3

I'm doing research on the PE format/Windows Loader and I am unable to locate specifics as to what creates the error "Not a valid Win32 Application" followed by a failure to load.

I've tried changing the Major/Minor LinkerVersion in the PE header as per Corkami's research. I've also tried zeroing out every unnecessary data structure in the header of the PE file. I have a particular file where, for dynamic analysis, it cannot map into memory and Process Monitor shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file. I suppose this is just superficial reason that EXPLORER.EXE is given by a kernel routine?

I even tried turning loader snaps on in WinDbg and tried to load the file in WinDbg, which also failed claiming it was not a valid Win32 app. OllyDbg fails, X32Dbg also fails. However, IDA Pro is able to parse the file just fine, and when I navigate to it's AddressOfEntryPoint, there appears to be valid code. I would attach this particular subject here but the file is malware so I don't know if that's appropriate. However, the question really is general, as the file won't load at all. I'll attach a couple of shots of its headers:

enter image description here enter image description here enter image description here

The file also has a MZ header in the first bytes, a proper link to a PE signature as well in e_lfanew. It seems that there must be some problem in the handoff between Explorer.exe, the caller of the load, before the loader actually initiates. This is the area where I am foggy as I know nothing about that step of the process concerning what happens before the image loader is initiated.

Improve this question
8
  • 2
    The initial parsing of the headers happens in the kernel so you may have to use a kernel debugger to track it down. BTW try running it on XP, it was much more forgiving than later Windows versions.
    – Igor Skochinsky ♦
    Jul 5, 2017 at 12:48
  • 1
    DId you strip the manifest?
    – dyasta
    Jul 11, 2017 at 19:49
  • @IgorSkochinsky do you know how I could set up WinDbg to break when I try to launch the program so that I could examine the memory? Im not sure how to break on program load but I assume that's what I'd have to do
    – the_endian
    Jul 14, 2017 at 9:19
  • there are lots of reasons why it can happen, but the most common reason is that the file has been truncated. Do you have any environment in which the file loads successfully?
    – peter ferrie
    Jul 14, 2017 at 20:16
  • @peterferrie no sir. I'm going to attempt to step thru the loading process in WinDbg kernel mode later. I suspect it will take a while as I become familiar with what to expect from the kernel functions. But perhaps I'll see the actual crash which should indicate what's going on. I've tried this thing in Xp, 7, and 10. It appears to be a newer file so I don't suspect it to be win 95 only for example. So the OS will check for proper length of sections and determine truncation?
    – the_endian
    Jul 14, 2017 at 20:32

1 Answer 1

Reset to default
1

  1. Checked if the EXE and all related DLLs are built for the same platform. (Don't mismatch 32-bit and 64-bit)

  2. Check the target operating system version has not been exceeded as referenced in the Windows PE header. In your case it seems to be targeted at Windows NT 4.0 (4.0)

  3. Check you are not missing any runtimes referenced by the import table with a tool such as depends Commonly this would be missing .NET frameworks or Visual C/C++ runtimes.

  4. Ensure a valid Windows Subsystem is targeted, in this case WINDOWS_GUI looks OK.

  5. Make sure platform of EXE is supported on your OS i.e. 16-bit won't run on 64-bit Windows, 64-bit won't run on 32-bit Windows.

I would recommend attaching debugger to the process actually calling CreateProcess, as at least some of these errors are triggered from kernelbase!CreateInternalProcessW API, you will see it call RtlSetLastWin32Error(193) when this error occurs.

This particular error seems to be a generic fall back error for any problem during the process creation when there is not a more specific error code.

Similar error messages during error process creation include:

  • The %1 application cannot be run in Win32 mode. (error code 129)
  • Cannot run %1 in Win32 mode. (Invalid EXE signature, error code 191)
  • The operating system cannot run %1. (Invalid module type error code 190, EXE marked invalid error code 192, iterated data exceeds 64K error 194, invalid minalloc size error code 195, invalid segment error 198)
  • The operating system cannot run this application program. (error code 196)
  • The operating system is not presently configured to run this application (error code 197)
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.