How to interpret exception codes shown in WinDbg?
Asked Answered
H

1

8

I am just debugging a Windows application which is crashing. After starting the app, attaching to it with WinDbg, and then letting it crash, the following appeared in the WinDbg command window:

(119c.1794): Unknown exception - code 0000071a (first chance)

I've been searching the web but haven't found any explanation of how to interpret those exception codes.

If it makes a difference, it's a 32-bit .NET application running on 64-bit Windows 8 (via WoW64).

Hamstring answered 23/7, 2015 at 11:41 Comment(1)
Whenever I get cryptic crash codes, I consult the 2.3.1 NTSTATUS values and the NTSTATUS codes pages. They should provide overlapping information. Most times, I can find the code, sometimes, I can't.Curie
A
13

WinDbg already displays the name of exceptions when it knows it:

(15c0.1370): Break instruction exception - code 80000003 (first chance)

You get more details with .exr -1:

0:009> .exr -1
ExceptionAddress: 77d5000c (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 00000000

You can also display NTSTATUS codes as proposed by @rrirower:

0:009> !gle
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0

And these status codes can be decoded with !error. It will consider Win32, Winsock, NTSTATUS and NetApi errors:

0:009> !error 0000071a 
Error code: (Win32) 0x71a (1818) - The remote procedure call was cancelled.
Ania answered 23/7, 2015 at 13:33 Comment(0)

© 2022 - 2024 — McMap. All rights reserved.