Skip to content

feat(tools): inventory PE code symbols and module identity - #13376

Merged
adriadam10 merged 1 commit into
boykopovar:mainfrom
StoneDC:b43/pe-inventory
Oct 30, 2026
Merged

adriadam10 merged 1 commit into
boykopovar:mainfrom
StoneDC:b43/pe-inventory

Conversation

@StoneDC

@StoneDC StoneDC commented Oct 30, 2026

Copy link
Copy Markdown
Contributor

What

Inventories a PE32+ module's code-symbol RVAs, code-section ranges and existing image-base/size/timestamp metadata as JSON without sample captures, disassembly or output files.

Implementation basis: Reuses symbolize_samples.PeModule, including its COFF-symbol and export-table fallback policies. Constructed PE fixtures fix expected addresses/names independently, exercise both modes and malformed files, and check input preservation. This is separate from #12499's sampled-stack summaries and #12873's ELF annotation output.

Known limits: The existing PE parser's coverage and decoded-name policy remain. Size/timestamp are metadata, not authentication; export fallback can have no symbols. This does not validate all PE directories, demangle names, prove execution, or match an image to a capture. Consumers must preserve 64-bit image-base precision.

Source/schema: tools/pe_symbol_inventory.py tools/symbolize_samples.py

Exact topic head 34d3bf669e0a0704d271b50d4da5b0132c0e85a6 is one independent commit on main da026c70655a132031d45e2008c24f993870d801. The current-main repository overlap checker against da026c70655a132031d45e2008c24f993870d801 reported no confirmed overlap. It could not finish comparisons for these older PRs already conflicting with main: #674, #1835, #3786, #5021, #7642, #9539, #10897, #12862. Their shared-file diffs were reviewed separately. 7 scoped file changes projected onto main and then combined with this topic without a new conflict; 1 peer file changes already conflict with main and are not claimed automatically mergeable. They do not provide this command or test matrix. Registration uses a separate target/name and there is no landing-order dependency. Changes to shared registration before landing need a refreshed merge/test check. Depends on: none. The twenty current topic heads are also merged into tested integration 3990a2bd7e0abeaaeeef963a30a3d6508d9b5be3.

Tested

Topic head: 34d3bf669e0a0704d271b50d4da5b0132c0e85a6. Combined integration: 3990a2bd7e0abeaaeeef963a30a3d6508d9b5be3, based on main da026c70655a132031d45e2008c24f993870d801. Ubuntu/WSL GCC 15.2, CMake 4.2.3, Python 3.14.4; Windows MinGW GCC 15.2, CMake 4.3.1, Python 3.14.3.

python tools/tests/test_pe_symbol_inventory.py: 2 tests passed on each platform, no skips. A mutation in the actual new tool was rejected by the fixture.

Registered CTest tools_pe_inventory passed on Linux and Windows as part of the filtered twenty-topic run: ctest --test-dir <build> -R <20-topic-pattern> -j 8 -V --output-on-failure, 20/20 passed on each platform, zero skips. cmake --build <linux-full-build> --parallel 8: complete default Linux product build passed. Windows used the full configuration and built the sixteen affected libc test targets plus relinker with --parallel 8; a complete default Windows build is not claimed. Conventions, whitespace, script registration and the public-header declaration/umbrella audit passed. No PS5, title or GPU validation run is claimed. macOS, WASM execution and hosted full-build CI are not reported as passed.

Checklist

  • Based on current main; no other open PR implements the same functions
  • One topic per PR; follow-ups go in a new PR
  • No comments in code except technical debt
  • Unimplemented paths throw (NotImplemented_nid_no_patch); silent stubs are listed under Silent stubs in their library's technical debt file
  • No notes, investigation .md files or images added to the repository (attach them to this PR)
  • New third-party code is a submodule built from source
  • Generic behaviour, not specific to one title
  • Depends on: none
  • Fixes: none
  • Unblocks: none
  • GPUs tested: n/a
  • AI-assisted: yes

@github-actions

github-actions Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Some comparisons could not be completed because a pull request conflicts with the base branch. Review these shared files manually before concluding that there is no overlap.

Pull request Shared files not compared
PR 674 CMakeLists.txt
PR 1835 CMakeLists.txt
PR 3786 CMakeLists.txt
PR 5021 CMakeLists.txt
PR 7642 CMakeLists.txt
PR 9539 CMakeLists.txt
PR 10897 CMakeLists.txt
PR 11104 CMakeLists.txt
PR 12862 CMakeLists.txt

@adriadam10 adriadam10 self-assigned this Oct 30, 2026
@adriadam10
adriadam10 merged commit cd0b743 into boykopovar:main Oct 30, 2026
13 checks passed
@adriadam10

Copy link
Copy Markdown
Collaborator

Checked that PeModule exposes the fields used, that the test fixtures exist on main, and that the new test pins addresses, names, identity metadata, export fallback and malformed-input failures (it cannot pass without the tool); PR CI is green; merged.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants