If You Stop in the Debugger

If you do not see a reason why you stopped, the message may have been "lost in the noise." Disassemble backwards from the current location and see if any of the addresses pushed onto the stack are strings.

The following sample sessions indicate possible techniques to ferret out error message strings:

##u eip-0b L2 
0028:........ push xxxxxxxx 
0028:........ call dword ptr [__Debug_Out_Service (........)] 
##da xxxxxxxx 
0030:xxxxxxxx ... this is the error message... 

##u eip-0a L2 
0028:........ push xxxxxxxx 
0028:........ call yyyyyyyy 
##da xxxxxxxx 
0030:xxxxxxxx ... this might be the error message... 

##u eip-0d L3 
0028:........ push xxxxxxxx 
0028:........ call yyyyyyyy 
0028:........ add esp, nn 
##da xxxxxxxx 
0030:xxxxxxxx ... this might be the error message...