{"id":399,"date":"2009-06-18T15:46:32","date_gmt":"2009-06-18T15:46:32","guid":{"rendered":"https:\/\/driverentry.com.br\/en\/2009\/06\/18\/taking-the-blue-screen-home\/"},"modified":"2026-07-30T20:15:36","modified_gmt":"2026-07-30T20:15:36","slug":"taking-the-blue-screen-home","status":"publish","type":"post","link":"https:\/\/driverentry.com.br\/en\/2009\/06\/18\/taking-the-blue-screen-home\/","title":{"rendered":"Taking the blue screen home"},"content":{"rendered":"
\"\"<\/a><\/div>\n

Nothing better than a nice bit of whining to start off this post. My pace is low because the university is sucking up all my vital energies. If you have been following my blog in the latest posts, you already know what I am talking about. In my free time I have been running around with my project, my internship and my job. My blog is also on that to-do list, but the poor little thing has less priority here. Some of you may know that I am a model-helicopter hobbyist, but as I told my friend Heldai the other day: “Hobby is the name we give to what we do to fill the time we have free, but I have yet to discover the name we would give to what we would like to do if we had free time…”<\/em>. Anyway, since this has nothing to do with today’s post, let us change the subject.<\/p>\n

Between one thing and another, I was trying to think of something simple for a small post. It was then that the question from reader Ismael Rocha (Bras\u00c3\u00adlia – DF) gave rise to this post.<\/p>\n

\n

“Is there a way to save the BSODs to later check for possible problems?”<\/p>\n<\/blockquote>\n

Save a blue screen? Save what? The machine is already dead, my friend! It is gone! It is over! What you can still try to save is your job.<\/p>\n

Joking aside, yes there is.<\/h3>\n

The operating system is pre-configured to restart automagically when a critical failure happens. Critical failure is the polite way of saying that the house fell down, the cow went to the swamp, the alligator hugged you, the drum spun, the iron screamed, the weather closed in, it got too small for you… anyway, a blue screen happened. Not that I do not like blue screens<\/a>, but rather the side effect they bring us. By the worldwide standard of third-party driver consumers, if you are the author of a driver installed on a machine at the moment of the failure, whether it is running or not, then the failure is your fault until proven otherwise. It is sad, but it is reality. From the moment a blue screen happens, you are the default culprit and you will have to keep putting up with little jokes for the rest of eternity. I would like to take advantage of the context to send a hug to my friend Heldai.<\/p>\n

Displaying the blue screen<\/h3>\n

In an attempt to save your dignity, you try to prove the fault is not yours. Saying that the machine reset is a feature<\/em> of your driver and that fortunately it worked very well is not going to stick, not the second time. But what can you do if the blue screen is just a flash of information while the machine restarts? Fortunately you can change that. By right-clicking on “My Computer”<\/em>, selecting “Properties”<\/em>. From there just take a look at the figure below to find out that you can prevent the machine from restarting automagically.<\/p>\n

\"\"<\/div>\n


<\/p>\n

You will have to uncheck the “Automatically restart” option, and thus have all the time you need to show everyone that the problem is not yours. Most of the time the system manages to detect the driver that is probably the cause of all this headache and display the file name on the blue screen as we can see in the figure below.<\/p>\n

Taking a blue screen apart<\/h3>\n
\"\"<\/div>\n


<\/p>\n

“Wow! So Windows has an artificial intelligence algorithm that probably uses nanotechnology somehow to find the guilty driver?”<\/p>\n

Actually it is a bit simpler than that; Windows simply takes the image of the driver that threw an unhandled exception or that voluntarily brought down the system upon detecting some inconsistency. For this reason, the name of the driver displayed is not always in fact the name of the guilty driver. If we think of the simple example where the driver MetralhadoraGiratoria.sys<\/em> writes where it should not, corrupting some allocation Pool<\/em>, this error can later be detected by the driver Laranja.sys<\/em> which, when making a memory allocation, calls a system routine that in turn calls the KeBugCheckEx()<\/a> routine upon detecting such an inconsistency. Can you guess the name of the driver that will appear on the BSOD?<\/p>\n

Other information can still be obtained from the blue screen. If it is the name of your driver that appears on the screen, then you can also get the address of the instruction where the disaster occurred. In our example the address is 0xF8DD8A415<\/em>; from there we can reach the function that was executing at the moment of the failure if we have the map file generated by the linker. It is also possible to obtain the date of the file image and clear up that doubt about whether it really was the right version that was running. The file date is obtained from the DateStamp<\/em> field and is expressed as a 32-bit hexadecimal value representing the number of seconds since midnight of January first, 1970. What is really hard is finding someone with enough patience to calculate that in front of a blue screen. There are far less laborious ways to find out that the fault was indeed yours.<\/p>\n

In my opinion, the most relevant information the blue screen offers is the Stop Code<\/strong>. As the name suggests, Stop Code<\/em> is a code that will indicate the reason for the system failure. You can consult the list of Stop Codes at this link<\/a> or take a look at the C:\\WinDDK\\6001.18002\\inc\\api\\BugCodes.h<\/em> file that comes with the WDK.<\/p>\n

\"\"<\/div>\n


<\/p>\n

Stop Codes<\/em> come with up to four parameters that bring additional information to the stop code. The interpretation of these values will depend on the failure code, which in our example is 0x7E. Consulting the link I mentioned a moment ago, we will have the following interpretation for the values presented to us.<\/p>\n

\"\"<\/div>\n


<\/p>\n

But is there a way to save the BSOD or not?<\/h3>\n

Yeah yeah yeah… It is just that I start writing and end up getting carried away. But anyway, when a critical failure occurs, the system creates a file known as a Crash Dump<\/strong>. There are three options of crash dumps<\/em> that can be generated.<\/p>\n