Analyze why EXE file (that I created myself) wont load (sys error 193)  

  1. Posts : 48
    windows 10 home

    Analyze why EXE file (that I created myself) wont load (sys error 193)

    (similar post on Software and Apps forum)
    I have written my own program that creates a .EXE file by modifying another .EXE file. The output file will not run. Intel's SDE program tells me it gets a system error 193.
    If the tool changes nothing, but just writes back everything it finds in the input, then the output runs fine, and in fact the binary files are identical.
    I have the tool making just a few changes. It lengthens the file size and virtual size of section # 4 (.data) by 1000x, and adds 1000x to the RVA of section # 5 (.rdata). It also adjusts the Relocations Data Directory pointer and the SizeOfImage in the image header. Otherwise the two files are identical.
    But the output file doesn't load.
    I also tried setting the output Checksum and SizeOfCode fields to 0 without changing anything else, and it runs successfully. So these fields are apparently not the cause of the problem.

    DO YOU KNOW a way or a tool to tell me what's wrong with my output .EXE??

    If you would like to analyze the files yourself, please tell me how to package the .EXEs as an attachment for you.

      My Computer

  2. Posts : 48
    windows 10 home
    Thread Starter

    I know why the EXE failed to load now. However, I want to leave this thread open because (1) it may be of interest to some later linker developer, and (2) I hope somebody will point to where the violated requirement is documented.

    I found out that the problem was that I had the first section starting at RVA = 2000x, rather than the usual 1000x produced by the microsoft and gnu linkers.

    There was another problem I discovered. As documented in the PE spec, sections have to be consecutive and adjacent. The pages occupied by a section go up to the page containing the last byte, as given by the size in memory of the section header. I tried placing a 1000x gap between two of the sections, and it failed to load. Instead, if I made the first of these sections 1000x longer, then it worked fine.

    The difference between making the first section 1000x longer, and starting the first section 1000x later, was that the latter case failed to load. In both cases I correctly adjusted the entry point address, the image size, and the relocations directory.

    So please, if you know where it is documented that the first section starts at 1000x, or better, a complete specification of what an EXE file requires in order to be loadable, ... then please post it here, and also on my thread in the Software and Apps forum.
      My Computer

  3. Posts : 48
    windows 10 home
    Thread Starter

    I found an article on Stack Overflow: assembly - VA (Virtual Adress) RVA (Relative Virtual Address) - Stack Overflow that touches on this question. It indicates that the loader reserves the first image page for the PE header to be loaded in, treating this as a hidden one-page section. I don't know if this is "official" or not.
      My Computer


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 10:27.
Find Us

Windows 10 Forums