{"record":{"id":"0b26293cd2df954b","repo":"QL-Win/QuickLook","slug":"optional-header-magic-value-of-0x-magic-x4-unkn","errorCode":null,"errorMessage":"Optional header magic value of '0x{magic:x4}' unknown.","messagePattern":"Optional header magic value of '0x(.+?)' unknown\\.","errorType":"exception","errorClass":"PEImageParseException","httpStatus":null,"severity":"error","filePath":"QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs","lineNumber":194,"sourceCode":"                SizeOfHeaders = reader.ReadUInt32(),\n                Checksum = reader.ReadUInt32(),\n                Subsystem = (ImageSubsystem)reader.ReadUInt16(),\n                DllCharacteristics = (ImageDllCharacteristics)reader.ReadUInt16(),\n                SizeOfStackReserve = reader.ReadUInt64(),\n                SizeOfStackCommit = reader.ReadUInt64(),\n                SizeOfHeapReserve = reader.ReadUInt64(),\n                SizeOfHeapCommit = reader.ReadUInt64(),\n                LoaderFlags = reader.ReadUInt32(),\n                NumberOfRvaAndSizes = reader.ReadUInt32()\n            };\n        }\n        else if (magic == 0x107)\n        {\n            throw new PEImageParseException((int)reader.BaseStream.Position - 2, \"Optional header for ROM's is not supported.\");\n        }\n        else\n        {\n            throw new PEImageParseException((int)reader.BaseStream.Position - 2, \"Optional header magic value of '0x\" + magic.ToString(\"x4\") + \"' unknown.\");\n        }\n\n        // Data Directories\n        if (reader.BaseStream.Length - reader.BaseStream.Position < OptionalHeader.NumberOfRvaAndSizes * 8) throw new PEImageParseException((int)reader.BaseStream.Position, \"Data directories incomplete.\");\n\n        OptionalHeader.DataDirectories = Create.Array((int)OptionalHeader.NumberOfRvaAndSizes, i => new ImageDataDirectory((ImageDataDirectoryName)i, reader.ReadUInt32(), reader.ReadUInt32()));\n\n        // Section Headers\n        if (reader.BaseStream.Length - reader.BaseStream.Position < CoffHeader.NumberOfSections * 40) throw new PEImageParseException((int)reader.BaseStream.Position, \"Section headers incomplete.\");\n\n        Sections = Create\n            .Enumerable(CoffHeader.NumberOfSections, i => new ImageSectionHeader\n            {\n                Name = reader.ReadBytes(8).TakeWhile(c => c != 0).ToArray().ToUTF8String(),\n                VirtualSize = reader.ReadUInt32(),\n                VirtualAddress = reader.ReadUInt32(),\n                SizeOfRawData = reader.ReadUInt32(),\n                PointerToRawData = reader.ReadUInt32(),","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/QL-Win/QuickLook/blob/cb5d9c429c81d9796fac469da2a68efb5626946d/QuickLook.Plugin/QuickLook.Plugin.PEViewer/PEImageParser/PEImage.cs#L176-L212","documentation":"The optional header magic must be one of exactly three values: 0x10b (PE32), 0x20b (PE32+), or 0x107 (ROM). If the 2-byte magic matches none of these, the parser cannot determine the optional header layout and rejects the image. The error message includes the actual magic value in hex (e.g. \"0x1234\") to aid debugging. The exception Offset points to the start of the 2-byte magic.","triggerScenarios":"The 2 bytes at the optional header offset are not 0x10b, 0x20b, or 0x107. This typically means file corruption at the optional header offset, or a non-PE file that coincidentally had a valid \"PE\\0\\0\" signature at e_lfanew but is not a real PE image.","commonSituations":"Byte-level corruption of the optional header region (the magic field was overwritten with garbage); a file that is not a PE image but whose bytes happen to align to produce a valid PE signature; a file parsed at the wrong offset due to a corrupted e_lfanew pointer.","solutions":["Validate the file with dumpbin /headers or a PE viewer to confirm it is a well-formed PE image","Re-download the file from its source and verify its cryptographic hash","If processing untrusted or user-selected files, catch PEImageParseException and skip the file rather than crashing","Inspect the actual magic value reported in the exception message — if it is clearly garbage, the file is corrupt"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Validate optional header magic is one of the three known values\nstatic bool IsValidOptionalHeaderMagic(string path)\n{\n    byte[] b = File.ReadAllBytes(path);\n    if (b.Length < 0x40) return false;\n    int peOff = BitConverter.ToInt32(b, 0x3C);\n    int magicOff = peOff + 4 + 20;\n    if (magicOff + 2 > b.Length) return false;\n    ushort magic = BitConverter.ToUInt16(b, magicOff);\n    return magic == 0x10b || magic == 0x20b || magic == 0x107;\n}","typeGuard":null,"tryCatchPattern":"try\n{\n    var image = PEImage.FromFile(path);\n}\ncatch (PEImageParseException ex) when (ex.Message.Contains(\"unknown\"))\n{\n    // Magic value is garbage — file is corrupted at the optional header\n    logger.Warn($\"Unknown optional header magic: {ex.Message}\");\n}","preventionTips":["Validate the optional header magic before full parsing when processing untrusted files","Inspect the magic value reported in the exception message — if it is not a recognized constant, the file is corrupt","Verify file integrity via hash comparison before parsing"],"tags":["pe-format","binary-parsing","corrupted-file"],"backgroundTag":null,"analyzedSha":"cb5d9c429c81d9796fac469da2a68efb5626946d","analyzedAt":"2026-08-13T11:51:01.370Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}