| Previous | Next |
| STATUS_INVALID_LDT_DESCRIPTOR | STATUS_RXACT_INVALID_STATE |
STATUS_INVALID_IMAGE_NE_FORMAT
Meaning and context of STATUS_INVALID_IMAGE_NE_FORMAT
This result (0xC000011B) error is returned if the system cannot find the correct PE header following the NE header and MSDOS header is correct.
The Portable Executable (PE) format is a file format for executables, object code, DLLs and others used in 32-bit and 64-bit versions of Windows operating systems. The PE format is a data structure that encapsulates the information necessary for the Windows OS loader to manage the wrapped executable code. This includes dynamic library references for linking, API export and import tables, resource management data and thread-local storage (TLS) data. On NT operating systems, the PE format is used for EXE, DLL, SYS (device driver), MUI and other file types. The Unified Extensible Firmware Interface (UEFI) specification states that PE is the standard executable format in EFI environments.
Microsoft migrated to the PE format from the 16-bit NE formats with the introduction of the Windows NT 3.1 operating system. All later versions of Windows, including Windows 95/98/ME and the Win32s addition to Windows 3.1x, support the file structure. The format has retained limited legacy support to bridge the gap between DOS-based and NT systems. For example, PE/COFF headers still include a DOS executable program, which is by default a DOS stub that displays a message like “This program cannot be run in DOS mode” (or similar), though it can be a full-fledged DOS version of the program (a later notable case being the Windows 98 SE installer). If NE header is not correct (for example this is a text or image file), this result will not be returned. This constitutes a form of fat binary. PE also continues to serve the changing Windows platform. Some extensions include the.NET PE format, a 64-bit version called PE32+ (sometimes PE+), and a specification for Windows CE.
The PE file format is organized as a linear stream of data. It begins with an MS-DOS header, a real-mode program stub, and a PE file signature. Immediately following is a PE file header and optional header. Beyond that, all the section headers appear, followed by all of the section bodies. Closing out the file are a few other regions of miscellaneous information, including relocation information, symbol table information, line number information, and string table data.
In most cases the reason of This result in that binary file is corrupted or taken from old OS.
Native status interpretation
STATUS_INVALID_IMAGE_NE_FORMAT is 0xC000011B, an NTSTATUS error value. AllStat describes it as “The specified image file did not have the correct format. It appears to be NE format.”. The first useful question is which native API, IRP, protocol operation, or subsystem in the Windows image loader and executable-format validation produced that status.
Debugging sequence
- Preserve this result before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
- Log the operation associated with image / ne / format, the object or handle type, process and thread identity, and the state transition immediately before the return.
- When user mode receives it, capture both the native status and the final Win32/COM error so the translation boundary remains visible.
Recovery considerations
A retry is appropriate only after the owner of it has changed the state described by “The specified image file did not have the correct format. It appears to be NE format.”, or when its contract explicitly marks the status as transient. If the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.
Official references
Looking for a different code? Search another status or error code.