debuggingexceptionwindbgwindows-nt

How to interpret exception codes shown in WinDbg?


I am just debugging a Windows application which is crashing. After starting the app, attaching to it with WinDbg, and then letting it crash, the following appeared in the WinDbg command window:

(119c.1794): Unknown exception - code 0000071a (first chance)

I've been searching the web but haven't found any explanation of how to interpret those exception codes.

If it makes a difference, it's a 32-bit .NET application running on 64-bit Windows 8 (via WoW64).


Solution

  • WinDbg already displays the name of exceptions when it knows it:

    (15c0.1370): Break instruction exception - code 80000003 (first chance)
    

    You get more details with .exr -1:

    0:009> .exr -1
    ExceptionAddress: 77d5000c (ntdll!DbgBreakPoint)
       ExceptionCode: 80000003 (Break instruction exception)
      ExceptionFlags: 00000000
    NumberParameters: 1
       Parameter[0]: 00000000
    

    You can also display NTSTATUS codes as proposed by @rrirower:

    0:009> !gle
    LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
    LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0
    

    And these status codes can be decoded with !error. It will consider Win32, Winsock, NTSTATUS and NetApi errors:

    0:009> !error 0000071a 
    Error code: (Win32) 0x71a (1818) - The remote procedure call was cancelled.