ArgumentException in Beacon.cs

Hi, I hope its okay that I raised another issue. I tested this with CobaltStrike beacon v4 on x64 injected threads on two different Windows 10 VMs and it produced the following output:

---

Scanning processes for injected threads Found injected thread Process : <process name> Process ID : 4592 Thread ID : 5484

Scanning injected thread for CobaltStrike beacon

Unhandled Exception: System.ArgumentException: An item with the same key has already been added. at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource) at System.Collections.Generic.Dictionary2.Insert(TKey key, TValue value, Boolean add) at CobaltStrikeConfigParser.Beacon.ParseTLV(Byte[] configBytes) at ConsoleUI.Program.GetBeaconFromYaraScan(Dictionary2 beaconMatchOffsets, Byte[] bytes) in C:\Users<username>\CobaltStrikeScan\ConsoleUI\Program.cs:line 167 at ConsoleUI.Program.Main(String[] args) in C:\Users<username>\CobaltStrikeScan\ConsoleUI\Program.cs:line 52

---

I’m unable to debug CobaltStrikeConfigParser in the solution because of the build order so I wasn’t able to dig deeper. I tried adding some try catch blocks and checks for whether the dict contains the key, but that doesn’t seem to help.

Thank you!

[x3419]

Awesome! That fixed the issue. I appreciate the help

[x3419]

I’ve uploaded the memdump here: https://easyupload.io/y22cxl Thanks I’ll try that commit. If you need a v4 beacon sample just let me know.