"Bad PE Header" exception thrown on valid executable image

[jggrant]

I have tried using PerfView to profile a rather large executable (I unfortunately cannot share), and I am encountering this exception found in the logs when trying to load its symbols:

An exception occurred during symbol lookup.  Continuing...
Exception: System.InvalidOperationException: Bad PE Header.
   at PEFile.PEHeader..ctor(Void* startOfPEFile)
   at PEFile.PEFile..ctor(String filePath)
   at Microsoft.Diagnostics.Tracing.Etlx.TraceCodeAddresses.TraceModuleUnchanged(TraceModuleFile moduleFile, TextWriter log, String overrideModuleFilePath)
   at Microsoft.Diagnostics.Tracing.Etlx.TraceCodeAddresses.OpenPdbForModuleFile(SymbolReader symReader, TraceModuleFile moduleFile)
   at Microsoft.Diagnostics.Tracing.Etlx.TraceCodeAddresses.LookupSymbolsForModule(SymbolReader reader, TraceModuleFile moduleFile, IEnumerator`1 codeAddressIndexCursor, Boolean enumerateAll, Int32& totalAddressCount)
   at Microsoft.Diagnostics.Tracing.Etlx.TraceCodeAddresses.LookupSymbolsForModule(SymbolReader reader, TraceModuleFile file)

After investigation, it is triggered by this check in the PEFile constructor:

if (!(sizeof(IMAGE_DOS_HEADER) <= imageHeaderOffset && imageHeaderOffset <= 512))

I see imageHeaderOffset is 560 in my executable. It seems bumping the threshold might be a way to fix it, at least locally increasing it to 1024 did the trick.

Thanks!

[brianrob]

Thanks for reporting this @jggrant. It does look like some of these checks are overly restrictive. I'm going to take a bit of time and see if I can't clean this code up a bit at the same time as I try to relax these checks.

[brianrob]

@jggrant once I have a candidate fix, is this something that you're able to help test? It would involve building the test branch of PerfView and then running that with your repro.

[jggrant]

@brianrob Sure, just let me know when it is available. Thanks!

[brianrob]

@jggrant, please try the change in #2317 and see if that works for you? Thanks.

[jggrant]

@brianrob I have tried the branch and it does not work. It fails at this line:

if (span.Length < m_sectionsOffset + sizeof(IMAGE_SECTION_HEADER) * ntHdr.FileHeader.NumberOfSections)

span.Length is 1024 while the right-hand side is 1144 (m_ntHeaderOffset=560, ntHdr.FileHeader.SizeOfOptionalHeader=240, ntHdr.FileHeader.NumberOfSections=8). The span read probably needs to be bigger.

[brianrob]

Thanks @jggrant. I've pushed some additional changes. Please try this one again.