peass-ng/PEASS-ng · error · ArgumentNullException

Value cannot be null. Parameter name: path

Error message

Value cannot be null.
Parameter name: path

What it means

ArgumentNullException thrown by AlphaFS's Directory.EnumerateFileIdBothDirectoryInfoCore when the path argument is null, empty, or whitespace. The core method opens a directory handle via CreateFileCore to enumerate FILE_ID_BOTH_DIR_INFORMATION entries, and a null path cannot be resolved to a full path. AlphaFS validates the input explicitly before touching the filesystem, so this is a caller-side argument error, not an OS error.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/AlphaFS/Filesystem/Directory Class/Directory Core Methods/Directory.EnumerateFileIdBothDirectoryInfoCore.cs:66

      /// <param name="safeFileHandle">An open handle to the directory from which to retrieve information.</param>
      /// <param name="path">A path to the directory.</param>
      /// <param name="shareMode">The <see cref="FileShare"/> mode with which to open a handle to the directory.</param>
      /// <param name="continueOnException"><c>true</c> suppress any Exception that might be thrown as a result from a failure, such as ACLs protected directories or non-accessible reparse points.</param>
      /// <param name="pathFormat">Indicates the format of the path parameter(s).</param>
      [SecurityCritical]
      internal static IEnumerable<FileIdBothDirectoryInfo> EnumerateFileIdBothDirectoryInfoCore(KernelTransaction transaction, SafeFileHandle safeFileHandle, string path, FileShare shareMode, bool continueOnException, PathFormat pathFormat)
      {
         if (!NativeMethods.IsAtLeastWindowsVista)
            throw new PlatformNotSupportedException(new Win32Exception((int) Win32Errors.ERROR_OLD_WIN_VERSION).Message);


         var pathLp = path;

         var callerHandle = null != safeFileHandle;
         if (!callerHandle)
         {
            if (Utils.IsNullOrWhiteSpace(path))
               throw new ArgumentNullException("path");

            pathLp = Path.GetExtendedLengthPathCore(transaction, path, pathFormat, GetFullPathOptions.RemoveTrailingDirectorySeparator | GetFullPathOptions.FullCheck);

            safeFileHandle = File.CreateFileCore(transaction, true, pathLp, ExtendedFileAttributes.BackupSemantics, null, FileMode.Open, FileSystemRights.ReadData, shareMode, true, false, PathFormat.LongFullPath);
         }


         try
         {
            if (!NativeMethods.IsValidHandle(safeFileHandle, Marshal.GetLastWin32Error(), !continueOnException))
               yield break;

            var fileNameOffset = (int) Marshal.OffsetOf(typeof(NativeMethods.FILE_ID_BOTH_DIR_INFO), "FileName");

            using (var safeBuffer = new SafeGlobalMemoryBufferHandle(NativeMethods.DefaultFileBufferSize))
            {
               while (true)
               {

View on GitHub (pinned to 53fb989abc)

Solutions

1. Check the path argument before calling: if string.IsNullOrWhiteSpace(path) log and skip instead of calling the enumerator.
2. If a handle-based overload is used, ensure the safeFileHandle passed is actually a valid open handle — with a valid handle the null-path check is bypassed.
3. Fix the upstream source that produced the empty path (failed lookup, unset config, unmounted drive).
4. Fall back to a known-good root (e.g. "C:\\") when the intended path cannot be resolved.

Example fix

// before
foreach (var info in Directory.EnumerateFileIdBothDirectoryInfo(path)) { ... }
// after
if (string.IsNullOrWhiteSpace(path)) { LogSkip(nameof(path)); return; }
foreach (var info in Directory.EnumerateFileIdBothDirectoryInfo(path)) { ... }

if (string.IsNullOrWhiteSpace(path)) throw new ArgumentException("path must be a non-empty directory path", nameof(path));

static bool HasPath(string? path) => !string.IsNullOrWhiteSpace(path);

try { foreach (var i in Directory.EnumerateFileIdBothDirectoryInfo(path)) Process(i); } catch (ArgumentNullException ex) { Log.Error("null path passed to enumerator", ex); }

When it happens

Trigger: Calling Directory.EnumerateFileIdBothDirectoryInfo(null) (or a path that is "" or all whitespace) without a pre-opened safeFileHandle; passing an uninitialized variable or the result of a failed path lookup into the enumerate API.

Common situations: winPEAS/AlphaFS-driven enumeration where a drive letter or folder path variable was never populated (e.g. a failed config read or empty registry value feeding the path), or refactored code that stopped passing a default path.

Related errors

• rootPathName
• volumeName
• volumeName
• drivePath
• driveName

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/e81143b0d51f8def. Report an issue: GitHub.