模仿用户时如何将SecureZeroMemory与LogonUser一起使用？

Question

When is it necessary or recommended to add the function SecureZeroMemory ?

Neither this MSFT sample for WindowsImpersonationContext , or these Stackoverflow questions link link2 even mention the SecureZeroMemory function.

Should I implement this function (or perhaps ask the owner of the accepted answers to include this feature?)

Answer 1

SecureZeroMemory is, as the name would imply, a way to set a block of memory to all 0x00 values, although it has the following idiosyncracies:

• It will never be optimized out by a compiler
• ...
• Actually, that's the only difference I can think of.

As @user629926 mentions, the SecureString class, as awkward as it can be to use, is a "safe" way of holding onto string data in memory without worrying that if your app crashes, someone can sift through the memory dump and find your raw sensitive data in it.