3

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try to fire it up. In fact, the loader never even starts up because there are no loader flags to be displayed for the process in WinDbg. Something is going wrong between the handoff from Explorer.exe and the load inside the Kernel. ProcMon shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file.

So thus I've entered Kernel Mode debugging on WinDbg. However, I'm not sure how to configure the debugger to properly troubleshoot this problem. When I press "g" and then open the file, it just crashes as normal and I have no log in WinDbg. If I press "Break" then I'm paused. I need to somehow break as soon as I double-click the file and then sep through the kernel code.

  • 1
    find the call stack in procmon and set a breakpoint on one of the function possibly a process specific breakpoint to stop breaking too much in hot code paths – blabb Jul 14 '17 at 9:41
4

I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it fails by stepping through it.

  • Are you familiar with KiSystemServiceCopyEnd and KiSystemServiceExit by any chance? I get those but theres absolutely nothing online about them other than in crash dumps and no real info – the_endian Jul 17 '17 at 10:19
  • @the_endian I'm not familiar with those, but they don't sound like anything related to image parsing. – Igor Skochinsky Jul 17 '17 at 14:20
  • Much thanks for your advice. I've finally gotten this thing narrowed down into MiCreateImageFileMap. It passes MiVerifyImageHeader checks (return 0 from that) but MiCreateImageFileMap does some extra checks of its own, which it fails with return code C000007B which is triggering that Invalid Win32 Application error. Going to keep examining this routine and see if I can pinpoint. These are both implemented static inside of NtCreateSection and then inside MmCreateSection. – the_endian Jul 18 '17 at 0:51
  • @the_endian I would suggest comparing the code flow for a good vs. bad binary and see where they diverge. – Igor Skochinsky Jul 21 '17 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.