Windows 8 DLL Bad Image error

Index > Windows > Windows 8 DLL Bad Image error

Goto page 1, 2 Next

Author

Thread

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 05:29

The code below works fine on Windows 2000-7, but on Windows 8 (CP 32-bit), application that uses this dll failed to start with message:

"MyDll.dll is either not designed to run on Windows or it contains an error. Try installing the program again using the original installation media or contact your system administrator or the software vendor support. Error status 0xc0000005."

I have no idea what wrong... Please help.

Code:

format PE GUI 4.0 DLL
entry EntryPoint

include 'win32w.inc'


section '.text' code readable executable

proc EntryPoint hinstDLL,fdwReason,lpvReserved

        cmp     [fdwReason],DLL_PROCESS_ATTACH
        jne     .exit

        mov     eax,[hinstDLL]
        mov     [HInstance],eax

        push    eax
        call    [DisableThreadLibraryCalls]

  .exit:
        xor     eax,eax
        inc     eax

        ret
endp

proc Install HostWnd
        ;
        ret
endp

proc Uninstall
        ;
        ret
endp


section '.data' data readable writeable

  HInstance      dd 0


section '.idata' import data readable writeable

  library kernel32,'Kernel32.dll',\
          user32,'User32.dll'

  include 'api\kernel32.inc'
  include 'api\user32.inc'


section '.edata' export data readable

  export 'MyDll.dll',\
         Install,'F1',\
         Uninstall,'F2'


section '.reloc' fixups data discardable

Last edited by TimK on 30 May 2012, 12:04; edited 1 time in total

30 May 2012, 05:29

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20430
Location: In your JS exploiting you and your system

revolution 30 May 2012, 05:32

Maybe:

Code:

format PE GUI 4.0 DLL

Try a higher version number.

30 May 2012, 05:32

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 05:38

revolution wrote:

Try a higher version number.

Code:

format PE GUI 5.0 DLL

Same error...

30 May 2012, 05:38

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20430
Location: In your JS exploiting you and your system

revolution 30 May 2012, 05:47

TimK wrote:

revolution wrote:
Try a higher version number.
Code:
format PE GUI 5.0 DLL    
Same error...

Try a higher version number.

30 May 2012, 05:47

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 05:59

revolution wrote:

Try a higher version number.

Tried 5, 6, 7 Smile

Nothing has changed.

30 May 2012, 05:59

bzdashek

Joined: 15 Feb 2012
Posts: 147
Location: Tolstokvashino, Russia

bzdashek 30 May 2012, 06:02

TimK wrote:

revolution wrote:
Try a higher version number.

Tried 5, 6, 7
Nothing has changed.

If nothing changes, then output an error.

30 May 2012, 06:02

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 06:06

bzdashek wrote:

If nothing changes, then output an error.

Same "Bad Image" error message.

30 May 2012, 06:06

sinsi

Joined: 10 Aug 2007
Posts: 794
Location: Adelaide

sinsi 30 May 2012, 06:23

Have you tried version 8?

30 May 2012, 06:23

bzdashek

Joined: 15 Feb 2012
Posts: 147
Location: Tolstokvashino, Russia

bzdashek 30 May 2012, 08:50

Try this:

Code:

format PE GUI 4.0 DLL 
entry EntryPoint 

include 'win32w.inc' 


section '.text' code readable executable 

proc EntryPoint hinstDLL,fdwReason,lpvReserved 

        cmp     [fdwReason],DLL_PROCESS_ATTACH 
        jne     .exit 

        mov     eax,[hinstDLL] 
        mov     [HInstance],eax 

        push    eax 
        call    [DisableThreadLibraryCalls] 

  .exit: 
        xor     eax,eax 
        inc     eax 

        ret 
endp 

proc Install HostWnd 
        ; 
        ret 
endp 

proc Uninstall 
        ; 
        ret 
endp 


section '.data' data readable writeable 

  HInstance      dd 0 


section '.idata' import data readable

  library kernel32,'Kernel32.dll',\ 
          user32,'User32.dll' 

  include 'api\kernel32.inc' 
  include 'api\user32.inc' 


section '.edata' export data readable 

  export 'MyDll.dll',\ 
         Install,'F1',\ 
         Uninstall,'F2' 


section '.reloc' fixups data discardable

30 May 2012, 08:50

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 09:46

bzdashek wrote:

Try this

Dont helps. Same error message text, but error code is 0xc0000020 (was 0xc0000005).

30 May 2012, 09:46

bzdashek

Joined: 15 Feb 2012
Posts: 147
Location: Tolstokvashino, Russia

bzdashek 30 May 2012, 11:56

Did you try to run DLL example from FASM? Does it work?

fasm\EXAMPLES\DLL

30 May 2012, 11:56

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 12:02

bzdashek wrote:

Did you try to run DLL example from FASM? Does it work?
fasm\EXAMPLES\DLL

It does not work. Same "Bad Image" error.

30 May 2012, 12:02

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 12:07

bzdashek wrote:

Did you try to run DLL example from FASM? Does it work?
fasm\EXAMPLES\DLL

It does not work. Same "Bad Image" error.

Description:
Filesize:	12.09 KB
Viewed:	18393 Time(s)

30 May 2012, 12:07

typedef

Joined: 25 Jul 2010
Posts: 2909
Location: 0x77760000

typedef 30 May 2012, 15:33

It seems like Win8 changed maybe? Maybe it requires something else that's missing or some PE field that is not ignored anymore(if there was any that was ignored in previous versions of Windows).

30 May 2012, 15:33

r22

Joined: 27 Dec 2004
Posts: 805

r22 30 May 2012, 16:10

On win7 64 bit I've run into Bad Image error if you don't have a BSS section or if your data section isn't aligned (or is too small).

Try this, if it doesn't work try adding the reloc section to the bottom as well from one of the above posts.

Code:

format PE GUI 4.0 DLL 
entry EntryPoint 

include 'win32w.inc' 


section '.text' code readable executable 

proc EntryPoint hinstDLL,fdwReason,lpvReserved 

        cmp     [fdwReason],DLL_PROCESS_ATTACH 
        jne     .exit 

        mov     eax,[hinstDLL] 
        mov     [HInstance],eax 

        push    eax 
        call    [DisableThreadLibraryCalls] 

  .exit: 
        xor     eax,eax 
        inc     eax 

        ret 
endp 

proc Install HostWnd 
        ; 
        ret 
endp 

proc Uninstall 
        ; 
        ret 
endp 


section '.data' data readable writeable 
align 16
HInstance      dd 0 

section '.bss' data readable writable
align 16
dd 0

section '.idata' import data readable

  library kernel32,'Kernel32.dll',\ 
          user32,'User32.dll' 

  include 'api\kernel32.inc' 
  include 'api\user32.inc' 


section '.edata' export data readable 

  export 'MyDll.dll',\ 
         Install,'F1',\ 
         Uninstall,'F2'

30 May 2012, 16:10

TimK

Joined: 14 Feb 2010
Posts: 20

TimK 30 May 2012, 16:38

r22 wrote:

On win7 64 bit I've run into Bad Image error if you don't have a BSS section or if your data section isn't aligned (or is too small).

Dont work... One difference: with align/bss, without .reloc section error code is 0xc0000020, with relocations 0xc0000005.

30 May 2012, 16:38

LostCoder

Joined: 07 Mar 2012
Posts: 22

LostCoder 31 May 2012, 19:05

I recently encountered a similar problem, though it was under Windows 7 x64 and it was EXE, not DLL. The problem resolved itself when the size of the EXE has increased, namely, the size of the sections .code and .data. Don't know why.

31 May 2012, 19:05

bzdashek

Joined: 15 Feb 2012
Posts: 147
Location: Tolstokvashino, Russia

bzdashek 01 Jun 2012, 09:38

Maybe Tomasz will say something, if he notices this thread?

01 Jun 2012, 09:38

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8357
Location: Kraków, Poland

Tomasz Grysztar 01 Jun 2012, 14:05

I have just tested it and it appears that Windows 8 doesn't like .reloc section to not have "readable" attribute. So the correction should be to replace the last line with:

Code:

section '.reloc' fixups data readable discardable

I will update the official example with this fix soon.

01 Jun 2012, 14:05

bzdashek

Joined: 15 Feb 2012
Posts: 147
Location: Tolstokvashino, Russia

bzdashek 01 Jun 2012, 20:07

Thanks for the explanation, Tomasz

Just look at it - since 95 it didn't care, and now here it is!

01 Jun 2012, 20:07

Goto page 1, 2 Next

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum