adding code to kernel32.dll

Did you recalculate the checksum field after modifying the .exe? (just a guess)

[amigo]

Yes,
Checksum doesn't matter here , loader doesn't check it, after modification inside existing code it loads the file OK without correcting checksum.
It depends of total size of image - I can increase last section 'a little' - up to the total size of ED000h (alignment 1000h) and above this value the crash occurs.

Regards
amigo

Maybe MS load kernel without standart EXE loader.
It will be very strange, but who know MS ways?

don't pacth kernel32.dll, it maybe a protected system file by os loader.
use global hook or DLL inject.

[amigo]

I've patched it, without checksum correcting, and XP works OK with my code inside. So os loader didn't check it.
UFOSPACE, you said "don't patch, but hook". But hooking during OS loading requires ring0 patching...
Thanx all for suggests, but the problem remains.

hi amigo
try to debug the os loader to see what it does.

I think the new PE ImageSize ( [PE_Header+0x50] ) is incorrect and should be recalculated.

PE ImageSize = Sum of the VirtualSize (aligned with ObjectAlign) of all Sections