Either by knowing which encoding the component in question uses for return codes, or by examining both error texts and seeing if one doesn’t make sense.
In general, the only user mode things that use NTSTATUS are those that call ntdll exports directly, or LSA-related components.
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Lin George
Sent: Tuesday, October 14, 2008 3:07 AM
To: Kernel Debugging Interest List
Cc: Kernel Debugging Interest List
Subject: Re: [windbg] about flags for !error command
Hi raj_r,
Your reply is really excellent. But when meeting with practical issue, we still meet with issue whether the error code is NTSTATUS or Win32 or something else. From the error code and message itself, it does not tell whehter it is NTSTATUS or Win32 or something else. So, developer when debugging, he or she needs to try !error command with each value for “Value” parameter, this is the pain. I show the sample below.
In this case, I know nothing about whether error code 4000001f is NTSTATUS or Win32 or something, so I tried with parameter value 0 and parameter value 1, and fortunately, I got only one error message and do not get two different error messages.
Here is my output. Do you have any ideas to check whether an error code is from NTSTATUS or Win32 or something else? So that we do not need to try one by one and also no chances to get two different error messages when try with value 0 and value 1?
(1c90.1d70): WOW64 breakpoint - code 4000001f (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
ntdll32!DbgBreakPoint:
00000000`7d61002d cc int 3
0:000:x86> !error 4000001f 0
Error code: (Win32) 0x4000001f (1073741855) -
0:000:x86> !error 4000001f 1
Error code: (NTSTATUS) 0x4000001f - Exception status code used by Win32 x86 emulation subsystem.
--------------------.
regards,
George
----- Original Message ----
From: raj_r
To: Kernel Debugging Interest List
Cc: Kernel Debugging Interest List
Sent: Sunday, October 12, 2008 3:17:52 AM
Subject: Re: [windbg] about flags for !error command
On 10/10/08, Lin George wrote:
The debugger help document does not cover the legal ranges. Where to look-up?
>
> !error Value [Flags]
legal range for errors can be from 0 to ffffffff or 0 to
ffffffff’ffffffff (0 to 2^32 or 0 to 2^64 or may be 0 to 2^128 and
above in far future) subject to certain conditions like the below one
thats valid for 2^32 range
The error codes returned by a function are not part of the Windows API
specification and can vary by operating system or device driver. For
this reason, we cannot provide the complete list of error codes that
can be returned by each function. There are also many functions whose
documentation does not include even a partial list of error codes that
can be returned.
Error codes are 32-bit values (bit 31 is the most significant bit).
Bit 29 is reserved for application-defined error codes; no system
error code has this bit set. If you are defining an error code for
your application, set this bit to one. That indicates that the error
code has been defined by an application, and ensures that your error
code does not conflict with any error codes defined by the system.
http://msdn.microsoft.com/en-us/library/ms679360(VS.85).aspx
NTSTATUS
2.2.34 NTSTATUS
NTSTATUS is a standard 32-bit datatype for system-supplied status code values.
NTSTATUS values are used to communicate system information. They are
of four types: success values, information values, warnings, and error
values, as specified in [MS-ERREF].
This type is declared as follows:
typedef long NTSTATUS;
http://msdn.microsoft.com/en-us/library/cc230357.aspx
When testing a return value, you should use one of the following
system-supplied macros (defined in ntdef.h):
NT_SUCCESS(Status)
Evaluates to TRUE if the return value specified by Status is a success
type (0 - 0x3FFFFFFF) or an informational type (0x40000000 -
0x7FFFFFFF).
NT_INFORMATION(Status)
Evaluates to TRUE if the return value specified by Status is an
informational type (0x40000000 - 0x7FFFFFFF).
NT_WARNING(Status)
Evaluates to TRUE if the return value specified by Status is a warning
type (0x80000000 - 0xBFFFFFFF).
NT_ERROR(Status)
Evaluates to TRUE if the return value specified by Status is an error
type (0xC0000000 - 0xFFFFFFFF).
http://msdn.microsoft.com/en-us/library/aa489609.aspx
you can get half a cd full of errors
http://download.microsoft.com/download/9/5/E/95EF66AF-9026-4BB0-A41D-A4F81802D92C/Windows_Communication_Protocols.zip
only thing you need is the ability to search and unless you develop
the attitude or ability to search ,seek and find what you need on
your own no amount of answers are going to help you
for flags as i already said there are only two values that seem to be working
they are 0 AND 1 as documented
—
You are currently subscribed to windbg as: xxxxx@yahoo.com
To unsubscribe send a blank email to xxxxx@lists.osr.com
—
You are currently subscribed to windbg as: unknown lmsubst tag argument: ‘’
To unsubscribe send a blank email to xxxxx@lists.osr.com
and try to find out where it does something which it isnt