Decoding Errors

Informational Posts

• Decoding different types of Windows' errors
  
• Introduction to the Windows' Debugger
  
• Command Prompt Cheat Sheet
  
• Character Table
  

---

Decoding Errors

Decoding Errors
 
-2147220978 style numbers are 32 bit signed integers, convert to hex with calculator.
 
Windows errors (smallish numbers) and  COM HResults (typically, but with exceptions, start with an 8 as in 0x80040154) are defined in WinError.h, except 8007nnnn where you look up the Window error number that it contains.
 
As a general rule Windows errors are less than 65,535 (0xFFFF). Errors starting 0x80000001 are Component Object Model (COM) HResults. Errors starting 0xC0000001 are NTStatus results. Errors starting 0xD0000001 are also NTStatus values returned in a HResult.
 
NTStatus errors (typically but not always start with an C as in 0xC0000022) are defined in NTStatus.h. 
 
.h files are the best source because it includes the symbolic name of the error which can give clues such as the source of the error. FormatMessage doesn't give the symbolic name only the description.
 
You get these files by downloading the Platform SDK (it's gigabytes)

https://developer.microsoft.com/en-us/windows/downloads/windows-10-sdk/
 
If you just want the two files I have them on my skydrive so I can reference them anywhere I go.

https://skydrive.live.com/redir?resid=E2F0CE17A268A4FA!121 (but they are from 2006)
 
Note internet errors (12,000 - 12,999) are windows errors but are specified in wininet.h also available above. 
 
There are errors defined in other .h files. But 99% are in the three above.
 
Structure of HResults and NTStatus Codes
 
The most significant bit in HResults, and the two most significant bits in NTStatus are set on error. Hence Hresults start 8 on error and NTStatus starts C on Error. The next 14 or 15 bits are reserved and some specify the facility - what area the error is in. This is the third and fourth number when reading hex. EG 0xnn07nnnn - An HResult facility code 7 is a normal Windows' error (returned from a COM program - hence it's returned as a HResult). Facility codes are defined in Winerror.h for HResults and NTStatus.h for NTStatus codes. They are different.
 
 
To Decode 0x8003nnnn Errors
 
HResults with facility code 3 means the HResult contains OLE Structured Storage errors (0x0 to 0xff). These are the same as Dos error codes. These don't seem to be in Windows' header files and the list of codes is at the end of this post.

 
To Decode 0x8004nnnn Errors
 
HResults with facility code 4 means the HResult contains OLE errors (0x0 to 0x1ff) while the rest of the range (0x200 onwards) is component specific errors so 20e from one component will have a different meaning to 20e from another component.

 

This is why the source of the error is extra important for errors above 0x80040200.

 

To Decode 0x8007nnnn Errors
 
HResults with facility code 7 means the HResult contains a Windows' error code. You have to look up the Windows' error code not the HResult.

 
To decode 0x80070002. The 0x means it's a hexadecimal number, the 8 means error, the first 7 means it a windows error, and the rest of the number, 2, is the actual Windows error.
 
To look up the error we need it in decimal format. Start Calculator (Start - All Programs - Accessories - Calculator) and choose View menu - Scientific, then View menu - Hex. Enter 2. Then View menu -  Decimal. It will say 2.
 
Start a Command Prompt (Start - All Programs - Accessories - Command Prompt) and type
 
net helpmsg 2
 
and it will say
 
The system cannot find the file specified.
 
or look it up in winerror.h
 
//
// MessageId: ERROR_FILE_NOT_FOUND
//
// MessageText:
//
// The system cannot find the file specified.
//
#define ERROR_FILE_NOT_FOUND             2L
 
To Decode 0x8019nnnn Errors
 
HResults with facility 0x19 are HTTP errors. Codes under 16,384 (0x4000) are the same as HTTP errors, eg HTTP status 404: The requested URL does not exist on the server is 0x80190194 (0x194 = 404). Codes 16,384 and higher are BITS specific.

To Decode 0xDnnnnnnn Errors
 
HResults starting 0xD are an HResult with a NTStatus value in it. Just cange the lead D to a C and treat as an NTStatus (Hresult = NTStatus OR 10000000).