Want to diagnose cause of system error 193.


  1. Posts : 48
    windows 10 home
       #1

    Want to diagnose cause of system error 193.


    Is there a tool that can tell me exactly why a particular .exe gets system error 193?

    In my case, I have written a program that modifies an existing .exe and writes the modified file back out.

    Right now, my program does nothing more than add 1000x to every section RVA and then adjust items in the header -- start of code, and entry point -- and clear the checksum. The tool also adjusts most items in the data directories; however, my input .exe has no data directories.

    I have attached output from 'objdump -x' on the input and output files, in case you can spot something I failed to adjust.

    Does Windows 10 validate the checksum on all executables now? Microsoft's PE format doc says
    The following are checked for validation at load time: all drivers, any DLL loaded at boot time, and any DLL that is loaded into a critical Windows process.

    Want to diagnose cause of system error 193. Attached Files
      My Computer


  2. Posts : 48
    windows 10 home
    Thread Starter
       #2

    It's not the checksum, because I made another output file which is identical to the input file except for clearing the checksum, and it still runs OK.
      My Computer


  3. Posts : 48
    windows 10 home
    Thread Starter
       #3

    Found cause, but still would like to know if it's documented anywhere!


    There are two requirements on the pages occupied by the sections in the EXE file.
    1. The sets of pages have to be consecutive and adjacent. This is explained in Microsoft's PE format spec.
    2. The first section must begin at RVA = 1000x. This is *NOT* explained in that document.

    If you know of a complete list of what is required for an EXE to load, please post it here. Also I posted a similar thread in the General Support forum, and you can post your answer there too.
      My Computer


  4. Posts : 48
    windows 10 home
    Thread Starter
       #4

    I found an article on Stack Overflow: assembly - VA (Virtual Adress) RVA (Relative Virtual Address) - Stack Overflow that touches on this question. It indicates that the loader reserves the first image page for the PE header to be loaded in, treating this as a hidden one-page section. I don't know if this is "official" or not.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 05:49.
Find Us




Windows 10 Forums