Back to Top

Monday, December 11, 2006

"not a valid win32 application"

An interesting difference between the loader of Win9x and WinNT line (tested with Win98 and Win2K SP4): if SizeOfImage is bigger than the sum of the header sizes and section sizes, Win98 will happily load it, while Win2K will complain that it's not a valid Win32 application. The tricky part about this is that you usually get this error with corrupted files or with DLLs (if you try to execute them), but these files show no signs of damage neither with dumpbin.exe nor with IDA.

0 comments:

Post a Comment

You can use some HTML tags, such as <b>, <i>, <a>. Comments are moderated, so there will be a delay until the comment appears. However if you comment, I follow.