http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.pnghttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/Daniel Pearson: Debugging a Windows Blue Screen of Death http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/en-usSat, 09 Aug 2008 00:14:34 GMTSat, 09 Aug 2008 00:14:34 GMTEvNet (EvNet, Version=1.0.3599.6114, Culture=neutral, PublicKeyToken=null)If you like debugging, see&nbsp;<A href="http://blogs.msdn.com/ntdebugging/">http://blogs.msdn.com/ntdebugging/</A>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=420526Sat, 09 Aug 2008 00:14:34 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4205260http://channel9.msdn.com/420526/WebViewBug.aspx?EVT=0If you like debugging, see&nbsp;http://blogs.msdn.com/ntdebugging/Jason E0http://channel9.msdn.com/420526/Trackback.aspx<P>If you like debugging, check out&nbsp;<A href="http://blogs.msdn.com/ntdebugging/">http://blogs.msdn.com/ntdebugging/</A>.<BR><BR></P>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=420525Sat, 09 Aug 2008 00:14:05 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4205250http://channel9.msdn.com/420525/WebViewBug.aspx?EVT=0If you like debugging, check out&nbsp;http://blogs.msdn.com/ntdebugging/.Jason E0http://channel9.msdn.com/420525/Trackback.aspxMark's video goes into more deal about the requirements for a successful dump but at a bare minimum you should create a 16 MB paging file on the same partition that Windows is installed and set the system to perform a small memory dump. That way once you triage the minidumps, you'll be able to determine if it's the same problem causing all of the bugchecks or if another action plan needs to be followed.<BR><BR>If you find it's your display driver causing the problem and it's not something the vendor has seen before, it's possible you'll need to provide them with a kernel memory dump. In that case you'll need to increase the size of the paging file on your boot partition and switch your options to kernel memory dump.http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416255Sat, 19 Jul 2008 12:34:29 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4162550http://channel9.msdn.com/416255/WebViewBug.aspx?EVT=0Mark's video goes into more deal about the requirements for a successful dump but at a bare minimum you should create a 16 MB paging file on the same partition that Windows is installed and set the system to perform a small memory dump. That way once you triage the minidumps, you'll be able to&#8230;Daniel Pearson0http://channel9.msdn.com/416255/Trackback.aspxUnfortunately your only real option is to attach a kernel debugger to the system and wait for it to crash again. If it's only just started happening and is rather frequent then I would suspect some sort of hardware error but get a debugger attached and we'll get some answers.http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416252Sat, 19 Jul 2008 12:17:35 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4162520http://channel9.msdn.com/416252/WebViewBug.aspx?EVT=0Unfortunately your only real option is to attach a kernel debugger to the system and wait for it to crash again. If it's only just started happening and is rather frequent then I would suspect some sort of hardware error but get a debugger attached and we'll get some answers.Daniel Pearson0http://channel9.msdn.com/416252/Trackback.aspx<P>Daniel's video nicely complements a talk I've delivered on crash and hang analysis at various conferences. You can check out the on-demand web cast from TechEd a couple years ago here:<BR><BR> <TABLE cellPadding=0> <TR> <TD> <P><A title="TechEd On-Demand Webcast: Windows Hang and Crash Dump Analysis " href="http://www.microsoft.com/events/EventDetails.aspx?CMTYSvcSource=MSCOMMedia&amp;Params=~CMTYDataSvcParams%5e~arg%20Name=%22ID%22%20Value=%221032298076%22/%5e~arg%20Name=%22ProviderID%22%20Value=%22A6B43178-497C-4225-BA42-DF595171F04C%22/%5e~arg%20Name=%22lang%22%20Value=%22en%22/%5e~arg%20Name=%22cr%22%20Value=%22US%22/%5e~sParams%5e~/sParams%5e~/CMTYDataSvcParams%5e" target=_blank><B>TechEd On-Demand Webcast: Windows Hang and Crash Dump Analysis </B></A></P></TD></TR></TABLE>I answer some of the questions raised here in the comments, like how to debug a frozen system and why a dump file requires a paging file on the boot volum (the one with \Windows).<BR></P>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416157Fri, 18 Jul 2008 23:18:24 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4161570http://channel9.msdn.com/416157/WebViewBug.aspx?EVT=0Daniel's video nicely complements a talk I've delivered on crash and hang analysis at various conferences. You can check out the on-demand web cast from TechEd a couple years ago here: TechEd On-Demand Webcast: Windows Hang and Crash Dump Analysis I answer some of the questions raised here&#8230;Mark Russinovich0http://channel9.msdn.com/416157/Trackback.aspxCan you save crash dumps in other cases?&nbsp; Make sure your page file on the boot drive (the one with the Windows directory) is large enough to save the kind of dump you've selected and turn off "Automatically restart" so you can see the blue screen (including the&nbsp;bugcheck code and parameters)&nbsp;and the results of the attempt to save the crash dump.<BR><BR>Then download notmyfault from here: <A href="http://technet.microsoft.com/en-us/sysinternals/bb963901.aspx">http://technet.microsoft.com/en-us/sysinternals/bb963901.aspx</A><BR><BR>Use notmyfault to crash your system and verify that crash dumps can be saved.http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416127Fri, 18 Jul 2008 20:49:04 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4161270http://channel9.msdn.com/416127/WebViewBug.aspx?EVT=0Can you save crash dumps in other cases?&nbsp; Make sure your page file on the boot drive (the one with the Windows directory) is large enough to save the kind of dump you've selected and turn off "Automatically restart" so you can see the blue screen (including the&nbsp;bugcheck code and&#8230;ZXTT950http://channel9.msdn.com/416127/Trackback.aspxkarnokd:<BR><BR>It's simple really - boot device drivers have special requirements, which&nbsp;lead to the ability to save crash dumps.<BR><BR>A storage driver written any old way won't be able to do this.&nbsp; Windows loads an extra copy of the boot driver, kernel crash dump writing code, plus a bitmap of the page file on the boot drive, then checksums the lot.&nbsp; At blue screen time, the checksum is verified and if good, the crash dump is written directly to the sectors known to be used by the page file on the boot drive.http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416122Fri, 18 Jul 2008 20:41:18 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4161220http://channel9.msdn.com/416122/WebViewBug.aspx?EVT=0karnokd:It's simple really - boot device drivers have special requirements, which&nbsp;lead to the ability to save crash dumps.A storage driver written any old way won't be able to do this.&nbsp; Windows loads an extra copy of the boot driver, kernel crash dump writing code, plus a bitmap of the&#8230;ZXTT950http://channel9.msdn.com/416122/Trackback.aspxUnhandled exceptions in kernel mode lead to reboot by policy (or if you're lucky a bluescreen with data capture for debugging purposes). Anytime something goes wrong in kernel world the system must commit temporary suicide (or start the reincarnation process, to be more positive in tone :)). There's too much weird and invalid state to deal with when this happens and typically and it's not worth it (the insuing instability and total strangeness that user mode gets to experience as a result)...<BR><BR>This keeps happening on my machine and there's no way for me to debug given that no data on the fault is preserved (or even captured). Clearly, it's a device driver malfunction.&nbsp;I suspect it's a driver that's not Vista Ready... :)<BR><BR>What's one to do in this case, Daniel?<BR>Chttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416101Fri, 18 Jul 2008 18:08:27 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4161010http://channel9.msdn.com/416101/WebViewBug.aspx?EVT=0Unhandled exceptions in kernel mode lead to reboot by policy (or if you're lucky a bluescreen with data capture for debugging purposes). Anytime something goes wrong in kernel world the system must commit temporary suicide (or start the reincarnation process, to be more positive in tone :)). There's&#8230;Charles0http://channel9.msdn.com/416101/Trackback.aspxProbably you get a freeze. A complete halt with the most current video buffer re-drawn over and over again.http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=416055Fri, 18 Jul 2008 12:17:55 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4160550http://channel9.msdn.com/416055/WebViewBug.aspx?EVT=0Probably you get a freeze. A complete halt with the most current video buffer re-drawn over and over again.Christian Liensberger0http://channel9.msdn.com/416055/Trackback.aspx<P>That doesn't sound good charles ;).. I was interested because.. if theres no one "there" ie, the kernel itself doing its bugcheck code has crashed out due to a hardware fault.. does my system just sit there... I assume I'd still have display because the gpu would just be outputting the last buffer it was given?<BR><BR>But I've watched the video now, really cool, loved the idea of trapping a driver by putting it on a "known offenders" list, and luring into doing something it will get caught red handed for.. :D</P>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415924Thu, 17 Jul 2008 18:49:59 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4159240http://channel9.msdn.com/415924/WebViewBug.aspx?EVT=0That doesn't sound good charles ;).. I was interested because.. if theres no one "there" ie, the kernel itself doing its bugcheck code has crashed out due to a hardware fault.. does my system just sit there... I assume I'd still have display because the gpu would just be outputting the last buffer&#8230;stevo_0http://channel9.msdn.com/415924/Trackback.aspxHardcore! :-) Nice to see some close to the metal stuff in with all the managed goodness. Helps keep us honest as developers ;-)http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415869Thu, 17 Jul 2008 09:45:28 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4158690http://channel9.msdn.com/415869/WebViewBug.aspx?EVT=0Hardcore! :-) Nice to see some close to the metal stuff in with all the managed goodness. Helps keep us honest as developers ;-)Tom Kirby-Green0http://channel9.msdn.com/415869/Trackback.aspxNice video. However, I never understood why there aren't any minidump created&nbsp;in case the swap file is moved to a differend partition/hard disk in WinXP? (In my case, I play 3D games and the videocard driver sometimes crashes my system and I cannot hope to send that crash dump to its manufacturer.)http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415863Thu, 17 Jul 2008 09:21:33 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4158630http://channel9.msdn.com/415863/WebViewBug.aspx?EVT=0Nice video. However, I never understood why there aren't any minidump created&nbsp;in case the swap file is moved to a differend partition/hard disk in WinXP? (In my case, I play 3D games and the videocard driver sometimes crashes my system and I cannot hope to send that crash dump to its manufacturer.)karnokd0http://channel9.msdn.com/415863/Trackback.aspx<BR>If this sort of thing is of intreast to you, this is a must see&nbsp;<A href="http://www.solsem.com/videolibrary.html#crashhang">Sysinternals Video Library</A><BR><BR>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415798Wed, 16 Jul 2008 23:16:50 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4157980http://channel9.msdn.com/415798/WebViewBug.aspx?EVT=0If this sort of thing is of intreast to you, this is a must see&nbsp;Sysinternals Video LibraryPerfectPhase0http://channel9.msdn.com/415798/Trackback.aspxI've had something like this happen to my machine twice in the last two days. There's some sort of kernel crash that causes the system to reboot - with no telemetry whatsoever. Certainly a critical system failure, but the system is unable to record any data before restarting.<BR><BR>Chttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415792Wed, 16 Jul 2008 22:14:00 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4157920http://channel9.msdn.com/415792/WebViewBug.aspx?EVT=0I've had something like this happen to my machine twice in the last two days. There's some sort of kernel crash that causes the system to reboot - with no telemetry whatsoever. Certainly a critical system failure, but the system is unable to record any data before restarting.CCharles0http://channel9.msdn.com/415792/Trackback.aspxI was just wondering today, what would happen if the 'code' that handles the bsod.. crashed? like, what if my processor was on last legs and caused an execution fault? <BR><BR>Let me guess, something really boring like everything going blank, or my computer restarting (or not)?http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415790Wed, 16 Jul 2008 22:08:33 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4157900http://channel9.msdn.com/415790/WebViewBug.aspx?EVT=0I was just wondering today, what would happen if the 'code' that handles the bsod.. crashed? like, what if my processor was on last legs and caused an execution fault? Let me guess, something really boring like everything going blank, or my computer restarting (or not)?stevo_0http://channel9.msdn.com/415790/Trackback.aspxThis is awesome. I would love to see much more like this. <div><br></div><div>It was interesting how to see how you could find information from the memory dump.</div>http://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=415771Wed, 16 Jul 2008 21:02:21 GMThttp://channel9.msdn.com/posts/Dan/Daniel-Pearson-Debugging-a-Windows-Blue-Screen-of-Death/?CommentID=4157710http://channel9.msdn.com/415771/WebViewBug.aspx?EVT=0This is awesome. I would love to see much more like this. It was interesting how to see how you could find information from the memory dump.Chadk0http://channel9.msdn.com/415771/Trackback.aspx