| Previous | Next |
| STATUS_COMMITMENT_LIMIT | STATUS_INVALID_IMAGE_NOT_MZ |
STATUS_INVALID_IMAGE_LE_FORMAT
The loader found LE-format structures instead of a supported PE image
The Linear Executable format was used by historical 16-bit and OS/2-era software. A DOS MZ header can point to several later executable formats, so the initial MZ signature alone is not enough to classify a file as Windows PE. This status means the follow-on signature identifies an LE image where the caller requires PE semantics.
Changing the extension to EXE or DLL cannot convert the format. Running the program requires an environment that supports its original executable model, a compatible virtual machine, or a rebuilt modern binary. PE inspection tools should report the format rather than treating every MZ-based file as damaged.
What to inspect
- Read e_lfanew and inspect the signature at that offset without assuming it is PE\0\0.
- Preserve the original file and determine its target operating system and processor before choosing a compatibility environment.
- Check whether an installer accidentally selected an obsolete component or unpacked the wrong architecture package.
- Do not patch the signature bytes; headers, relocation records, entry conventions, and imports use different formats.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: PE and COFF format
- LLVM: llvm-readobj COFF inspection
- Wine source: PE module loader
Looking for a different code? Search another status or error code.