How to interpret exception codes shown in WinDbg?

Alex D picture Alex D · Jul 23, 2015 · Viewed 9k times · Source

I am just debugging a Windows application which is crashing. After starting the app, attaching to it with WinDbg, and then letting it crash, the following appeared in the WinDbg command window:

(119c.1794): Unknown exception - code 0000071a (first chance)

I've been searching the web but haven't found any explanation of how to interpret those exception codes.

If it makes a difference, it's a 32-bit .NET application running on 64-bit Windows 8 (via WoW64).

Answer

Thomas Weller picture Thomas Weller · Jul 23, 2015

WinDbg already displays the name of exceptions when it knows it:

(15c0.1370): Break instruction exception - code 80000003 (first chance)

You get more details with .exr -1:

0:009> .exr -1
ExceptionAddress: 77d5000c (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 00000000

You can also display NTSTATUS codes as proposed by @rrirower:

0:009> !gle
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0

And these status codes can be decoded with !error. It will consider Win32, Winsock, NTSTATUS and NetApi errors:

0:009> !error 0000071a 
Error code: (Win32) 0x71a (1818) - The remote procedure call was cancelled.