I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.
I've tried changing the Major/Minor LinkerVersion in the PE header as per Corkami's research. I've also tried zeroing out every unnecessary data structure in the header of the PE file. I have a particular file where, for dynamic analysis, it cannot map into memory and Process Monitor shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file. I suppose this is just superficial reason that EXPLORER.EXE is given by a kernel routine?
I even tried turning loader snaps on in WinDbg and tried to load the file in WinDbg, which also failed claiming it was not a valid Win32 app. OllyDbg fails, X32Dbg also fails. However, IDA Pro is able to parse the file just fine, and when I navigate to it's AddressOfEntryPoint, there appears to be valid code. I would attach this particular subject here but the file is malware so I don't know if that's appropriate. However, the question really is general, as the file won't load at all. I'll attach a couple of shots of its headers:
The file also has a MZ header in the first bytes, a proper link to a PE signature as well in e_lfanew. It seems that there must be some problem in the handoff between Explorer.exe, the caller of the load, before the loader actually initiates. This is the area where I am foggy as I know nothing about that step of the process concerning what happens before the image loader is initiated.