[PR #1482] [MERGED] feat(artifacts): inspect PE resource identities and payload ranges #2920

New issue

Closed

opened 2026-10-17 21:11:51 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:11:51 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1482
Author: @thangldw
Created: 10/10/2026
Status: ✅ Merged
Merged: 10/10/2026
Merged by: @morluto

Base: main ← Head: codex/inspect-pe-resources

📝 Commits (3)

56fb9a8 feat(artifacts): inspect PE resource identities and payload ranges
4446ad4 fix(artifacts): reject header payloads overlapping PE sections
50a4557 Merge remote-tracking branch 'origin/main' into HEAD

📊 Changes

26 files changed (+1694 additions, -3 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+4 -1)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+12 -0)
📝 docs/binary-diagnostics.md (+45 -0)
📝 scripts/lib/catalog-builders.mjs (+10 -1)
📝 src/application/CapabilityInventory.ts (+2 -0)
📝 src/application/InvestigationProviders.ts (+7 -0)
➕ src/application/binaryDiagnostics/PeResourcesPort.ts (+19 -0)
➕ src/application/binaryDiagnostics/PeResourcesService.test.ts (+64 -0)
➕ src/application/binaryDiagnostics/PeResourcesService.ts (+183 -0)
📝 src/cli/binaryDiagnosticsCommands.ts (+26 -0)
📝 src/cliCommandNames.ts (+1 -0)
📝 src/composition/binaryDiagnostics.ts (+6 -0)
📝 src/contracts/native/binaryDiagnosticsToolContracts.ts (+19 -0)
📝 src/contracts/toolEffects.ts (+1 -0)
📝 src/domain/artifactOperationError.ts (+1 -0)
➕ src/domain/native/peResources.ts (+113 -0)
📝 src/generatedPackageMetadata.ts (+1 -1)
➕ src/native/pe/PeResourceLayout.ts (+143 -0)
➕ src/native/pe/PeResourceParser.test.ts (+261 -0)
➕ src/native/pe/PeResourceParser.ts (+315 -0)

...and 6 more files

📄 Description

Closes #1254.

REA can read PE resource bytes, but analysts currently have to walk the resource directory themselves. This adds inspect_pe_resources and rea inspect-pe-resources for one explicit PE32/PE32+ artifact, using a shared CLI/MCP service without an active target or engine installation.

The complete Evidence preserves numeric IDs versus UTF-16 names, type/name/language identity, directory and data-entry source locations, payload RVA/file ranges, and full SHA-256 hashes. Static RT_GROUP_ICON relationships retain same-language RT_ICON resolution, other-language candidates, missing references, and size mismatches. Malformed or ambiguous mappings and exhausted budgets fail without partial success; stable file reading and cancellation reuse the existing boundaries.

Tool contracts, effects, capability availability, provider catalog, and authored skill/documentation are updated. Other payload formats remain opaque. Image decoding, Windows language fallback, and actual shell/window loading are outside the portable parser's scope.

Validation:

46 tests passed across seven files, including source-owned PE32/PE32+ fixtures, malformed/overlapping ranges, file boundaries, service output validation, real compiled CLI and stdio MCP, MCP schemas, contract presentation, and product catalog.
npm run check passed (typecheck, lint, formatting, unused-code and architecture checks).
npm run docs:check and npm run verify:test-discovery passed.
Optional Windows SDK resource-loading verification was not run.

Implementation was developed with AI-agent assistance and verified through the checks above.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1482 **Author:** [@thangldw](https://github.com/thangldw) **Created:** 10/10/2026 **Status:** ✅ Merged **Merged:** 10/10/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `codex/inspect-pe-resources` --- ### 📝 Commits (3) - [`56fb9a8`](https://github.com/morluto/rea/commit/56fb9a81285f67b2409c05b294776719d5161e8c) feat(artifacts): inspect PE resource identities and payload ranges - [`4446ad4`](https://github.com/morluto/rea/commit/4446ad4f57b62eb7cac55c3e4720562dbcdae811) fix(artifacts): reject header payloads overlapping PE sections - [`50a4557`](https://github.com/morluto/rea/commit/50a4557ee03ea510a59c0f5b8862653ba8611099) Merge remote-tracking branch 'origin/main' into HEAD ### 📊 Changes **26 files changed** (+1694 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+4 -1) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+12 -0) 📝 `docs/binary-diagnostics.md` (+45 -0) 📝 `scripts/lib/catalog-builders.mjs` (+10 -1) 📝 `src/application/CapabilityInventory.ts` (+2 -0) 📝 `src/application/InvestigationProviders.ts` (+7 -0) ➕ `src/application/binaryDiagnostics/PeResourcesPort.ts` (+19 -0) ➕ `src/application/binaryDiagnostics/PeResourcesService.test.ts` (+64 -0) ➕ `src/application/binaryDiagnostics/PeResourcesService.ts` (+183 -0) 📝 `src/cli/binaryDiagnosticsCommands.ts` (+26 -0) 📝 `src/cliCommandNames.ts` (+1 -0) 📝 `src/composition/binaryDiagnostics.ts` (+6 -0) 📝 `src/contracts/native/binaryDiagnosticsToolContracts.ts` (+19 -0) 📝 `src/contracts/toolEffects.ts` (+1 -0) 📝 `src/domain/artifactOperationError.ts` (+1 -0) ➕ `src/domain/native/peResources.ts` (+113 -0) 📝 `src/generatedPackageMetadata.ts` (+1 -1) ➕ `src/native/pe/PeResourceLayout.ts` (+143 -0) ➕ `src/native/pe/PeResourceParser.test.ts` (+261 -0) ➕ `src/native/pe/PeResourceParser.ts` (+315 -0) _...and 6 more files_ </details> ### 📄 Description Closes #1254. REA can read PE resource bytes, but analysts currently have to walk the resource directory themselves. This adds `inspect_pe_resources` and `rea inspect-pe-resources` for one explicit PE32/PE32+ artifact, using a shared CLI/MCP service without an active target or engine installation. The complete Evidence preserves numeric IDs versus UTF-16 names, type/name/language identity, directory and data-entry source locations, payload RVA/file ranges, and full SHA-256 hashes. Static RT_GROUP_ICON relationships retain same-language RT_ICON resolution, other-language candidates, missing references, and size mismatches. Malformed or ambiguous mappings and exhausted budgets fail without partial success; stable file reading and cancellation reuse the existing boundaries. Tool contracts, effects, capability availability, provider catalog, and authored skill/documentation are updated. Other payload formats remain opaque. Image decoding, Windows language fallback, and actual shell/window loading are outside the portable parser's scope. Validation: - 46 tests passed across seven files, including source-owned PE32/PE32+ fixtures, malformed/overlapping ranges, file boundaries, service output validation, real compiled CLI and stdio MCP, MCP schemas, contract presentation, and product catalog. - `npm run check` passed (typecheck, lint, formatting, unused-code and architecture checks). - `npm run docs:check` and `npm run verify:test-discovery` passed. - Optional Windows SDK resource-loading verification was not run. Implementation was developed with AI-agent assistance and verified through the checks above. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:11:51 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2920

No description provided.

Rows
Columns