I have a stubborn PE file which I cannot get to load. The PE headers seem to be intact and the file even parses fine in several PE tools. I am receiving a "Invalid Win32 Application" error when I try to fire it up. In fact, the loader never even starts up because there are no loader flags to be displayed for the process in WinDbg. Something is going wrong between the handoff from Explorer.exe and the load inside the Kernel. ProcMon shows a "FILE LOCKED WITH ONLY READERS" status when Explorer.exe tries to CreateFileMapping the file.
So thus I've entered Kernel Mode debugging on WinDbg. However, I'm not sure how to configure the debugger to properly troubleshoot this problem. When I press "g" and then open the file, it just crashes as normal and I have no log in WinDbg. If I press "Break" then I'm paused. I need to somehow break as soon as I double-click the file and then sep through the kernel code.