peass-ng/PEASS-ng · error · ArgumentException

failed to construct OCTET STRING from byte[]:

Error message

failed to construct OCTET STRING from byte[]: 

What it means

Asn1OctetString.GetInstance, given a raw byte[], first parses it as an ASN.1 object; if parsing throws IOException it is rethrown as ArgumentException with this message. It means the byte[] you passed was expected to be an encoded OCTET STRING but is not decodable ASN.1 data.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1OctetString.cs:56

         *
         * @param obj the object we want converted.
         * @exception ArgumentException if the object cannot be converted.
         */
        public static Asn1OctetString GetInstance(object obj)
        {
            if (obj == null || obj is Asn1OctetString)
            {
                return (Asn1OctetString)obj;
            }
            else if (obj is byte[])
            {
                try
                {
                    return GetInstance(FromByteArray((byte[])obj));
                }
                catch (IOException e)
                {
                    throw new ArgumentException("failed to construct OCTET STRING from byte[]: " + e.Message);
                }
            }
            // TODO: this needs to be deleted in V2
            else if (obj is Asn1TaggedObject)
            {
                return GetInstance(((Asn1TaggedObject)obj).GetObject());
            }
            else if (obj is Asn1Encodable)
            {
                Asn1Object primitive = ((Asn1Encodable)obj).ToAsn1Object();

                if (primitive is Asn1OctetString)
                {
                    return (Asn1OctetString)primitive;
                }
            }

            throw new ArgumentException("illegal object in GetInstance: " + Platform.GetTypeName(obj));

View on GitHub (pinned to 53fb989abc)

Solutions

1. If the bytes are raw data (not ASN.1), construct directly: new DerOctetString(bytes)
2. Validate the byte[] parses as DER before calling GetInstance (Asn1Object.FromByteArray in try/catch)
3. Check where the byte[] came from — re-derive from the parent ASN.1 structure instead of manual slicing
4. Log e.Message (appended to this error) to see the underlying parse failure

Example fix

// before
Asn1OctetString s = Asn1OctetString.GetInstance(rawBytes); // raw, non-ASN.1 data
// after
Asn1OctetString s = new DerOctetString(rawBytes); // wrap raw data directly

bool IsDerEncoded(byte[] data) { try { Asn1Object.FromByteArray(data); return true; } catch { return false; } }

bool IsOctetString(byte[] data) { try { return Asn1Object.FromByteArray(data) is Asn1OctetString; } catch { return false; } }

try { return Asn1OctetString.GetInstance(bytes); }
catch (ArgumentException) { return new DerOctetString(bytes); } // treat as raw data

When it happens

Trigger: Calling Asn1OctetString.GetInstance(byte[]) where the byte[] is not a valid DER-encoded OCTET STRING (wrong content, truncated, or an entirely different ASN.1 structure that then fails inner GetInstance).

Common situations: Extracting a payload from a PKCS structure and re-wrapping it; passing raw plaintext bytes where DER-encoded bytes are required; off-by-one slicing of a decoded structure.

Related errors

• unsupported tag number
• encoding error in GetInstance:
• illegal object in GetInstance:
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/06146c0c953045e7. Report an issue: GitHub.