Who is GWES and why does it keep apologizing?


I’ve seen this question a few times on the newsgroup so I thought I’d take a stab at it. We’re having another freak winter storm in Redmond so it’s not like I can leave work anyway…

"We're Sorry.." screenshot

What is GWES?

Gwes is the Graphical Windowing and Event Subsystem. It’s one little program that draws all the controls on the device like scrollbars, buttons, and checkboxes. It also handles passing window messages back and forth between applications and manages the WndProcs of all of the programs on the device that are displaying UI.

So why does it crash all the time?

A crash dump (“Watson dump”) is usually triggered by an unhandled exception in a program. It packages up a callstack and some diagnostics and queues it for transmission up to our Windows Error Reporting database.

If a program (let’s call it test.exe) crashes inside WinMain, the exception gets out to the unhandled exception trap in the kernel which creates the Watson dump and then terminates test.exe.

But what if test.exe crashes inside its WndProc? The exception travels up the callstack. The next process up the callstack is GWES – GWES is the process that calls each WndProc in the first place, because it’s marshalling the window messages throughout the system.

What if GWES didn’t handle exceptions that were thrown from your WndProc? Then any crashing WndProc would crash GWES without fail and take down the entire system. That doesn’t happen, so we know that’s not true. GWES handles exceptions thrown out of other WndProcs. So GWES is responsible for triggering a Watson dump when another program crashes in a WndProc.

The problem is that when the Watson dump is created, it sees that GWES is at the top of the callstack, so GWES gets the place of honor in the Watson UI that you see in the screenshot above. We have fixed this for future versions of the system [edit: including WM6] - crashes inside a WndProc will show the correct process name in the "We're Sorry..." UI.

Sometimes it really is just sorry.

That said, it is possible that GWES really is crashing for some reason. So please keep sending those error reports up to us. We use them to diagnose problems and prioritize fixes towards the crashes that customers are hitting the most often.



Comments (24)
  1. Jon Payne says:

    Does GWES eat some exceptions?

    If I create a standard Win32 Smart Device Project and add some code to make it crash at the start of WinMain, I see a crash as I would expect. If I move the same code to the WndProc function (eg in the IDM_HELP_ABOUT handler) the crash seems to get eatten by something and the program exits the message handler but continues running.

    Also, is there any way I can find out from a device that is showing a crash in GWES which module might have caused the crash?  Are the Dr Watson reports logged anywhere?

  2. Iulia says:

    Hello guys, I really do admire you for what you are doing, but I really have to day that this errors are really disappointing.

    How can you do such things? There should have never be a EULA invented in the first place.

    BTW: how come you advertise .net / C# programming so much ? I think it is not very appropriate  for mobile devices. Java like – a virtual machine should be banned from the mobile devices programming.

    Good luck and best regards!

  3. Shredded Peas says:

    Those blasted EULAs!  They’re always causing my GWES to crash!  Now if you’ll excuse me, I have a mobile C# programming job to apply for.

  4. nano says:

    Is it possible to store localy what Dr. Watson is reporting to Microsoft? I am interested mainly in call stack. Actually I was looking for a method for some time and found nothing.

  5. MikeCal says:

    Nano, if you’re looking to keep the watson callstacks on your device, you can set a registry key to keep them from being uploaded.  Unfortunately, the callstack will be in hex without symbols.  The translation back to symbols is done on the server.  So I’m not sure how much this will help you.  But here’s the key if you want to try it.




  6. Frazell Thomas says:

    The error reporting screen has always been an area i wanted to question. More specifically, how can MS ensure that the error report is sent at no cost to me?

  7. scyost says:

    Hi Frazell,

    Connection manager knows some things about which connections cost money and which ones don’t. I think in this case though, watson just queues up the reports and sends them across USB the next time you cradle to a PC.

  8. Rob Allan says:

    I’ve been experimenting with Dr Watson error logs on a CE 5.0 device, with mixed success. I’ve tried analysing the logs using Platform Builder, WinDbg, and the Windows CE Dump Viewer. I always see the following:

    – If I crash a console app, and open the .kdmp file in one of the applications listed above, I see a stack trace that relates to my app, and correctly identifies where the crash occurred.

    – If I crash a GUI app, and open the .kdmp file in one of the applications listed above, the stack trace is useless — it contains one or two levels of the gwes.exe stack, but nothing that relates to the program I was executing.

    Is this another symptom of the same issue that you describe in your blog? In other words, is Dr Watson not only wrongly attributing the blame to gwes.exe in the UI, but also storing gwes.exe state information in the .kdmp file, rather than information regarding the state of my app? If this is the case, will future versions fix this so that the .kdmp file allows me to analyse the state of my application?

    And one final question — in what version of the OS are these fixes slated for release?

  9. jefpav says:

    Please remind me how to get around the "access is denied" issue when trying to copy dumpfiles while the WM5 device is displaying the error reporting dialog.  I believe that the files are (possibly sent and) deleted after the dialog is closed.  

    The tutorial "Finding Windows CE bugs with help from "Dr. Watson"" at http://www.windowsfordevices.com/articles/AT7568439504.html uses the WM5 FileManager to copy the files, but I have had very limitied success with this technique because I receive "access is denied".  PC Explorer over activesync yields the same error.  What am I missing?  What’s the trick?

    Thanks in advance for the advice, (meanwhile I’ll just stop writing code that crashes. <smile>)


  10. seker says:


    I am very curious about GWES.exe.

    One thing I want to know is when the GWES.exe is restarted after crashed(closed itself).

  11. scyost says:

    Hi Jef,

    Because the crash dumps might contain passwords or other personally-identifiable information, they are stored in a directory that is restricted from reading. For a development device, I think the easiest way to get access to those dumps is to use the Device Security Configuration Manager to change the security policies on the device. You need one that has the Grant Manager set to USER_AUTH (16) so I’d probably use the "Security Off" policy set.

    Once you make that change, you should be able to access the directory over the ActiveSync connection.

  12. nicole says:

    so, in english, how does one get rid of these errors?

  13. Jeffrey says:

    Hi, I’m making a Pocket PC application in Sybase PocketBuilder and when I want to deploy the program to my Pocket PC (where Windows Mobile 5 is running), I get the same message as is shown in the screenshot above. So I have a problem with GWES.exe. When I run my application on another Pocket PC, here is Windows CE 2003 installed, I don’t have this problem. Does anyone knows how to fix this? I really tried everything. Please help, this is an application I have to make for school and I want it to work on WM 5!



  14. Jeffrey says:

    Hi, I found the problem, I was working with Sybase Pocketbuilder 2.0.0. I updated this to version 2.0.4. That fixed the problem!

  15. Carl says:

    My Moto Q is in the Key Lock mode and I just got the gwes.exe for the first time. I can only get the screen to light up by pressing the red on/off button. I can’t get the phone to respond so I can unlock the key pad. Can any one help me get my Q phone unlocked and past the gwes.exe?

  16. manubrain says:

    My Qtek S200 is completely blocked. I cannot dial any number, I cannot enter the phone because the key pad is also blocked and as such I cannot type my access code. Worst of all, it is in the lock mode.

    Please can some one tell me what to do in order to unblock my phone. Thanks in advance

  17. Ricardo says:

    Hello guys:

    I have an embedded visual C++ 3.0 aplication and I have a problem with windows mobile 5.0. When my aplication syncronize a SQL Server 2000 data base, the aplication shows de same window. I kill the aplication and restart it, and then I have problems saving data in the data base. Can anyone help me? I need to know how to fix the problem.

  18. I have the same problem Carl had with my Moto Q – Trying to avoid a hard reset I came across this post. How nice it would be to avoid that due to a crashed laptop – unable to sync etc… (it’s been a rough week ;)…

    I’ll check back in a couple of hours

  19. AnshNeedsHelp says:

    Hey i am working on WinCE 5.0 and DaVinci Board and I am getting Debuggers log as:::

    0 PID:0 TID:0 Sp=ffffc7cc

      2278 PID:41acdd16 TID:41d64a2a Data Abort: Thread=81acdad4 Proc=81025520 ‘gwes.exe’

      2279 PID:41acdd16 TID:41d64a2a AKY=00000011 PC=0004bca4(gwes.exe+0x0003bca4) RA=00054118(gwes.exe+0x00044118) BVA=0a000008 FSR=00000007

      2941 PID:41acdd16 TID:41d64a2a LMEMDEBUG: DLLExit Heap 0x7C010000 not destroyed


      2941 PID:41acdd16 TID:41d64a2a       Ptr=0x00110F00 Size=82 Count=2 hThrd=0x41D64A2A LineNum=0 File=

      2942 PID:41acdd16 TID:41d64a2a         Stack=0x03F91EEC

      2943 PID:41acdd16 TID:41d64a2a         Stack=0x0A042724

      2943 PID:41acdd16 TID:41d64a2a         Stack=0x0A016CC4

      2944 PID:41acdd16 TID:41d64a2a         Stack=0x0A016D94

      2944 PID:41acdd16 TID:41d64a2a         Stack=0x0A0172A4

      2945 PID:41acdd16 TID:41d64a2a         Stack=0x0A01625C

      2946 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2947 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

      2948 PID:41acdd16 TID:41d64a2a       Ptr=0x00110EA0 Size=184 Count=1 hThrd=0x41D64A2A LineNum=0 File=

      2948 PID:41acdd16 TID:41d64a2a         Stack=0x03F91EEC

      2949 PID:41acdd16 TID:41d64a2a         Stack=0x0A042724

      2950 PID:41acdd16 TID:41d64a2a         Stack=0x0A01EEA4

      2950 PID:41acdd16 TID:41d64a2a         Stack=0x0A017258

      2951 PID:41acdd16 TID:41d64a2a         Stack=0x0A01625C

      2952 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2952 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

      2953 PID:41acdd16 TID:41d64a2a LMEMDEBUG: DLLExit Heap 0x0 not destroyed


      2954 PID:41acdd16 TID:41d64a2a       Ptr=0x00110540 *CritSect*(0) Count=7 hThrd=0x41D64A2A LineNum=0 File=

      2954 PID:41acdd16 TID:41d64a2a         Stack=0x0A021488

      2955 PID:41acdd16 TID:41d64a2a         Stack=0x0A016250

      2956 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2956 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

      2957 PID:41acdd16 TID:41d64a2a       Ptr=0x001104E0 *Event* Count=6 hThrd=0x41D64A2A LineNum=0 File=

      2958 PID:41acdd16 TID:41d64a2a         Stack=0x0A0422B4

      2958 PID:41acdd16 TID:41d64a2a         Stack=0x0A016240

      2959 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2960 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

      2961 PID:41acdd16 TID:41d64a2a       Ptr=0x00110480 *CritSect*(0) Count=5 hThrd=0x41D64A2A LineNum=0 File=

      2961 PID:41acdd16 TID:41d64a2a         Stack=0x0A016238

      2962 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2962 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

      2963 PID:41acdd16 TID:41d64a2a       Ptr=0x001103C0 *CritSect*(0) Count=4 hThrd=0x41D64A2A LineNum=0 File=

      2963 PID:41acdd16 TID:41d64a2a         Stack=0x0A0163C4

      2964 PID:41acdd16 TID:41d64a2a         Stack=0x03F8DDCC

  20. Mike Landis says:

    I have applications that run flawlessly in debug mode but generate GWES errors in release mode.  I’d really like to find a list of potential GWES vulnerabilities that I can scan the code for or recommendations for an exception handler that will provide maximum information about the source of the problem(s).  Any recommendations?

    Thanks, Mike


  21. Lin Orez says:

    I have a Dell X51v and several programs and 8 gb of memory.  Recently I did a hard reset and reloaded my software to distribute more to my SD card and now I consistently get the "we’re sorry…" Are there any newer versions of gwes.ex to down load?  

  22. prathu says:


    Am Developing an application for WM 6. When I install the application I am getting ApplicationName.exe(gwes.exe) error. i.e "We are sorry….".

    How can I handle the same in the code



  23. pandharinath says:

    Hi all,

    i created one multithreaded application in which in one thread i got folowing error and that after thread get exited


    Data Abort: Thread=9661ada8 Proc=80096c70 ‘Mpap.exe’

    AKY=00000801 PC=03f57a74(coredll.dll+0x00009a74) RA=03f5d594(coredll.dll+0x0000f594) BVA=63202738 FSR=00000405

    TLSKERN_NOFAULT set… bypassing kernel debugger.

    Data Abort: Thread=9661ada8 Proc=80096c70 ‘Mpap.exe’

    AKY=00000801 PC=03f6ffe8(coredll.dll+0x00021fe8) RA=50616548(???+0x50616548) BVA=3230312a FSR=00000405

    Exception ‘Data Abort’ Thread=9661ada8 AKY=00000801 PC=00000000 BVA=3230312a


    Can anybody know the reason please help me



  24. Remysor says:

    I have a GPS which has installed windows ce core 5 and it shows the error "Fatal application error …. gwes.exe has performed …..Program: gwes.exe , Exception: 0xC0000005 , Address: 00023914 "  and in boot menu it requests only nk.nb0. Is there anything I can do in this situation?

Comments are closed.

Skip to main content