internal static string ShowAndRestore(ProtectedString psWord,
			bool bCenterScreen, bool bSetForeground, uint uCharCount, bool? bInitHide)
		{
			IntPtr h = IntPtr.Zero;
			try { h = NativeMethods.GetForegroundWindowHandle(); }
			catch(Exception) { Debug.Assert(false); }

			CharPickerForm dlg = new CharPickerForm();
			dlg.InitEx(psWord, bCenterScreen, bSetForeground, uCharCount, bInitHide);

			DialogResult dr = dlg.ShowDialog();

			ProtectedString ps = dlg.SelectedCharacters;
			string strRet = null;
			if((dr == DialogResult.OK) && (ps != null)) strRet = ps.ReadString();

			UIUtil.DestroyForm(dlg);

			try
			{
				if(h != IntPtr.Zero)
					NativeMethods.EnsureForegroundWindow(h);
			}
			catch(Exception) { Debug.Assert(false); }

			return strRet;
		}

		public static PwgError Generate(out ProtectedString psOut,
			PwProfile pwProfile, byte[] pbUserEntropy,
			CustomPwGeneratorPool pwAlgorithmPool)
		{
			Debug.Assert(pwProfile != null);
			if(pwProfile == null) throw new ArgumentNullException("pwProfile");

			PwgError e = PwgError.Unknown;
			CryptoRandomStream crs = null;
			byte[] pbKey = null;
			try
			{
				crs = CreateRandomStream(pbUserEntropy, out pbKey);

				if(pwProfile.GeneratorType == PasswordGeneratorType.CharSet)
					e = CharSetBasedGenerator.Generate(out psOut, pwProfile, crs);
				else if(pwProfile.GeneratorType == PasswordGeneratorType.Pattern)
					e = PatternBasedGenerator.Generate(out psOut, pwProfile, crs);
				else if(pwProfile.GeneratorType == PasswordGeneratorType.Custom)
					e = GenerateCustom(out psOut, pwProfile, crs, pwAlgorithmPool);
				else { Debug.Assert(false); psOut = ProtectedString.Empty; }
			}
			finally
			{
				if(crs != null) crs.Dispose();
				if(pbKey != null) MemUtil.ZeroByteArray(pbKey);
			}

			return e;
		}

		public static bool Copy(ProtectedString psToCopy, bool bIsEntryInfo,
			PwEntry peEntryInfo, PwDatabase pwReferenceSource)
		{
			if(psToCopy == null) throw new ArgumentNullException("psToCopy");
			return Copy(psToCopy.ReadString(), true, bIsEntryInfo, peEntryInfo,
				pwReferenceSource, IntPtr.Zero);
		}

		public static PwgError Generate(ProtectedString psOutBuffer,
			PwProfile pwProfile, CryptoRandomStream crsRandomSource)
		{
			if(pwProfile.Length == 0) return PwgError.Success;

			PwCharSet pcs = new PwCharSet(pwProfile.CharSet.ToString());
			char[] vGenerated = new char[pwProfile.Length];

			PwGenerator.PrepareCharSet(pcs, pwProfile);

			for(int nIndex = 0; nIndex < (int)pwProfile.Length; ++nIndex)
			{
				char ch = PwGenerator.GenerateCharacter(pwProfile, pcs,
					crsRandomSource);

				if(ch == char.MinValue)
				{
					Array.Clear(vGenerated, 0, vGenerated.Length);
					return PwgError.TooFewCharacters;
				}

				vGenerated[nIndex] = ch;
			}

			byte[] pbUTF8 = Encoding.UTF8.GetBytes(vGenerated);
			psOutBuffer.SetString(Encoding.UTF8.GetString(pbUTF8, 0, pbUTF8.Length));
			Array.Clear(pbUTF8, 0, pbUTF8.Length);
			Array.Clear(vGenerated, 0, vGenerated.Length);

			return PwgError.Success;
		}

        internal static PwgError Generate(out ProtectedString psOut,
			PwProfile pwProfile, CryptoRandomStream crsRandomSource)
        {
            psOut = ProtectedString.Empty;
            if(pwProfile.Length == 0) return PwgError.Success;

            PwCharSet pcs = new PwCharSet(pwProfile.CharSet.ToString());
            char[] vGenerated = new char[pwProfile.Length];

            PwGenerator.PrepareCharSet(pcs, pwProfile);

            for(int nIndex = 0; nIndex < (int)pwProfile.Length; ++nIndex)
            {
                char ch = PwGenerator.GenerateCharacter(pwProfile, pcs,
                    crsRandomSource);

                if(ch == char.MinValue)
                {
                    Array.Clear(vGenerated, 0, vGenerated.Length);
                    return PwgError.TooFewCharacters;
                }

                vGenerated[nIndex] = ch;
            }

            byte[] pbUtf8 = StrUtil.Utf8.GetBytes(vGenerated);
            psOut = new ProtectedString(true, pbUtf8);
            MemUtil.ZeroByteArray(pbUtf8);
            Array.Clear(vGenerated, 0, vGenerated.Length);

            return PwgError.Success;
        }

		public static bool Copy(ProtectedString psToCopy, bool bIsEntryInfo,
			PwEntry peEntryInfo, PwDatabase pwReferenceSource)
		{
			Debug.Assert(psToCopy != null);
			if(psToCopy == null) throw new ArgumentNullException("psToCopy");

			if(bIsEntryInfo && !AppPolicy.Try(AppPolicyId.CopyToClipboard))
				return false;

			string strData = SprEngine.Compile(psToCopy.ReadString(), false,
				peEntryInfo, pwReferenceSource, false, false);

			try
			{
				ClipboardUtil.Clear();

				DataObject doData = CreateProtectedDataObject(strData);
				Clipboard.SetDataObject(doData);

				m_pbDataHash32 = HashClipboard();
				m_strFormat = null;

				RaiseCopyEvent(bIsEntryInfo, strData);
			}
			catch(Exception) { Debug.Assert(false); return false; }

			if(peEntryInfo != null) peEntryInfo.Touch(false);

			// SprEngine.Compile might have modified the database
			Program.MainForm.UpdateUI(false, null, false, null, false, null, false);

			return true;
		}

        public void InitEx(ProtectedString psWord, bool bCenterScreen, bool bSetForeground)
        {
            m_psWord = psWord;

            if(bCenterScreen) this.StartPosition = FormStartPosition.CenterScreen;

            m_bSetForeground = bSetForeground;
        }

		private void SetKey(byte[] pbPasswordUtf8)
		{
			Debug.Assert(pbPasswordUtf8 != null);
			if(pbPasswordUtf8 == null) throw new ArgumentNullException("pbPasswordUtf8");

			SHA256Managed sha256 = new SHA256Managed();
			byte[] pbRaw = sha256.ComputeHash(pbPasswordUtf8);

			m_psPassword = new ProtectedString(true, pbPasswordUtf8);
			m_pbKeyData = new ProtectedBinary(true, pbRaw);
		}

        /// <summary>
        /// Initialize the dialog. Needs to be called before the dialog is shown.
        /// </summary>
        /// <param name="vStringDict">String container. Must not be <c>null</c>.</param>
        /// <param name="strStringName">Initial name of the string. May be <c>null</c>.</param>
        /// <param name="psStringValue">Initial value. May be <c>null</c>.</param>
        public void InitEx(ProtectedStringDictionary vStringDict, string strStringName,
            ProtectedString psStringValue, PwDatabase pwContext)
        {
            Debug.Assert(vStringDict != null); if(vStringDict == null) throw new ArgumentNullException("vStringDict");
            m_vStringDict = vStringDict;

            m_strStringName = strStringName;
            m_psStringValue = psStringValue;

            m_pwContext = pwContext;
        }

		internal static ProtectedString GetKeyParts(byte[] pbPasswordUtf8, out ProtectedBinary pbKeyData)
		{
			Debug.Assert(pbPasswordUtf8 != null);
			if(pbPasswordUtf8 == null) throw new ArgumentNullException("pbPasswordUtf8");

			SHA256Managed sha256 = new SHA256Managed();
			byte[] pbRaw = sha256.ComputeHash(pbPasswordUtf8);

			var psPassword = new ProtectedString(true, pbPasswordUtf8);
			pbKeyData = new ProtectedBinary(true, pbRaw);
			return psPassword;
		}

		private void SetKey(byte[] pbPasswordUtf8)
		{
			Debug.Assert(pbPasswordUtf8 != null);
			if(pbPasswordUtf8 == null) throw new ArgumentNullException("pbPasswordUtf8");

#if (DEBUG && !KeePassLibSD)
			Debug.Assert(ValidatePassword(pbPasswordUtf8));
#endif

			byte[] pbRaw = CryptoUtil.HashSha256(pbPasswordUtf8);

			m_psPassword = new ProtectedString(true, pbPasswordUtf8);
			m_pbKeyData = new ProtectedBinary(true, pbRaw);
		}

public void ExpandPattern()
{
    // arrange
    var psOutBuffer = new ProtectedString();
    var pwProfile = new PwProfile();
    pwProfile.Pattern = "g{5}";
    var pbKey = new byte[] { 0x00 };
    var crsRandomSource = new CryptoRandomStream(CrsAlgorithm.Salsa20, pbKey);
    var error = PatternBasedGenerator.Generate(psOutBuffer, pwProfile, crsRandomSource);

    // act
    // nothing to do as ExpandPattern() would have been called by calling Generate()

    // assert
    Assert.AreEqual(PwgError.Success, error);
    var actual = psOutBuffer.ReadString();
    Assert.AreEqual("ggggg", actual);
}

		public static PwgError Generate(ProtectedString psOutBuffer,
			PwProfile pwProfile, byte[] pbUserEntropy,
			CustomPwGeneratorPool pwAlgorithmPool)
		{
			Debug.Assert(psOutBuffer != null);
			if(psOutBuffer == null) throw new ArgumentNullException("psOutBuffer");
			Debug.Assert(pwProfile != null);
			if(pwProfile == null) throw new ArgumentNullException("pwProfile");

			psOutBuffer.Clear();

			CryptoRandomStream crs = CreateCryptoStream(pbUserEntropy);
			PwgError e = PwgError.Unknown;

			if(pwProfile.GeneratorType == PasswordGeneratorType.CharSet)
				e = CharSetBasedGenerator.Generate(psOutBuffer, pwProfile, crs);
			else if(pwProfile.GeneratorType == PasswordGeneratorType.Pattern)
				e = PatternBasedGenerator.Generate(psOutBuffer, pwProfile, crs);
			else if(pwProfile.GeneratorType == PasswordGeneratorType.Custom)
				e = GenerateCustom(psOutBuffer, pwProfile, crs, pwAlgorithmPool);
			else { Debug.Assert(false); }

			return e;
		}

 private void OnBtnOK(object sender, EventArgs e)
 {
     byte[] pbUtf8 = m_secWord.ToUtf8();
     m_psSelected = new ProtectedString(true, pbUtf8);
     Array.Clear(pbUtf8, 0, pbUtf8.Length);
 }

		public ProtectedString Remove(int iStart, int nCount)
		{
			if(iStart < 0) throw new ArgumentOutOfRangeException("iStart");
			if(nCount < 0) throw new ArgumentOutOfRangeException("nCount");
			if(nCount == 0) return this;

			// Only operate directly with strings when m_bIsProtected is
			// false, not in the case of non-null m_strPlainText, because
			// the operation creates a new sequence in memory
			if(!m_bIsProtected)
				return new ProtectedString(false, ReadString().Remove(
					iStart, nCount));

			UTF8Encoding utf8 = StrUtil.Utf8;

			byte[] pb = ReadUtf8();
			char[] v = utf8.GetChars(pb);
			char[] vNew;

			try
			{
				if((iStart + nCount) > v.Length)
					throw new ArgumentException("iStart + nCount");

				vNew = new char[v.Length - nCount];
				Array.Copy(v, 0, vNew, 0, iStart);
				Array.Copy(v, iStart + nCount, vNew, iStart, v.Length -
					(iStart + nCount));
			}
			finally
			{
				Array.Clear(v, 0, v.Length);
				MemUtil.ZeroByteArray(pb);
			}

			byte[] pbNew = utf8.GetBytes(vNew);
			ProtectedString ps = new ProtectedString(m_bIsProtected, pbNew);

			Debug.Assert(utf8.GetString(pbNew, 0, pbNew.Length) ==
				ReadString().Remove(iStart, nCount));

			Array.Clear(vNew, 0, vNew.Length);
			MemUtil.ZeroByteArray(pbNew);
			return ps;
		}

		public ProtectedString WithProtection(bool bProtect)
		{
			if(bProtect == m_bIsProtected) return this;

			byte[] pb = ReadUtf8();
			ProtectedString ps = new ProtectedString(bProtect, pb);

			if(bProtect) MemUtil.ZeroByteArray(pb);
			return ps;
		}

		private static void TestProtectedObjects()
		{
#if DEBUG
			Encoding enc = StrUtil.Utf8;

			byte[] pbData = enc.GetBytes("Test Test Test Test");
			ProtectedBinary pb = new ProtectedBinary(true, pbData);
			if(!pb.IsProtected) throw new SecurityException("ProtectedBinary-1");

			byte[] pbDec = pb.ReadData();
			if(!MemUtil.ArraysEqual(pbData, pbDec))
				throw new SecurityException("ProtectedBinary-2");
			if(!pb.IsProtected) throw new SecurityException("ProtectedBinary-3");

			byte[] pbData2 = enc.GetBytes("Test Test Test Test");
			byte[] pbData3 = enc.GetBytes("Test Test Test Test Test");
			ProtectedBinary pb2 = new ProtectedBinary(true, pbData2);
			ProtectedBinary pb3 = new ProtectedBinary(true, pbData3);
			if(!pb.Equals(pb2)) throw new SecurityException("ProtectedBinary-4");
			if(pb.Equals(pb3)) throw new SecurityException("ProtectedBinary-5");
			if(pb2.Equals(pb3)) throw new SecurityException("ProtectedBinary-6");

			if(pb.GetHashCode() != pb2.GetHashCode())
				throw new SecurityException("ProtectedBinary-7");
			if(!((object)pb).Equals((object)pb2))
				throw new SecurityException("ProtectedBinary-8");
			if(((object)pb).Equals((object)pb3))
				throw new SecurityException("ProtectedBinary-9");
			if(((object)pb2).Equals((object)pb3))
				throw new SecurityException("ProtectedBinary-10");

			ProtectedString ps = new ProtectedString();
			if(ps.Length != 0) throw new SecurityException("ProtectedString-1");
			if(!ps.IsEmpty) throw new SecurityException("ProtectedString-2");
			if(ps.ReadString().Length != 0)
				throw new SecurityException("ProtectedString-3");

			ps = new ProtectedString(true, "Test");
			ProtectedString ps2 = new ProtectedString(true, enc.GetBytes("Test"));
			if(ps.IsEmpty) throw new SecurityException("ProtectedString-4");
			pbData = ps.ReadUtf8();
			pbData2 = ps2.ReadUtf8();
			if(!MemUtil.ArraysEqual(pbData, pbData2))
				throw new SecurityException("ProtectedString-5");
			if(pbData.Length != 4)
				throw new SecurityException("ProtectedString-6");
			if(ps.ReadString() != ps2.ReadString())
				throw new SecurityException("ProtectedString-7");
			pbData = ps.ReadUtf8();
			pbData2 = ps2.ReadUtf8();
			if(!MemUtil.ArraysEqual(pbData, pbData2))
				throw new SecurityException("ProtectedString-8");
			if(!ps.IsProtected) throw new SecurityException("ProtectedString-9");
			if(!ps2.IsProtected) throw new SecurityException("ProtectedString-10");

			Random r = new Random();
			string str = string.Empty;
			ps = new ProtectedString();
			for(int i = 0; i < 100; ++i)
			{
				bool bProt = ((r.Next() % 4) != 0);
				ps = ps.WithProtection(bProt);

				int x = r.Next(str.Length + 1);
				int c = r.Next(20);
				char ch = (char)r.Next(1, 256);

				string strIns = new string(ch, c);
				str = str.Insert(x, strIns);
				ps = ps.Insert(x, strIns);

				if(ps.IsProtected != bProt)
					throw new SecurityException("ProtectedString-11");
				if(ps.ReadString() != str)
					throw new SecurityException("ProtectedString-12");

				ps = ps.WithProtection(bProt);

				x = r.Next(str.Length);
				c = r.Next(str.Length - x + 1);

				str = str.Remove(x, c);
				ps = ps.Remove(x, c);

				if(ps.IsProtected != bProt)
					throw new SecurityException("ProtectedString-13");
				if(ps.ReadString() != str)
					throw new SecurityException("ProtectedString-14");
			}
#endif
		}

        private static string ReplaceNewPasswordPlaceholder(string strText,
            SprContext ctx, uint uRecursionLevel)
        {
            PwEntry pe = ctx.Entry;
            PwDatabase pd = ctx.Database;
            if((pe == null) || (pd == null)) return strText;

            string str = strText;

            const string strNewPwStart = @"{NEWPASSWORD";
            if(str.IndexOf(strNewPwStart, StrUtil.CaseIgnoreCmp) < 0) return str;

            string strGen = null;

            int iStart;
            List<string> lParams;
            while(SprEngine.ParseAndRemovePlhWithParams(ref str, ctx, uRecursionLevel,
                strNewPwStart + ":", out iStart, out lParams, true))
            {
                if(strGen == null)
                    strGen = GeneratePassword((((lParams != null) &&
                        (lParams.Count > 0)) ? lParams[0] : string.Empty), ctx);

                str = str.Insert(iStart, strGen);
            }

            const string strNewPwPlh = strNewPwStart + @"}";
            if(str.IndexOf(strNewPwPlh, StrUtil.CaseIgnoreCmp) >= 0)
            {
                if(strGen == null) strGen = GeneratePassword(null, ctx);

                str = StrUtil.ReplaceCaseInsensitive(str, strNewPwPlh, strGen);
            }

            if(strGen != null)
            {
                pe.CreateBackup(pd);

                ProtectedString psGen = new ProtectedString(
                    pd.MemoryProtection.ProtectPassword, strGen);
                pe.Strings.Set(PwDefs.PasswordField, psGen);

                pe.Touch(true, false);
                pd.Modified = true;
            }
            else { Debug.Assert(false); }

            return str;
        }

        /// <summary>
        /// Initialize the dialog.
        /// </summary>
        /// <param name="psWord">Password to pick characters from.</param>
        /// <param name="bCenterScreen">Specifies whether to center the form
        /// on the screen or not.</param>
        /// <param name="bSetForeground">If <c>true</c>, the window will be
        /// brought to the foreground when showing it.</param>
        /// <param name="uCharCount">Number of characters to pick. Specify
        /// 0 to allow picking a variable amount of characters.</param>
        public void InitEx(ProtectedString psWord, bool bCenterScreen,
            bool bSetForeground, uint uCharCount, bool? bInitHide)
        {
            m_psWord = psWord;

            if(bCenterScreen) this.StartPosition = FormStartPosition.CenterScreen;

            m_bSetForeground = bSetForeground;
            m_uCharCount = uCharCount;
            m_bInitHide = bInitHide;
        }

		/// <summary>
		/// Construct a new protected string. The string is initialized
		/// to the value passed in the <c>pbTemplate</c> protected string.
		/// </summary>
		/// <param name="psTemplate">The initial string value. This
		/// parameter won't be modified. Must not be <c>null</c>.</param>
		/// <exception cref="System.ArgumentNullException">Thrown if the input
		/// parameter is <c>null</c>.</exception>
		public ProtectedString(ProtectedString psTemplate)
		{
			Debug.Assert(psTemplate != null);
			if(psTemplate == null) throw new ArgumentNullException("psTemplate");

			try { m_secString = new SecureString(); }
			catch(NotSupportedException) { } // Windows 98 / ME

			m_bIsProtected = psTemplate.m_bIsProtected;
			SetString(psTemplate.ReadString());
		}