Workaround for Unexpected Error in PowerCfg -SleepStudy

PowerCfg is a nifty little tool for analyzing and configuring all kinds of things related to battery usage and power plans. In Windows 8.1 PowerCfg learned how to analyze the effectiveness of connected standby, a new low-power mode introduced in Windows 8 that enables applications to stay connected while the device (mostly) sleeps. All the more frustrating when that new command suddenly stops working.

How It Should Be

Before running an analysis of connected standby make sure your device supports it with the command powercfg -a (most laptops do not, tablets had better or you should get something else). Then try to generate the connected standby report on an elevated command prompt with powercfg -sleepstudy. If that works, congratulations. Bookmark this page and come back when it does not any more.

How It Is

Powercfg -sleepstudy is supposed to generated an HTML report in C:\ProgramData\Microsoft\Windows\SleepStudy. I had used if successfully before, a report dating back two weeks proves that. But when I run the command today all I get is this:

“An unexpected error condition has occurred. Unable to perform operation. You may not have permission to perform this operation.”

Analysis

With an error like that the first thing I do is monitor the program’s execution with Sysinternals Process Monitor. There might be some missing file or incorrectly set permission that causes the problem. The ProcMon trace also shows nicely which files are created by the analyzed program.

I quickly found that PowerCfg creates the file %temp%\sleepstudy-report.xml and writes to it. A little bit later it opens the file and closes it again. That is near the end of the trace. In situations like this one it can be helpful to know which DLL and optionally which function is doing the work. You can get that information easily by double-clicking an event and switching to the tab Stack. When %temp%\sleepstudy-report.xml is created the function doing the work is SaveSleepStudyReport in energy.dll. When the file is opened again the function is TransformSleepStudyReport as this screenshot shows:

Sure enough, the file sleepstudy-report.xml was sitting in the temp directory and it was updated when I reran the PowerCfg command. Getting the data obviously worked. It seemed that only the last step, the conversion from XML to human-friendly HTML was broken.

Where the Data Comes From

With a little digging around I found that the actual data is collected via Event Tracing for Windows (ETW) and stored in C:\Windows\System32\wdi\SleepStudy. On my tablet that directory contained 66 .ETL files, some from that same day, so the data collection obviously worked.

The command powercfg -sleepstudy does nothing but read the existing (binary) data, convert it first to XML and then to HTML.

More Analysis

As a next step I wanted to know why the function TransformSleepStudyReport failed, in other words I wanted to know its return code. In order to get that an API monitoring tool like Rohitab API Monitor is required. Rohitab’s program is surprisingly easy to easy while being extremely powerful. Unfortunately there seems to be a bug affecting the tool on Windows 8.1 – I could not get it to launch PowerCfg.exe elevated, neither did the new process notification work.

I turned to OllyDbg, a powerful free debugger that unfortunately is lacking a bit on the UX side. I have by no means mastered this tool, but I was able to determine that TransformSleepStudyReport is being called with just two parameters: the input file and the output file. To my dismay I was not able to determine that function’s return value.

Writing My Own

That was when I decided to write my own little tool that calls TransformSleepStudyReport in energy.dll. I knew it would not be difficult because I had the parameters, and in my own tool I would finally see the function’s return value.

I did, and I got the return value. Converted to a string it said “unknown error”. Not much better than PowerCfg’s output “An unexpected error condition has occurred”.

I had suspected the intermediate XML with to be faulty for some time, but with my own tool I was finally able to test my hypothesis. What if there was a syntax error in the XML? I uploaded the file to an online XML checker that promptly complained about this line:

Do you see what’s wrong?

Hint: double quotes in a string enclosed in double quotes

I replaced the double quotes in the string with ". The line now looked like this:

Then I ran my tool again – and the HTML report appeared!

DIY

This is what you can do when powercfg -sleepstudy fails with unexpected error condition:

1. Download my tool TransformSleepStudyReport.exe
2. Fix the quotes in %temp%\sleepstudy-report.xml
3. Run: TransformSleepStudyReport.exe C:\Users\Username\AppData\Local\Temp\sleepstudy-report.xml report.html