8

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:

The application was unable to start correctly (0xc000007b)

But if I jmp from the code section to 0x00400040 then it works.

Why did I get error with that strange address (0xc000007b) ? Is it possible to start the execution of program from code which is located outside sections?

I use Windows 8.

3
  • If you set 0x00000040 where? Commented Aug 25, 2013 at 12:42
  • 1
    0x40 as Address of EP in optional header (0x110 offset)
    – edhoklorf
    Commented Aug 25, 2013 at 13:07
  • The error is defined in ntstatus.h of the WDK. The error code has existed for a long time and is known under its symbolic name as STATUS_INVALID_IMAGE_FORMAT.
    – 0xC0000022L
    Commented Aug 26, 2013 at 18:44

1 Answer 1

12

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders.

Set SizeOfHeaders to AddressOfEntryPoint to make it work.

The error you get is defined in ntstatus.h as follows:

//
// MessageId: STATUS_INVALID_IMAGE_FORMAT
//
// MessageText:
//
// {Bad Image}
// %hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0x%08lx.
//
#define STATUS_INVALID_IMAGE_FORMAT      ((NTSTATUS)0xC000007BL)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.