int length = Marshal.ReadInt32(intPtr, -4);
for(int i=0;i<length;i+=2){
  short unicodeChar = Marshal.ReadInt16(intPtr, i);
  // handle unicodeChar
}

static String SecureStringToString(SecureString value)
{
    IntPtr bstr = Marshal.SecureStringToBSTR(value);

    try
    {
        return Marshal.PtrToStringBSTR(bstr);
    }
    finally
    {
        Marshal.FreeBSTR(bstr);
    }
}