3

I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try to fire it up. In fact, the loader never even starts up because there are no loader flags to be displayed for the process in WinDbg. Something is going wrong between the handoff from Explorer.exe and the load inside the Kernel. ProcMon shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file.

So thus I've entered Kernel Mode debugging on WinDbg. However, I'm not sure how to configure the debugger to properly troubleshoot this problem. When I press "g" and then open the file, it just crashes as normal and I have no log in WinDbg. If I press "Break" then I'm paused. I need to somehow break as soon as I double-click the file and then sep through the kernel code.

Improve this question
1
  • 1
    find the call stack in procmon and set a breakpoint on one of the function possibly a process specific breakpoint to stop breaking too much in hot code paths
    – blabb
    Commented Jul 14, 2017 at 9:41

1 Answer 1

Reset to default
4

I would suggest you to put a breakpoint on NtCreateSection function which is responsible on validating and mapping the PE image when called with SEC_IMAGE flag. Hopefully you can track down where it fails by stepping through it.

Improve this answer
4
  • Are you familiar with KiSystemServiceCopyEnd and KiSystemServiceExit by any chance? I get those but theres absolutely nothing online about them other than in crash dumps and no real info
    – the_endian
    Commented Jul 17, 2017 at 10:19
  • @the_endian I'm not familiar with those, but they don't sound like anything related to image parsing.
    – Igor Skochinsky ♦
    Commented Jul 17, 2017 at 14:20
  • Much thanks for your advice. I've finally gotten this thing narrowed down into MiCreateImageFileMap. It passes MiVerifyImageHeader checks (return 0 from that) but MiCreateImageFileMap does some extra checks of its own, which it fails with return code C000007B which is triggering that Invalid Win32 Application error. Going to keep examining this routine and see if I can pinpoint. These are both implemented static inside of NtCreateSection and then inside MmCreateSection.
    – the_endian
    Commented Jul 18, 2017 at 0:51
  • @the_endian I would suggest comparing the code flow for a good vs. bad binary and see where they diverge.
    – Igor Skochinsky ♦
    Commented Jul 21, 2017 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.