Blue screen of death (original) (raw)

The so-called blue screen of death, also abbreviated as BSoD, refers to the screen displayed by Microsoft's Windows operating system when it cannot (or is in danger of being unable to) recover from a system error. There are two Windows error screens that are both referred to as the blue screen of death, with one being significantly more serious than the other.

A BSoD is also a "Stop Error", as known in the Windows XP manuals.

A "true" blue screen of death occurs when the Windows NT operating system's kernel cannot recover from an error, and the only action a user can take is to restart the operating system, losing all unsaved work and possibly breaking the integrity of the file system. The information displayed on the blue screen of death is often not enough to determine what went wrong, even for someone with access to the source code (for example, it does not contain a stack dump, and if it did, it would be a lot of work to copy it somewhere else since you cannot save the data displayed on the screen at this point). It only displays at what point the code crashed, which can be completely different from where the error originated, and thus can mislead users into believing it is a hardware error or similar. The blue screen of death usually occurs only after Windows encounters a very serious error. This version of the blue screen of death is present in Windows NT, Windows 2000, and Windows XP, the latter two of which are based on NT.

The less serious blue screen of death occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. In these operating systems, the BSoD is the main way for VxDs to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSoD gives the user the option to either restart or continue. However, VxDs do not display BSoDs frivolously—they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSoD is displayed the system is usually unstable or unresponsive.

The most common reason for BSoD'ing is problems with incompatible versions of DLLss. This cause is sometimes referred to as DLL hell. Windows loads these DLLss into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.

The following is a re-creation of a Windows NT/2000/XP BSoD:

\r\n*** STOP: 0x0000000A (0x00000000, 0x00000002, 0x00000000, 8038c510) IRQL_NOT_LESS_OR_EQUAL*** Address 8038c510 has base at 8038c000 - Ntfs.sys\r\n

\r\nCPUID:AuthenticAMD irq1:1f SYSVER 0xf0000565\r\n

\r\nAddress dword dump Build [1314] \r\n- Name
\r\n801afc24 80149905 80149905 ff8e6b8c 80129c2c ff8e6b94 8025c000 - Ntfs.SYS
\r\n801afd24 80129c2c 80129c2c ff8e6b94 00000000 ff8e6b94 80100000 - ntoskrnl.exe
\r\n801afd34 801240f2 80124f02 ff8e6cf4 ff8e6d60 ff8e6c58 80100000 - ntoskrnl.exe
\r\n801afd54 80124a16 80124a16 ff8e6f60 ff8e6c3c 8015ac7e 80100000 - ntoskrnl.exe
\r\n801afd64 8015ac7e 8015ac7e ff8e6cf4 ff8e6f60 ff8e6c58 80100000 - ntoskrnl.exe
\r\n801afc70 80129bda 80129bda 00000000 80088000 80106f60 80100000 - ntoskrnl.exe

\r\nRestart and set the recovery options in the system control panel
\r\nor the /CRASHDEBUG system start option. If this message reappears,
\r\ncontact your system administrator or technical support group.\r\n

Windows can be set to do a memory dump or restart immediately after this message is displayed.

The following is a re-creation of a Windows 9x/Me BSoD:

A fatal exception 0E has occurred at 0157:BF7FF831. The current application will be terminated.

• Press any key to terminate the current application.

• Press CTRL+ALT+DEL to restart your computer. You will lose any unsaved information in all applications.

            Press any key to continue

By default, the display is white (CGA color 0x0F; HTML color #FFFFFF) lettering on a blue (EGA color 0x01; HTML color #0000AA) background, with information about current memory values and register values. Demonstrating a sense of humor, Microsoft has added a utility that allows the user to change a setting in system.ini that controls the colors that the BSoD code uses to any of the 16 CGA colors.

This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSoD is seen only in cases where the entire operating system crashes.

System administrators often use "to bluescreen" or "to BSoD" as a verb, as in: "The server just BSoD'd" or "Windows 2000 doesn't bluescreen as much as NT 4 did." (This usage is unrelated to color key special effects in film, also called bluescreen.)

The blue screen of death in one form or another is present in all Windows operating systems since Windows version 2.0.

Some BSoD's have been caused by WinNuke, which was a very popular way for script kiddies to attack other people and disconnect computers from their internet connections and/or BSoD the computer. The vulnerability WinNuke exploits exists only in Windows 95, and a patch is available.

External links

• BSoD popping up in odd places
• BSoD humor