[ BUG ] Receive commands generate index out of range errors even when successful

[TigerC10]

Describe the bug
Executing Receive-FalconInstaller results in an ArgumentOutOfRangeException. However, the sensor installer is actually successfully downloaded!

To Reproduce

$sensorInfo=(Get-FalconInstaller -Filter "platform:'windows'" -Limit 1 -Detailed)
Receive-FalconInstaller -Id $sensorInfo.sha256 -Path "${Env:ProgramData}\CrowdStrike\WindowsSensor.exe" -Force 

Expected behavior
I do not expect the exception.

Environment (please complete the following information):

• OS: Windows Server 2019
• PowerShell: 5.1
• PSFalcon: 2.2.6

Additional context
The sensor downloads successfully, it's just an odd error that pops out after the download is complete.

I cannot replicate the issue on PowerShell 7.1, it seems that something was introduced that makes PSFalcon incompatible with PowerShell 5.1. Since PS 5.1 is the default "Windows PowerShell", this is unfortunate.

Transcript content

VERBOSE: 02:15:03 [Receive-FalconInstaller] /sensors/entities/download-installer/v1:get
VERBOSE: 02:15:03 [ApiClient.Invoke] GET https://api.crowdstrike.com/sensors/entities/download-installer/v1?id=b04b4925643fdc0138aa715d054cfa25418c3ba4095a6e5a00e652f67fd958f0
VERBOSE: 02:15:03 [ApiClient.Invoke] Accept=application/octet-stream
VERBOSE: 02:15:03 [ApiClient.Invoke] Receiving ByteArray content...
VERBOSE: 02:15:03 [ApiClient.Invoke] Creating 'C:\ProgramData\CrowdStrike\WindowsSensor.exe'.
Invoke-Falcon : Index was out of range. Must be non-negative and less than the size of the collection.
Parameter name: index
At C:\Program Files\WindowsPowerShell\Modules\PSFalcon\2.2.6\public\sensors.ps1:156 char:9
+         Invoke-Falcon @Param -UserInput $PSBoundParameters
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Invoke-Falcon], ArgumentOutOfRangeException
    + FullyQualifiedErrorId : System.ArgumentOutOfRangeException,Invoke-Falcon

[bk-cs]

Thanks for the report! I've been looking at this one and I haven't tracked down where the error is popping up. Something is receiving an empty array when the download completes.

[bk-cs]

I think I've tracked this down and relocated some internal functions to prevent the error from occurring. The changes will be present in the next release.

If you'd like to resolve it for your local module before release, you can replace public\Private.ps1 and class\Class.ps1 using the steps outlined below.

Import-Module -Name PSFalcon
$ModulePath = (Show-FalconModule).ModulePath
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/e60951774c23443ce7d3c7788c823d268c2a7fc1/private/Private.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath private) Private.ps1)
(Invoke-WebRequest -Uri https://raw.githubusercontent.com/CrowdStrike/psfalcon/e60951774c23443ce7d3c7788c823d268c2a7fc1/class/Class.ps1 -UseBasicParsing).Content > (Join-Path (Join-Path $ModulePath class) Class.ps1)

You will need to fully close and re-open PowerShell, re-import PSFalcon and re-request your token before testing the change.

I'll leave this issue open for other users to apply this fix before the next release.

[jnichols35]

@bk-cs thanks for a fix to this, I was banging my head against the wall last night trying to figure out what I was doing wrong.

Do you have an ETA for a new release?

[bk-cs]

Do you have an ETA for a new release?

Not yet. There have been several new API releases and I'm behind on adding them. I'm continuing it work on it and will put out the release as soon as I can. My hope is that including fixes in individual issues can fix problems and relieve some of the pressure to get the release out. 😄

[dimasix9]

@bk-cs hi
I have a similar error. It is related to the real-time-response.ps1 file . So it cannot be resolved with your aforementioned solution.

Invoke-Falcon : Index was out of range. Must be non-negative and less than the size of the collection.
Parameter name: index
At C:\Users\{username}\Documents\WindowsPowerShell\Modules\PSFalcon\2.2.6\public\real-time-response.ps1:614 char:31
+ ... Request in (Invoke-Falcon @Param -Endpoint $Endpoint -UserInput $PSBo ...
+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : OperationStopped: (:) [Invoke-Falcon], ArgumentOutOfRangeException
    + FullyQualifiedErrorId : System.ArgumentOutOfRangeException,Invoke-Falcon

P.S. I got that it helped a guy with the same problem at another issue thread #398 but for me it doesn't work :(

[bk-cs]

@bk-cs hi I have a similar error. It is related to the real-time-response.ps1 file . So it cannot be resolved with your aforementioned solution.

P.S. I got that it helped a guy with the same problem at another issue thread #398 but for me it doesn't work :(

Did you restart PowerShell after applying that fix? Did you verify that the targeted files were updated?

Usually the error is generated by a function that is called by all the PSFalcon commands--it shouldn't be specific to a file in the public folder (like real-time-response.ps1). The error points to that file because that's the initial command that led to the error, but the error itself happens in a different function.

[bk-cs]

This fix is included in the 2.2.7 release.