[GH-ISSUE #1254] feat(artifacts): inspect PE resource identities and payload ranges #451

New issue

Closed

opened 2026-10-15 18:25:10 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:25:10 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1254

Current limitation

The native byte inspection workflow can supply a PE resource section, but REA has no format-aware inventory of resource type/name/language, payload file/RVA ranges, complete payload hashes and icon-group relationships. Analysts currently walk the returned directory bytes themselves.

Scope and evidence

The reconstruction feedback successfully read the complete resource interval and independently validated SDK loading; it did not report a byte-read defect. Current source and canonical tool inventory confirm that inspect_binary_layout is scoped to ELF64 AMD64 diagnostics, while artifact container inspection does not provide a PE resource-directory inventory. Merely opening a PE with Ghidra does not establish this feature.

Required behavior

Inspect one explicit PE artifact's resource tree without executing it. Preserve resource IDs versus strings, language identity, directory/payload source locations, RVA-to-file mapping and complete hashes. Distinguish observed bytes, interpreted relationships and unsupported/malformed cases; icon groups reference image resources but do not prove actual shell/window resource loading.

Use source-owned fixtures with named and numeric resources, multiple languages, icon groups, truncated directories, invalid/overlapping ranges and absent resources. Keep optional Windows SDK loading verification separate from portable parsing. Verify complete CLI/MCP results and caller-selected artifacts without installing toolchains.

Closed #362 listed resources within a broad PE/COFF/PDB proposal but does not establish this specific implemented workflow. This is a narrow remaining capability request, not a request to reopen all of #362 or a provider-resource parsing bug.

Source: src/contracts/native/binaryDiagnosticsToolContracts.ts:16 and src/contracts/artifactToolContracts.ts.

Verification and scope

Missing format-aware inventory is source/catalog-confirmed. The historical resource SDK workflow was not rerun on the latest release; no new parsing defect or actual Windows resource-loading claim is made.

Audit date: 2026-10-09. Latest npm dist-tag verified as rea-agents@6.1.0; current main tested at f4c99ab8a53806dd57dc24b3d5a600905bcb4686. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

Originally created by @N0zoM1z0 on GitHub (Oct 9, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1254 ### Current limitation The native byte inspection workflow can supply a PE resource section, but REA has no format-aware inventory of resource type/name/language, payload file/RVA ranges, complete payload hashes and icon-group relationships. Analysts currently walk the returned directory bytes themselves. ### Scope and evidence The reconstruction feedback successfully read the complete resource interval and independently validated SDK loading; it did not report a byte-read defect. Current source and canonical tool inventory confirm that `inspect_binary_layout` is scoped to ELF64 AMD64 diagnostics, while artifact container inspection does not provide a PE resource-directory inventory. Merely opening a PE with Ghidra does not establish this feature. ### Required behavior Inspect one explicit PE artifact's resource tree without executing it. Preserve resource IDs versus strings, language identity, directory/payload source locations, RVA-to-file mapping and complete hashes. Distinguish observed bytes, interpreted relationships and unsupported/malformed cases; icon groups reference image resources but do not prove actual shell/window resource loading. Use source-owned fixtures with named and numeric resources, multiple languages, icon groups, truncated directories, invalid/overlapping ranges and absent resources. Keep optional Windows SDK loading verification separate from portable parsing. Verify complete CLI/MCP results and caller-selected artifacts without installing toolchains. ### Related work Closed #362 listed resources within a broad PE/COFF/PDB proposal but does not establish this specific implemented workflow. This is a narrow remaining capability request, not a request to reopen all of #362 or a provider-resource parsing bug. Source: [src/contracts/native/binaryDiagnosticsToolContracts.ts:16](https://github.com/morluto/rea/blob/f4c99ab8a53806dd57dc24b3d5a600905bcb4686/src/contracts/native/binaryDiagnosticsToolContracts.ts#L16) and `src/contracts/artifactToolContracts.ts`. ### Verification and scope Missing format-aware inventory is source/catalog-confirmed. The historical resource SDK workflow was not rerun on the latest release; no new parsing defect or actual Windows resource-loading claim is made. Audit date: 2026-10-09. Latest npm dist-tag verified as `rea-agents@6.1.0`; current main tested at `f4c99ab8a53806dd57dc24b3d5a600905bcb4686`. Linux x64, Node 24.18.0, MCP client SDK 2.3.1. Native observations use unmodified Ghidra 12.1.4 and JDK 21, two CPUs and a 512 MiB Java heap. No target execution or executable mutation was used for the static native checks.

bsakaguchi

2026-10-15 18:25:10 +00:00