Jump to content

Blue screen of death

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Unknown W. Brackets (talk | contribs) at 06:20, 17 December 2004 (Sorry, charlie. Reverting vandalism.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

A Bluescreened Public Internet Payphone

The Blue Screen of Death, also abbreviated as BSoD, refers to the screen displayed by Microsoft's Windows operating system when it cannot (or is in danger of being unable to) recover from a system error. There are two Windows error screens that are both referred to as the blue screen of death, with one being significantly more serious than the other.

A BSoD is also a "Stop Error", as known in the Windows XP manuals. The blue screen of death in one form or another has been present in all Windows operating systems since Windows version 2.0.

Types of blue screens

Windows XP/2000/NT

In Windows NT, 2000, and XP, a blue screen of death ("Stop" error) occurs when the kernel encounters an error from which it can not recover. This is usually caused by a driver that throws an unhandled exception or performs an illegal operation. The only action the user can take in this situation is to restart the computer, which results in the possible corruption or loss of data because Windows has not been properly shut down.

The "Stop" message contains the error code and its symbolic name (ex: 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses. It displays the address where the problem occurred, along with the driver in question. Windows can be set up to send debugging information through a COM port to a separate kernel debugger. The debugger is necessary to perform a stack trace, as it would be impractical to copy the information off the screen, and it is not saved to disk. Also, the point at which the code crashed can be completely different from where the error originated, and thus can mislead users into believing it is a hardware error or similar.1

Under Windows NT and 2000, the second and third sections of the screen contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver.

In 2003, the people at TweakXP.com found a "feature", which can be used to manually cause a blue screen. To enable it, the user needs to add a value to the Windows registry. After that, a BSoD will appear each time the user presses the Scroll Lock key, while holding the right Ctrl. [1]

Windows Me/9x

The less serious (but more common) blue screen of death occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. In these operating systems, the BSoD is the main way for VxDs to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSoD gives the user the option to either restart or continue. However, VxDs do not display BSoDs frivolously—they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSoD is displayed the system is usually unstable or unresponsive.

The most common reason for BSoD'ing is problems with incompatible versions of DLLs. This cause is sometimes referred to as DLL hell. Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con". This is often inserted on websites to crash user's machines. Microsoft has released a patch at http://www.microsoft.com/technet/security/bulletin/ms00-017.mspx.

The BSOD can appear if a user ejects a floppy disk while it is being read on 9x/ME.

This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSoD is seen only in cases where the entire operating system crashes.

Display

By default, the display is white (CGA color 0x0F; HTML color #FFFFFF) lettering on a blue (EGA color 0x01; HTML color #0000AA) background, with information about current memory values and register values. Demonstrating a sense of humor, Microsoft has added a utility that allows the user to change a setting in system.ini that controls the colors that the BSoD code uses to any of the 16 CGA colors.

Windows 95, 98 and Me use 80x25 text mode. The font is similar to Fixedsys. The Windows NT BSoD uses 80x50 text mode. The screen resolution is 720x400. The XP BSoD uses font Lucida Console.

Examples

Windows XP

The following is a re-creation of the Windows XP BSoD, although they somewhat vary: 

A problem has been detected and Windows has been shut down to prevent damage
to your computer.
                                                                                
PFN_LIST_CORRUPT

If this is the first time you've seen this Stop error screen,
restart your computer. If this screen appears again, follow
these steps:

Check to make sure any new hardware or software is properly installed.
If this is a new installation, ask your hardware or software manufacturer
for any Windows updates you might need.

If problems continue, disable or remove any newly installed hardware
or software. Disable BIOS memory options such as caching or shadowing.
If you need to use Safe Mode to remove or disable components, restart
your computer, press F8 to select Advanced Startup Options, and then
select Safe Mode.

Technical information:
*** STOP: 0x0000004E (0x00000099, 0x00000000, 0x00000000, 0x00000000)


Beginning dump of physical memory
Physical memory dump complete.
Contact your system administrator or technical support group for further
assistance.

Windows NT4/2000

The Windows NT4/2000 BSoD looks like this: 

*** STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000000, 8038c510)
IRQL_NOT_LESS_OR_EQUAL*** Address 8038c510 has base at 8038c000 - Ntfs.sys

CPUID:AuthenticAMD irq1:1f SYSVER 0xf0000565

Dll Base DateStmp - Name               Dll Base DateStmp - Name
80100000 336546bf - ntoskrnl.exe       80010000 33247f88 - hal.dll
80000100 334d3a53 - atapi.sys          80007000 33248043 - SCSIPORT.SYS
802ab000 33013e6b - epst.mpd           802b5000 336016a2 - Disk.sys
802b9000 336015af - CLASS2.SYS         8038c000 3356d637 - Ntfs.sys
802bd000 33d844be - Floppy.sys         803e4000 33d84553 - viaide.sys
f9328000 31ec6c8d - Siwvid.sys         f95c9000 31ec6c99 - Null.SYS
f9468000 31ed868b - KSecDD.sys         f95cb000 335e60cf - Beep.SYS
f9348000 335bc82a - i8024prt.sys       f95cb000 3373c39d - ctrl2cap.SYS
f947c000 31ec6c94 - kbdclass.sys       f9474000 3324806f - mouclass.sys
f9370000 33248011 - VIDEOPORT.SYS      fe9d7000 3370e7b9 - NDIS.SYS
f9480000 31ec6c6d - vga.sys            f93b0000 332480dd - Msfs.SYS
f90f0000 332480d0 - Npfs.sys           fe957000 3356da41 - ati.sys
a0000000 335157ac - win32k.sys         fe914000 334ea144 - ati.dll
fe0c9000 335bd30e - Fastfat.SYS        fe110000 31ec6c9b - Parport.SYS
fe108000 31ec6c9b - Serial.sys         f93b4000 31ec7c9d - ParVdm.SYS
f9050000 332480ab - Parallel.sys       

Address  dword dump   Build [1314]                             - Name
801afc24 80149905 80149905 ff8e6b8c 80129c2c ff8e6b94 8025c000 - Ntfs.SYS
801afd24 80129c2c 80129c2c ff8e6b94 00000000 ff8e6b94 80100000 - ntoskrnl.exe
801afd34 801240f2 80124f02 ff8e6cf4 ff8e6d60 ff8e6c58 80100000 - ntoskrnl.exe
801afd54 80124a16 80124a16 ff8e6f60 ff8e6c3c 8015ac7e 80100000 - ntoskrnl.exe
801afd64 8015ac7e 8015ac7e ff8e6cf4 ff8e6f60 ff8e6c58 80100000 - ntoskrnl.exe
801afc70 80129bda 80129bda 00000000 80088000 80106f60 80100000 - ntoskrnl.exe

Restart and set the recovery options in the system control panel
or the /CRASHDEBUG system start option. If this message reappears,
contact your system administrator or technical support group.

Windows 95/98/Me

The following is a re-creation of a Windows 95/98/Me BSoD:

 Windows  
   A fatal exception 0E has occurred at 0157:BF7FF831. The
   current application will be terminated.

   *  Press any key to terminate the current application.
   *  Press CTRL+ALT+DEL to restart your computer.  You will
      lose any unsaved information in all applications.

                    Press any key to continue

Blue screens in the IT industry

System administrators often use "to bluescreen" or "to BSoD" as a verb, as in: "The server just BSoD'd", "Oh, great, it's going to BSoD", or "Windows 2000 doesn't bluescreen as much as NT 4 did." (This usage is unrelated to color key special effects in film, also called bluescreen.)

Embedded systems running Microsoft Windows have also been known to Bluescreen. Typical examples are Internet payphones, automatic teller machines and information displays.

Some BSoDs have been caused by WinNuke, which was a very popular way for script kiddies to attack other people and disconnect computers from their internet connections and/or BSoD the computer. The vulnerability WinNuke exploits exists only in Windows 95 however, although Microsoft has discontinued support for the operating system. BSoDs unrelated to WinNuke, however, are not prevented by this patch.

Well-Known References to the Blue Screen of Death

The Linux operating system, which is generally viewed as being more stable than the Microsoft operating systems, rarely encounters conditions which could cause such a terminal error. However, many previous Windows users have retained a fondness for the Windows Blue Screen of Death so they have attempted to bring this to Linux by creating a screensaver module which mimics all forms of the Windows Blue Screen of Death. This is included in many popular Linux distributions.

Microsoft has also included a reference to the BSoD as an easter egg in the Internet Explorer browser. Typing "about:mozilla" in the address bar will result in a blank blue page being displayed. The command is the standard way to bring up The Book of Mozilla, another easter egg on the Netscape family of browsers.

See also

Reference

  1. Microsoft Windows NT Workstation Resource Kit, ISBN 1-57231-343-9.
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Blue_screen_of_death&oldid=8673119"