@lttrung97Blog
Thanh Trung Le

Windows Error Codes and Messages

Thanh Trung Le
Thanh Trung Le · 22 min read

Article Overview and Navigation

I. Windows Error Generation Architecture, Interpretation, and External Influences

A. Core Windows Architectural Components, Modules, and Inter-Process/Inter-Component Communication Mechanisms Pertinent to Error Origination and Propagation

The Windows operating system employs a layered architecture where errors can originate at various levels, from hardware interactions to user-mode application logic. Understanding the propagation of these errors through different components is crucial for accurate diagnosis.
Core Architectural Layers and Error Flow:
Errors can initiate at the hardware level, detected by the CPU, chipsets, or peripheral devices. These are initially processed by Low-Level Hardware Error Handlers (LLHEHs), which can be interrupt handlers, exception handlers, or firmware callbacks. LLHEHs capture error information into a hardware error packet and report it to the Windows kernel.1 The Windows Hardware Error Architecture (WHEA) standardizes this process, involving the Platform-Specific Hardware Error Driver (PSHED) to abstract platform-specific error handling mechanisms and provide a consistent interface to the OS.1 The kernel then creates a standardized error record, logs it to the system event log, and raises an Event Tracing for Windows (ETW) event. In cases requiring a system restart, the error record is saved to nonvolatile storage via PSHED and processed after reboot.1
Kernel-mode errors originate within the NT Executive subsystems (NTOSKRNL.EXE), device drivers (e.g., file system, network, graphics, storage), or the Hardware Abstraction Layer (HAL.DLL). These typically manifest as NTSTATUS codes. User-mode errors arise in applications or system libraries (e.g., NTDLL.DLL, KERNEL32.DLL). These can result from application logic flaws, failed API calls that translate kernel errors, or issues within the libraries themselves.
Inter-process and inter-component communication (IPC/ICC) mechanisms such as Local Procedure Call (LPC), Remote Procedure Call (RPC), and the Component Object Model (COM) are vital pathways for operations and, consequently, for error propagation. A failure in a server component, like the RPC Subsystem (RPCSS), can manifest as an error in a client process. The concept of activity propagation, as seen in frameworks like WCF, allows for correlation of error traces across different endpoints for a single unit of processing, aiding in diagnosing distributed failures.2
Error Propagation and Translation:
Errors often surface in components distant from their origin. A low-level I/O error, such as STATUS_IO_DEVICE_ERROR from a disk driver, might propagate through the I/O Manager to a file system driver (e.g., NTFS.SYS), then be translated by KERNEL32.DLL into a Win32 error code (e.g., ERROR_IO_DEVICE), and finally be reported to an application. The application might further wrap this into a custom exception or an HRESULT. A primary mechanism for this translation is the RtlNtStatusToDosError function in NTDLL.DLL, which converts NTSTATUS codes to their equivalent Win32 system error codes.3 This function is heavily utilized by KERNEL32.DLL and KERNELBASE.DLL.
The layered nature of the system means that a failure in a foundational component can cause higher-level components to fail with errors that may seem unrelated if the root cause is not traced back. For example, if the Memory Manager (MM) in NTOSKRNL.EXE fails an allocation request with STATUS_NO_MEMORY, a user-mode application requesting memory via HeapAlloc (which calls VirtualAlloc in KERNEL32.DLL, which in turn calls NtAllocateVirtualMemory in NTDLL.DLL that transitions to kernel mode) might see HeapAlloc return NULL with GetLastError() returning ERROR_NOT_ENOUGH_MEMORY, or a subsequent HRESULT like E_OUTOFMEMORY.
Exception Handling Mechanisms:
Windows utilizes several mechanisms for handling software and hardware exceptions:
Many Windows operations, particularly I/O, are asynchronous. An I/O Request Packet (IRP) might be initiated, and the function returns STATUS_PENDING. The actual operation is performed by a device driver, and any error might occur later in a driver's worker thread or a Deferred Procedure Call (DPC). The error is then reported via a completion mechanism (e.g., event, I/O completion port, callback routine).6,7 This asynchronous nature can make it challenging to correlate the reported error with the original initiating operation without robust tracing.
Furthermore, diverse errors across different subsystems can often stem from a common root cause: the exhaustion of critical system resources. Depletion of non-paged pool, paged pool, system Page Table Entries (PTEs), handles, or GDI objects can lead to a cascade of failures. For instance, non-paged pool exhaustion can cause any subsequent kernel-mode component attempting allocation to fail, often with STATUS_INSUFFICIENT_RESOURCES, manifesting in varied ways depending on the component and operation that failed.8,9 Similarly, Winsock errors like WSAENOBUFS often indicate ephemeral port exhaustion, a specific type of resource scarcity.10,11

B. Roles of Specific Components in Error Generation

1. Kernel-mode Core Components:
2. User-mode System Libraries:
3. Component Object Model (COM):
4. .NET Framework / .NET Core:
  • a. Common Language Runtime (CLR) (e.g., mscorwks.dll, coreclr.dll): The CLR manages the execution of .NET applications. It has its own exception handling system. When .NET code interoperates with native COM components or Win32 APIs (via P/Invoke), the CLR is responsible for marshalling data and translating error codes. HRESULTs from COM calls or Win32 errors from P/Invoke calls are typically converted into .NET exceptions.40 The original HRESULT is often stored in the Exception.HResult property. The CLR's marshalling and error translation can sometimes lose context, especially with custom error codes or if IErrorInfo is not properly provided by a COM component.41
  • b. Base Class Library (BCL): The BCL provides fundamental .NET classes and functionalities. Methods within the BCL that call underlying OS services will catch errors from those services (HRESULTs, Win32 errors) and wrap them in more specific .NET exception types, such as System.IO.IOException, System.UnauthorizedAccessException, or System.OutOfMemoryException. The original error information may be available via the HResult property or as an InnerException. Issues with garbage collection and finalization, particularly concerning the release of unmanaged resources (handles, native memory) wrapped by .NET objects, can lead to delayed errors. If an object's Dispose method is not called and its finalizer attempts to release an already invalid handle or perform an illegal operation, an exception (often an SEHException or a critical failure) can occur on the finalizer thread, making it difficult to attribute to the code that originally misused the resource.
5. Networking Stack:
The layered nature of network filtering (NDIS filters, WFP callouts, legacy LSPs/WSPs, application-level firewalls) means a Winsock error like WSAECONNREFUSED or WSAETIMEDOUT could be due to a block or modification at any of these layers. Pinpointing the responsible layer often requires specialized diagnostic tools. Furthermore, DNS resolution failures (leading to WSAHOST_NOT_FOUND) are a common source of network errors.52,53 However, intermittent DNS issues or misconfigurations might cause subsequent connection attempts to fail with timeouts or unreachability errors if an application caches a stale IP or if the DNS resolution itself times out, thereby masking the DNS root cause.
6. Third-Party Filter Drivers (Critical External Influence):
Third-party filter drivers are kernel-mode components that intercept and potentially modify system operations. They are commonly used by security software (Antivirus, EDR, DLP), encryption tools, backup agents, and virtualization software.

C. Primary Error Code Systems, Propagation Paths, and Translation

Windows utilizes several distinct error code systems, each typically associated with a specific layer or subsystem. Understanding their propagation and translation is key to tracing an error to its true origin.
The translation between these error code systems can sometimes lead to a loss of specificity. NTSTATUS provides a rich set of error codes; when RtlNtStatusToDosError maps these to the smaller set of Win32 error codes, multiple distinct NTSTATUS conditions might map to a single, more generic Win32 error.3 For example, various underlying file access issues might all translate to ERROR_ACCESS_DENIED. This can make diagnosing the precise root cause more challenging if only the translated code is observed.
A common pitfall in user-mode Win32 programming is the handling of GetLastError(). This function retrieves the last error code for the calling thread. If an application calls an API that fails and sets an error code, then calls another API that succeeds (which might reset the error code to ERROR_SUCCESS or 0) before calling GetLastError(), the retrieved error will not correspond to the actual failing call. Diligent error checking immediately after each potentially failing API call is essential.
When a filter driver directly completes an IRP or intercepts an operation and returns an NTSTATUS error code (e.g., STATUS_ACCESS_DENIED), this error propagates up the call stack. If a user-mode application initiated the operation, this NTSTATUS will typically be translated by NTDLL/KERNEL32 into a Win32 error. However, if a filter driver bug causes a system crash (BSOD), the error information is captured through the bug check mechanism (e.g., a bug check code like DRIVER_IRQL_NOT_LESS_OR_EQUAL and associated parameters). This is a distinct error reporting path from API-level error code propagation and translation.

D. Error Message Interpretation Complexity

Interpreting Windows error messages accurately can be challenging due to the operating system's complex, layered architecture, intricate interactions between its numerous components, and, critically, the pervasive influence of third-party filter drivers. Error messages reported at the application or end-user level may appear misleading or overly generic, often obscuring the true root cause.
The layered abstraction inherent in Windows means that an error originating in a low-level component (e.g., a disk driver) is often processed and translated by several intermediate layers (I/O Manager, file system driver, KERNEL32.DLL) before being presented to an application. Each layer might handle or interpret the error differently, potentially losing some of the original context. For example, an ERROR_ACCESS_DENIED (Win32) seen by an application attempting to open a file could originate from:
The error is reported by the API the application called (e.g., CreateFile), not necessarily by the component that made the ultimate decision to deny access.
As discussed, error code translation (e.g., NTSTATUS to Win32, Win32 to HRESULT) can reduce specificity. A rich NTSTATUS code like STATUS_INSUFFICIENT_RESOURCES might be translated to a more generic ERROR_NOT_ENOUGH_MEMORY or E_OUTOFMEMORY, masking whether the issue was non-paged pool, paged pool, commit charge, or another specific resource.3
The most significant complicating factor is the interception of system operations by third-party filter drivers.54,79 These drivers can:
Consequently, while truly incorrect error reporting by core Windows components is rare, the apparent ambiguity or misleading nature of an error message usually stems from one or more of these factors: error code translation losing detail, a failure in a lower-level dependency that is masked by higher layers, or an explicit block, modification, or bug introduced by a third-party filter driver.
Accurately diagnosing the root cause often requires understanding the specific module that originated the error or, crucially, the module that intercepted and altered the operation (like a filter driver), along with the sequence of calls leading to the failure. The organization of error codes by originating module in Section II of this document is intended to assist in this diagnostic process. Tools like kernel debuggers (WinDbg), ETW tracing, fltmc.exe for file system filters, and Process Monitor are invaluable for peeling back the layers and identifying the true source of an error.67
The act of enabling detailed diagnostics or attaching a debugger can sometimes alter system timing or behavior, potentially causing intermittent errors (especially those related to race conditions in filter drivers) to disappear or change, a phenomenon that complicates troubleshooting. Furthermore, some security filter drivers may be overly aggressive in their blocking heuristics, leading to false positives where legitimate operations are denied, making the resulting error messages seem incorrect to the user or developer, even though the filter is operating as designed (albeit too broadly).77 Understanding the potential origins of errors, as detailed in the subsequent sections, and particularly the pervasive role of filter drivers, is paramount for correct interpretation and effective resolution.

II. The Catalog of Public Windows Error Codes and Messages

A. Scope of Catalog

This catalog aims to provide a comprehensive reference for publicly documented error codes found within standard Microsoft development resources, primarily the Windows SDK (Software Development Kit) and Windows Driver Kit (WDK) headers (e.g., ntstatus.h, winerror.h, winsock2.h) and associated documentation. The codes included are relevant to developers and system administrators across the architectural layers discussed in Section I.

B. Organization by Originating Module/Subsystem

Errors are organized by the primary originating module or subsystem to aid in understanding their provenance and context.

C. Error Code Details

For each error code, the following details are provided:
  1. Error Code Value: Canonical form (Hexadecimal preferred; Decimal for common Win32 codes; Facility/Code for HRESULTs).
  2. Symbolic Name: Official name from SDK/WDK headers.
  3. Originating Module/Component: The primary Windows component or subsystem from which this error typically originates or is reported by.
  4. Associated Error Message Text(s): Standard textual representation(s) (e.g., via FormatMessage or common exception messages).
  5. Detailed Causation ("Why"): Specific technical reasons for the error, linked to the originating component's function and potential interception by third-party drivers.
  6. Triggering Conditions ("When"): Common operations, API calls, system states, or driver interactions during which the error typically manifests.

1. Kernel Executive Subsystems (NTOSKRNL.EXE) & HAL (HAL.DLL) - NTSTATUS Codes

These errors typically originate from the core Windows kernel, its executive subsystems, or the Hardware Abstraction Layer. They are fundamental to system operation.
a. Memory Manager (MM)
b. I/O Manager (Io)
c. Object Manager (Ob)
d. Process and Thread Manager (Ps)
e. Configuration Manager (CM - Registry)

2. Win32 API Sets (KERNEL32.DLL / KERNELBASE.DLL, USER32.DLL, GDI32.DLL, ADVAPI32.DLL, SHELL32.DLL) - Win32 Error Codes

These errors are typically set by user-mode Win32 API functions and retrieved via GetLastError().
a. KERNEL32.DLL / KERNELBASE.DLL (Core File, Memory, Process/Thread APIs)

3. Component Object Model (COM/OLE) & RPC Subsystem (OLE32.DLL / COMBASE.DLL / RPCSS) - HRESULT Codes

HRESULTs are the standard error reporting mechanism for COM. They are 32-bit values where the top bit indicates success (0) or failure (1). The HRESULT also contains a facility code and an error code specific to that facility.

Error Code Summary Table

Summary of Windows Error Codes by Origin
Originating Module/Component Category
Error Code (Example)
Symbolic Name (Example)
Brief Cause Summary
Kernel Executive (Memory Manager)
0xC0000005
STATUS_ACCESS_VIOLATION
Invalid memory access (bad pointer, permissions, DEP, bug).
Kernel Executive (Memory Manager / I/O)
0xC0000006
STATUS_IN_PAGE_ERROR
I/O error occurred while paging data from disk (disk error, corruption, filter driver).
Kernel Executive (Memory Manager)
0xC0000017
STATUS_NO_MEMORY
System commit limit, page file, or kernel pool exhaustion; quota exceeded; memory leak.
Kernel Executive (I/O Manager / PnP)
0xC000000E
STATUS_NO_SUCH_DEVICE
Specified device object does not exist (removed, disabled, driver issue, config error).
Kernel Executive (I/O Manager / File System)
0xC000000F
STATUS_NO_SUCH_FILE
Specified file/directory does not exist; path error; missing boot file/dependency.
Kernel Executive (I/O Manager / Drivers)
0xC0000010
STATUS_INVALID_DEVICE_REQUEST
Unsupported IOCTL/FSCTL; invalid parameters for device; driver state invalid.
Kernel Executive (Security / I/O / Object Mgr / Filters)
0xC0000022
STATUS_ACCESS_DENIED
Insufficient permissions (ACLs), missing privileges, MIC violation, explicit block by filter driver (AV/EDR/DLP).
Kernel Executive (Object Manager)
0xC0000034
STATUS_OBJECT_NAME_NOT_FOUND
Named kernel object (file, key, event, etc.) does not exist; path error; stale SMB cache.
Kernel Executive (Object Manager / FS / Registry)
0xC0000035
STATUS_OBJECT_NAME_COLLISION
Attempt to create an object (file, key, named object) that already exists.
Kernel Executive (Object Manager)
0xC000003A
STATUS_OBJECT_PATH_NOT_FOUND
Intermediate directory/key component in a hierarchical path does not exist.
Kernel Executive (I/O Manager / File System)
0xC0000043
STATUS_SHARING_VIOLATION
File open request conflicts with existing open handle's sharing modes; filter driver interference.
Kernel Executive (Process Manager)
0xC000000B
STATUS_INVALID_CID
Invalid or non-existent Process ID (PID) or Thread ID (TID) supplied.
Kernel Executive (Process Manager)
0xC000004B
STATUS_THREAD_IS_TERMINATING
Operation attempted on a thread object that is already exiting.
Kernel Executive (Process Manager)
0xC000010A
STATUS_PROCESS_IS_TERMINATING
Operation attempted on a process object that is already exiting.
Kernel Executive (Various / Drivers)
0xC000009A
STATUS_INSUFFICIENT_RESOURCES
Kernel resource exhaustion (non-paged/paged pool, PTEs, threads, IRPs); often driver leak.
Kernel Executive (I/O Manager / Storage Drivers)
0xC0000185
STATUS_IO_DEVICE_ERROR
Hardware I/O error reported by storage device (disk failure, bad sector, cable issue, driver bug).
Kernel Executive (Configuration Manager)
0xC000014C
STATUS_REGISTRY_CORRUPT
Registry hive file is corrupt on disk or in memory; disk error; improper shutdown.
Win32 API (Various)
0
ERROR_SUCCESS
Operation completed successfully.
Win32 API (KERNEL32/KERNELBASE)
1
ERROR_INVALID_FUNCTION
Unsupported or incorrect function called (generic).
Win32 API (KERNEL32/KERNELBASE)
2
ERROR_FILE_NOT_FOUND
File/directory does not exist; path error; missing dependency. (Win32 equivalent of STATUS_NO_SUCH_FILE).
Win32 API (KERNEL32/KERNELBASE)
3
ERROR_PATH_NOT_FOUND
Intermediate path component does not exist; invalid drive. (Win32 equivalent of STATUS_OBJECT_PATH_NOT_FOUND).
Win32 API (Various)
5
ERROR_ACCESS_DENIED
Insufficient permissions, missing privilege, integrity violation, read-only attribute, block by filter driver. (Win32 equivalent of STATUS_ACCESS_DENIED).
Win32 API (KERNEL32/KERNELBASE, etc.)
6
ERROR_INVALID_HANDLE
Handle is invalid, closed, uninitialized, corrupted, or wrong type. (Win32 equivalent of STATUS_INVALID_HANDLE).
Win32 API (KERNEL32/USER32/GDI32)
8
ERROR_NOT_ENOUGH_MEMORY
Virtual memory, heap, USER/GDI object exhaustion; memory leak. (Win32 equivalent of STATUS_NO_MEMORY).
Win32 API (KERNEL32/KERNELBASE)
15
ERROR_INVALID_DRIVE
Specified drive letter does not exist or is unavailable.
Win32 API (KERNEL32/KERNELBASE)
19
ERROR_WRITE_PROTECT
Attempt to write to write-protected media.
Win32 API (KERNEL32/KERNELBASE)
32
ERROR_SHARING_VIOLATION
File access/sharing mode conflicts with existing open handle; file locked by another process/filter. (Win32 equivalent of STATUS_SHARING_VIOLATION).
Win32 API (KERNEL32/KERNELBASE)
33
ERROR_LOCK_VIOLATION
Attempt to access a file region locked by another process/handle using LockFile(Ex).
Win32 API (Various)
87
ERROR_INVALID_PARAMETER
Incorrect argument passed to API function (value range, NULL pointer, bad flags, malformed string).
Win32 API (Various)
122
ERROR_INSUFFICIENT_BUFFER
Caller-provided buffer is too small for the data to be returned by the API.
Win32 API (KERNEL32/KERNELBASE)
183
ERROR_ALREADY_EXISTS
Attempt to create a file/directory/object that already exists using create-new semantics. (Win32 equivalent of STATUS_OBJECT_NAME_COLLISION).
COM/OLE / COM Servers
0x80004001
E_NOTIMPL
Called COM method is not implemented by the server object.
COM/OLE (OLE32/COMBASE)
0x80004002
E_NOINTERFACE
Requested COM interface (IID) is not supported by the object queried; proxy/stub issue; registration error.
Note: This table provides illustrative examples and brief summaries. Refer to the main catalog for details. Filter driver influence is a common factor not always explicitly stated here.

Works Cited

  1. Components of the Windows Hardware Error Architecture - Windows ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/whea/components-of-the-windows-hardware-error-architecture
  2. Propagation - WCF | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/dotnet/framework/wcf/diagnostics/tracing/propagation
  3. RtlNtStatusToDosError function (winternl.h) - Win32 apps | Microsoft ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-rtlntstatustodoserror
  4. Microsoft-specific exception handling mechanisms - Wikipedia, accessed May 12, 2025, https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms
  5. Syscalls via Vectored Exception Handling - RedOps - English, accessed May 12, 2025, https://redops.at/en/blog/syscalls-via-vectored-exception-handling
  6. Return STATUS_PENDING in Create Callback. · Issue #547 - GitHub, accessed May 12, 2025, https://github.com/winfsp/winfsp/issues/547
  7. IoCreateFile function (wdm.h) - Windows drivers - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-iocreatefile
  8. What causes SMB server error STATUS_INSUFFICIENT_RESOURCES (0xc000009a) ? | Microsoft Community Hub, accessed May 12, 2025, https://techcommunity.microsoft.com/discussions/windowsserver/what-causes-smb-server-error-status-insufficient-resources-0xc000009a-/3948713
  9. WdfDriverCreate fails with status of 0xC000009A - NTDEV - OSR Developer Community, accessed May 12, 2025, https://community.osr.com/t/wdfdrivercreate-fails-with-status-of-0xc000009a/53006
  10. error WSAENOBUFS (10055) - Windows Client | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/connect-tcp-greater-than-5000-error-wsaenobufs-10055
  11. What causes winsock 10055 errors? How should I troubleshoot? - Server Fault, accessed May 12, 2025, https://serverfault.com/questions/399311/what-causes-winsock-10055-errors-how-should-i-troubleshoot
  12. [MS-ERREF]: NTSTATUS Values | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
  13. ntstatus.h - CodeMachine, accessed May 12, 2025, https://codemachine.com/downloads/win71/ntstatus.h
  14. ntoskrnl.exe causing crashes and BSOD, even in safe mode - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/ntoskrnlexe-causing-crashes-and-bsod-even-in-safe/73055535-78e0-417e-9b64-d9c91bc7997b
  15. Troubleshooting Windows Startup and Shutdown Problems | Microsoft Press Store, accessed May 12, 2025, https://www.microsoftpressstore.com/articles/article.aspx?p=2201310
  16. NT Internals - Nynaeve, accessed May 12, 2025, http://www.nynaeve.net/?cat=10
  17. Alex Ionescu's Blog – Windows Internals, Thoughts on Security, and Reverse Engineering, accessed May 12, 2025, https://www.alex-ionescu.com/
  18. Blinding Sysmon: How to disable Windows monitoring in a covert way - HackMag, accessed May 12, 2025, https://hackmag.com/security/sysmon-blinding/
  19. Book Review: Windows Kernel Programming and Creating Drivers of Select Exercises, accessed May 12, 2025, https://truneski.github.io/post/2020/04/03/book-review-windows-kernel-programming-and-creating-drivers-of-select-exercises/
  20. "STATUS_SHARING_VIOLATION" error message when you try to open a highly fragmented file on a computer that is running Windows 7 or Windows Server 2008 R2 - Microsoft Support, accessed May 12, 2025, https://support.microsoft.com/en-us/topic/-status-sharing-violation-error-message-when-you-try-to-open-a-highly-fragmented-file-on-a-computer-that-is-running-windows-7-or-windows-server-2008-r2-be899c3b-8c5a-c883-ce0d-055d258a9178
  21. BSOD Problems INTERNAL POWER ERROR crashdump ntoskrnl - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/bsod-problems-internal-power-error-crashdump/493a90bd-549f-49b2-bf30-bb98cfa2d1fc
  22. GUI application Execution fails after porting an application from VS2015 to VS2022. - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/answers/questions/2140710/gui-application-execution-fails-after-porting-an-a
  23. Faulting module name: KERNELBASE.dll - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/faulting-module-name-kernelbasedll/d5a7b008-eb11-4e9e-ab5f-63016fe760d9
  24. Kernel32.dll - Glossary - DevX, accessed May 12, 2025, https://www.devx.com/terms/kernel32-dll/
  25. How to correct common User32.dll file errors - Microsoft Support, accessed May 12, 2025, https://support.microsoft.com/en-us/topic/how-to-correct-common-user32-dll-file-errors-3b34cc67-5741-ce2b-cc7d-86d5410f44f4
  26. Is user32.dll the "WinApi" msdn speaks of? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/48823107/is-user32-dll-the-winapi-msdn-speaks-of
  27. Quickly Fix the GDI32.dll was not Found Error on Windows - Fortect, accessed May 12, 2025, https://www.fortect.com/fix-dll-errors/gdi32-dll-not-found-windows/
  28. How to Fix Gdi32.dll Not Found or Missing Errors - TechSpace, accessed May 12, 2025, https://techspace.co.th/help/kb/systems/os/win10/how-to-fix-gdi32-dll-not-found-or-missing-errors
  29. How to Fix Advapi32.dll Not Found or Missing Errors - Lifewire, accessed May 12, 2025, https://www.lifewire.com/how-to-fix-advapi32-dll-not-found-or-missing-errors-2622982
  30. Advapi32.dll not found: what to do if this error occurs on your PC? - DiskInternals, accessed May 12, 2025, https://www.diskinternals.com/partition-recovery/advapi32-dll-not-found/
  31. How to Fix Shell32.dll Not Found or Missing Errors - Lifewire, accessed May 12, 2025, https://www.lifewire.com/how-to-fix-shell32-dll-not-found-or-missing-errors-2624008
  32. ShellExecuteA function (shellapi.h) - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-shellexecutea
  33. HRESULT Error Codes | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/shows/inside/hresult
  34. Error Codes in COM - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/learnwin32/error-codes-in-com
  35. COM Error Codes (Generic) (Winerror.h) - Win32 apps | Microsoft ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/com/com-error-codes-1
  36. Error the RPC server is unavailable - Windows Server | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/not-log-on-error-rpc-server-unavailable
  37. RPC error troubleshooting guidance - Windows Client | Microsoft ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/rpc-errors-troubleshooting
  38. impacket/impacket/hresult_errors.py at master · fortra/impacket - GitHub, accessed May 12, 2025, https://github.com/SecureAuthCorp/impacket/blob/master/impacket/hresult_errors.py
  39. HRESULT (Enums) - PInvoke.net, accessed May 12, 2025, https://www.pinvoke.net/default.aspx/Enums/HRESULT.html
  40. Exception.HResult Property (System) | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/dotnet/api/system.exception.hresult?view=net-9.0
  41. How to: Map HRESULTs and Exceptions - .NET Framework ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/dotnet/framework/interop/how-to-map-hresults-and-exceptions
  42. Why am I getting linker errors for ws2_32.dll in my C program? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/5220309/why-am-i-getting-linker-errors-for-ws2-32-dll-in-my-c-program
  43. bind function (winsock.h) - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-bind
  44. connect function (winsock2.h) - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-connect
  45. Windows Sockets Error Codes (Winsock2.h) - Win32 apps ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/winsock/windows-sockets-error-codes-2
  46. FwpmCalloutAdd0 function (fwpmk.h) - Windows drivers - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/fwpmk/nf-fwpmk-fwpmcalloutadd0
  47. Roadmap for Developing WFP Callout Drivers - Windows drivers ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/network/roadmap-for-developing-wfp-callout-drivers
  48. Data corruption and network issues when you run a WFP-based application on a computer that is running Windows - Microsoft Support, accessed May 12, 2025, https://support.microsoft.com/en-us/topic/data-corruption-and-network-issues-when-you-run-a-wfp-based-application-on-a-computer-that-is-running-windows-d9316101-56f4-bc72-3001-83d3dd02b7a4
  49. NDIS LWF driver causing issues for WFP drivers in the network stack? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/69554075/ndis-lwf-driver-causing-issues-for-wfp-drivers-in-the-network-stack
  50. Roadmap for Developing NDIS Drivers - Windows - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/network/roadmap-for-developing-ndis-drivers
  51. NDIS Filter Drivers - Windows drivers | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/network/ndis-filter-drivers
  52. Socket error #11001: Host not found - Remote Utilities, accessed May 12, 2025, https://www.remoteutilities.com/support/kb/socket-error-11001-host-not-found/
  53. Socket error 11001 or 11004 when testing an alert - Pingman Tools, accessed May 12, 2025, https://www.pingman.com/kb/article/socket-error-11001-or-11004-when-testing-an-alert-45.html
  54. About File System Filter Drivers - Windows drivers | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/about-file-system-filter-drivers
  55. CmCallbackGetKeyObjectID function (wdm.h) - Windows drivers - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-gb/windows-hardware/drivers/ddi/wdm/nf-wdm-cmcallbackgetkeyobjectid
  56. CmCallbackGetKeyObjectIDEx function (wdm.h) - Windows drivers ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-cmcallbackgetkeyobjectidex
  57. Filtering Registry Calls - Windows drivers - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/filtering-registry-calls
  58. CmRegisterCallbackEx function (wdm.h) - Windows drivers - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-cmregistercallbackex
  59. EX_CALLBACK_FUNCTION (wdm.h) - Windows drivers | Microsoft ..., accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nc-wdm-ex_callback_function
  60. Mini-filter and sharing violation in post-cleanup callback - OSR Developer Community, accessed May 12, 2025, https://community.osr.com/t/mini-filter-and-sharing-violation-in-post-cleanup-callback/24822
  61. Datacom Server TCPIP error 10061 WSAECONNREFUSED Connection Refused, accessed May 12, 2025, https://knowledge.broadcom.com/external/article/203992/datacom-server-tcpip-error-10061-wsaecon.html
  62. Why do Marshal products report Winsock errors? - Trustwave Support, accessed May 12, 2025, https://support.trustwave.com/kb/Goto12989.aspx
  63. Socket error 10060 (WSAETIMEDOUT) - TN3270 Plus User Guide, accessed May 12, 2025, https://www.sdisw.com/tn3270/manual/wsaetimedout.htm
  64. Socket errors 10060, 10061, 10064, 10065, accessed May 12, 2025, https://hstechdocs.helpsystems.com/manuals/globalscape/archive/cuteftp6/socket_errors_10060,_10061,_10064,_10065.htm
  65. Windows BSOD driver/Windows Install Issues. : r/techsupport - Reddit, accessed May 12, 2025, https://www.reddit.com/r/techsupport/comments/1im90j2/windows_bsod_driverwindows_install_issues/
  66. How To Fix a Blue Screen of Death (BSOD) on Windows PC - Secure Data Recovery Services, accessed May 12, 2025, https://www.securedatarecovery.com/blog/fixing-blue-screen-of-death
  67. Introduction to TroubleShootingScript toolset (TSS) - Windows Client | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/windows-tss/introduction-to-troubleshootingscript-toolset-tss
  68. Handling an IRP that the Framework does not Support - Windows drivers | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/wdf/handling-an-irp-that-the-framework-does-not-support
  69. The NT Insider:Secrets of the Universe Revealed! - How NT Handles I/O Completion, accessed May 12, 2025, https://www.osronline.com/article.cfm%5Eid=83.htm
  70. Use NTSTATUS Values - Windows drivers | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-ntstatus-values
  71. System Error Codes (0-499) (WinError.h) - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-
  72. Windows Error Codes (MSDN) | PDF | Component Object Model - Scribd, accessed May 12, 2025, https://www.scribd.com/doc/89465561/Windows-Error-Codes-MSDN
  73. [MS-ERREF]: HRESULT Values | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/705fb797-2175-4a90-b5a3-3918024b10b8
  74. Common HRESULT Values - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/seccrypto/common-hresult-values
  75. COM Error Codes (STG, RPC) (Winerror.h) - Win32 apps - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/com/com-error-codes-3
  76. WSASendMsg function (winsock2.h) - Win32 apps | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winsock2/nf-winsock2-wsasendmsg
  77. Troubleshooting endpoint data loss prevention configuration and policy sync, accessed May 12, 2025, https://learn.microsoft.com/en-us/purview/dlp-edlp-tshoot-sync
  78. How to All Error of Encountered a Sharing Violation while Accessing in Windows PC, accessed May 12, 2025, https://www.youtube.com/watch?v=zZ8FMTCxm9Y
  79. Performance and consistency issues when modules or driver are loaded - SQL Server, accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/sql/database-engine/performance/performance-consistency-issues-filter-drivers-modules
  80. Error Code 0xc0000005 in Windows 10? Fix it! - DiskInternals, accessed May 12, 2025, https://www.diskinternals.com/partition-recovery/error-code-0xc0000005-in-windows-10-fix-it/
  81. 0xc0000005 System Access Violation but Unsure the Trigger is (Chrome, Discord and TiWorker.exe triggers) - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/0xc0000005-system-access-violation-but-unsure-the/d1a98a35-1d76-482d-a462-e804c61c501c
  82. How to Resolve STATUS_IN_PAGE_ERROR (0xc0000006 Error)? - Auslogics, accessed May 12, 2025, https://www.auslogics.com/en/articles/fix-status-in-page-error-0xc0000006-error/
  83. error code 0xc0000006 - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/error-code-0xc0000006/47039af9-8cd4-4689-a3f2-498f10e4ef94
  84. How to Fix Windows 10 Upgrade Error Code 0xc0000017 - EaseUS Software, accessed May 12, 2025, https://www.easeus.com/computer-instruction/how-to-fix-windows-10-upgrade-error-0xc0000017.html
  85. Fix Windows 10 Error 0xc0000017 - Computer Repairs, accessed May 12, 2025, https://itfix.org.uk/fix-windows-10-error-0xc0000017/
  86. How to fix error 0xc00000e in Windows - IONOS, accessed May 12, 2025, https://www.ionos.com/digitalguide/server/configuration/0xc00000e/
  87. Error 0xc00000e : r/techsupport - Reddit, accessed May 12, 2025, https://www.reddit.com/r/techsupport/comments/18xzf06/error_0xc00000e/
  88. Computer won't boot and have code 0xc000000f - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/computer-wont-boot-and-have-code-0xc000000f/72862f9f-514a-44c7-b1ed-c10743bfbab7
  89. [SOLVED]: How to Fix 0xc000000f Error on Windows and Regain Control - Geekflare, accessed May 12, 2025, https://geekflare.com/dev/fix-0xc000000f-error-on-windows/
  90. Randomly getting STATUS_INVALID_DEVICE_REQUEST for every smbclient calls · Issue #154 · jborean93/smbprotocol - GitHub, accessed May 12, 2025, https://github.com/jborean93/smbprotocol/issues/154
  91. How To Fix The Blue Screen Error Stop Code THREAD STUCK IN DEVICE DRIVER In Windows 10/11 [Tutorial] - YouTube, accessed May 12, 2025, https://www.youtube.com/watch?v=nSMCwPDI1fI
  92. failed to start with the following error: 0xC0000022 - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/failed-to-start-with-the-following-error/31b73dd1-20ce-45b5-bc37-8cb458e79dfe
  93. Error 0xC0000022 access denied, while trying to activate windows - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/error-0xc0000022-access-denied-while-trying-to/ac8ac291-0c56-42f7-97d6-33f62f48a78d
  94. Fix Windows 10 Error code 0xc0000034 - DiskInternals, accessed May 12, 2025, https://www.diskinternals.com/partition-recovery/0xc0000034/
  95. BSOD Error Code 0xc0000034 and compatibility issue with USB boot - Windows 10 Forums, accessed May 12, 2025, https://www.tenforums.com/bsod-crashes-debugging/74137-bsod-error-code-0xc0000034-windows-10-a.html
  96. "STATUS_OBJECT_NAME_NOT_FOUND" error message when you open a newly-created file in a shared folder in Windows 7 or in Windows Server 2008 R2 - Microsoft Support, accessed May 12, 2025, https://support.microsoft.com/en-us/topic/-status-object-name-not-found-error-message-when-you-open-a-newly-created-file-in-a-shared-folder-in-windows-7-or-in-windows-server-2008-r2-111de51c-ea2e-8c68-3ce9-9185a93bb8b8
  97. PerfDiag Logger failed to start 0xC0000035 - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/perfdiag-logger-failed-to-start-0xc0000035/c64191b6-2a2b-4423-a967-6ec4b75fdfe4
  98. We are getting STATUS_OBJECT_NAME_COLLISION in upload file even though file is not already exist on given path · Issue #551 · hierynomus/smbj - GitHub, accessed May 12, 2025, https://github.com/hierynomus/smbj/issues/551
  99. [MS-CIFS]: SMB Error Classes and Codes | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-cifs/8f11e0f3-d545-46cc-97e6-f00569e3e1bc
  100. STATUS_SHARING_VIOLATION when open file for the second time - NTDEV, accessed May 12, 2025, https://community.osr.com/t/status-sharing-violation-when-open-file-for-the-second-time/49156
  101. Windows Error Code 0xc0000185 - PC Outlet, accessed May 12, 2025, https://pcoutlet.com/software/windows/windows-error-code-0xc0000185
  102. Fix Windows 10/11 Startup Error Code 0xc0000185 - AnyRecover, accessed May 12, 2025, https://www.anyrecover.com/recover-computer-data/error-code-0xc0000185/
  103. PsLookupThreadByThreadId is failing with STATUS_INVALID_CID[0xC000000B] - NTDEV, accessed May 12, 2025, https://community.osr.com/t/pslookupthreadbythreadid-is-failing-with-status-invalid-cid-0xc000000b/49393
  104. Windows Thread Suspension Internals Part 1 - Reverse Engineering 0x4 Fun, accessed May 12, 2025, http://rce4fun.blogspot.com/2014/11/windows-thread-suspension-internals.html
  105. Fix: Boot Configuration Data Unreadable Error 0xc000014c - MiniTool Partition Wizard, accessed May 12, 2025, https://www.partitionwizard.com/partitionmagic/0xc000014c.html
  106. BSOD|| Technical Description of System Error (0xc000014c) - Arcserve Support, accessed May 12, 2025, https://support.arcserve.com/s/article/KB000009266
  107. How to convert specific NTSTATUS value to the Hresult? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/25566234/how-to-convert-specific-ntstatus-value-to-the-hresult
  108. Which API returns the message for NTSTATUS? - c++ - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/78683179/which-api-returns-the-message-for-ntstatus
  109. Error 5 : Access Denied when starting windows service - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/4267051/error-5-access-denied-when-starting-windows-service
  110. What causes WriteFile to return ERROR_ACCESS_DENIED? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/4312568/what-causes-writefile-to-return-error-access-denied
  111. Access is denied on 0x80070005 - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/access-is-denied-on-0x80070005/0ad70e81-2343-4bb7-99a9-78f3d9ea578c
  112. Windows Server error "Access is denied (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))" - Support and Troubleshooting, accessed May 12, 2025, https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB0564283
  113. Why am I getting Error Code 6 on StartService? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/13254487/why-am-i-getting-error-code-6-on-startservice
  114. 0x6 ERROR_INVALID_HANDLE error when a multithreaded application accesses a smart card - Windows Client | Microsoft Learn, accessed May 12, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-client/certificates-and-public-key-infrastructure-pki/0x6-error-invalid-handle-multithreaded-application
  115. "Win32Exception Not enough storage is available to process this command" error when run as a windows service - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/28920550/win32exception-not-enough-storage-is-available-to-process-this-command-error-w
  116. Why RegisterClass fails with ERROR_NOT_ENOUGH_MEMORY? - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/18893366/why-registerclass-fails-with-error-not-enough-memory
  117. Windows error 0x80070008 or 0x8007000E - BornCity, accessed May 12, 2025, https://borncity.com/win/2016/12/13/windows-error-0x80070008-or-0x8007000e/
  118. readlink on Windows cannot read app exec links · Issue #82015 · python/cpython - GitHub, accessed May 12, 2025, https://github.com/python/cpython/issues/82015
  119. Error Reference Difference PDF - Scribd, accessed May 12, 2025, https://fr.scribd.com/document/434230838/Error-Reference-difference-pdf
  120. OpenProcess error 87 invalid parameter - winapi - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/4988082/openprocess-error-87-invalid-parameter
  121. NT Error Code 87 - Microsoft: Windows servers | Tek-Tips, accessed May 12, 2025, https://www.tek-tips.com/threads/nt-error-code-87.112376/
  122. ERROR_INSUFFICIENT_BUFFER returned from GetAdaptersAddresses - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/12279135/error-insufficient-buffer-returned-from-getadaptersaddresses
  123. error 183 Cannot create a file when that file already exists. Unable to start WPAS service, accessed May 12, 2025, https://learn.microsoft.com/en-us/answers/questions/2198391/error-183-cannot-create-a-file-when-that-file-alre?forum=windowserver-all&referrer=answers
  124. Error [183] Cannot create a file when that file already exists. | NTLite Forums, accessed May 12, 2025, https://www.ntlite.com/community/index.php?threads/error-183-cannot-create-a-file-when-that-file-already-exists.4310/
  125. Not implemented (Exception from HRESULT: 0x80004001 (E_NOTIMPL)) - Forums, Autodesk, accessed May 12, 2025, https://forums.autodesk.com/t5/inventor-programming-ilogic/not-implemented-exception-from-hresult-0x80004001-e-notimpl/td-p/2640018
  126. Visual Studio 2013 Error Message: 0x80004001 (E_NOTIMPL) - Stack Overflow, accessed May 12, 2025, https://stackoverflow.com/questions/29711395/visual-studio-2013-error-message-0x80004001-e-notimpl
  127. Thread: [RESOLVED] Interopt.Excel issue or something else? - VBForums, accessed May 12, 2025, https://www.vbforums.com/showthread.php?910455-RESOLVED-Interopt-Excel-issue-or-something-else
  128. HRESULT: 0x80004002 (E_NOINTERFACE) from STA Thread - Help - Intuit, accessed May 12, 2025, https://help.developer.intuit.com/s/question/0D5G000004Dk61AKAR/hresult-0x80004002-enointerface-from-sta-thread
  129. NTSTATUS Error Code List - David Vielmetter -, accessed May 12, 2025, https://davidvielmetter.com/tips/ntstatus-error-code-list/
  130. stop code system thread exception not handled.. after reboot its - Microsoft Community, accessed May 12, 2025, https://answers.microsoft.com/en-us/windows/forum/all/stop-code-system-thread-exception-not-handled/18a0655e-dc28-4014-8625-eba67b9dff93
  131. [MS-ERREF]: Win32 Error Codes - Learn Microsoft, accessed May 12, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d
  132. squid.sourceforge.net, accessed May 12, 2025, https://squid.sourceforge.net/changesets/squid3/patches/631.patch

More from Thanh Trung Le

All posts

Related posts