why not just byte[] and we don't have to deal with CER?   we did use byte[] in codes above.

And you must use AllocHGlobal, I suggest wrapping it with SafeHandle to minimize CER scope.  See [SafeUnmanageMemoryHandle](http://stackoverflow.com/questions/17562295/if-i-allocate-some-memory-with-allochglobal-do-i-have-to-free-it-with-freehglob) sample.