morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #4830] [MERGED] feat(pe): inspect Authenticode certificate tables #6432

New issue

Closed

opened 2026-10-31 01:14:25 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:14:25 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/4830
Author: @mvanhorn
Created: 10/17/2026
Status: ✅ Merged
Merged: 10/22/2026
Merged by: @morluto

Base: main ← Head: fix/pe-certificates

📝 Commits (10+)

e659bb7 feat(pe): inspect Authenticode certificate tables
8dddc60 fix(pe): bound and validate certificate DER decoding
41cc5c9 docs: list PE certificates in the translated READMEs
acd169b fix(pe): cap OBJECT IDENTIFIER length and arc size
206315a fix(pe): reject truncated certificate tables and PKCS#7
c13f794 chore(ci): keep fork workflow files unchanged
dccda8d fix(pe): charge serial and validity text to the decoded budget
1ebf689 Merge main into fix/pe-certificates
c9f0637 Merge main into fix/pe-certificates
e6dc8c3 fix(pe): require certificate fields and preserve signer key ids

📊 Changes

54 files changed (+2668 additions, -57 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+8 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+14 -0)
📝 README.md (+1 -0)
📝 docs/.vitepress/config.ts (+1 -0)
📝 docs/cli.md (+12 -0)
📝 docs/index.md (+1 -1)
➕ docs/pe-certificates.md (+54 -0)
📝 docs/readme/README_ar.md (+1 -0)
📝 docs/readme/README_de.md (+1 -0)
📝 docs/readme/README_el.md (+1 -0)
📝 docs/readme/README_es.md (+1 -0)
📝 docs/readme/README_fa.md (+1 -0)
📝 docs/readme/README_fr.md (+1 -0)
📝 docs/readme/README_id.md (+1 -0)
📝 docs/readme/README_it.md (+1 -0)
📝 docs/readme/README_ja.md (+1 -0)
📝 docs/readme/README_ko.md (+1 -0)
📝 docs/readme/README_ml.md (+1 -0)
📝 docs/readme/README_pl.md (+1 -0)
📝 docs/readme/README_pt-BR.md (+1 -0)

...and 34 more files

📄 Description

Summary

Add inspect_pe_certificates / inspect-pe-certificates for one explicit
local PE32/PE32+ image. The workflow reads
IMAGE_DIRECTORY_ENTRY_SECURITY as a file-offset WIN_CERTIFICATE table and
returns entry ranges, types, payload SHA-256, and structurally decoded PKCS#7
signedData signer/X.509 identity fields when type 2 is present.

It does not execute the image, verify signatures, chains, timestamps, or
Authenticode digest coverage. A missing security directory is observed absence
of that table, not proof the image is unsigned in every catalog or overlay
sense. Malformed PE headers, truncated entries, and non-signedData PKCS#7 fail
without partial success. No Windows SDK is required.

Usage

rea inspect-pe-certificates /absolute/path/to/application.exe --json

MCP: inspect_pe_certificates with an absolute path.

Tests

Merge resolution at 3ca73d13a against main (c7efd3a38): preserves both PE certificate inspection and native export inspection across CLI/MCP registration, composition, effect metadata, and local-contract validation.

npm run test:focused selecting the PE certificate domain/parser/service, CLI/MCP/filesystem tests, tool-effects and local-contract tests, and native-export/PE-resource filesystem tests — exit 0, 10 files, 51 tests passed. Runtime and packaged-skill build passed.
npm run check — exit 0.
npm run docs:generate and npm run docs:check — exit 0; includes 9 README consistency tests.
Full suite and real Windows image verification were not run for this merge resolution; the CLI/MCP workflows used fixtures.

Earlier validation:

npm run check:fast
npm run test:local -- domain, parser, and service tests (10 passed)
npm run test:focused -- CLI, MCP, and filesystem tests (7 passed on this
feature; plus the shared local-contract NUL case)

Demo

Author readiness

Human owner: @mvanhorn

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/4830 **Author:** [@mvanhorn](https://github.com/mvanhorn) **Created:** 10/17/2026 **Status:** ✅ Merged **Merged:** 10/22/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/pe-certificates` --- ### 📝 Commits (10+) - [`e659bb7`](https://github.com/morluto/rea/commit/e659bb7e68568ce892470803e5e33ac49ccbee51) feat(pe): inspect Authenticode certificate tables - [`8dddc60`](https://github.com/morluto/rea/commit/8dddc607e3f09ba10d8f1df04841fd4151eb4d5a) fix(pe): bound and validate certificate DER decoding - [`41cc5c9`](https://github.com/morluto/rea/commit/41cc5c98a1959db6d184f0902b4ff05f8a40211a) docs: list PE certificates in the translated READMEs - [`acd169b`](https://github.com/morluto/rea/commit/acd169b356553602a2acafbeb83a5531bb6e55fa) fix(pe): cap OBJECT IDENTIFIER length and arc size - [`206315a`](https://github.com/morluto/rea/commit/206315ade51e7e8d12f4d72e26a81424a7cac932) fix(pe): reject truncated certificate tables and PKCS#7 - [`c13f794`](https://github.com/morluto/rea/commit/c13f79435f0886bba8d55891a4b5abe46cb350ab) chore(ci): keep fork workflow files unchanged - [`dccda8d`](https://github.com/morluto/rea/commit/dccda8d08445c3358f1784a261670d72d0c216f6) fix(pe): charge serial and validity text to the decoded budget - [`1ebf689`](https://github.com/morluto/rea/commit/1ebf689aa54cec150570dab7052bdc8000131d45) Merge main into fix/pe-certificates - [`c9f0637`](https://github.com/morluto/rea/commit/c9f06379c911c6f7399624d64653051d4bea817f) Merge main into fix/pe-certificates - [`e6dc8c3`](https://github.com/morluto/rea/commit/e6dc8c33117edc8ff206309a35f878b5973805b8) fix(pe): require certificate fields and preserve signer key ids ### 📊 Changes **54 files changed** (+2668 additions, -57 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+8 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+14 -0) 📝 `README.md` (+1 -0) 📝 `docs/.vitepress/config.ts` (+1 -0) 📝 `docs/cli.md` (+12 -0) 📝 `docs/index.md` (+1 -1) ➕ `docs/pe-certificates.md` (+54 -0) 📝 `docs/readme/README_ar.md` (+1 -0) 📝 `docs/readme/README_de.md` (+1 -0) 📝 `docs/readme/README_el.md` (+1 -0) 📝 `docs/readme/README_es.md` (+1 -0) 📝 `docs/readme/README_fa.md` (+1 -0) 📝 `docs/readme/README_fr.md` (+1 -0) 📝 `docs/readme/README_id.md` (+1 -0) 📝 `docs/readme/README_it.md` (+1 -0) 📝 `docs/readme/README_ja.md` (+1 -0) 📝 `docs/readme/README_ko.md` (+1 -0) 📝 `docs/readme/README_ml.md` (+1 -0) 📝 `docs/readme/README_pl.md` (+1 -0) 📝 `docs/readme/README_pt-BR.md` (+1 -0) _...and 34 more files_ </details> ### 📄 Description ## Summary Add `inspect_pe_certificates` / `inspect-pe-certificates` for one explicit local PE32/PE32+ image. The workflow reads `IMAGE_DIRECTORY_ENTRY_SECURITY` as a file-offset `WIN_CERTIFICATE` table and returns entry ranges, types, payload SHA-256, and structurally decoded PKCS#7 signedData signer/X.509 identity fields when type 2 is present. It does not execute the image, verify signatures, chains, timestamps, or Authenticode digest coverage. A missing security directory is observed absence of that table, not proof the image is unsigned in every catalog or overlay sense. Malformed PE headers, truncated entries, and non-signedData PKCS#7 fail without partial success. No Windows SDK is required. ## Usage ```bash rea inspect-pe-certificates /absolute/path/to/application.exe --json ``` MCP: `inspect_pe_certificates` with an absolute `path`. ## Tests Merge resolution at `3ca73d13a` against `main` (`c7efd3a38`): preserves both PE certificate inspection and native export inspection across CLI/MCP registration, composition, effect metadata, and local-contract validation. - `npm run test:focused` selecting the PE certificate domain/parser/service, CLI/MCP/filesystem tests, tool-effects and local-contract tests, and native-export/PE-resource filesystem tests — exit 0, 10 files, 51 tests passed. Runtime and packaged-skill build passed. - `npm run check` — exit 0. - `npm run docs:generate` and `npm run docs:check` — exit 0; includes 9 README consistency tests. - Full suite and real Windows image verification were not run for this merge resolution; the CLI/MCP workflows used fixtures. Earlier validation: - `npm run check:fast` - `npm run test:local --` domain, parser, and service tests (10 passed) - `npm run test:focused --` CLI, MCP, and filesystem tests (7 passed on this feature; plus the shared local-contract NUL case) ## Demo ![demo](https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/pe-certificates/demo.gif) <video src="https://raw.githubusercontent.com/mvanhorn/pr-demo-assets/main/rea/pe-certificates/demo.mp4" controls width="720"></video> ## Author readiness Human owner: @mvanhorn - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:14:25 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:47:18 +00:00

[PR #6465] [CLOSED] fix(environment): normalize recorded empty absence responses #7359

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#6432

No description provided.

Rows
Columns