{"record":{"id":"d5be941d42fbf5d2","repo":"t8y2/dbx","slug":"unsupported-pe-optional-header-magic-0x-optional","errorCode":null,"errorMessage":"unsupported PE optional header magic: 0x{optional_magic:04x}","messagePattern":"unsupported PE optional header magic: 0x(.+?)","errorType":"exception","errorClass":"PeFormatError","httpStatus":null,"severity":"error","filePath":"agents/scripts/validate_windows_pe_dependencies.py","lineNumber":54,"sourceCode":"def imported_dlls(path: Path) -> list[str]:\n    data = path.read_bytes()\n    if len(data) < 64 or data[:2] != b\"MZ\":\n        raise PeFormatError(\"missing DOS header\")\n\n    pe_offset = _read_u32(data, 0x3C)\n    if data[pe_offset : pe_offset + 4] != b\"PE\\0\\0\":\n        raise PeFormatError(\"missing PE signature\")\n\n    section_count = _read_u16(data, pe_offset + 6)\n    optional_header_size = _read_u16(data, pe_offset + 20)\n    optional_header_offset = pe_offset + 24\n    optional_magic = _read_u16(data, optional_header_offset)\n    if optional_magic == 0x20B:\n        data_directories_offset = optional_header_offset + 112\n    elif optional_magic == 0x10B:\n        data_directories_offset = optional_header_offset + 96\n    else:\n        raise PeFormatError(f\"unsupported PE optional header magic: 0x{optional_magic:04x}\")\n\n    import_directory_rva = _read_u32(data, data_directories_offset + 8)\n    import_directory_size = _read_u32(data, data_directories_offset + 12)\n    if import_directory_rva == 0 or import_directory_size == 0:\n        return []\n\n    size_of_headers = _read_u32(data, optional_header_offset + 60)\n    section_table_offset = optional_header_offset + optional_header_size\n    sections = []\n    for index in range(section_count):\n        section_offset = section_table_offset + index * 40\n        sections.append(\n            (\n                _read_u32(data, section_offset + 12),\n                _read_u32(data, section_offset + 8),\n                _read_u32(data, section_offset + 20),\n                _read_u32(data, section_offset + 16),\n            )","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/scripts/validate_windows_pe_dependencies.py#L36-L72","documentation":"imported_dlls() parses a Windows PE file to list its imported DLLs. After locating the optional header it reads the 16-bit magic that distinguishes PE32+ (0x20B) from PE32 (0x10B); only those two layouts are implemented. This error is raised when the file declares any other optional-header magic, so the parser cannot know where the data directories (and therefore the import table) live.","triggerScenarios":"Calling imported_dlls(path) on a file whose PE optional header magic is neither 0x10B nor 0x20B — e.g. corrupted pe_offset pointing into random bytes, a ROM/EFI or old PE image variant, a hand-crafted or fuzzed header, or a truncated file whose 0x3C pointer lands on non-header data.","commonSituations":"Validating a corrupt or tampered binary; pointing the validator at a non-PE file that happens to start with 'MZ' (some self-extractors, .NET single-file bundles, DOS stubs); a repo checkout where binary files were mangled by text-mode conversion; fuzz-tested inputs in CI.","solutions":["Verify the input is a real Windows PE: check that data[0x3C] points to a 'PE\\0\\0' signature and that the optional header magic is 0x10B or 0x20B before validating.","Re-obtain the binary from a trusted build artifact (rebuild/re-download); the header is likely corrupt.","If you must support another PE variant, extend the script's magic dispatch to compute the correct data_directories_offset for it.","Exclude the file from validation or guard the script invocation so only genuine .exe/.dll artifacts are passed in."],"exampleFix":"// before\nimports = imported_dlls(Path(binary_path))\n// after\ntry:\n    imports = imported_dlls(Path(binary_path))\nexcept PeFormatError as err:\n    print(f\"skipping {binary_path}: {err}\")\n    imports = []","handlingStrategy":"validation","validationCode":"import struct\nfrom pathlib import Path\n\ndef has_supported_pe_optional_header(path: Path) -> bool:\n    data = path.read_bytes()\n    if len(data) < 64 or data[:2] != b\"MZ\":\n        return False\n    pe = struct.unpack_from(\"<I\", data, 0x3C)[0]\n    if data[pe:pe+4] != b\"PE\\x00\\x00\":\n        return False\n    magic = struct.unpack_from(\"<H\", data, pe + 24)[0]\n    return magic in (0x10B, 0x20B)","typeGuard":"def is_valid_pe_bytes(data: bytes) -> bool:\n    return len(data) >= 64 and data[:2] == b\"MZ\"","tryCatchPattern":"try:\n    imports = imported_dlls(path)\nexcept PeFormatError as err:\n    log.warning(\"unsupported or malformed PE %s: %s\", path, err)\n    imports = []","preventionTips":["Only run the validator on artifacts produced by a known PE toolchain (MSVC/MinGW).","Verify file hashes against build outputs to catch corrupted/truncated copies.","Pre-screen with pefile.PE(path) which gives clearer diagnostics for header problems.","Exclude non-image PE variants (COFF objects, .lib) from validation."],"tags":["pe-format","binary-parsing","corrupt-file","python"],"backgroundTag":"unsupported-pe-optional-header-magic","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}