Can I set entry point at code in PE headers?

Question

If I set something like 0x00000040 (my code is located at this address), then the program crashes with this error:

The application was unable to start correctly (0xc000007b)

But if I jmp from the code section to 0x00400040 then it works.

Why did I get error with that strange address (0xc000007b) ? Is it possible to start the execution of program from code which is located outside sections?

I use Windows 8.

The error is defined in ntstatus.h of the WDK. The error code has existed for a long time and is known under its symbolic name as STATUS_INVALID_IMAGE_FORMAT. — 0xC0000022L, Aug 26 '13 at 18:44

score 12 · Answer 1 · edited Aug 26 '13 at 18:42

Windows 8 introduces a new restriction: the AddressOfEntryPoint can't be smaller than SizeOfHeaders.

Set SizeOfHeaders to AddressOfEntryPoint to make it work.

The error you get is defined in ntstatus.h as follows:

//
// MessageId: STATUS_INVALID_IMAGE_FORMAT
//
// MessageText:
//
// {Bad Image}
// %hs is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor for support. Error status 0x%08lx.
//
#define STATUS_INVALID_IMAGE_FORMAT      ((NTSTATUS)0xC000007BL)

Can I set entry point at code in PE headers?

1 Answers1