This is going to be very short post, however, I still feel it’s important to understand how to use the !error extension in order to extract some readable and understandable information about a NTSTATUS error.
Here’s a current list of NTSTATUS Errors – 2.3.1 NTSTATUS values
The NTSTATUS are used by kernel-mode drivers which support standard driver routines and driver support routines. Some driver return a NTSTATUS value as their return type, in order to display information regarding: success values, informational values, warnings and error values.
We can therefore use the !error extension with the value displayed by the NTSTATUS value:
Stop: 0x0000007E (0xC000005, 0x95E5529C, 0xA12C0B40, 0xA12C0720
Here’s a little snippet I’ve taken from a dump, notice the 0xC000005, this is a NTSTATUS error, we can use the !error extension with this value to display the following result:
The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
This is usually due to drivers referencing invalid memory addresses.