Hey, Can someone help me and figure out why this PE-File doesn't execute? It should execute properly but it just won't work.

If you look at it please don't be scared because the sections are not optimized they have all the same size.

Can someone figure this out? I don't get it.

Thanks.

seems that it has its import section broken:

Hmm is it really broken? the whole functions of user32.dll are imported and Stud-PE doesn't give an error to me it displays all imports correctly. I think there must be another reason why this doesn't work.

Well, I'm not familiar with internal PE structure, but I thought that one dll name can't figure so many times in import section Anyway fileinfo (Total Commander plugin) says that something is wrong with it: "Missing Functions in implict load DLL" (whatever it means).

Yes. That's true. In a normal import section this shouldn't happen that the DLL name appear more than 1 time but.. This should also work.. at least it does with 20+ imports ... Hmm I'll check it.

Ok .. I fixed the imports and now it is correct.. but same problem doesn't execute.. .. I updated the file above to pqp2.zip.. now with gdi32 imports.. It has nothing todo with the imports.. it is another reason because if there are no imports but code section is same size then it also doesn't work..

the size of image field (offset 0xD0 in ur file) is not correct. u must set it to last section alignment+size of that last section (aligned to section alignment).

Yes you are totally correct! Got it now thanks Ancient One!

when u run it u will get exception coz ur code write to code section which don't have the write attribute.

Yes I know I made this exception to see if the PE File is executed.. but it was always a "not valid win32 executable" .. and didn't raise this exception! anyway it works nice now Thank you again!