Question about STOP code differences

WINDBG
1

I’ve been trying to find out the difference between STOP codes that start with 0x1… and those that start with 0x0…

For example:
0x1000007E and 0x0000007E

Anyone have an explanation or a link to a discussion about it?

Thanks!

  • John (aka usasma)
2

The bug check codes with 10000000 set are generally the “minidump”-ified versions of a particular bug check code. This generally signifies that signifies that crash data was preprocessed to ensure that a valid register context is included in the minidump, as only limited sections of memory are present in a miniduimp.

As the debugger documentation states, the bug code parameters are identical regardless of whether the bug check is reported as a “minidump”-ified version or not, so this shouldn’t impact the dump analysis process.

  • S

From: xxxxx@lists.osr.com [xxxxx@lists.osr.com] on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
Sent: Sunday, September 25, 2011 3:38 AM
To: Kernel Debugging Interest List
Subject: [windbg] Question about STOP code differences

I’ve been trying to find out the difference between STOP codes that start with 0x1… and those that start with 0x0…

For example:
0x1000007E and 0x0000007E

Anyone have an explanation or a link to a discussion about it?

Thanks!

  • John (aka usasma)

WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

both are identical one is win32 error code other is ntstatus

lkd> !error 0x0000007e
Error code: (Win32) 0x7e (126) - The specified module could not be found.
lkd> !error 0x1000007e
Error code: (NTSTATUS) 0x1000007e (268435582) - The specified module
could not be found.

On 9/25/11, Skywing wrote:
> The bug check codes with 10000000 set are generally the “minidump”-ified
> versions of a particular bug check code. This generally signifies that
> signifies that crash data was preprocessed to ensure that a valid register
> context is included in the minidump, as only limited sections of memory are
> present in a miniduimp.
>
> As the debugger documentation states, the bug code parameters are identical
> regardless of whether the bug check is reported as a “minidump”-ified
> version or not, so this shouldn’t impact the dump analysis process.
>
> - S
> ________________________________________
> From: xxxxx@lists.osr.com [xxxxx@lists.osr.com]
> on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
> Sent: Sunday, September 25, 2011 3:38 AM
> To: Kernel Debugging Interest List
> Subject: [windbg] Question about STOP code differences
>
> I’ve been trying to find out the difference between STOP codes that start
> with 0x1… and those that start with 0x0…
>
> For example:
> 0x1000007E and 0x0000007E
>
> Anyone have an explanation or a link to a discussion about it?
>
> Thanks!
> - John (aka usasma)
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
thanks and regards

raj_r

4

No, this is incorrect. For bug check codes, this bit indicates whether the dump state has been specially processed for use a minidump.

  • S (Msft)

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of raj_r
Sent: Sunday, September 25, 2011 9:31 PM
To: Kernel Debugging Interest List
Subject: Re: [windbg] Question about STOP code differences

both are identical one is win32 error code other is ntstatus

lkd> !error 0x0000007e
Error code: (Win32) 0x7e (126) - The specified module could not be found.
lkd> !error 0x1000007e
Error code: (NTSTATUS) 0x1000007e (268435582) - The specified module could not be found.

On 9/25/11, Skywing wrote:
> The bug check codes with 10000000 set are generally the
> “minidump”-ified versions of a particular bug check code. This
> generally signifies that signifies that crash data was preprocessed to
> ensure that a valid register context is included in the minidump, as
> only limited sections of memory are present in a miniduimp.
>
> As the debugger documentation states, the bug code parameters are
> identical regardless of whether the bug check is reported as a
> “minidump”-ified version or not, so this shouldn’t impact the dump analysis process.
>
> - S
> ________________________________________
> From: xxxxx@lists.osr.com
> [xxxxx@lists.osr.com]
> on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
> Sent: Sunday, September 25, 2011 3:38 AM
> To: Kernel Debugging Interest List
> Subject: [windbg] Question about STOP code differences
>
> I’ve been trying to find out the difference between STOP codes that
> start with 0x1… and those that start with 0x0…
>
> For example:
> 0x1000007E and 0x0000007E
>
> Anyone have an explanation or a link to a discussion about it?
>
> Thanks!
> - John (aka usasma)
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
thanks and regards

raj_r

—
WINDBG is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

5

Ken ,
i read your earlier post after i posted
thanks for the correction i didnt know about the bit being
preprocessed for minidump

after i read your earlier post i was searching in windbg help file for
these queries

bugcheck, stop , stop error , stop code , bugdump etc but cant seem to
find where this preprocessed bit is documented will hit google and see

regards

raj

On 9/26/11, Skywing wrote:
> No, this is incorrect. For bug check codes, this bit indicates whether the
> dump state has been specially processed for use a minidump.
>
> - S (Msft)
>
> -----Original Message-----
> From: xxxxx@lists.osr.com
> [mailto:xxxxx@lists.osr.com] On Behalf Of raj_r
> Sent: Sunday, September 25, 2011 9:31 PM
> To: Kernel Debugging Interest List
> Subject: Re: [windbg] Question about STOP code differences
>
> both are identical one is win32 error code other is ntstatus
>
> lkd> !error 0x0000007e
> Error code: (Win32) 0x7e (126) - The specified module could not be found.
> lkd> !error 0x1000007e
> Error code: (NTSTATUS) 0x1000007e (268435582) - The specified module could
> not be found.
>
>
> On 9/25/11, Skywing wrote:
>> The bug check codes with 10000000 set are generally the
>> “minidump”-ified versions of a particular bug check code. This
>> generally signifies that signifies that crash data was preprocessed to
>> ensure that a valid register context is included in the minidump, as
>> only limited sections of memory are present in a miniduimp.
>>
>> As the debugger documentation states, the bug code parameters are
>> identical regardless of whether the bug check is reported as a
>> “minidump”-ified version or not, so this shouldn’t impact the dump
>> analysis process.
>>
>> - S
>> ________________________________________
>> From: xxxxx@lists.osr.com
>> [xxxxx@lists.osr.com]
>> on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
>> Sent: Sunday, September 25, 2011 3:38 AM
>> To: Kernel Debugging Interest List
>> Subject: [windbg] Question about STOP code differences
>>
>> I’ve been trying to find out the difference between STOP codes that
>> start with 0x1… and those that start with 0x0…
>>
>> For example:
>> 0x1000007E and 0x0000007E
>>
>> Anyone have an explanation or a link to a discussion about it?
>>
>> Thanks!
>> - John (aka usasma)
>>
>> —
>> WINDBG is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>> —
>> WINDBG is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
>
> –
> thanks and regards
>
> raj_r
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> WINDBG is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
thanks and regards

raj_r

6

msdn shows there are

Bug Check 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M
Bug Check 0x1000007F: UNEXPECTED_KERNEL_MODE_TRAP_M
Bug Check 0x1000008E: KERNEL_MODE_EXCEPTION_NOT_HANDLED_M
Bug Check 0x100000EA: THREAD_STUCK_IN_DEVICE_DRIVER_M
Bug Check 0xC0000218: STATUS_CANNOT_LOAD_REGISTRY_FILE
Bug Check 0xC000021A: STATUS_SYSTEM_PROCESS_TERMINATED
Bug Check 0xC0000221: STATUS_IMAGE_CHECKSUM_MISMATCH
Bug Check 0xDEADDEAD: MANUALLY_INITIATED_CRASH1
Separator
Expand
MSDN
Bug Check 0x1000007E: SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M

The SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M bug check has a value of
0x1000007E. This indicates that a system thread generated an exception
which the error handler did not catch.

Bug check 0x1000007E has the same meaning and parameters as bug check
0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED).

so _m denotes minidumpified ??

thanks and regards

raj

On 9/26/11, raj_r wrote:
> Ken ,
> i read your earlier post after i posted
> thanks for the correction i didnt know about the bit being
> preprocessed for minidump
>
> after i read your earlier post i was searching in windbg help file for
> these queries
>
> bugcheck, stop , stop error , stop code , bugdump etc but cant seem to
> find where this preprocessed bit is documented will hit google and see
>
> regards
>
> raj
>
>
> On 9/26/11, Skywing wrote:
>> No, this is incorrect. For bug check codes, this bit indicates whether
>> the
>> dump state has been specially processed for use a minidump.
>>
>> - S (Msft)
>>
>> -----Original Message-----
>> From: xxxxx@lists.osr.com
>> [mailto:xxxxx@lists.osr.com] On Behalf Of raj_r
>> Sent: Sunday, September 25, 2011 9:31 PM
>> To: Kernel Debugging Interest List
>> Subject: Re: [windbg] Question about STOP code differences
>>
>> both are identical one is win32 error code other is ntstatus
>>
>> lkd> !error 0x0000007e
>> Error code: (Win32) 0x7e (126) - The specified module could not be found.
>> lkd> !error 0x1000007e
>> Error code: (NTSTATUS) 0x1000007e (268435582) - The specified module
>> could
>> not be found.
>>
>>
>> On 9/25/11, Skywing wrote:
>>> The bug check codes with 10000000 set are generally the
>>> “minidump”-ified versions of a particular bug check code. This
>>> generally signifies that signifies that crash data was preprocessed to
>>> ensure that a valid register context is included in the minidump, as
>>> only limited sections of memory are present in a miniduimp.
>>>
>>> As the debugger documentation states, the bug code parameters are
>>> identical regardless of whether the bug check is reported as a
>>> “minidump”-ified version or not, so this shouldn’t impact the dump
>>> analysis process.
>>>
>>> - S
>>> ________________________________________
>>> From: xxxxx@lists.osr.com
>>> [xxxxx@lists.osr.com]
>>> on behalf of xxxxx@gmail.com [xxxxx@gmail.com]
>>> Sent: Sunday, September 25, 2011 3:38 AM
>>> To: Kernel Debugging Interest List
>>> Subject: [windbg] Question about STOP code differences
>>>
>>> I’ve been trying to find out the difference between STOP codes that
>>> start with 0x1… and those that start with 0x0…
>>>
>>> For example:
>>> 0x1000007E and 0x0000007E
>>>
>>> Anyone have an explanation or a link to a discussion about it?
>>>
>>> Thanks!
>>> - John (aka usasma)
>>>
>>> —
>>> WINDBG is sponsored by OSR
>>>
>>> For our schedule of WDF, WDM, debugging and other seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>> —
>>> WINDBG is sponsored by OSR
>>>
>>> For our schedule of WDF, WDM, debugging and other seminars visit:
>>> http://www.osr.com/seminars
>>>
>>> To unsubscribe, visit the List Server section of OSR Online at
>>> http://www.osronline.com/page.cfm?name=ListServer
>>>
>>
>>
>> –
>> thanks and regards
>>
>> raj_r
>>
>> —
>> WINDBG is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>> —
>> WINDBG is sponsored by OSR
>>
>> For our schedule of WDF, WDM, debugging and other seminars visit:
>> http://www.osr.com/seminars
>>
>> To unsubscribe, visit the List Server section of OSR Online at
>> http://www.osronline.com/page.cfm?name=ListServer
>>
>
>
> –
> thanks and regards
>
> raj_r
>

–
thanks and regards

raj_r

7

xxxxx@gmail.com wrote:

I’ve been trying to find out the difference between STOP codes that start with 0x1… and those that start with 0x0…

For example:
0x1000007E and 0x0000007E

Anyone have an explanation or a link to a discussion about it?

Use the source, Luke.

The “bugcodes.h” file in the DDK describes the bit fields in a bug check
code. That will tell you that bit 28 is a “reserved” bit, but Skywing
elucidated that.

–
Tim Roberts, xxxxx@probo.com
Providenza & Boekelheide, Inc.