title: Why does this code work without the unsafe keyword?
body: <p>In <a href="https://stackoverflow.com/questions/791498/how-to-steal-private-data-in-net/791506#791506">an answer</a> to his own <a href="https://stackoverflow.com/questions/791498/how-to-steal-private-data-in-net/">controversial question</a>, <a href="https://stackoverflow.com/users/33854/mash">Mash</a> has illustrated that you don't need the "unsafe" keyword to read and write directly to the bytes of any .NET object instance. You can declare the following types:</p>
  
  <pre><code>   [StructLayout(LayoutKind.Explicit)]
     struct MemoryAccess
     {
  
        [FieldOffset(0)]
        public object Object;
  
        [FieldOffset(0)]
        public TopBytes Bytes;
     }
  
     class TopBytes
     {
        public byte b0;
        public byte b1;
        public byte b2;
        public byte b3;
        public byte b4;
        public byte b5;
        public byte b6;
        public byte b7;
        public byte b8;
        public byte b9;
        public byte b10;
        public byte b11;
        public byte b12;
        public byte b13;
        public byte b14;
        public byte b15;
     }
  </code></pre>
  
  <p>And then you can do things like change an "immutable" string. The following code prints "bar" on my machine:</p>
  
  <pre><code> string foo = "foo";
   MemoryAccess mem = new MemoryAccess();
   mem.Object = foo;
   mem.Bytes.b8 = (byte)'b';
   mem.Bytes.b10 = (byte)'a';
   mem.Bytes.b12 = (byte)'r';
   Console.WriteLine(foo);
  </code></pre>
  
  <p>You can also trigger an <a href="http://msdn.microsoft.com/en-us/library/system.accessviolationexception.aspx" rel="nofollow noreferrer">AccessViolationException</a> by corrupting object references with the same technique.</p>
  
  <p>Question: I thought that (in pure managed C# code) the <a href="http://msdn.microsoft.com/en-us/library/chfa2zb8(VS.71).aspx" rel="nofollow noreferrer">unsafe</a> keyword was necessary to do things like this. Why is it not necessary here? <strong>Does this mean that pure managed "safe" code is not really safe at all?</strong></p>