List of peculiar exit codes on Windows

Process exit codes are fairly straightforward on Windows. They are essentially the return value of a process: a plain, 32-bit unsigned integer code. There are no strict rules governing this value, just convention:

  • 0 means success
  • Anything else means failure
  • If the system is involved in the termination of a program, the returned value might be a standard Win32 error code, HRESULT, or NTSTATUS. For example, if your process gets terminated due to an unhandled access violation, the exit code will be 0xC0000005

Due to the third point above, when your process is terminated, you can get a pretty good idea regarding the cause. However, sometimes that’s not the case. At work I’ve seen many exit codes that I found interesting. In some cases we figured out the reason, in other cases, we didn’t (comments welcome!). I thought I’d compile a list of codes that might be of interest to others. This is listed as a resource, so I plan to update/extend it in the future.

Exit code value Most probable cause
0x00000000 Most of the time it means success, however, that’s not always the case…
0x00000001 Terminated by a process manager (taskmgr.exe, Process Explorer, etc.)
0x00000003 std::abort was called (one of the three ways the CRT can tear down the process in case of std::abort results in code 3).
0x000000FF When a program crashes, and the user chooses “Close the program” on Windows Error Reporting’s dialog, sometimes (but only sometimes) the process is terminated with this code. This seems to be sporadic, and I’m unaware of the exact reason.
0x40010004 The system terminated the application during shutdown.
0x40000015 This is NTSTATUS STATUS_FATAL_APP_EXIT. One of the three ways the CRT can tear down the process in case of std::abort results in this code.
0x6E760038, 0x6E76003B, 0x6E760034 Terminations by an Nvidia DLL, such as nvoglv64.dll (0x6E is ‘n’, and 0x76 is ‘v’, by the way). I was told they have revamped the way they terminate the current process, so you shouldn’t see these exit codes with newer drivers.
0xC0000354 Unknown (it’s STATUS_DEBUGGER_INACTIVE, but that doesn’t really make sense for a regular, user-mode application).
0xC0000409 This NTSTATUS value used to mean STATUS_STACK_BUFFER_OVERRUN. With the introduction of an OS feature called fastfail, this code was generalized. Unfortunately, to get a more specific reason for a termination like this, you need to inspect the exception parameters.
0xCFFFFFFF When an application hangs (that is, when the system thinks it hangs), a WER dialog is displayed telling you that “XY.exe is not responding”. If you choose to “Close the application”, it gets terminated with this code.
Advertisements

Author: Donpedro

C++ programmer with an interest in operating systems and everything low level.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s