How to interpret exception codes shown in WinDbg?

Question

I am just debugging a Windows application which is crashing. After starting the app, attaching to it with WinDbg, and then letting it crash, the following appeared in the WinDbg command window:

(119c.1794): Unknown exception - code 0000071a (first chance)

I've been searching the web but haven't found any explanation of how to interpret those exception codes.

If it makes a difference, it's a 32-bit .NET application running on 64-bit Windows 8 (via WoW64).

Whenever I get cryptic crash codes, I consult the [2.3.1 NTSTATUS values](https://msdn.microsoft.com/en-us/library/cc704588.aspx) and the [NTSTATUS codes](http://deusexmachina.uk/ntstatus.html) pages. They should provide overlapping information. Most times, I can find the code, sometimes, I can't. — rrirower, Jul 23 '15 at 13:25

score 12 · Accepted Answer · edited Sep 08 '15 at 16:56

WinDbg already displays the name of exceptions when it knows it:

(15c0.1370): Break instruction exception - code 80000003 (first chance)

You get more details with .exr -1:

0:009> .exr -1
ExceptionAddress: 77d5000c (ntdll!DbgBreakPoint)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 1
   Parameter[0]: 00000000

You can also display NTSTATUS codes as proposed by @rrirower:

0:009> !gle
LastErrorValue: (Win32) 0 (0) - The operation completed successfully.
LastStatusValue: (NTSTATUS) 0 - STATUS_WAIT_0

And these status codes can be decoded with !error. It will consider Win32, Winsock, NTSTATUS and NetApi errors:

0:009> !error 0000071a 
Error code: (Win32) 0x71a (1818) - The remote procedure call was cancelled.

How to interpret exception codes shown in WinDbg?

1 Answers1