running jobs
  10. Powershell: Uninstall application by UpgradeCode
  11. Export-CSV exports length but not name
  12. Timing a command’s execution in PowerShell
  13. How to properly -filter multiple strings in a PowerShell copy script
  14. Write-Host vs Write-Information in PowerShell 5
  15. Why does “Get-ChildItem -File | Get-FileHash” work?
  16. Get the drive letter of USB drive in PowerShell
  17. Powershell Using Start-Process in PSSession to Open Notepad
  18. CMD or Powershell command to combine (merge) corresponding lines from two files [duplicate]
  19. Powershell Get-ChildItem most recent file in directory
  20. Powershell – Reboot and Continue Script
  21. Hashtables and key order
  22. Executing powershell command directly in jenkins pipeline
  23. How can I execute an external program with parameters in PowerShell?
  24. Should $null be on the left side of the equality comparison? (-eq with arrays)
  25. Does PowerShell support HashTable Serialization?
  26. How can I redirect stdout and stderr without polluting PowerShell error output
  27. Using Powershell environmental variables as strings when outputting files
  28. Variable scoping in PowerShell
  29. PowerShell launch script in new instance
  30. How to return specific data type from PowerShell function i.e. DataTable

Leave a Comment