“not a valid win32 application”

An interesting difference between the loader of Win9x and WinNT line (tested with Win98 and Win2K SP4): if SizeOfImage is bigger than the sum of the header sizes and section sizes, Win98 will happily load it, while Win2K will complain that it’s not a valid Win32 application. The tricky part about this is that you usually get this error with corrupted files or with DLLs (if you try to execute them), but these files show no signs of damage neither with dumpbin.exe nor with IDA.


Leave a Reply

Your email address will not be published. Required fields are marked *