[GH-ISSUE #1702] [Bug] inspect-pe-resources rejects stock Windows resource images at the default entry budget #569

New issue

Closed

opened 2026-10-15 18:26:15 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:15 +00:00

Owner

Originally created by @JasonBuildAI on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1702

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Native analysis or decompilation

Observed behavior

rea inspect-pe-resources (MCP inspect_pe_resources) rejects stock Windows resource images at the default budgets with a resource_constraint error and returns no inventory, even though the files fit the 64 MiB max_file_bytes default with room to spare (imageres.dll.mun is 23.2 MiB, shell32.dll.mun 17.3 MiB, wmploc.DLL.mun 8.6 MiB) and are well-formed:

$ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json; echo $?
{"code":"resource_constraint","category":"resource_constraint","message":"PE resource directory entry budget exceeded; no partial inventory was returned.","retryable":false,"details":{"operation":"inspect_pe_resources","resource":"memory","reason":"PE resource directory entry budget exceeded; no partial inventory was returned.","reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}}
1

The same run succeeds with an explicit budget, which shows the images are otherwise fully analyzable:

$ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json --max-entries 65536
... "coverage":{"status":"complete","examined_entries":6476,"resources":3234} ...

Measured on Windows 11 25H2 (build 26200.9457), 2026-10-11:

file	examined entries	default 4096
`C:\Windows\SystemResources\imageres.dll.mun`	6476	rejected
`C:\Windows\SystemResources\shell32.dll.mun`	5903	rejected
`C:\Windows\SystemResources\wmploc.DLL.mun`	5440	rejected

A scan of C:\Windows\SystemResources found 3 of 140 files above 4096 entries; C:\Windows\System32 (4286 files) and .mui files (1918 files) contained none above the default.

Reproduction

On Windows 11 (any recent build), run:
rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json
Observe exit code 1 and the resource_constraint error above without any inventory.
Re-run with --max-entries 65536 to confirm the file parses completely (6476 examined entries, 3234 resources).

Expected behavior

The default max_entries budget should admit the largest resource tables shipped by the supported OS. A caller inspecting a stock Windows resource image should receive the complete inventory without first discovering and raising a hidden budget; the budget should still fail closed (no partial results) when genuinely exceeded. An independent tool (pefile 2024.8.26) reports exactly the same 3234 / 2944 / 2714 resource triples with zero mismatches on type/name/language, RVA, file offset, size, and code page, so the expected outcome is the complete inventory rather than an error.

Impact and scope

Windows reverse engineers cannot inspect the highest-value icon and dialog resource containers (imageres, shell32, wmploc) through default CLI or MCP calls. Workaround --max-entries 65536 exists but is undiscoverable from the failure message, and MCP callers must know the flag-equivalent parameter.

Not affected: smaller resource images behave identically before and after a budget change (for example notepad.exe reports 69 examined entries / 31 resources in both cases); no evidence or provenance contract changes; exceeding any budget still fails without partial results, and metadata remains bounded by the independent 8 MiB budget.

REA version

6.4.0 source revision 13e03e94 (also reproduced on 6.3.0 / ee46323b)

Runtime and platform

Node.js 22.22.2; Windows 11 25H2 x64 (build 26200.9457)

Target and artifact context

PE32+ resource-only images shipped with Windows (SystemResources\*.dll.mun, *.DLL.mun)

Interface

CLI

Earliest failure stage

Native analysis or reconstruction

Relevant output or evidence

$ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json
{"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}
$ rea inspect-pe-resources "C:\Windows\SystemResources\shell32.dll.mun" --format json
{"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}
$ rea inspect-pe-resources "C:\Windows\SystemResources\wmploc.DLL.mun" --format json
{"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}

Analysis or suspected cause

Hypothesis (source-derived): the default max_entries of 4096 in src/domain/native/peResources.ts predates a measurement of stock Windows tables. examined_entries counts type, name, and language directory entries; the largest stock image needs 6476, so any table above the default is rejected before parsing payloads. The 65536 maximum and the separate 8 MiB metadata budget already bound allocation for the measured files, so the default itself appears to be the only limiter.

Additional context

The three files exceed the old default by 33-58%. A regression test that emits a 6476-entry table and asserts complete default coverage, plus a fix raising the default with headroom, is prepared in a linked pull request.

Originally created by @JasonBuildAI on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1702 ### Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ### Area Native analysis or decompilation ### Observed behavior `rea inspect-pe-resources` (MCP `inspect_pe_resources`) rejects stock Windows resource images at the default budgets with a `resource_constraint` error and returns no inventory, even though the files fit the 64 MiB `max_file_bytes` default with room to spare (imageres.dll.mun is 23.2 MiB, shell32.dll.mun 17.3 MiB, wmploc.DLL.mun 8.6 MiB) and are well-formed: ``` $ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json; echo $? {"code":"resource_constraint","category":"resource_constraint","message":"PE resource directory entry budget exceeded; no partial inventory was returned.","retryable":false,"details":{"operation":"inspect_pe_resources","resource":"memory","reason":"PE resource directory entry budget exceeded; no partial inventory was returned.","reported_limits":{"max_file_bytes":67108864,"max_entries":4096}}} 1 ``` The same run succeeds with an explicit budget, which shows the images are otherwise fully analyzable: ``` $ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json --max-entries 65536 ... "coverage":{"status":"complete","examined_entries":6476,"resources":3234} ... ``` Measured on Windows 11 25H2 (build 26200.9457), 2026-10-11: | file | examined entries | default 4096 | | --- | --- | --- | | `C:\Windows\SystemResources\imageres.dll.mun` | 6476 | rejected | | `C:\Windows\SystemResources\shell32.dll.mun` | 5903 | rejected | | `C:\Windows\SystemResources\wmploc.DLL.mun` | 5440 | rejected | A scan of `C:\Windows\SystemResources` found 3 of 140 files above 4096 entries; `C:\Windows\System32` (4286 files) and `.mui` files (1918 files) contained none above the default. ### Reproduction 1. On Windows 11 (any recent build), run: `rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json` 2. Observe exit code 1 and the `resource_constraint` error above without any inventory. 3. Re-run with `--max-entries 65536` to confirm the file parses completely (6476 examined entries, 3234 resources). ### Expected behavior The default `max_entries` budget should admit the largest resource tables shipped by the supported OS. A caller inspecting a stock Windows resource image should receive the complete inventory without first discovering and raising a hidden budget; the budget should still fail closed (no partial results) when genuinely exceeded. An independent tool (`pefile` 2024.8.26) reports exactly the same 3234 / 2944 / 2714 resource triples with zero mismatches on type/name/language, RVA, file offset, size, and code page, so the expected outcome is the complete inventory rather than an error. ### Impact and scope Windows reverse engineers cannot inspect the highest-value icon and dialog resource containers (imageres, shell32, wmploc) through default CLI or MCP calls. Workaround `--max-entries 65536` exists but is undiscoverable from the failure message, and MCP callers must know the flag-equivalent parameter. Not affected: smaller resource images behave identically before and after a budget change (for example `notepad.exe` reports 69 examined entries / 31 resources in both cases); no evidence or provenance contract changes; exceeding any budget still fails without partial results, and metadata remains bounded by the independent 8 MiB budget. ### REA version 6.4.0 source revision 13e03e94 (also reproduced on 6.3.0 / ee46323b) ### Runtime and platform Node.js 22.22.2; Windows 11 25H2 x64 (build 26200.9457) ### Target and artifact context PE32+ resource-only images shipped with Windows (`SystemResources\*.dll.mun`, `*.DLL.mun`) ### Interface CLI ### Earliest failure stage Native analysis or reconstruction ### Relevant output or evidence ``` $ rea inspect-pe-resources "C:\Windows\SystemResources\imageres.dll.mun" --format json {"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}} $ rea inspect-pe-resources "C:\Windows\SystemResources\shell32.dll.mun" --format json {"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}} $ rea inspect-pe-resources "C:\Windows\SystemResources\wmploc.DLL.mun" --format json {"code":"resource_constraint",...,"reported_limits":{"max_file_bytes":67108864,"max_entries":4096}} ``` ### Analysis or suspected cause Hypothesis (source-derived): the default `max_entries` of 4096 in `src/domain/native/peResources.ts` predates a measurement of stock Windows tables. `examined_entries` counts type, name, and language directory entries; the largest stock image needs 6476, so any table above the default is rejected before parsing payloads. The 65536 maximum and the separate 8 MiB metadata budget already bound allocation for the measured files, so the default itself appears to be the only limiter. ### Additional context The three files exceed the old default by 33-58%. A regression test that emits a 6476-entry table and asserts complete default coverage, plus a fix raising the default with headroom, is prepared in a linked pull request.

bsakaguchi

2026-10-15 18:26:15 +00:00