peass-ng/PEASS-ng · error · ArgumentException

malformed BMPString encoding encountered

Error message

malformed BMPString encoding encountered

What it means

BMPString is UCS-2 encoded, so its byte payload must contain an even number of bytes (2 per character). The byte[] constructor throws ArgumentException when the length is odd, because the trailing byte cannot form a character.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/DerBmpString.cs:65

            {
                return GetInstance(o);
            }

            return new DerBmpString(Asn1OctetString.GetInstance(o).GetOctets());
        }

        /**
         * basic constructor - byte encoded string.
         */
        [Obsolete("Will become internal")]
        public DerBmpString(byte[] str)
        {
            if (str == null)
                throw new ArgumentNullException("str");

            int byteLen = str.Length;
            if (0 != (byteLen & 1))
                throw new ArgumentException("malformed BMPString encoding encountered", "str");

            int charLen = byteLen / 2;
            char[] cs = new char[charLen];

            for (int i = 0; i != charLen; i++)
            {
                cs[i] = (char)((str[2 * i] << 8) | (str[2 * i + 1] & 0xff));
            }

            this.str = new string(cs);
        }

        internal DerBmpString(char[] str)
        {
            if (str == null)
                throw new ArgumentNullException("str");

            this.str = new string(str);

View on GitHub (pinned to 53fb989abc)

Solutions

1. Encode with Encoding.BigEndianUnicode.GetBytes(text) so the array is always even-length.
2. Fix the slicing/concatenation that produced an odd-length buffer.
3. Construct from a string (new DerBmpString(string)) and let the library encode correctly.

Example fix

// before
var bmp = new DerBmpString(Encoding.UTF8.GetBytes(name)); // odd length possible
// after
var bmp = new DerBmpString(name); // or Encoding.BigEndianUnicode.GetBytes(name)

if (str == null || (str.Length & 1) != 0) throw new InvalidDataException("BMPString byte length must be even (UCS-2)");

static bool IsWellFormedBmpBytes(byte[] b) => b != null && (b.Length & 1) == 0;

When it happens

Trigger: Calling new DerBmpString(byteArray) where byteArray.Length is odd — e.g. a buffer sliced mid-character, concatenated with a stray byte, or produced by a non-UCS-2 encoder (UTF-8/ASCII bytes).

Common situations: Feeding UTF-8 or ASCII bytes into DerBmpString instead of Encoding.BigEndianUnicode bytes; truncating a buffer by one byte; manual DER parsing with a wrong length.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• indefinite-length primitive encoding encountered
• malformed BMPString encoding encountered
• data
• must be in the range 0 to 7
• if 'data' is empty, 'padBits' must be 0

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/6dcaf5142b3a1324. Report an issue: GitHub.