Why does FormatMessage only create partial messages for ERROR_SYSTEM_PROCESS_TERMINATED and ERROR_UNHANDLED_EXCEPTION system errors?

Question

I have been using the FormatMessage function within the Windows API to generate message strings from system error codes. I noticed that for some error codes the full message doesn't appear to be created.

Take this sample program as an example:

int main()
{
  wchar_t * buffer = nullptr;
  FormatMessageW(
    FORMAT_MESSAGE_FROM_SYSTEM 
    | FORMAT_MESSAGE_ALLOCATE_BUFFER 
    | FORMAT_MESSAGE_IGNORE_INSERTS, 
    nullptr, 
    ERROR_SYSTEM_PROCESS_TERMINATED,
    MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
    reinterpret_cast<LPWSTR>(&buffer), 
    0, 
    nullptr);

  std::wcout << buffer << std::endl;
  return 0;
}

According to MSDN I should see the following:

{Fatal System Error}
The %hs system process terminated unexpectedly with a status of 0x%08x (0x%08x 0x%08x). The system has been shut down.

However, in the sample program I will see:

{Fatal System Error}
The %hs system process terminated unexpectedly with a status of 0x

I noticed that ERROR_UNHANDLED_EXCEPTION also doesn't create the full message (when compared to the list on MSDN). Both of the expected messages contain 0x%08 placeholders, but the message ends after 0x.

From what I can see, other error messages appear to match the lists on MSDN (i.e. the issue appears to be restricted to ERROR_UNHANDLED_EXCEPTION and ERROR_SYSTEM_PROCESS_TERMINATED).

---

Credit to engf-010 - you get the same if you use the Error Lookup tool in Visual Studio (Tools - Error Lookup). The error codes are 574 and 591.

---

Does anyone know why these messages are being cropped?

Is there anyway to get the full message?

Answer 1

The messages you mention (ERROR_UNHANDLED_EXCEPTION and ERROR_SYSTEM_PROCESS_TERMINATED) have printf-style inserts (%08x). However, FormatMessage uses %0 to terminate a message.

My guess is that there's another avenue where these messages are returned by the system with the printf-style placeholders already populated; these messages, in their raw form, are not meant to be handled by FormatMessage.

Given that these messages contain the text (Fatal System Error) or (Application Error), it is not altogether surprising that Windows handles these message specially.