peass-ng/PEASS-ng · error · ArgumentException

illegal object in GetInstance:

Error message

illegal object in GetInstance: 

What it means

DerBitString.GetInstance throws ArgumentException 'illegal object in GetInstance: <type name>' when the supplied object is neither a DerBitString nor a byte[]/tagged object it can convert — i.e. the wrong ASN.1 type was passed for extraction.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBitString.cs:42

            object obj)
        {
            if (obj == null || obj is DerBitString)
            {
                return (DerBitString)obj;
            }
            if (obj is byte[])
            {
                try
                {
                    return (DerBitString)FromByteArray((byte[])obj);
                }
                catch (Exception e)
                {
                    throw new ArgumentException("encoding error in GetInstance: " + e.ToString());
                }
            }

            throw new ArgumentException("illegal object in GetInstance: " + Platform.GetTypeName(obj));
        }

        /**
		 * return a Bit string from a tagged object.
		 *
		 * @param obj the tagged object holding the object we want
		 * @param explicitly true if the object is meant to be explicitly
		 *              tagged false otherwise.
		 * @exception ArgumentException if the tagged object cannot
		 *               be converted.
		 */
        public static DerBitString GetInstance(
            Asn1TaggedObject obj,
            bool isExplicit)
        {
            Asn1Object o = obj.GetObject();

            if (isExplicit || o is DerBitString)

View on GitHub (pinned to 53fb989abc)

Solutions

1. Check the actual type: parse with Asn1Object.FromByteArray and verify `is DerBitString` before GetInstance
2. If the source is an Asn1TaggedObject, use the (Asn1TaggedObject, bool explicitly) overload
3. Fix the field extraction path so the BIT STRING field is selected (e.g. certificate signature value, not signature algorithm)
4. If you need arbitrary content as bits, convert the object via its own GetEncoded()/ToAsn1Object first

Example fix

// before
DerBitString bits = DerBitString.GetInstance(seqObj); // a SEQUENCE
// after
if (seqObj is DerBitString bits) { /* use bits */ }
else { throw new InvalidDataException("expected BIT STRING, got " + Platform.GetTypeName(seqObj)); }

// parse generically and inspect the concrete type before extracting
Asn1Object o = Asn1Object.FromByteArray(bytes);
bool ok = o is DerBitString;

bool IsBitString(Asn1Object o) => o is DerBitString;

try { return DerBitString.GetInstance(obj); }
catch (ArgumentException ex) { throw new InvalidDataException("expected BIT STRING, got: " + ex.Message, ex); }

When it happens

Trigger: Passing a DerSequence, DerInteger, DerOctetString, or null-like/other Asn1Object to DerBitString.GetInstance expecting it to be a BIT STRING.

Common situations: Misreading a certificate/PKCS structure and pulling the wrong field (e.g. signature is a BIT STRING but you pass the AlgorithmIdentifier SEQUENCE); type assumptions after a schema/version change in the parsed structure.

Related errors

• failed to construct OCTET STRING from byte[]:
• unsupported tag number
• encoding error in GetInstance:
• illegal object in GetInstance:
• illegal object in GetInstance:

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/29aecd3c062a0644. Report an issue: GitHub.