peass-ng/PEASS-ng · error · IOException

unknown BER object encountered

Error message

unknown BER object encountered

What it means

A BER/DER decoding guard in Asn1InputStream.ReadObject: while parsing indefinite-length (constructed) ASN.1, the tag number was not one of the recognized constructed types (OctetString, Sequence, Set, External, tagged) so the parser cannot build an object for it. It fires on malformed or non-standard ASN.1 input, and also serves as the catch-all for unrecognized tags in corrupted streams.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:216

                if ((tag & Asn1Tags.Tagged) != 0)
                {
                    return new BerTaggedObjectParser(true, tagNo, sp).ToAsn1Object();
                }

                // TODO There are other tags that may be constructed (e.g. BitString)
                switch (tagNo)
                {
                    case Asn1Tags.OctetString:
                        return new BerOctetStringParser(sp).ToAsn1Object();
                    case Asn1Tags.Sequence:
                        return new BerSequenceParser(sp).ToAsn1Object();
                    case Asn1Tags.Set:
                        return new BerSetParser(sp).ToAsn1Object();
                    case Asn1Tags.External:
                        return new DerExternalParser(sp).ToAsn1Object();
                    default:
                        throw new IOException("unknown BER object encountered");
                }
            }
            else
            {
                try
                {
                    return BuildObject(tag, tagNo, length);
                }
                catch (ArgumentException e)
                {
                    throw new Asn1Exception("corrupted stream detected", e);
                }
            }
        }

        internal virtual int Limit
        {
            get { return limit; }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the input bytes are valid DER/BER encoded data before parsing
2. Re-encode the original object with BouncyCastle's Asn1Encodable DER/BER writers instead of hand-crafted encodings
3. If the payload may be truncated, read the complete stream into a buffer before constructing Asn1InputStream

When it happens

Trigger: Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:216 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/5464e7b4e2159063. Report an issue: GitHub.