morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #1703] [MERGED] fix(native): raise default PE resource entry budget to 16384 #4765

New issue

Closed

opened 2026-10-31 00:54:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:54:48 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1703
Author: @JasonBuildAI
Created: 10/11/2026
Status: ✅ Merged
Merged: 10/11/2026
Merged by: @morluto

Base: main ← Head: fix/pe-resource-entry-budget-a7f3c9

📝 Commits (1)

bfac8ac fix(native): raise default PE resource entry budget to 16384

📊 Changes

4 files changed (+46 additions, -3 deletions)

View changed files

📝 docs/binary-diagnostics.md (+2 -1)
📝 src/domain/native/peResources.ts (+6 -1)
📝 src/native/pe/PeResources.fixture.ts (+2 -1)
📝 tests/boundary/filesystem/peResources.test.ts (+36 -0)

📄 Description

Summary

Windows reverse engineers can now inspect stock Windows resource images such as imageres.dll.mun through the default CLI and MCP calls. Fixes #1702.

Before this change, rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" exited 1 with resource_constraint and returned no inventory, because the default max_entries budget (4096) is smaller than the largest stock tables (imageres 6476, shell32 5903, wmploc 5440 examined entries on Windows 11 25H2). After the change, the default budgets return coverage.status: "complete" with the full inventory.

Problem and expected behavior

Smallest trigger: run rea inspect-pe-resources with default budgets on any stock Windows resource image whose table exceeds 4096 examined entries.

Observed (base 13e03e94, real files):

$ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json; echo $?
{"code":"resource_constraint","category":"resource_constraint","message":"PE resource directory entry budget exceeded; no partial inventory was returned.","retryable":false,"details":{"operation":"inspect_pe_resources","resource":"memory","reason":"PE resource directory entry budget exceeded; no partial inventory was returned.","reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}}
1

Expected: a complete inventory, confirmed independently by pefile 2024.8.26, which matches the parser exactly (0 mismatches across type/name/language, RVA, file offset, size, and code page) when the budget is raised.

Change and scope

src/domain/native/peResources.ts: default max_entries 4096 -> 16384, with the measured stock-image sizes cited at the default. The 65536 maximum and the independent 8 MiB metadata budget are unchanged, and exceeding any budget still fails closed without partial results.
src/native/pe/PeResources.fixture.ts: optional sectionBytes parameter so tests can emit larger tables through the same fixture.
tests/boundary/filesystem/peResources.test.ts: new test emits a 6476-entry table (two types, 1620 + 1617 single-language names) via a 256 KiB section and asserts the default budgets report complete coverage with 6476 examined entries and 3237 resources.
docs/binary-diagnostics.md: documents the new default with its basis.

Intentionally not included: changes to the parser, budgets, or error taxonomy; no new flags or tools.

Contract and boundary impact

Semantic owner and earliest changed stage: the input contract's default budget in src/domain/native/peResources.ts; the earliest changed stage is native-analysis budget admission. The CLI derives its default from the schema shape, so no CLI-local edit was needed.
CLI and MCP/tool-catalog contract: the advertised default for --max-entries / inspect_pe_resources.max_entries moves 4096 -> 16384; minimum 1 and maximum 65536 are unchanged. Callers that pass an explicit budget see identical behavior. Raising a default only admits calls that previously failed with a typed error, so this is not a breaking change.
Provider, bridge, target-format, or platform compatibility: parser and provider code untouched; no platform-specific paths.
Evidence, artifact, provenance, or reconstruction contract: coverage and inventory semantics unchanged; the bounded-failure mode (no partial inventory) is preserved and still covered by existing tests.
Process execution, authorization, cleanup, or containment impact: none. Allocation stays bounded by the 8 MiB metadata budget and the 65536 hard entry maximum.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: none committed; .cache/mcp-tool-catalog.json was regenerated locally so the MCP schema-validity suite exercises the new default. docs/binary-diagnostics.md is the only authored doc change.

Evidence and regression coverage

Tests added or updated: tests/boundary/filesystem/peResources.test.ts (new stock-scale default-budget test) and the fixture's optional section size; parser and service suites still pass.
Base reproduction or other evidence: compiled-CLI runs against real stock images at base 13e03e94 fail with max_entries: 4096, and at head bfac8ac6 return complete coverage (raw output below). pefile counts agree exactly.
User-visible CLI/MCP output (if applicable):

# head, default budgets
$ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json
... "coverage":{"status":"complete","examined_entries":6476,"resources":3234} ...
$ rea inspect-pe-resources "C:\Windows\SystemResources\shell32.dll.mun" --format json
... "coverage":{"status":"complete","examined_entries":5903,"resources":2944} ...
$ rea inspect-pe-resources "C:\Windows\SystemResources\wmploc.DLL.mun" --format json
... "coverage":{"status":"complete","examined_entries":5440,"resources":2714} ...
# control, identical before and after: notepad.exe 69 examined entries / 31 resources

Remaining proof gaps: only Windows 11 25H2 (build 26200.9457) was measured; other Windows builds and non-English .mui tables were not above the old default in local scans (0 of 4286 System32 files, 0 of 1918 .mui files, 3 of 140 SystemResources files), so they are not exercised here. The repository's symlink boundary test fails on this machine with EPERM because Windows symlink creation needs developer mode; the same failure occurs on the unmodified base and is unrelated.

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

node node_modules/vitest/vitest.mjs run tests/boundary/filesystem/peResources.test.ts src/native/pe/PeResourceParser.test.ts src/application/binaryDiagnostics/PeResourcesService.test.ts — 31 passed, 1 failed; the failure is the pre-existing EPERM symlink case, reproduced identically on base 13e03e94; the new stock-scale test passes.
npm run artifacts:mcp-catalog && node node_modules/vitest/vitest.mjs run tests/boundary/mcp/toolSchemaValidity.test.ts — 7 passed; the regenerated advertised schema carries "default": 16384.
npm run check:fast — 2 tasks successful (typecheck, lint).
npm run docs:check — 6 tasks successful.
pefile 2024.8.26 cross-check on the three stock images at --max-entries 65536 — 0 mismatches, identical resource counts (3234 / 2944 / 2714).
npx oxfmt --check on the changed files — reports only CRLF-vs-LF checkout differences caused by this Windows worktree; LF copies pass, and the committed blobs are LF.
rea inspect-pe-resources <file> --format json on base 13e03e94 and head bfac8ac6 — raw before/after output quoted above.

AI disclosure: this change was drafted with AI assistance at my request, under my direction and review.

Compatibility, safety, and release

Breaking changes or migration steps: none. Raising the default only admits calls that previously returned a typed resource_constraint failure; explicit budgets behave identically, and the failure mode for genuinely oversized inputs is unchanged.
Real Hopper/Ghidra, browser, or OS coverage: real Windows 11 25H2 stock resource images were analyzed through the compiled CLI; no provider (Hopper/Ghidra) involvement.
Package or release metadata impact: none; docs-only plus contract-default change.
Security, privacy, process, or containment review: no new inputs or privileges; allocation remains bounded by the existing budgets and fails closed.

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1703 **Author:** [@JasonBuildAI](https://github.com/JasonBuildAI) **Created:** 10/11/2026 **Status:** ✅ Merged **Merged:** 10/11/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/pe-resource-entry-budget-a7f3c9` --- ### 📝 Commits (1) - [`bfac8ac`](https://github.com/morluto/rea/commit/bfac8ac680166f0e117c2f9bcf81f356a2cfeaca) fix(native): raise default PE resource entry budget to 16384 ### 📊 Changes **4 files changed** (+46 additions, -3 deletions) <details> <summary>View changed files</summary> 📝 `docs/binary-diagnostics.md` (+2 -1) 📝 `src/domain/native/peResources.ts` (+6 -1) 📝 `src/native/pe/PeResources.fixture.ts` (+2 -1) 📝 `tests/boundary/filesystem/peResources.test.ts` (+36 -0) </details> ### 📄 Description ## Summary Windows reverse engineers can now inspect stock Windows resource images such as `imageres.dll.mun` through the default CLI and MCP calls. Fixes #1702. Before this change, `rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun"` exited 1 with `resource_constraint` and returned no inventory, because the default `max_entries` budget (4096) is smaller than the largest stock tables (imageres 6476, shell32 5903, wmploc 5440 examined entries on Windows 11 25H2). After the change, the default budgets return `coverage.status: "complete"` with the full inventory. ## Problem and expected behavior Smallest trigger: run `rea inspect-pe-resources` with default budgets on any stock Windows resource image whose table exceeds 4096 examined entries. Observed (base 13e03e94, real files): ``` $ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json; echo $? {"code":"resource_constraint","category":"resource_constraint","message":"PE resource directory entry budget exceeded; no partial inventory was returned.","retryable":false,"details":{"operation":"inspect_pe_resources","resource":"memory","reason":"PE resource directory entry budget exceeded; no partial inventory was returned.","reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}} 1 ``` Expected: a complete inventory, confirmed independently by `pefile` 2024.8.26, which matches the parser exactly (0 mismatches across type/name/language, RVA, file offset, size, and code page) when the budget is raised. ## Change and scope - `src/domain/native/peResources.ts`: default `max_entries` 4096 -> 16384, with the measured stock-image sizes cited at the default. The 65536 maximum and the independent 8 MiB metadata budget are unchanged, and exceeding any budget still fails closed without partial results. - `src/native/pe/PeResources.fixture.ts`: optional `sectionBytes` parameter so tests can emit larger tables through the same fixture. - `tests/boundary/filesystem/peResources.test.ts`: new test emits a 6476-entry table (two types, 1620 + 1617 single-language names) via a 256 KiB section and asserts the default budgets report complete coverage with 6476 examined entries and 3237 resources. - `docs/binary-diagnostics.md`: documents the new default with its basis. Intentionally not included: changes to the parser, budgets, or error taxonomy; no new flags or tools. ## Contract and boundary impact - Semantic owner and earliest changed stage: the input contract's default budget in `src/domain/native/peResources.ts`; the earliest changed stage is native-analysis budget admission. The CLI derives its default from the schema shape, so no CLI-local edit was needed. - CLI and MCP/tool-catalog contract: the advertised default for `--max-entries` / `inspect_pe_resources.max_entries` moves 4096 -> 16384; minimum 1 and maximum 65536 are unchanged. Callers that pass an explicit budget see identical behavior. Raising a default only admits calls that previously failed with a typed error, so this is not a breaking change. - Provider, bridge, target-format, or platform compatibility: parser and provider code untouched; no platform-specific paths. - Evidence, artifact, provenance, or reconstruction contract: coverage and inventory semantics unchanged; the bounded-failure mode (no partial inventory) is preserved and still covered by existing tests. - Process execution, authorization, cleanup, or containment impact: none. Allocation stays bounded by the 8 MiB metadata budget and the 65536 hard entry maximum. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: none committed; `.cache/mcp-tool-catalog.json` was regenerated locally so the MCP schema-validity suite exercises the new default. `docs/binary-diagnostics.md` is the only authored doc change. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/filesystem/peResources.test.ts` (new stock-scale default-budget test) and the fixture's optional section size; parser and service suites still pass. - Base reproduction or other evidence: compiled-CLI runs against real stock images at base 13e03e94 fail with `max_entries: 4096`, and at head `bfac8ac6` return complete coverage (raw output below). `pefile` counts agree exactly. - User-visible CLI/MCP output (if applicable): ``` # head, default budgets $ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json ... "coverage":{"status":"complete","examined_entries":6476,"resources":3234} ... $ rea inspect-pe-resources "C:\Windows\SystemResources\shell32.dll.mun" --format json ... "coverage":{"status":"complete","examined_entries":5903,"resources":2944} ... $ rea inspect-pe-resources "C:\Windows\SystemResources\wmploc.DLL.mun" --format json ... "coverage":{"status":"complete","examined_entries":5440,"resources":2714} ... # control, identical before and after: notepad.exe 69 examined entries / 31 resources ``` - Remaining proof gaps: only Windows 11 25H2 (build 26200.9457) was measured; other Windows builds and non-English `.mui` tables were not above the old default in local scans (0 of 4286 System32 files, 0 of 1918 `.mui` files, 3 of 140 SystemResources files), so they are not exercised here. The repository's symlink boundary test fails on this machine with `EPERM` because Windows symlink creation needs developer mode; the same failure occurs on the unmodified base and is unrelated. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `node node_modules/vitest/vitest.mjs run tests/boundary/filesystem/peResources.test.ts src/native/pe/PeResourceParser.test.ts src/application/binaryDiagnostics/PeResourcesService.test.ts` — 31 passed, 1 failed; the failure is the pre-existing `EPERM` symlink case, reproduced identically on base 13e03e94; the new stock-scale test passes. - `npm run artifacts:mcp-catalog && node node_modules/vitest/vitest.mjs run tests/boundary/mcp/toolSchemaValidity.test.ts` — 7 passed; the regenerated advertised schema carries `"default": 16384`. - `npm run check:fast` — 2 tasks successful (typecheck, lint). - `npm run docs:check` — 6 tasks successful. - `pefile` 2024.8.26 cross-check on the three stock images at `--max-entries 65536` — 0 mismatches, identical resource counts (3234 / 2944 / 2714). - `npx oxfmt --check` on the changed files — reports only CRLF-vs-LF checkout differences caused by this Windows worktree; LF copies pass, and the committed blobs are LF. - `rea inspect-pe-resources <file> --format json` on base 13e03e94 and head `bfac8ac6` — raw before/after output quoted above. AI disclosure: this change was drafted with AI assistance at my request, under my direction and review. ## Compatibility, safety, and release - Breaking changes or migration steps: none. Raising the default only admits calls that previously returned a typed `resource_constraint` failure; explicit budgets behave identically, and the failure mode for genuinely oversized inputs is unchanged. - Real Hopper/Ghidra, browser, or OS coverage: real Windows 11 25H2 stock resource images were analyzed through the compiled CLI; no provider (Hopper/Ghidra) involvement. - Package or release metadata impact: none; docs-only plus contract-default change. - Security, privacy, process, or containment review: no new inputs or privileges; allocation remains bounded by the existing budgets and fails closed. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 00:54:48 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:14:09 +00:00

[PR #4765] [MERGED] fix(ida): refuse universal Mach-O targets in attached profiles #6398

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4765

No description provided.

Rows
Columns