A work-in-progress utility to decode hex-encoded Windows Hardware Event Architecture (WHEA) records.
WHEA events are output by the Microsoft-Windows-Kernel-WHEA
provider to the Microsoft-Windows-Kernel-WHEA/Operational
channel. You can view these events using standard Windows tools such as the Event Viewer application and Get-WinEvent
PowerShell command. The events are not parsed, with only the "raw data" provided in the form of a hex-encoded string. To parse an event provide the value of the RawData
field to DecodeWheaRecord
as the input argument. For example:
DecodeWheaRecord.exe 57684C6701000000200000000000000050434920180000800200000000000000
Expected size of WHEA_EVENT_LOG_ENTRY_HEADER record: 32
{
"Signature": "WhLg",
"Version": 1,
"Length": 32,
"Type": "Informational",
"OwnerTag": 541672272,
"Id": "AerNotGrantedToOs",
"Flags": "LogInternalEtw",
"PayloadLength": 0
}
Support for the large majority of WHEA events is present, as of Windows 11 22H2 and Windows Server 2022, but few have been tested against real test data. Adding support for the minority of events which are unsupported would also benefit by having real events to test against. If you're using this utility to parse an event which doesn't have a test case, as per the table below, please consider submitting it via a GitHub issue to help us verify the correctness of the implementation and improve support.
Entry ID | Symbolic name | Structure name | Test case | Notes |
---|---|---|---|---|
0x80000001 |
CmcPollingTimeout |
Unknown | No | |
0x80000002 |
WheaInit |
Unknown | No | |
0x80000003 |
CmcSwitchToPolling |
Unknown | No | |
0x80000004 |
DroppedCorrectedError |
WHEAP_DROPPED_CORRECTED_ERROR_EVENT |
No | |
0x80000005 |
StartedReportHwError |
WHEAP_STARTED_REPORT_HW_ERROR |
No | |
0x80000006 |
PFAMemoryOfflined |
WHEAP_PFA_MEMORY_OFFLINED |
No | |
0x80000007 |
PFAMemoryRemoveMonitor |
WHEAP_PFA_MEMORY_REMOVE_MONITOR |
No | |
0x80000008 |
PFAMemoryPolicy |
WHEAP_PFA_MEMORY_POLICY |
No | |
0x80000009 |
PshedInjectError |
WHEAP_PSHED_INJECT_ERROR |
No | |
0x8000000a |
OscCapabilities |
WHEAP_OSC_IMPLEMENTED |
Yes | |
0x8000000b |
PshedPluginRegister |
WHEAP_PSHED_PLUGIN_REGISTER |
No | |
0x8000000c |
AddRemoveErrorSource |
WHEAP_ADD_REMOVE_ERROR_SOURCE_EVENT |
Yes | |
0x8000000d |
WorkQueueItem |
Unknown | No | |
0x8000000e |
AttemptErrorRecovery |
WHEAP_ATTEMPT_RECOVERY_EVENT |
No | |
0x8000000f |
McaFoundErrorInBank |
WHEAP_FOUND_ERROR_IN_BANK_EVENT |
No | |
0x80000010 |
McaStuckErrorCheck |
WHEAP_STUCK_ERROR_EVENT |
No | |
0x80000011 |
McaErrorCleared |
WHEAP_ERROR_CLEARED_EVENT |
No | |
0x80000012 |
ClearedPoison |
WHEAP_CLEARED_POISON_EVENT |
No | |
0x80000013 |
ProcessEINJ |
WHEAP_PROCESS_EINJ_EVENT |
Yes | |
0x80000014 |
ProcessHEST |
WHEAP_PROCESS_HEST_EVENT |
Yes | |
0x80000015 |
CreateGenericRecord |
WHEAP_CREATE_GENERIC_RECORD_EVENT |
No | |
0x80000016 |
ErrorRecord |
WHEAP_ERROR_RECORD_EVENT |
No | |
0x80000017 |
ErrorRecordLimit |
Unknown | No | |
0x80000018 |
AerNotGrantedToOs |
None | Yes | No payload |
0x80000019 |
ErrSrcArrayInvalid |
WHEAP_ERR_SRC_ARRAY_INVALID_EVENT |
No | |
0x8000001a |
AcpiTimeOut |
WHEAP_ACPI_TIMEOUT_EVENT |
No | |
0x8000001b |
CmciRestart |
WHEAP_CMCI_RESTART_EVENT |
Yes | |
0x8000001c |
CmciFinalRestart |
Unknown | No | |
0x8000001d |
EntryEtwOverFlow |
WHEA_ETW_OVERFLOW_EVENT |
No | |
0x8000001e |
AzccRootBusSearchErr |
WHEA_AZCC_ROOT_BUS_ERR_EVENT |
No | |
0x8000001f |
AzccRootBusList |
WHEA_AZCC_ROOT_BUS_LIST_EVENT |
No | |
0x80000020 |
ErrSrcInvalid |
WHEAP_ERR_SRC_INVALID_EVENT |
No | |
0x80000021 |
GenericErrMemMap |
WHEAP_GENERIC_ERR_MEM_MAP_EVENT |
Yes | |
0x80000022 |
PshedCallbackCollision |
Unknown | No | |
0x80000023 |
SELBugCheckProgress |
WHEA_SEL_BUGCHECK_PROGRESS |
No | |
0x80000024 |
PshedPluginLoad |
WHEA_PSHED_PLUGIN_LOAD_EVENT |
No | |
0x80000025 |
PshedPluginUnload |
WHEA_PSHED_PLUGIN_UNLOAD_EVENT |
No | |
0x80000026 |
PshedPluginSupported |
WHEA_PSHED_PLUGIN_PLATFORM_SUPPORT_EVENT |
No | |
0x80000027 |
DeviceDriver |
WHEAP_DEVICE_DRV_EVENT |
No | |
0x80000028 |
CmciImplPresent |
WHEAP_CMCI_IMPLEMENTED_EVENT |
No | |
0x80000029 |
CmciInitError |
WHEAP_CMCI_INITERR_EVENT |
No | |
0x8000002a |
SELBugCheckRecovery |
Unknown | No | |
0x8000002b |
DrvErrSrcInvalid |
Unknown | No | |
0x8000002c |
DrvHandleBusy |
Unknown | No | |
0x8000002d |
WheaHeartbeat |
WHEA_PSHED_PLUGIN_HEARTBEAT |
No | No payload |
0x8000002e |
AzccRootBusPoisonSet |
WHEA_AZCC_SET_POISON_EVENT |
No | |
0x8000002f |
SELBugCheckInfo |
Unknown | No | |
0x80000030 |
ErrDimmInfoMismatch |
WHEA_PSHED_PLUGIN_DIMM_MISMATCH |
No | |
0x80000031 |
eDpcEnabled |
WHEAP_EDPC_ENABLED_EVENT |
Yes | |
0x80000032 |
PageOfflineDone |
WHEA_OFFLINE_DONE_EVENT |
No | |
0x80000033 |
PageOfflinePendMax |
Unknown | No | |
0x80000034 |
BadPageLimitReached |
Unknown | No | |
0x80000035 |
SrarDetail |
WHEA_SRAR_DETAIL_EVENT |
No | |
0x80000036 |
EarlyError |
Unknown | No | |
0x80000037 |
PcieOverrideInfo |
WHEAP_PCIE_OVERRIDE_INFO |
No | |
0x80000038 |
ReadPcieOverridesErr |
WHEAP_PCIE_READ_OVERRIDES_ERR |
No | |
0x80000039 |
PcieConfigInfo |
WHEAP_PCIE_CONFIG_INFO |
No | |
0x80000040 |
PcieSummaryFailed |
Unknown | No | |
0x80000041 |
ThrottleRegCorrupt |
WHEA_THROTTLE_REGISTRY_CORRUPT_EVENT |
No | |
0x80000042 |
ThrottleAddErrSrcFailed |
WHEA_THROTTLE_ADD_ERR_SRC_FAILED_EVENT |
No | No payload |
0x80000043 |
ThrottleRegDataIgnored |
WHEA_THROTTLE_REG_DATA_IGNORED_EVENT |
No | |
0x80000044 |
EnableKeyNotifFailed |
WHEA_PSHED_PLUGIN_ENABLE_NOTIFY_FAILED_EVENT |
No | |
0x80000045 |
KeyNotificationFailed |
WHEA_REGISTER_KEY_NOTIFICATION_FAILED_EVENT |
No | No payload |
0x80000046 |
PcieRemoveDevice |
WHEA_THROTTLE_PCIE_REMOVE_EVENT |
No | |
0x80000047 |
PcieAddDevice |
WHEA_THROTTLE_PCIE_ADD_EVENT |
No | |
0x80000048 |
PcieSpuriousErrSource |
WHEAP_SPURIOUS_AER_EVENT |
No | |
0x80000049 |
MemoryAddDevice |
WHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT |
No | |
0x8000004a |
MemoryRemoveDevice |
WHEA_THROTTLE_MEMORY_ADD_OR_REMOVE_EVENT |
No | |
0x8000004b |
MemorySummaryFailed |
WHEA_MEMORY_THROTTLE_SUMMARY_FAILED_EVENT |
No | |
0x8000004c |
PcieDpcError |
WHEAP_DPC_ERROR_EVENT |
No | |
0x8000004d |
CpuBusesInitFailed |
WHEA_PSHED_PI_CPU_BUSES_INIT_FAILED_EVENT |
No | |
0x8000004e |
PshedPluginInitFailed |
WHEA_PSHED_PLUGIN_INIT_FAILED_EVENT |
No | |
0x8000004f |
FailedAddToDefectList |
WHEA_FAILED_ADD_DEFECT_LIST_EVENT |
No | No payload |
0x80000050 |
DefectListFull |
WHEAP_PLUGIN_DEFECT_LIST_FULL_EVENT |
No | No payload |
0x80000051 |
DefectListUEFIVarFailed |
WHEAP_PLUGIN_DEFECT_LIST_UEFI_VAR_FAILED |
No | No payload |
0x80000052 |
DefectListCorrupt |
WHEAP_PLUGIN_DEFECT_LIST_CORRUPT |
No | No payload |
0x80000053 |
BadHestNotifyData |
WHEAP_BAD_HEST_NOTIFY_DATA_EVENT |
No | |
0x80000054 |
SrasTableNotFound |
WHEA_SRAS_TABLE_NOT_FOUND |
No | No payload |
0x80000055 |
SrasTableError |
WHEA_SRAS_TABLE_ERROR |
No | No payload |
0x80000057 |
SrasTableEntries |
WHEA_SRAS_TABLE_ENTRIES_EVENT |
No | |
0x80000057 |
RowFailure |
WHEAP_ROW_FAILURE_EVENT |
No | |
0x80000060 |
CpusFrozen |
Unknown | No | |
0x80000061 |
CpusFrozenNoCrashDump |
Unknown | No | |
0x80040010 |
PshedPiTraceLog |
WHEA_PSHED_PI_TRACE_EVENT |
No |
All content is licensed under the terms of The MIT License.