Jump to content

Blue screen of death

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by 207.69.136.197 (talk) at 20:24, 14 December 2005 (→Windows NT/2000/XP). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

A Bluescreened Public Internet Payphone

The Blue Screen of Death (BSoD) is the screen displayed by Microsoft's Windows operating system when it cannot (or is in danger of being unable to) recover from a system error. There are two Windows error screens that are both referred to as the blue screen of death, with one being significantly more serious than the other.

The blue screen of death in one form or another has been present in all Windows operating systems since Windows version 3.1. It is related to the black screen of death in OS/2. In early builds of Windows Vista (then called Longhorn) it was complemented with the red screen of death, used for boot loader errors.

Types of blue screens

Windows NT/2000/XP

In Windows NT, Windows 2000, and Windows XP, a blue screen of death occurs when the kernel, or a driver running in kernel mode, encounters an error from which it cannot recover. This is usually caused by a driver that throws an unhandled exception or performs an illegal operation. The only action the user can take in this situation is to restart the computer, which results in possible data loss due to Windows not properly shutting down.

Blue screens are known as "Stop errors" in the Windows NT/2000/XP documentation, and are also sometimes referred to as "bugchecks".

The "Stop" message contains the error code and its symbolic name (e.g. 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT and 2000, the second and third sections of the screen contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. (Microsoft et al, 1996)

By default, Windows will create a memory dump file when a blue screen error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64K "minidump" to a "complete dump" which is effectively a copy of the entire contents of physical RAM. The resulting memory dump file may be debugged later, using a kernel debugger. A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information onscreen is limited and thus possibly misleading, it may hide the true source of the error.

Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. (Windows XP also allows for local kernel debugging.) If a blue screen error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to "break in", rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

The Windows debugger is available as a free download from Microsoft. [1] A Free Scan with Error Doctor can be downloaded here: [2]

Windows includes a feature that can be used to manually cause a blue screen. To enable it, the user must add a value to the Windows registry. After that, a BSoD will appear when the user presses the SCROLL LOCK key twice while holding the right CTRL key. [3] This feature is primarily useful for obtaining a memory dump of the computer while it is in a given state. As such, it is generally used to aid in troubleshooting system hangs.

ReactOS

ReactOS, an attempt at creating open-source implementation of Windows NT-compatible operating system, also features its own BSoD similar to the Windows NT one (see the gallery below).

Windows 9x/Me

The blue screen of death also occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. Here it is less serious, but more common. In these operating systems, the BSoD is the main way for virtual device drivers to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSoD gives the user the option to either restart or continue. However, VxDs do not display BSoDs frivolously—they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSoD is displayed the system is usually unstable or unresponsive.

The most common reason for BSoD'ing is problems with incompatible versions of DLLs. This cause is sometimes referred to as DLL hell. Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con". This is often inserted on websites to crash user's machines. Microsoft has released a patch for this. [4]

The BSoD can appear if a user ejects a removable medium while it is being read on 9x/ME. This is particularly common while using Microsoft Office, if a user simply wants to view a document, he might eject a floppy disk before exiting the program. Since Microsoft Office always creates a temporary file in the same directory, it will trigger a BSoD upon exiting because it will attempt to delete the file on the disk that is no longer in the drive.

This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSoD is seen only in cases where the entire operating system crashes.

Display

By default, the display is white (CGA color 0x0F; HTML color #FFFFFF) lettering on a blue (EGA color 0x01; HTML color #0000AA) background, with information about current memory values and register values. For visually impaired users, Microsoft has added a utility that allows the user to change a setting in system.ini that controls the colors that the BSoD code uses to any of the 16 CGA colors.

Windows 95, 98 and Me use 80x25 text mode. The font is identical to Terminal. The Windows NT BSoD uses 80x50 text mode. The screen resolution is 720x400. The XP BSoD uses font Lucida Console.

Windows Vista

The following is a re-creation of a Windows Vista BSoD:


A problem has been detected and Windows has been shut down to prevent damage
to your computer.

   KMODE_EXCEPTION_NOT_HANDLED

If this is the first time you've seen this error screen,
restart your computer. If this screen appears again, follow
these steps:

STEP 1: Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer for
any Windows updates you might need.

STEP 2: If problems continue, disable or remove any newly installed hardware
or software, or try to run Chkdsk after a restart of the computer.

Technical information:

    STOP: 0x0000001E (0x80000003, 0xBFC0304, 0x0000000, 0x0000001)


You can now press Ctrl+Alt+Delete to restart the computer _

See also: Red screen of death.

Windows XP

The following is a re-creation of a Windows XP BSoD:


A problem has been detected and Windows has been shut down to prevent damage
to your computer.

PFN_LIST_CORRUPT

If this is the first time you've seen this error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.


Technical information:

*** STOP: 0x0000004e (0x00000099, 0x00000000, 0x00000000, 0x00000000)


Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.

Second example:


A problem has been detected and Windows has been shut down to prevent damage
to your computer.

An attempt was made to write to read-only memory.

If this is the first time you've seen this error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.


Technical information:

*** STOP: 0X000000BE (0XF90A0905, 0X01CD5121, 0X8055616C, 0X0000000A)

*** NDIS.sys – Address F90A0905 base at F9083000, Datestamp 41107ec3


Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.

Windows 2000

The Windows 2000 BSoD looks like this:


STOP: c000026c {Unable to Load Device Driver}
\SystemRoot\System32\Drivers\Fdc.SYS device driver could not be loaded.
Error Status was 0xc000012f

If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows 2000 updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Refer to your Getting Started manual for more information on
troubleshooting Stop errors.

Windows NT3/4

The Windows NT3/4 BSoD looks like this:


*** STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000000, 8038c510)
IRQL_NOT_LESS_OR_EQUAL*** Address 8038c510 has base at 8038c000 - Ntfs.sys

CPUID:AuthenticAMD irq1:1f SYSVER 0xf0000565

Dll Base DateStmp - Name               Dll Base DateStmp - Name
80100000 336546bf - ntoskrnl.exe       80010000 33247f88 - hal.dll
80000100 334d3a53 - atapi.sys          80007000 33248043 - SCSIPORT.SYS
802ab000 33013e6b - epst.mpd           802b5000 336016a2 - Disk.sys
802b9000 336015af - CLASS2.SYS         8038c000 3356d637 - Ntfs.sys
802bd000 33d844be - Floppy.sys         803e4000 33d84553 - viaide.sys
f9328000 31ec6c8d - Siwvid.sys         f95c9000 31ec6c99 - Null.SYS
f9468000 31ed868b - KSecDD.sys         f95cb000 335e60cf - Beep.SYS
f9348000 335bc82a - i8024prt.sys       f95cb000 3373c39d - ctrl2cap.SYS
f947c000 31ec6c94 - kbdclass.sys       f9474000 3324806f - mouclass.sys
f9370000 33248011 - VIDEOPORT.SYS      fe9d7000 3370e7b9 - NDIS.SYS
f9480000 31ec6c6d - vga.sys            f93b0000 332480dd - Msfs.SYS
f90f0000 332480d0 - Npfs.sys           fe957000 3356da41 - ati.sys
a0000000 335157ac - win32k.sys         fe914000 334ea144 - ati.dll
fe0c9000 335bd30e - Fastfat.SYS        fe110000 31ec6c9b - Parport.SYS
fe108000 31ec6c9b - Serial.sys         f93b4000 31ec7c9d - ParVdm.SYS
f9050000 332480ab - Parallel.sys

Address dword dump Build [1314]                                - Name
801afc24 80149905 80149905 ff8e6b8c 80129c2c ff8e6b94 8025c000 - Ntfs.SYS
801afd24 80129c2c 80129c2c ff8e6b94 00000000 ff8e6b94 80100000 - ntoskrnl.exe
801afd34 801240f2 80124f02 ff8e6cf4 ff8e6d60 ff8e6c58 80100000 - ntoskrnl.exe
801afd54 80124a16 80124a16 ff8e6f60 ff8e6c3c 8015ac7e 80100000 - ntoskrnl.exe
801afd64 8015ac7e 8015ac7e ff8e6cf4 ff8e6f60 ff8e6c58 80100000 - ntoskrnl.exe
801afc70 80129bda 80129bda 00000000 80088000 80106f60 80100000 - ntoskrnl.exe

Restart and set the recovery options in the system control panel
or the /CRASHDEBUG system start option. If this message reappears,
contact your system administrator or technical support group.

Windows 95/98

The following is a re-creation of a Windows 95/98 BSoD:

                                   Windows 


   A fatal exception 0E has occurred at 0157:BF7FF831. The current
   application will be terminated.

   *  Press any key to terminate the current application.
   *  Press CTRL+ALT+DEL again to restart your computer. You will
      lose any unsaved information in all applications.

                         Press any key to continue _

Windows Me

The following is a re-creation of a Windows Me BSoD:

                                   Windows 


   An error has occurred. To continue:
   Press Enter to return to Windows, or Press CTRL+ALT+DEL to restart
   your computer. If you do this, you will lose any unsaved information
   in all open applications.

   ***  Error: 0D : 0157 : 00005ED7

                         Press any key to continue _

Blue screens in the IT industry

System administrators often use "to bluescreen" or "to BSoD" (with each letter pronounced individually—that is, "bee-ess-oh-dee") as a verb, as in: "The server just BSoD'd", "Oh, great, it's going to BSoD", or "Windows 2000 doesn't bluescreen as much as NT 4 did." (This usage is unrelated to color key special effects in film, also called bluescreen.)

Embedded systems running Microsoft Windows have also been known to Bluescreen. Typical examples are Internet payphones, automatic teller machines and information displays.

Some BSoDs have been caused by WinNuke, which was a very popular way for script kiddies to attack other people and disconnect computers from their Internet connections and/or cause a BSoD. The vulnerability WinNuke exploits exists only in Windows 95, and Microsoft has released a patch preventing WinNuke attacks.

Well-known references to the blue screen of death

As the BSoD is often subject to jokes and gags, it was also "introduced" to other system platforms as part of screensavers.

Microsoft has also included a reference to the BSoD as an Easter egg in the Internet Explorer browser (versions 4 through 6). Typing "about:mozilla" in the address bar will result in a blank blue page being displayed. However, this has been removed with Service Pack 2 but it can still be shown by typing "res://mshtml.dll/about.moz" instead. The command is the standard way to bring up The Book of Mozilla, another Easter egg on the Netscape/Mozilla family of browsers.

Several online vendors sell blue T-shirts that re-create the BSoD.

In January, 1998, the online magazine Salon.com held a contest where readers sent in fake, humorous error messages in the form of haiku poetry. One of the honorable mentions made a reference to the BSoD. It was written by Peter Rothman.

In the Xbox first-person shooter video game Halo 2, the Microsoft-owned Bungie Studios placed a reference to the BSoD. In the multiplayer map level known as Zanzibar, there is a console that can be used by players to open a nearby gate. Once the console is used, the screen immediately goes to a BSoD-like screen that pokes fun at the true computer error.

The BSoD can be seen in another first-person shooter, Half-Life. Near the start of the game, in the room where the player first meets a security guard, a computer is sitting on a table in the far corner showing a Windows-like screen. "Using" the computer several times will cause the screen to change to a Windows 9X BSoD and an alarm to sound. The sequel Half-Life 2 also features images of BSoDs on computers in Isaac Kleiner's laboratory.

In Unreal Championship 2, when getting fragged, one of the robot characters, named Raptor will exclaim: "I see the blue screen.", which doubles as a reference to the phenomenon of seeing "the light" when dying.

In Advance Wars: Dual Strike for the Nintendo DS, a robot character named CO Jugger refers to the BSoD.

There are images of BSoDs in the computer game Far Cry. Several monitors on scientific consoles feature Windows NT4 BSoD-like rolling text. There are also static images of Windows 98-like BSoDs.

In the Nintendo GameCube game Eternal Darkness: Sanity's Requiem a random hallucination experienced by a player with low sanity is a version of the BSoD. Thankfully the game returns to normal less than a minute later.

File:Computer over.JPG
The BSoD is parodied multiple times at the Homestar Runner website. It appears in some "Strong Bad Emails" as well as some "Biz Cas Fri" cartoons.

In the episode of The Adventures of Jimmy Neutron: Boy Genius, Nightmare in Retroville, When Jimmy Neutron clamme that "The screen is frozen,"" A Bsod (possibly a Windows Me Bsod.) can be seen.

In the story mode of the fighting game Guilty Gear XX, the robotic character Robo-Ky yells out that he is experiencing a BSoD as he malfunctions.

Reference

  • Microsoft Corp. (1996). Microsoft Windows NT workstation resource kit. 1st ed. Redmond, WA: Microsoft Press.

See also

Wikimedia Commons has media related to BSoD.

Template:Link FA

Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Blue_screen_of_death&oldid=31368671"