fix(managed): recognize PE Thumb and ARMNT machines (#605)

Signed-off-by: Rudy Celekli <47457359+rudycelekli@users.noreply.github.com>

src/domain/binaryTarget.ts

@@ -237,6 +237,8 @@ const peArchitecture = (machine: number): BinaryArchitecture | undefined => {
     case 0x8664:
       return "x86_64";
     case 0x1c0:
+    case 0x1c2:
+    case 0x1c4:
       return "arm";
     case 0xaa64:
       return "arm64";

src/domain/peInspection.ts

@@ -132,6 +132,7 @@ export function parseMachineType(machine: number): PeMachineType {
     case 0x8664:
       return "x64";
     case 0x01c0:
+    case 0x01c2:
     case 0x01c4:
       return "arm";
     case 0xaa64:

src/dotnet/ManagedPeReader.ts

@@ -106,6 +106,8 @@ const architectureFor = (machine: number): ManagedPeLayout["architecture"] => {
     case 0x8664:
       return "x86_64";
     case 0x01c0:
+    case 0x01c2:
+    case 0x01c4:
       return "arm";
     case 0xaa64:
       return "arm64";

tests/boundary/providers/managed/managedArmMachine.test.ts

@@ -0,0 +1,50 @@
+import { writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { expect, it } from "vitest";
+import { createTestTempDirectory } from "../../../fixtures/temporaryDirectory.js";
+import { parseBinaryTarget } from "../../../../src/application/BinaryTargetResolver.js";
+import { parseMachineType } from "../../../../src/domain/peInspection.js";
+import { buildManagedPeFixture } from "../../../../src/dotnet/ManagedPe.fixture.js";
+import { ManagedStaticProvider } from "../../../../src/dotnet/ManagedStaticProvider.js";
+
+it.each([0x01c0, 0x01c2, 0x01c4])(
+  "opens and inspects managed PE ARM machine 0x%s through the public path",
+  async (machine) => {
+    const bytes = buildManagedPeFixture({ cliFlags: 0 });
+    bytes.writeUInt16LE(machine, bytes.readUInt32LE(0x3c) + 4);
+    const directory = await createTestTempDirectory("rea-managed-arm-");
+    const path = join(directory, "fixture.exe");
+    await writeFile(path, bytes);
+    const parsed = await parseBinaryTarget(path);
+    expect(parsed.ok).toBe(true);
+    if (!parsed.ok) throw parsed.error;
+    expect(parsed.value).toMatchObject({
+      kind: "executable",
+      format: "pe",
+      architecture: "arm",
+      managed: true,
+    });
+    expect(parseMachineType(machine)).toBe("arm");
+    const client = new ManagedStaticProvider().createClient(parsed.value);
+    try {
+      for (const operation of [
+        "inspect_managed_artifact",
+        "inspect_managed_members",
+        "inspect_managed_native_boundaries",
+      ] as const) {
+        const observed = await client.execute(operation, {});
+        expect(observed.ok).toBe(true);
+        if (!observed.ok) throw observed.error;
+        expect(observed.value.subject).toMatchObject({
+          path,
+          sha256: parsed.value.sha256,
+        });
+        expect(observed.value.result).toMatchObject({
+          module: { name: "Fixture.dll" },
+        });
+      }
+    } finally {
+      await client.close();
+    }
+  },
+);