[GH-ISSUE #2812] [Feature] Decode RT_VERSION and RT_STRING payloads in inspect-pe-resources #1004

New issue

Open

opened 2026-10-15 18:30:16 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:30:16 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 13, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/2812

Before submitting

I searched open and closed issues/PRs (RT_STRING, RT_VERSION, VERSIONINFO, string table, PE resources); #1254 and #1702 cover the resource inventory, not payload decoding.
I understand the contribution scope must be reviewed before integration.
No credentials, private samples or sensitive data.

Area

Evidence, artifacts, or reconstruction

Current limitation

inspect-pe-resources (6.4.0) returns RT_STRING (type 6) and RT_VERSION (type 16) payloads as opaque bytes ("payloads other than RT_GROUP_ICON remain opaque"). Both formats are fixed and documented by Microsoft, and they answer two first questions of any Windows investigation: which build is this (FileVersion, ProductVersion, CompanyName, translation table) and which user-visible messages does it contain (string tables; Delphi resourcestring and RTL/VCL messages live there).

$ rea inspect-pe-resources /abs/AUTORIZADOR.exe --json
# 53 entries of type 6 (RT_STRING), 1 entry of type 16 (RT_VERSION, lang 1046, 808 bytes, sha256 b2950ffb…8e2c) – all opaque

Environment: macOS 27.0.1 arm64, Node 24.13.0, rea-agents@6.4.0 local install.

Proposed outcome

Static payload decoders inside inspect_pe_resources (or a sibling operation):

RT_VERSION: VS_FIXEDFILEINFO (file/product version, flags, OS, type) plus StringFileInfo tables per language/code page and VarFileInfo\Translation, with offsets.
RT_STRING: expand each block (name id N) into its 16 strings with id (N-1)*16 + i, UTF-16LE text, original byte ranges; empty slots kept explicitly.
Malformed lengths or padding become explicit unknowns per payload, not inventory failures.

Use cases

Identify a build without running it (here the version changed from 6.6.2.0 to 6.6.3.0 while the installer name changed too, so file identity alone is not enough).
Catalog user-facing error messages for behavior reconstruction and diffing between builds.

Minimal public repro

ftp://arpoador.datasus.gov.br/siasus/autorizador/AUTORIZADOR_SETUP.exe (sha256 226e68e4e5c2ef3d8749bdc788481f80eb79d5ac13dc51c89ecdc1cf96082aaa) → innoextract -e → app/AUTORIZADOR.exe (sha256 708b974938d3028f158d78162636ab0a25dcc3a06540fae2aaea02670ec22f4f). Any stock Windows DLL also exercises both formats.

Suggested approach

Reuse the bounded resource snapshot; both decoders are small, deterministic and need no provider.

Originally created by @matbrgz on GitHub (Oct 13, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/2812 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Before submitting - [x] I searched open and closed issues/PRs (`RT_STRING`, `RT_VERSION`, `VERSIONINFO`, `string table`, `PE resources`); #1254 and #1702 cover the resource inventory, not payload decoding. - [x] I understand the contribution scope must be reviewed before integration. - [x] No credentials, private samples or sensitive data. ### Area Evidence, artifacts, or reconstruction ### Current limitation `inspect-pe-resources` (6.4.0) returns `RT_STRING` (type 6) and `RT_VERSION` (type 16) payloads as opaque bytes ("payloads other than RT_GROUP_ICON remain opaque"). Both formats are fixed and documented by Microsoft, and they answer two first questions of any Windows investigation: *which build is this* (`FileVersion`, `ProductVersion`, `CompanyName`, translation table) and *which user-visible messages does it contain* (string tables; Delphi `resourcestring` and RTL/VCL messages live there). ```text $ rea inspect-pe-resources /abs/AUTORIZADOR.exe --json # 53 entries of type 6 (RT_STRING), 1 entry of type 16 (RT_VERSION, lang 1046, 808 bytes, sha256 b2950ffb…8e2c) – all opaque ``` Environment: macOS 27.0.1 arm64, Node 24.13.0, `rea-agents@6.4.0` local install. ### Proposed outcome Static payload decoders inside `inspect_pe_resources` (or a sibling operation): - `RT_VERSION`: `VS_FIXEDFILEINFO` (file/product version, flags, OS, type) plus `StringFileInfo` tables per language/code page and `VarFileInfo\Translation`, with offsets. - `RT_STRING`: expand each block (name id N) into its 16 strings with id `(N-1)*16 + i`, UTF-16LE text, original byte ranges; empty slots kept explicitly. - Malformed lengths or padding become explicit unknowns per payload, not inventory failures. ### Use cases - Identify a build without running it (here the version changed from 6.6.2.0 to 6.6.3.0 while the installer name changed too, so file identity alone is not enough). - Catalog user-facing error messages for behavior reconstruction and diffing between builds. ### Minimal public repro `ftp://arpoador.datasus.gov.br/siasus/autorizador/AUTORIZADOR_SETUP.exe` (sha256 `226e68e4e5c2ef3d8749bdc788481f80eb79d5ac13dc51c89ecdc1cf96082aaa`) → `innoextract -e` → `app/AUTORIZADOR.exe` (sha256 `708b974938d3028f158d78162636ab0a25dcc3a06540fae2aaea02670ec22f4f`). Any stock Windows DLL also exercises both formats. ### Suggested approach Reuse the bounded resource snapshot; both decoders are small, deterministic and need no provider.

bsakaguchi added the

area: domain

enhancement

labels

2026-10-15 18:30:16 +00:00

bsakaguchi referenced this issue

2026-10-17 21:07:44 +00:00

[PR #1004] [MERGED] fix(contracts)!: require absolute local paths for remaining caller-supplied file inputs #2571

bsakaguchi referenced this issue

2026-10-17 21:08:16 +00:00

[PR #1068] [MERGED] fix(cli): preserve blank JSON paths for input validation #2617

bsakaguchi added