peass-ng/PEASS-ng · error · IOException

unknown tag encountered

Error message

unknown tag {tagNo} encountered

What it means

Asn1InputStream.BuildObject throws this IOException when it encounters an ASN.1 tag number it does not know how to map to a DER object class. The default branch of the tag switch covers tags that are neither recognized universal types nor handled application/private/constructed tags.

Solutions

1. Verify the byte stream is valid ASN.1 starting at the parse offset (use openssl asn1parse to inspect).
2. Check you are not feeding compressed/encrypted wrappers — decrypt/decompress before ASN.1 parsing.
3. Extend handling by parsing the unknown tag yourself via a custom Asn1Object or use the newer Org.BouncyCastle.Asn1 parser version with broader tag support.
4. Catch IOException from ReadObject and treat the input as unsupported/malformed.

Example fix

// before
Asn1Object obj = asn1Stream.ReadObject();
// after
try { Asn1Object obj = asn1Stream.ReadObject(); }
catch (IOException ex) { throw new InvalidDataException("Unsupported or unknown ASN.1 tag", ex); }

static bool HasKnownLeadingTag(byte[] data)
{
    if (data == null || data.Length == 0) return false;
    int tagNo = data[0] & 0x1f; // low 5 bits of tag byte (short form)
    // known universal tags: 1..21 incl. common DER types
    return (data[0] & 0xc0) == 0 && tagNo <= 21;
}

Asn1Object obj;
try {
    obj = stream.ReadObject();
} catch (IOException ex) when (ex.Message.StartsWith("unknown tag")) {
    throw new NotSupportedException("ASN.1 stream contains a tag this parser does not support", ex);
}

When it happens

Trigger: ReadObject/ReadVector encounters a tagNo not in BouncyCastle's supported set — e.g. reserved or exotic universal tags, unsupported APPLICATION/PRIVATE class tags, or bytes that were never valid ASN.1 shifted so a tag byte decodes to an unknown number.

Common situations: Parsing a certificate/PKCS structure using tag types outside BouncyCastle's supported universal set; feeding non-ASN.1 bytes (text, ZIP, truncated file) to the parser; offset misalignment from skipping bytes before parsing.

Related errors

• BOOLEAN value should have 1 byte in it
• DER length more than 4 bytes:
• unknown object encountered in constructed OCTET STRING:
• byte value should have 1 byte in it
• cannot recognise object in stream

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/16ac29880b52eb5a. Report an issue: GitHub.

Appendix: source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:128

                                if (!(asn1Obj is Asn1OctetString))
                                {
                                    throw new Asn1Exception("unknown object encountered in constructed OCTET STRING: "
                                        + Platform.GetTypeName(asn1Obj));
                                }

                                strings[i] = (Asn1OctetString)asn1Obj;
                            }

                            return new BerOctetString(strings);
                        }
                    case Asn1Tags.Sequence:
                        return CreateDerSequence(defIn);
                    case Asn1Tags.Set:
                        return CreateDerSet(defIn);
                    case Asn1Tags.External:
                        return new DerExternal(ReadVector(defIn));
                    default:
                        throw new IOException("unknown tag " + tagNo + " encountered");
                }
            }

            return CreatePrimitiveDerObject(tagNo, defIn, tmpBuffers);
        }

        internal virtual Asn1EncodableVector ReadVector(DefiniteLengthInputStream dIn)
        {
            if (dIn.Remaining < 1)
                return new Asn1EncodableVector(0);

            Asn1InputStream subStream = new Asn1InputStream(dIn);
            Asn1EncodableVector v = new Asn1EncodableVector();
            Asn1Object o;
            while ((o = subStream.ReadObject()) != null)
            {
                v.Add(o);
            }

View on GitHub (pinned to 53fb989abc)