peass-ng/PEASS-ng · error · ArgumentException

illegal object in GetInstance:

Error message

illegal object in GetInstance: 

What it means

DerBoolean.GetInstance is BouncyCastle's strict conversion helper: it only accepts null or an object that is already a DerBoolean. Passing any other object type (e.g. DerInteger, DerOctetString, a raw bool/byte[]) makes the parser throw this ArgumentException with the offending type name appended to the message.

Solutions

1. Inspect the actual type in the message (Platform.GetTypeName output) and use the matching Der* GetInstance, e.g. DerInteger.GetInstance
2. If the value is inside a tagged object, call GetInstance((Asn1TaggedObject)obj, true) so tagging is unwrapped first
3. Verify the ASN.1 structure you are parsing actually defines this field as BOOLEAN
4. Wrap parsing in try/catch ArgumentException and treat the element as absent/malformed

Example fix

// before
var b = DerBoolean.GetInstance(asn1Obj);
// after
if (asn1Obj is DerBoolean db) { var b = db; }
else if (asn1Obj is Asn1TaggedObject t) { var b = DerBoolean.GetInstance(t, true); }
else { /* handle wrong type */ }

bool ok = obj == null || obj is DerBoolean;

bool IsDerBoolean(object o) => o is DerBoolean;

try { var b = DerBoolean.GetInstance(obj); }
catch (ArgumentException ex) { /* log ex.Message, treat field as invalid */ }

When it happens

Trigger: Calling DerBoolean.GetInstance(obj) with an Asn1Object that is not a DerBoolean (e.g. a DerInteger or Asn1Null parsed from an ASN.1 stream), or passing a non-null object when expecting a BOOLEAN-tagged element that was actually encoded as a different ASN.1 type.

Common situations: Parsing X.509/CRL/CMS structures where a field is misinterpreted or a different certificate profile encodes a value as INTEGER/NULL instead of BOOLEAN; mixing up GetInstance(object) vs GetInstance(Asn1TaggedObject, bool) overloads.

Related errors

• illegal object in GetInstance:
• BOOLEAN value should have 1 byte in it
• byte value should have 1 byte in it
• cannot recognise object in stream
• DER length more than 4 bytes:

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/98404a128c3a0297. Report an issue: GitHub.

Appendix: source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBoolean.cs:27

        private readonly byte value;

        public static readonly DerBoolean False = new DerBoolean(false);
        public static readonly DerBoolean True = new DerBoolean(true);

        /**
         * return a bool from the passed in object.
         *
         * @exception ArgumentException if the object cannot be converted.
         */
        public static DerBoolean GetInstance(
            object obj)
        {
            if (obj == null || obj is DerBoolean)
            {
                return (DerBoolean)obj;
            }

            throw new ArgumentException("illegal object in GetInstance: " + Platform.GetTypeName(obj));
        }

        /**
         * return a DerBoolean from the passed in bool.
         */
        public static DerBoolean GetInstance(
            bool value)
        {
            return value ? True : False;
        }

        /**
         * return a Boolean from a tagged object.
         *
         * @param obj the tagged object holding the object we want
         * @param explicitly true if the object is meant to be explicitly
         *              tagged false otherwise.
         * @exception ArgumentException if the tagged object cannot

View on GitHub (pinned to 53fb989abc)