2

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.

I've tried changing the Major/Minor LinkerVersion in the PE header as per Corkami's research. I've also tried zeroing out every unnecessary data structure in the header of the PE file. I have a particular file where, for dynamic analysis, it cannot map into memory and Process Monitor shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file. I suppose this is just superficial reason that EXPLORER.EXE is given by a kernel routine?

I even tried turning loader snaps on in WinDbg and tried to load the file in WinDbg, which also failed claiming it was not a valid Win32 app. OllyDbg fails, X32Dbg also fails. However, IDA Pro is able to parse the file just fine, and when I navigate to it's AddressOfEntryPoint, there appears to be valid code. I would attach this particular subject here but the file is malware so I don't know if that's appropriate. However, the question really is general, as the file won't load at all. I'll attach a couple of shots of its headers:

enter image description here enter image description here enter image description here

The file also has a MZ header in the first bytes, a proper link to a PE signature as well in e_lfanew. It seems that there must be some problem in the handoff between Explorer.exe, the caller of the load, before the loader actually initiates. This is the area where I am foggy as I know nothing about that step of the process concerning what happens before the image loader is initiated.

  • 2
    The initial parsing of the headers happens in the kernel so you may have to use a kernel debugger to track it down. BTW try running it on XP, it was much more forgiving than later Windows versions. – Igor Skochinsky Jul 5 '17 at 12:48
  • DId you strip the manifest? – dyasta Jul 11 '17 at 19:49
  • @IgorSkochinsky do you know how I could set up WinDbg to break when I try to launch the program so that I could examine the memory? Im not sure how to break on program load but I assume that's what I'd have to do – the_endian Jul 14 '17 at 9:19
  • there are lots of reasons why it can happen, but the most common reason is that the file has been truncated. Do you have any environment in which the file loads successfully? – peter ferrie Jul 14 '17 at 20:16
  • @peterferrie no sir. I'm going to attempt to step thru the loading process in WinDbg kernel mode later. I suspect it will take a while as I become familiar with what to expect from the kernel functions. But perhaps I'll see the actual crash which should indicate what's going on. I've tried this thing in Xp, 7, and 10. It appears to be a newer file so I don't suspect it to be win 95 only for example. So the OS will check for proper length of sections and determine truncation? – the_endian Jul 14 '17 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.