| Previous | Next |
| STATUS_INVALID_IMAGE_NOT_MZ | STATUS_INVALID_IMAGE_WIN_16 |
STATUS_INVALID_IMAGE_PROTECT
The MZ header relocation field is inconsistent with the executable layout
The IMAGE_DOS_HEADER includes e_lfarlc, the offset of the DOS relocation table. For PE images, legacy header fields still have structural constraints even though the Windows loader ultimately follows e_lfanew to the NT headers. This status reports an invalid e_lfarlc relationship that makes the image header unacceptable.
Such a value can result from truncation, a broken packer, incorrect binary generation, or deliberate fuzzing. It should not be repaired by copying one header field from another executable because offsets are tied to the exact DOS stub and file layout.
What to inspect
- Dump the complete IMAGE_DOS_HEADER and verify e_cparhdr, e_crlc, e_lfarlc, and e_lfanew against file boundaries.
- Compare the image with the build artifact before signing, packing, or installer transformation.
- Check whether a security product or updater rewrote the file while another component attempted to load it.
- Use a bounds-checking PE parser to find overlapping or out-of-range header regions.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- LLVM source: COFF object parsing
- Wine source: PE module loader
Looking for a different code? Search another status or error code.