Basic Question About Error Codes RRS feed

  • Question

  • I'm writing a Driver (both the user space DLL and the WDF driver).  In the kernel code I see functions that return NTSTATUS.  So, I presume any errors and so forth are communicated by NTSTATUS codes.  I'm using GetLastError() in userspace when there's an error, and I don't think I'm getting back NTSTATUS codes.  For example, I got back an error in user space 170.  In winerror.h this corresponds to ERROR_BUSY, which would make sense.  There is no NTSTATUS code for 170 (0xAA).  Is this true, that kernel space uses one system and user space uses another?  If this is true . . . how do I map status from one to the other?  This is a fundamental question, which I haven't been able to find any clarity on. Any comments are more than appreciated. Thanks for taking the time to read this.
    Thursday, May 31, 2012 9:15 PM


  • Yes, the system defined kernel NTSTATUS codes are translated to Windows error codes by most usermode Win32 APIs (defined in winerror.h).

    A documented function to do the translaton is RtlNtStatusToDosError. 

    -- pa

    Thursday, May 31, 2012 11:30 PM

All replies

  • As Pavel pointed out there is a mapping.  Microsoft has the table at to give you some of the mapping.

    Don Burn Windows Filesystem and Driver Consulting Website: Blog:

    Friday, June 1, 2012 1:08 AM
  • you can also run winerror <error code> to see the mappings

    d -- This posting is provided "AS IS" with no warranties, and confers no rights.

    Friday, June 1, 2012 3:28 AM
  • You guys are all awesome. Thanks for the very detailed info, this was exactly what I needed.
    Friday, June 1, 2012 9:10 PM