Windows 10: Analyze why EXE file (that I created myself) wont load (sys error 193)
Analyze why EXE file (that I created myself) wont load (sys error 193)
(similar post on Software and Apps forum)
I have written my own program that creates a .EXE file by modifying another .EXE file. The output file will not run. Intel's SDE program tells me it gets a system error 193.
If the tool changes nothing, but just writes back everything it finds in the input, then the output runs fine, and in fact the binary files are identical.
I have the tool making just a few changes. It lengthens the file size and virtual size of section # 4 (.data) by 1000x, and adds 1000x to the RVA of section # 5 (.rdata). It also adjusts the Relocations Data Directory pointer and the SizeOfImage in the image header. Otherwise the two files are identical.
But the output file doesn't load.
I also tried setting the output Checksum and SizeOfCode fields to 0 without changing anything else, and it runs successfully. So these fields are apparently not the cause of the problem.
DO YOU KNOW a way or a tool to tell me what's wrong with my output .EXE??
If you would like to analyze the files yourself, please tell me how to package the .EXEs as an attachment for you.
I know why the EXE failed to load now. However, I want to leave this thread open because (1) it may be of interest to some later linker developer, and (2) I hope somebody will point to where the violated requirement is documented.
I found out that the problem was that I had the first section starting at RVA = 2000x, rather than the usual 1000x produced by the microsoft and gnu linkers.
There was another problem I discovered. As documented in the PE spec, sections have to be consecutive and adjacent. The pages occupied by a section go up to the page containing the last byte, as given by the size in memory of the section header. I tried placing a 1000x gap between two of the sections, and it failed to load. Instead, if I made the first of these sections 1000x longer, then it worked fine.
The difference between making the first section 1000x longer, and starting the first section 1000x later, was that the latter case failed to load. In both cases I correctly adjusted the entry point address, the image size, and the relocations directory.
So please, if you know where it is documented that the first section starts at 1000x, or better, a complete specification of what an EXE file requires in order to be loadable, ... then please post it here, and also on my thread in the Software and Apps forum.
I found an article on Stack Overflow: assembly - VA (Virtual Adress) RVA (Relative Virtual Address) - Stack Overflow that touches on this question. It indicates that the loader reserves the first image page for the PE header to be loaded in, treating this as a hidden one-page section. I don't know if this is "official" or not.
The issue happens on multiple platforms - PC and LapTops running Win10. Issues are with Samsung Portable SSD MU-PS250 (direct USB3 output) - I have tried several of these Drives and all wont work! and SanDisk Exterme Pro SATA in a 2.5" SATAIII ...
I built a pc last week and I get the BSOD after a few minutes of playing any game I try. I only have the last dump file I got because the BSOD before the last wouldn't let me start my pc in safe mode or restore to a previous date so I had to...
Somehow unintentionally I created a dynamic disk partition on what was my boot drive but is now intended to be my documents and pictures folder drive.
How do I get rid of the first dynamic partition and change it to a normal partition to store...
since i upgraded from 7 to 10 all worked fine to start until i signed in with my MS account which i have changed my security from email to phone. this wont be active till 22/09/15. now it is has if all 10 apps have been disabled but all my apps from...
edge nor ie dont want to load youtube videos in html5 if u disable flash in settings videos dont work what bullshit is that and flash stuttering like crazy .. chrome works fine..i really wanted to go on edge but just flash player is no go for me...