Blue Screen of Death: Encyclopedia - Blue Screen of Death

Blue Screen of Death

The Blue Screen of Death (BSoD) is the screen displayed by Microsoft's Windows operating system when it cannot (or is in danger of being unable to) recover from a system error. There are two Windows error screens that are both referred to as the blue screen of death, with one being significantly more serious than the other.

The blue screen of death in one form or another has been present in all Windows operating systems since Windows version 3.1. It is related to the black screen of death in OS/2. In early builds of Windows Vista (then called Longhorn) it was complemented with the red screen of death, used for boot loader errors.

Blue Screen of Death - Types of blue screens

Blue Screen of Death - Windows NT/2000/XP

In Windows NT, Windows 2000, and Windows XP, a blue screen of death occurs when the kernel, or a driver running in kernel mode, encounters an error from which it cannot recover. This is usually caused by a driver that throws an unhandled exception or performs an illegal operation. The only safe action the operating system can take in this situation is to restart the computer. As a result, user data may be lost, because users are not given an opportunity to save data that has not yet been saved to disk.

Blue screens are known as "Stop errors" in the Windows NT/2000/XP documentation, and are also sometimes referred to as "bugchecks".

The "Stop" message contains the error code and its symbolic name (e.g. 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT and 2000, the second and third sections of the screen contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver. (Microsoft et al, 1996)

By default, Windows will create a memory dump file when a blue screen error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64K "minidump" to a "complete dump" which is effectively a copy of the entire contents of physical RAM. The resulting memory dump file may be debugged later, using a kernel debugger. A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information onscreen is limited and thus possibly misleading, it may hide the true source of the error.

Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. (Windows XP also allows for local kernel debugging.) If a blue screen error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to "break in", rather than displaying the BSoD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

The Windows debugger is available as a free download from Microsoft. [1]

Windows includes a feature that can be used to manually cause a blue screen. To enable it, the user must add a value to the Windows registry. After that, a BSoD will appear when the user presses the SCROLL LOCK key twice while holding the right CTRL key. [2] This feature is primarily useful for obtaining a memory dump of the computer while it is in a given state. As such, it is generally used to aid in troubleshooting system hangs.

A BSoD can also be caused by a critical boot loader error, where the operating system is unable to access the boot partition due to incorrect storage drivers or similar problems. The error code in this situation is STOP 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there is no memory dump saved. Since the system is unable to boot in this situation, correction of the problem may require booting with the Microsoft Windows CD. After booting to the CD, it may be possible to correct the problem by performing a repair install or by using the Recovery Console.

Blue Screen of Death - ReactOS

ReactOS, an attempt at creating open-source implementation of Windows NT-compatible operating system, also features its own BSoD similar to the Windows NT one (see the gallery below).

Blue Screen of Death - Windows 9x/Me

The blue screen of death also occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. Here it is less serious, but more common. In these operating systems, the BSoD is the main way for virtual device drivers to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSoD gives the user the option to either restart or continue. However, VxDs do not display BSoDs frivolously—they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSoD is displayed the system is usually unstable or unresponsive.

The most common reason for BSoD'ing is problems with incompatible versions of DLLs. This cause is sometimes referred to as DLL hell. Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.

In Windows 95 and 98, a BSoD occurs when the system attempts to access the file "c:\con\con". This is often inserted on websites to crash user's machines. Microsoft has released a patch for this. [3]

The BSoD can appear if a user ejects a removable medium while it is being read on 9x/ME. This is particularly common while using Microsoft Office, if a user simply wants to view a document, he might eject a floppy disk before exiting the program. Since Microsoft Office always creates a temporary file in the same directory, it will trigger a BSoD upon exiting because it will attempt to delete the file on the disk that is no longer in the drive.

This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSoD is seen only in cases where the entire operating system crashes.

Blue Screen of Death - Display

By default, the display is white (EGA color 0x0F; HTML color #FFFFFF) lettering on a blue (EGA color 0x01; HTML color #0000AA) background, with information about current memory values and register values. For visually impaired users, Microsoft has added a utility that allows the user to change a setting in system.ini that controls the colors that the BSoD code uses to any of the 16 EGA colors.

Windows 95, 98 and Me use 80x25 text mode. The font is identical to Terminal. The Windows NT BSoD uses 80x50 text mode. The screen resolution is 720x400. The XP BSoD uses font Lucida Console.

Blue Screen of Death - Windows XP

The following is a re-creation of a Windows XP BSoD:

Second example:

Blue Screen of Death - Windows 2000

The Windows 2000 BSoD looks like this:

Blue Screen of Death - Windows NT3/4

The Windows NT3/4 BSoD looks like this:

Blue Screen of Death - Windows 95/98

The following is a re-creation of a Windows 95/98 BSoD:

   A fatal exception 0E has occurred at 0157:BF7FF831. The current
   application will be terminated.

   *  Press any key to terminate the current application.
   *  Press CTRL+ALT+DEL again to restart your computer. You will
      lose any unsaved information in all applications.

                         Press any key to continue _

Blue Screen of Death - Windows Me

The following is a re-creation of a Windows Me BSoD:

   An error has occurred. To continue:
   Press Enter to return to Windows, or Press CTRL+ALT+DEL to restart
   your computer. If you do this, you will lose any unsaved information
   in all open applications.

   ***  Error: 0D : 0157 : 00005ED7

                         Press any key to continue _

Blue Screen of Death - Blue screens in the IT industry

System administrators often use "to bluescreen" or "to BSoD" (with each letter pronounced individually—that is, "bee-ess-oh-dee") as a verb, as in: "The server just BSoD'd", "Oh, great, it's going to BSoD", or "Windows 2000 doesn't bluescreen as much as NT 4 did." (This usage is unrelated to color key special effects in film, also called bluescreen.)

Embedded systems running Microsoft Windows have also been known to Bluescreen. Typical examples are Internet payphones, automatic teller machines and information displays.

Some BSoDs have been caused by WinNuke, which was a very popular way for script kiddies to attack other people and disconnect computers from their Internet connections and/or cause a BSoD. The vulnerability WinNuke exploits exists only in Windows 95, and Microsoft has released a patch preventing WinNuke attacks.

Blue Screen of Death - Well-known references to the blue screen of death

As the BSoD is often subject to jokes and gags, it was also "introduced" to other system platforms as part of screensavers.

Microsoft has also included a reference to the BSoD as an Easter egg in the Internet Explorer browser (versions 4 through 6). Typing "about:mozilla" in the address bar will result in a blank blue page being displayed. However, this has been removed with Service Pack 2 but it can still be shown by typing "res://mshtml.dll/about.moz" instead. The command is the standard way to bring up The Book of Mozilla, another Easter egg on the Netscape/Mozilla family of browsers.

Several online vendors sell blue T-shirts that re-create the BSoD.

In January, 1998, the online magazine Salon.com held a contest where readers sent in fake, humorous error messages in the form of haiku poetry. One of the honorable mentions made a reference to the BSoD. It was written by Peter Rothman.

In the Xbox first-person shooter video game Halo 2, the Microsoft-owned Bungie Studios placed a reference to the BSoD. In the multiplayer map level known as Zanzibar, there is a console that can be used by players to open a nearby gate. Once the console is used, the screen immediately goes to a BSoD-like screen that pokes fun at the true computer error.

The BSoD can be seen in another first-person shooter, Half-Life. Near the start of the game, in the room where the player first meets a security guard, a computer is sitting on a table in the far corner showing a Windows-like screen. "Using" the computer several times will cause the screen to change to a Windows 9X BSoD and an alarm to sound. The sequel Half-Life 2 also features images of BSoDs on computers in Isaac Kleiner's laboratory.

In Unreal Championship 2, when getting fragged, one of the robot characters, named Raptor will exclaim: "I see the blue screen.", which doubles as a reference to the phenomenon of seeing "the light" when dying.

In Advance Wars: Dual Strike for the Nintendo DS, a robot character named CO Jugger refers to the BSoD when using his Super CO Power "System Crash"

There are images of BSoDs in the computer game Far Cry. Several monitors on scientific consoles feature Windows NT4 BSoD-like rolling text. There are also static images of Windows 98-like BSoDs.

In the Nintendo GameCube game Eternal Darkness: Sanity's Requiem a random hallucination experienced by a player with low sanity is a version of the BSoD. Thankfully the game returns to normal less than a minute later.

In the episode of The Adventures of Jimmy Neutron: Boy Genius, Nightmare in Retroville, when Jimmy Neutron claims that "The screen is frozen", a BSoD (possibly from Windows Me) can be seen.

In the story mode of the fighting game Guilty Gear XX, the robotic character Robo-Ky yells out that he is experiencing a BSoD as he malfunctions.

In the Video Game SWAT 4, the blue screen is seen on several of the computers in the "Red Library Offices" level. The screen is a parody of the original blue screen and contains humorous content.

Blue Screen of Death - Gallery

Windows NT 3.1

Windows NT 3.5

Windows 2000

Windows XP

Windows 9x

ReactOS

Blue Screen of Death - Reference

• Microsoft Corp. (1996). Microsoft Windows NT workstation resource kit. 1st ed. Redmond, WA: Microsoft Press.

See also

• Sad Mac — Pre-iMac (Old World ROM) Mac OS equivalent
• Spinning wait cursor or Spinning Beach Ball of Death — similarly-named icon in Mac OS X, that commonly means an application is busy, but can mean a serious error requiring restarting the application or the computer
• Guru Meditation — Amiga OS equivalent
• Row of Bombs — Atari / Mac OS (old) equivalent
• Kernel panic — Unix variant equivalent
• Red screen of death — The red counterpart which existed in pre-beta builds of Windows Vista
• Yellow screen of death — A screen shown when there is XML parsing error happens in Mozilla browsers
• Black screen of death — OS/2 and Windows
• Xbox 360 screen of death — in videogame console

Adapted from the Wikipedia article "Blue Screen of Death", under the G.N U Free Docmentation License. Please also see http://en.wikipedia.org/wiki