Simulating a BlueScreen

views:

900

answers:

+7 Q:

Simulating a BlueScreen

I am trying to make a program that records a whole bunch of things periodically. The specific reason is that if it bluescreens, a developer can go back and check a lot of the environment and see what was going on around that time.

My problem, is their a way to cause a bluescreen? Maybe with a windowsAPI call (ZeroMemory maybe?).

Anywhoo, if you can think of a way to cause a bluescreen on call I would be thankful.

The computer I am testing this on is designed to take stuff like this haha.

by the way the language I am using is C\C++. Thank you

+3 A:

If you kill the csrss process you'll get a blue-screen rather quickly.

WaldenL 2009-03-20 19:23:28

Will it happen every time?Or is it somewhat of a coin flip?

2009-03-20 19:27:11

CSRSS is a critical process - the system will always bugcheck when it crashes.

Michael Burr 2009-03-20 19:29:47

I can't really see much difference between a fake BSOD and killing csrss...

Kalmi 2009-03-20 19:51:00

If you want to simulate a hard crash such as a bluescreen, you'd pretty much have to yank the power cord. NOT recommended.

In case of a crash, anything not saved to persistent storage will be lost. If you want to simulate a crash for purposes of logging, write a "kill switch" into your logger, which stops the logging. Now you can simulate a crash by killing the logging and making sure you have the data you would have wanted in case of an actual crash.

Dave Swersky 2009-03-20 19:24:26

Their will be really no other programs running on the computer but mine so I am not worried about data loss. I am using this computer specifically for stress testing. I want an actual bluescreen for the accuracy.

2009-03-20 19:26:22

+10 A:

You can configure a machine to crash on a keystroke (Ctrl-ScrollLock)

http://support.microsoft.com/kb/244139

Since it appears that there are times when that won't work on some systems with USB keyboards, you can also get the Debugging Tools for Windows, install the kernel debugger, and use the ".crash" command to force a bugcheck.

http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Michael Burr 2009-03-20 19:24:46

The only down side to this is it's a "fake" bluescreen. I don't mean fake as in you can recover, but there's a codepath in windows that specifically bluescreens when you hit the keys, or use the kernel debugger, where killing csrss is actually a crash.

WaldenL 2009-03-20 19:36:31

For the keyboard option, the crash is in a driver handling the interrupt - can't get much more non-determinisitic than that. Pretty similar for the kd crash - break into kd using Ctrl-C and the system can be in any state. The CSRSS crash is actually caused by specific code in Windows.

Michael Burr 2009-03-20 19:45:28

@Michael, it's more violent than CSRSS, but still doesn't cause memory corruption etc, and so might be a bit less effective for testing. Though if one wants to be really violent, pulling the plug is effective :)

bdonlan 2009-08-04 00:41:42

+1 A:

Why simulate? Run Windows ME.

John Rasch 2009-03-20 19:25:11

I'm not sure exactly what you'd be testing. Since your program runs periodically, surely it's enough to check that the information is being dumped at the frequency that you specify while the system is running? Are you checking that the information stays around after the blue screen? Depending on how you are dumping it (and whether you are flushing buffers), this may not be necessary.

tvanfosson 2009-03-20 19:28:13

I am trying to make a program to have developers understand what causes bluescreens. It works by storing a lot of runtime information at certain times.

2009-03-20 19:29:47

@dafis -- my point is that the program stores information. since it stores it periodically, not at the time of the blue screen, it ought to be enough to test that the information is stored. I'm not sure what additional benefit you get from causing the blue screen.

tvanfosson 2009-03-20 19:54:36

@tvan, perhaps he wants to see whether the information will be useful at identifying the cause of the bluescreen?

bdonlan 2009-08-04 00:42:46

+4 A:

In order to cause a BSOD, a driver running in kernel mode needs to cause it. If you really want to do this, you can write a driver which exposes KeBugCheck to usermode.

http://msdn.microsoft.com/en-us/library/ms801640.aspx

Jesse Weigert 2009-03-20 19:30:48

First of all, I would advise you to use a Virtual Machine to test this BSOD on. This will allow you to keep a backup just in case the BSOD does some damage to the system. Here's a tip on how to generate a BSOD simply by pressing CTRL+SCROLLLOCK+SCROLLLOCK.

Is there a Windows API to generate one? No, according to this article. Still, if you would call certain API's with invalid data, they could still cause a crash inside the kernel, which would result in your BSOD.

Workshop Alex 2009-09-23 11:46:02

ansaurus

tags:

views:

answers:

Simulating a BlueScreen

related questions