QL-Win/QuickLook · error · PEImageParseException

Optional header magic value of '0x{magic:x4}' unknown.

Error message

Optional header magic value of '0x{magic:x4}' unknown.

What it means

The optional header magic must be one of exactly three values: 0x10b (PE32), 0x20b (PE32+), or 0x107 (ROM). If the 2-byte magic matches none of these, the parser cannot determine the optional header layout and rejects the image. The error message includes the actual magic value in hex (e.g. "0x1234") to aid debugging. The exception Offset points to the start of the 2-byte magic.

Source

Thrown at QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs:194

                SizeOfHeaders = reader.ReadUInt32(),
                Checksum = reader.ReadUInt32(),
                Subsystem = (ImageSubsystem)reader.ReadUInt16(),
                DllCharacteristics = (ImageDllCharacteristics)reader.ReadUInt16(),
                SizeOfStackReserve = reader.ReadUInt64(),
                SizeOfStackCommit = reader.ReadUInt64(),
                SizeOfHeapReserve = reader.ReadUInt64(),
                SizeOfHeapCommit = reader.ReadUInt64(),
                LoaderFlags = reader.ReadUInt32(),
                NumberOfRvaAndSizes = reader.ReadUInt32()
            };
        }
        else if (magic == 0x107)
        {
            throw new PEImageParseException((int)reader.BaseStream.Position - 2, "Optional header for ROM's is not supported.");
        }
        else
        {
            throw new PEImageParseException((int)reader.BaseStream.Position - 2, "Optional header magic value of '0x" + magic.ToString("x4") + "' unknown.");
        }

        // Data Directories
        if (reader.BaseStream.Length - reader.BaseStream.Position < OptionalHeader.NumberOfRvaAndSizes * 8) throw new PEImageParseException((int)reader.BaseStream.Position, "Data directories incomplete.");

        OptionalHeader.DataDirectories = Create.Array((int)OptionalHeader.NumberOfRvaAndSizes, i => new ImageDataDirectory((ImageDataDirectoryName)i, reader.ReadUInt32(), reader.ReadUInt32()));

        // Section Headers
        if (reader.BaseStream.Length - reader.BaseStream.Position < CoffHeader.NumberOfSections * 40) throw new PEImageParseException((int)reader.BaseStream.Position, "Section headers incomplete.");

        Sections = Create
            .Enumerable(CoffHeader.NumberOfSections, i => new ImageSectionHeader
            {
                Name = reader.ReadBytes(8).TakeWhile(c => c != 0).ToArray().ToUTF8String(),
                VirtualSize = reader.ReadUInt32(),
                VirtualAddress = reader.ReadUInt32(),
                SizeOfRawData = reader.ReadUInt32(),
                PointerToRawData = reader.ReadUInt32(),

View on GitHub (pinned to cb5d9c429c)

Solutions

1. Validate the file with dumpbin /headers or a PE viewer to confirm it is a well-formed PE image
2. Re-download the file from its source and verify its cryptographic hash
3. If processing untrusted or user-selected files, catch PEImageParseException and skip the file rather than crashing
4. Inspect the actual magic value reported in the exception message — if it is clearly garbage, the file is corrupt

// Validate optional header magic is one of the three known values
static bool IsValidOptionalHeaderMagic(string path)
{
    byte[] b = File.ReadAllBytes(path);
    if (b.Length < 0x40) return false;
    int peOff = BitConverter.ToInt32(b, 0x3C);
    int magicOff = peOff + 4 + 20;
    if (magicOff + 2 > b.Length) return false;
    ushort magic = BitConverter.ToUInt16(b, magicOff);
    return magic == 0x10b || magic == 0x20b || magic == 0x107;
}

try
{
    var image = PEImage.FromFile(path);
}
catch (PEImageParseException ex) when (ex.Message.Contains("unknown"))
{
    // Magic value is garbage — file is corrupted at the optional header
    logger.Warn($"Unknown optional header magic: {ex.Message}");
}

When it happens

Trigger: The 2 bytes at the optional header offset are not 0x10b, 0x20b, or 0x107. This typically means file corruption at the optional header offset, or a non-PE file that coincidentally had a valid "PE\0\0" signature at e_lfanew but is not a real PE image.

Common situations: Byte-level corruption of the optional header region (the magic field was overwritten with garbage); a file that is not a PE image but whose bytes happen to align to produce a valid PE signature; a file parsed at the wrong offset due to a corrupted e_lfanew pointer.

Related errors

• COFF header not found.
• Data directories incomplete.
• Section headers incomplete.
• COFF header incomplete.
• Optional header not found.

AI-assisted analysis of QL-Win/QuickLook@cb5d9c429c (2026-08-13). Data as JSON: /api/errors/0b26293cd2df954b. Report an issue: GitHub.