Windows 10: Analyze why EXE file (that I created myself) wont load (sys error 193)

(similar post on Software and Apps forum)
I have written my own program that creates a .EXE file by modifying another .EXE file. The output file will not run. Intel's SDE program tells me it gets a system error 193.
If the tool changes nothing, but just writes back everything it finds in the input, then the output runs fine, and in fact the binary files are identical.
I have the tool making just a few changes. It lengthens the file size and virtual size of section # 4 (.data) by 1000x, and adds 1000x to the RVA of section # 5 (.rdata). It also adjusts the Relocations Data Directory pointer and the SizeOfImage in the image header. Otherwise the two files are identical.
But the output file doesn't load.
I also tried setting the output Checksum and SizeOfCode fields to 0 without changing anything else, and it runs successfully. So these fields are apparently not the cause of the problem.

DO YOU KNOW a way or a tool to tell me what's wrong with my output .EXE??

If you would like to analyze the files yourself, please tell me how to package the .EXEs as an attachment for you.

Thanks.

:)

 

blue screen error

*******************************************************************************

*
*

* Bugcheck Analysis
*

*
*

*******************************************************************************



Use !analyze -v to get detailed debugging information.



BugCheck D1, {108, 2, 0, fffff805cdc8d5a2}



Unable to load image \SystemRoot\System32\drivers\Netwbw02.sys, Win32 error 0n2

*** WARNING: Unable to verify timestamp for Netwbw02.sys

*** ERROR: Module load completed but symbols could not be loaded for Netwbw02.sys



Update the Intel 3160 WiFi Driver to version 18.40.0.9:

http://downloads.dell.com/FOLDER03711806M/7/Network_Driver_MVH6C_WN32_18.40.0.9_A06_04.EXE



Update the Intel Management Engine Interface Driver to version 9.5.22.1760:

http://downloads.dell.com/FOLDER01975220M/1/Chipset_Driver_9M49M_WN_9.5.22.1760_A00.EXE



This file will automatically self-install after downloading. Restart required.



Update the Intel HD Graphics Family Driver to version 20.19.15.4463:

http://downloads.dell.com/FOLDER03821732M/1/Video_Driver_0WPX0_WN32_20.19.15.4463_A03.EXE



Update the Dell Airplane Mode Switch Driver to version 1.4.1.0:

http://downloads.dell.com/FOLDER01691863M/1/Network_Driver_90M6T_WN_1.4.1_A00.EXE

 

Random Crashes / BSODs during boot (and during boot ONLY) - MiniDump files included

The minidump files showed that for both of the errors the process that crashed was the SCEWIN_64.exe.

The SCEWIN_64.exe appears to be a component of MSI Control Center.

The 0x00000019 error appears to be caused by the amifldrv64.sys which appears to be a component of a MSI Bios update utility:

BugCheck 19, {22, ffffd00024424000, 0, 0}

*** WARNING: Unable to verify timestamp for amifldrv64.sys

*** ERROR: Module load completed but symbols could not be loaded for amifldrv64.sys

Probably caused by : amifldrv64.sys ( amifldrv64+1a04 )

PROCESS_NAME: SCEWIN_64.exe

Try uninstalling, at least temporarily, the MSI software.

 

I know why the EXE failed to load now. However, I want to leave this thread open because (1) it may be of interest to some later linker developer, and (2) I hope somebody will point to where the violated requirement is documented.

I found out that the problem was that I had the first section starting at RVA = 2000x, rather than the usual 1000x produced by the microsoft and gnu linkers.

There was another problem I discovered. As documented in the PE spec, sections have to be consecutive and adjacent. The pages occupied by a section go up to the page containing the last byte, as given by the size in memory of the section header. I tried placing a 1000x gap between two of the sections, and it failed to load. Instead, if I made the first of these sections 1000x longer, then it worked fine.

The difference between making the first section 1000x longer, and starting the first section 1000x later, was that the latter case failed to load. In both cases I correctly adjusted the entry point address, the image size, and the relocations directory.

So please, if you know where it is documented that the first section starts at 1000x, or better, a complete specification of what an EXE file requires in order to be loadable, ... then please post it here, and also on my thread in the Software and Apps forum.

 

I found an article on Stack Overflow: assembly - VA (Virtual Adress) RVA (Relative Virtual Address) - Stack Overflow that touches on this question. It indicates that the loader reserves the first image page for the PE header to be loaded in, treating this as a hidden one-page section. I don't know if this is "official" or not.