6

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:

The application was unable to start correctly (0xc000007b)

But if I jmp from the code section to 0x00400040 then it works.

Why did I get error with that strange address (0xc000007b) ? Is it possible to start the execution of program from code which is located outside sections?

I use Windows 8.

Improve this question
3
  • If you set 0x00000040 where? – Gilles 'SO- stop being evil' Aug 25 '13 at 12:42
  • 1
    0x40 as Address of EP in optional header (0x110 offset) – edhoklorf Aug 25 '13 at 13:07
  • The error is defined in ntstatus.h of the WDK. The error code has existed for a long time and is known under its symbolic name as STATUS_INVALID_IMAGE_FORMAT. – 0xC0000022L♦ Aug 26 '13 at 18:44
11

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders.

Set SizeOfHeaders to AddressOfEntryPoint to make it work.

The error you get is defined in ntstatus.h as follows:

//
// MessageId: STATUS_INVALID_IMAGE_FORMAT
//
// MessageText:
//
// {Bad Image}
// %hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0x%08lx.
//
#define STATUS_INVALID_IMAGE_FORMAT      ((NTSTATUS)0xC000007BL)
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.