What does NTSTATUS 0x4001000A (DBG_PRINTEXCEPTION_WIDE_C) mean?

DBG_PRINTEXCEPTION_WIDE_C

Meaning and context of DBG_PRINTEXCEPTION_WIDE_C

The OutputDebugStringA generate exception DBG_PRINTEXCEPTION_C (W version in win10 - DBG_PRINTEXCEPTION_WIDE_C) with 2 arguments - (string length in characters + 1, string pointer) - as result we can handle this exception yourself (system default handler for this exception do this).

Example handler for redirect OutputDebugString to console:

LONG NTAPI VexHandler(PEXCEPTION_POINTERS ExceptionInfo)
{
    PEXCEPTION_RECORD ExceptionRecord = ExceptionInfo->ExceptionRecord;

    switch (ExceptionRecord->ExceptionCode)
    {
    case DBG_PRINTEXCEPTION_WIDE_C:
    case DBG_PRINTEXCEPTION_C:

        if (ExceptionRecord->NumberParameters >= 2)
        {
            ULONG len = (ULONG)ExceptionRecord->ExceptionInformation[0];

            union {
                ULONG_PTR up;
                PCWSTR pwz;
                PCSTR psz;
            };

            up = ExceptionRecord->ExceptionInformation[1];

            HANDLE hOut = GetStdHandle(STD_ERROR_HANDLE);

            if (ExceptionRecord->ExceptionCode == DBG_PRINTEXCEPTION_C)
            {
                // localized text will be incorrect displayed, if used not CP_OEMCP encoding 
                // WriteConsoleA(hOut, psz, len, &len, 0);

                // assume CP_ACP encoding
                if (ULONG n = MultiByteToWideChar(CP_ACP, 0, psz, len, 0, 0))
                {
                    PWSTR wz = (PWSTR)alloca(n * sizeof(WCHAR));

                    if (len = MultiByteToWideChar(CP_ACP, 0, psz, len, wz, n))
                    {
                        pwz = wz;
                    }
                }
            }

            if (len)
            {
                WriteConsoleW(hOut, pwz, len - 1, &len, 0);
            }

        }
        return EXCEPTION_CONTINUE_EXECUTION;
    }

    return EXCEPTION_CONTINUE_SEARCH;
}

And for set this handler need call:

AddVectoredExceptionHandler(TRUE, VexHandler);

Native status interpretation for DBG_PRINTEXCEPTION_WIDE_C

DBG_PRINTEXCEPTION_WIDE_C is 0x4001000A, an NTSTATUS informational value. For DBG_PRINTEXCEPTION_WIDE_C, allStat describes it as “Debugger printed exception on control C.”. For DBG_PRINTEXCEPTION_WIDE_C, the first useful question is which native API, IRP, protocol operation, or subsystem in the kernel, native API, or subsystem that returned the status produced that status.

Debugging sequence for DBG_PRINTEXCEPTION_WIDE_C

• Preserve DBG_PRINTEXCEPTION_WIDE_C before RtlNtStatusToDosError, HRESULT conversion, exception translation, or provider-specific remapping removes information.
• Compare the exact dbg / printexception / wide / c operation on a working system and record differences in object lifetime, access token, device state, negotiated protocol, and policy.
• For kernel I/O, keep the device stack, IRP major/minor function, request parameters, completion routine, and the first component that completed the request with DBG_PRINTEXCEPTION_WIDE_C.

Recovery considerations for DBG_PRINTEXCEPTION_WIDE_C

A retry is appropriate only after the owner of DBG_PRINTEXCEPTION_WIDE_C has changed the state described by “Debugger printed exception on control C.”, or when its contract explicitly marks the status as transient. For DBG_PRINTEXCEPTION_WIDE_C, if the value reports corruption, invalid format, access policy, or a lifecycle mismatch, preserve evidence and correct that cause before repeating the request.

Official references for DBG_PRINTEXCEPTION_WIDE_C

• Microsoft Open Specifications: NTSTATUS values
• Microsoft: Using NTSTATUS values

Looking for a different code? Search another status or error code.