[PR #6509] [MERGED] feat(pe): inspect import and delay-load tables #7373

New issue

Closed

opened 2026-11-01 21:47:24 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:24 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6509
Author: @mvanhorn
Created: 10/23/2026
Status: ✅ Merged
Merged: 10/24/2026
Merged by: @gensokyo-dev

Base: main ← Head: feat/pe-imports

📝 Commits (10+)

6de4c19 feat(pe): inspect import and delay-load tables
d403595 fix(pe): default PE import fixture options
130b5ba test(pe): keep import path cases on the dedicated MCP contract
4682a8e fix(native): index virtual-to-file mapping lookups
e13fee6 fix(pe): report partial import evidence and exact pefile hashes
0b65cbc fix(pe): read only own ordinal tables for DLL names
336f83c refactor(native): align PE mapping index with shared semantics
105f4ea fix(native): preserve PE import facts and prove hash compatibility
0d6073e test(native): verify PE import workflows and measured costs
aec2f5c chore: integrate current main for PE import verification

📊 Changes

66 files changed (+4824 additions, -31 deletions)

View changed files

📝 .agents/skills/reverse-engineer-anything/SKILL.md (+8 -0)
📝 .agents/skills/reverse-engineer-anything/references/native-and-artifacts.md (+13 -0)
📝 README.md (+1 -0)
📝 THIRD_PARTY_NOTICES.md (+1 -0)
📝 docs/.vitepress/config.ts (+1 -0)
📝 docs/cli.md (+11 -0)
📝 docs/index.md (+1 -1)
➕ docs/pe-imports.md (+73 -0)
📝 docs/readme/README_ar.md (+1 -0)
📝 docs/readme/README_de.md (+1 -0)
📝 docs/readme/README_el.md (+1 -0)
📝 docs/readme/README_es.md (+1 -0)
📝 docs/readme/README_fa.md (+1 -0)
📝 docs/readme/README_fr.md (+1 -0)
📝 docs/readme/README_id.md (+1 -0)
📝 docs/readme/README_it.md (+1 -0)
📝 docs/readme/README_ja.md (+1 -0)
📝 docs/readme/README_ko.md (+1 -0)
📝 docs/readme/README_ml.md (+1 -0)
📝 docs/readme/README_pl.md (+1 -0)

...and 46 more files

📄 Description

Related to #4539.

Adds inspect_pe_imports / inspect-pe-imports for one selected local PE: standard/delay DLLs, names or ordinals, hints, IAT RVAs, consumed ranges and a pefile-compatible imphash when the complete standard table supports it. CLI/MCP share bounded stable-file reading, validation and Evidence; the target is never executed.

The integration consumes parsed PE facts and canonical indexed mappings. Descriptor/thunk RVA overflow and descriptor mapping gaps preserve preceding rows and explicit partial coverage. An unexamined directory retains its declaration with zero consumed spans. Coverage is reconciled with actual rows, standard-table issues withhold the hash, and delay-only issues preserve an independently complete standard hash. Cancellation, typed resource recovery and failed-cleanup ownership remain intact.

Validation:

277 checks pass on main 7f70797b integration, covering parser/mapping/image/service/filesystem/CLI/MCP/lifecycle behavior and the upstream plist-fixture correction. Full npm run check, npm run docs:check and test discovery pass. Negative controls reproduce the corrected overflow, mapping-gap, coverage and cancellation failures before correction. Actual SDK output is checked against the advertised JSON schema.
Independent pefile 2024.8.26 agrees with every ordered DLL/name/ordinal/hint/IAT RVA, machine, bitness and imphash from shipped pip PE32/PE32+ launchers (85 / 86 imports), and all 696 ordinal-map entries. Full MIT attribution is included. The proposed 63-bit ordinal mask was rejected after byte-level controls proved it disagrees with pinned pefile. No Windows execution or deep-engine behavior is newly qualified.
Two 24-task CLI comparisons cover empty, shipped and 2,048-section/function fixtures with complete Evidence/oracle equality. In the final measured RVA comparison, large-case estimated tokens remain 70,342; elapsed median 2.825 → 2.221 s has overlapping ranges, CPU 2.423 → 2.428 s and sampled family RSS 382.9 → 389.0 MiB. No speedup is claimed. Later coverage/mapping guards and main changes are outside those pinned timings.

Verification report records artifact digests, revisions, provenance and measurement limits. Final CI run 40057282775 fails on 11 separate plist cases. Exact main cd10ee1f and actual CI merge c3d08d01 reproduce the same 19 passing / 11 failing cases with identical normalized failures and unchanged producing sources. Two other shards are cancelled; their remaining coverage is unexecuted. The maintainer-authorized baseline bypass is supported by these controls; the PR's selected checks pass.

Author readiness

Human owner: @mvanhorn

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6509 **Author:** [@mvanhorn](https://github.com/mvanhorn) **Created:** 10/23/2026 **Status:** ✅ Merged **Merged:** 10/24/2026 **Merged by:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Base:** `main` ← **Head:** `feat/pe-imports` --- ### 📝 Commits (10+) - [`6de4c19`](https://github.com/morluto/rea/commit/6de4c1973f34e682023653b5241ec4059586dd82) feat(pe): inspect import and delay-load tables - [`d403595`](https://github.com/morluto/rea/commit/d403595eeba2448b30c5957a3877d321ee7b4d65) fix(pe): default PE import fixture options - [`130b5ba`](https://github.com/morluto/rea/commit/130b5babaa4585be47f3f97e9fd1a393838918d1) test(pe): keep import path cases on the dedicated MCP contract - [`4682a8e`](https://github.com/morluto/rea/commit/4682a8ec2efb948da182218dd5e9a55ccf4d3117) fix(native): index virtual-to-file mapping lookups - [`e13fee6`](https://github.com/morluto/rea/commit/e13fee68a417f1550cc26afec576bc44b429e6e2) fix(pe): report partial import evidence and exact pefile hashes - [`0b65cbc`](https://github.com/morluto/rea/commit/0b65cbcfe2bf78a808d41e12fa5aee9c0fc93da4) fix(pe): read only own ordinal tables for DLL names - [`336f83c`](https://github.com/morluto/rea/commit/336f83cbb08dcc02a2d4c932f9c82f2c7b83554e) refactor(native): align PE mapping index with shared semantics - [`105f4ea`](https://github.com/morluto/rea/commit/105f4ea66ebc82e559fe1000aabe75ced3024a41) fix(native): preserve PE import facts and prove hash compatibility - [`0d6073e`](https://github.com/morluto/rea/commit/0d6073e5a7f4f759a9482ed9760a5972b3b612c7) test(native): verify PE import workflows and measured costs - [`aec2f5c`](https://github.com/morluto/rea/commit/aec2f5c0340693914fe9c49ae19ce129e7fa9d53) chore: integrate current main for PE import verification ### 📊 Changes **66 files changed** (+4824 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `.agents/skills/reverse-engineer-anything/SKILL.md` (+8 -0) 📝 `.agents/skills/reverse-engineer-anything/references/native-and-artifacts.md` (+13 -0) 📝 `README.md` (+1 -0) 📝 `THIRD_PARTY_NOTICES.md` (+1 -0) 📝 `docs/.vitepress/config.ts` (+1 -0) 📝 `docs/cli.md` (+11 -0) 📝 `docs/index.md` (+1 -1) ➕ `docs/pe-imports.md` (+73 -0) 📝 `docs/readme/README_ar.md` (+1 -0) 📝 `docs/readme/README_de.md` (+1 -0) 📝 `docs/readme/README_el.md` (+1 -0) 📝 `docs/readme/README_es.md` (+1 -0) 📝 `docs/readme/README_fa.md` (+1 -0) 📝 `docs/readme/README_fr.md` (+1 -0) 📝 `docs/readme/README_id.md` (+1 -0) 📝 `docs/readme/README_it.md` (+1 -0) 📝 `docs/readme/README_ja.md` (+1 -0) 📝 `docs/readme/README_ko.md` (+1 -0) 📝 `docs/readme/README_ml.md` (+1 -0) 📝 `docs/readme/README_pl.md` (+1 -0) _...and 46 more files_ </details> ### 📄 Description Related to #4539. Adds `inspect_pe_imports` / `inspect-pe-imports` for one selected local PE: standard/delay DLLs, names or ordinals, hints, IAT RVAs, consumed ranges and a pefile-compatible imphash when the complete standard table supports it. CLI/MCP share bounded stable-file reading, validation and Evidence; the target is never executed. The integration consumes parsed PE facts and canonical indexed mappings. Descriptor/thunk RVA overflow and descriptor mapping gaps preserve preceding rows and explicit partial coverage. An unexamined directory retains its declaration with zero consumed spans. Coverage is reconciled with actual rows, standard-table issues withhold the hash, and delay-only issues preserve an independently complete standard hash. Cancellation, typed resource recovery and failed-cleanup ownership remain intact. Validation: - **277 checks pass** on main `7f70797b` integration, covering parser/mapping/image/service/filesystem/CLI/MCP/lifecycle behavior and the upstream plist-fixture correction. Full `npm run check`, `npm run docs:check` and test discovery pass. Negative controls reproduce the corrected overflow, mapping-gap, coverage and cancellation failures before correction. Actual SDK output is checked against the advertised JSON schema. - Independent pefile 2024.8.26 agrees with every ordered DLL/name/ordinal/hint/IAT RVA, machine, bitness and imphash from shipped pip PE32/PE32+ launchers (85 / 86 imports), and all 696 ordinal-map entries. Full MIT attribution is included. The proposed 63-bit ordinal mask was rejected after byte-level controls proved it disagrees with pinned pefile. No Windows execution or deep-engine behavior is newly qualified. - Two **24-task** CLI comparisons cover empty, shipped and 2,048-section/function fixtures with complete Evidence/oracle equality. In the final measured RVA comparison, large-case estimated tokens remain 70,342; elapsed median 2.825 → 2.221 s has overlapping ranges, CPU 2.423 → 2.428 s and sampled family RSS 382.9 → 389.0 MiB. No speedup is claimed. Later coverage/mapping guards and main changes are outside those pinned timings. [Verification report](https://github.com/mvanhorn/rea/blob/0f225fb98f701179c60121a6c4c644e9312eb8cf/docs/verification/pe-imports-2026-10-24.md) records artifact digests, revisions, provenance and measurement limits. Final CI run [40057282775](https://github.com/morluto/rea/actions/runs/40057282775) fails on 11 separate plist cases. Exact main `cd10ee1f` and actual CI merge `c3d08d01` reproduce the same 19 passing / 11 failing cases with identical normalized failures and unchanged producing sources. Two other shards are cancelled; their remaining coverage is unexecuted. The maintainer-authorized baseline bypass is supported by these controls; the PR's selected checks pass. ## Author readiness Human owner: @mvanhorn - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:47:24 +00:00

closed this issue
added the
pull-request
label

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#7373

No description provided.

Rows
Columns