peass-ng/PEASS-ng · error · IOException

unknown tag {tagNo} encountered

Error message

unknown tag {tagNo} encountered

What it means

Asn1InputStream.BuildObject throws this IOException when it encounters an ASN.1 tag number it does not know how to map to a DER object class. The default branch of the tag switch covers tags that are neither recognized universal types nor handled application/private/constructed tags.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:128

                                if (!(asn1Obj is Asn1OctetString))
                                {
                                    throw new Asn1Exception("unknown object encountered in constructed OCTET STRING: "
                                        + Platform.GetTypeName(asn1Obj));
                                }

                                strings[i] = (Asn1OctetString)asn1Obj;
                            }

                            return new BerOctetString(strings);
                        }
                    case Asn1Tags.Sequence:
                        return CreateDerSequence(defIn);
                    case Asn1Tags.Set:
                        return CreateDerSet(defIn);
                    case Asn1Tags.External:
                        return new DerExternal(ReadVector(defIn));
                    default:
                        throw new IOException("unknown tag " + tagNo + " encountered");
                }
            }

            return CreatePrimitiveDerObject(tagNo, defIn, tmpBuffers);
        }

        internal virtual Asn1EncodableVector ReadVector(DefiniteLengthInputStream dIn)
        {
            if (dIn.Remaining < 1)
                return new Asn1EncodableVector(0);

            Asn1InputStream subStream = new Asn1InputStream(dIn);
            Asn1EncodableVector v = new Asn1EncodableVector();
            Asn1Object o;
            while ((o = subStream.ReadObject()) != null)
            {
                v.Add(o);
            }

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the byte stream is valid ASN.1 starting at the parse offset (use openssl asn1parse to inspect).
2. Check you are not feeding compressed/encrypted wrappers — decrypt/decompress before ASN.1 parsing.
3. Extend handling by parsing the unknown tag yourself via a custom Asn1Object or use the newer Org.BouncyCastle.Asn1 parser version with broader tag support.
4. Catch IOException from ReadObject and treat the input as unsupported/malformed.

Example fix

// before
Asn1Object obj = asn1Stream.ReadObject();
// after
try { Asn1Object obj = asn1Stream.ReadObject(); }
catch (IOException ex) { throw new InvalidDataException("Unsupported or unknown ASN.1 tag", ex); }

static bool HasKnownLeadingTag(byte[] data)
{
    if (data == null || data.Length == 0) return false;
    int tagNo = data[0] & 0x1f; // low 5 bits of tag byte (short form)
    // known universal tags: 1..21 incl. common DER types
    return (data[0] & 0xc0) == 0 && tagNo <= 21;
}

Asn1Object obj;
try {
    obj = stream.ReadObject();
} catch (IOException ex) when (ex.Message.StartsWith("unknown tag")) {
    throw new NotSupportedException("ASN.1 stream contains a tag this parser does not support", ex);
}

When it happens

Trigger: ReadObject/ReadVector encounters a tagNo not in BouncyCastle's supported set — e.g. reserved or exotic universal tags, unsupported APPLICATION/PRIVATE class tags, or bytes that were never valid ASN.1 shifted so a tag byte decodes to an unknown number.

Common situations: Parsing a certificate/PKCS structure using tag types outside BouncyCastle's supported universal set; feeding non-ASN.1 bytes (text, ZIP, truncated file) to the parser; offset misalignment from skipping bytes before parsing.

Related errors

• unknown object encountered in constructed OCTET STRING:
• DER length more than 4 bytes:
• BOOLEAN value should have 1 byte in it
• unexpected end-of-contents marker
• indefinite-length primitive encoding encountered

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/16ac29880b52eb5a. Report an issue: GitHub.