Blue screen of death

(Redirected from Bugcheck)
Blue screen of death
Component of Microsoft Windows
Windows11-10.0.22449.1000-BSOD.png
System crash in Windows 11 build 22000.346 and later feature updates
TypeError screen
Introduced inWindows 3.0 build 55
Windows NT 3.1 October 1991 build

A blue screen of death (also known as a blue screen, bugcheck, BSOD, or Stop error)[1] is a common name for the screen that occurs during a system crash in Microsoft Windows operating systems. It is shown when the operating system can no longer function safely due to a fatal system error.

History

Contrary to popular belief, Windows 1.0 and Windows 2.x do not have a crash screen. When early Windows is run on a newer version of MS-DOS, it will print out an "Incorrect DOS version" error message, followed by portions of the computer's memory contents being spewed into the console buffer during the boot process, which is often thought to be a crash screen, although it is simply a bug that is present within the logo code. Whenever Windows does crash, it often results in a system hang or the shell returning to DOS.

A user interface for displaying important system messages was first introduced in Windows 3.0 and is mostly used by virtual device drivers in 386 enhanced mode. This is a full screen message in text mode, which suspends Windows until it is dismissed by the user by pressing a key. Initially, it used a black background but later changed to blue with Windows 3.1. Other than this, the interface was kept virtually unchanged through the rest of the classic Windows series.

In Windows 3.x, this is mostly used in situations where a program could not continue running until the user acted, such as device conflicts or disk swaps.[2] However, severe system errors would still cause Windows to exit back to MS-DOS in a similar fashion to old Windows versions. The interface is also used for a simple task manager implemented in Windows 3.1, which allows the user to terminate an unresponsive program or to reboot the system by pressing Ctrl+Alt+Del, given that Windows is running in the 386 Enhanced Mode. The message shown when there is an unresponsive program was originally written by Steve Ballmer, as later revealed by Microsoft developer Raymond Chen.[3]

Windows 95 and later notably use the user interface to report severe system errors instead of exiting to DOS, which earned it the infamous "blue screen of death" nickname. The Windows 9x series is also unique in that it allows the user to continue after most system errors, although it often resulted in an unstable system.[4] The wording for the exception message was updated with Windows Me as a part of similar changes to other error dialogs.

Other notable uses for the interface also include ACPI subsystem errors in early Windows 98 builds, which override the background color to red, or early builds of Windows Me that briefly replaced the graphical "safe to turn off" screen with a blue screen at one point. Windows Me also replaced MS-DOS black screen errors for startup initialization errors during startup, such as protection errors, with a blue screen.

Windows NT

On Windows NT, blue screens are also commonly known as STOP errors, referring to the *** STOP label that introduced the error code up to Windows 7. According to John Vert, the developer who originally wrote the code in the NT kernel that was responsible for controlling the screen in text mode, the white-on-blue color was chosen in order to match the MIPS' firmware display, as well as the default color scheme of the SlickEdit text editor that many NT developers had used at the time.[5]

The first known build to implement a blue screen is the October 1991 build. Earlier builds merely print the error code to a debugger, if attached, and trigger a breakpoint in an infinite loop. Originally, a system crash only resulted in the error code being printed out to the screen, although later during Windows NT 3.1 development it was extended to also display the stack trace and a list of loaded drivers and their base addresses, alongside giving the stop codes their names that would be commonly used in documentation.

The message was simplified in Windows 2000 to only include possible instructions for the user should they encounter the blue screen. Additionally, the introduction of a VGA driver in the kernel itself allowed for the blue screen to be displayed in 640×480 graphics mode instead of the legacy 80×50 text mode - although the initial implementation in build 1796 and 1814 featured a bug which caused text to be drawn over a black background or on top of the boot screen graphic. The user instructions were further updated and the font changed to Lucida Console in Windows XP.

During the development of Windows 8, the blue screen underwent many significant changes. Around build 7788, the blue screen was updated to support higher resolutions using VBE 2.0 and anti-aliasing. At first, this updated blue screen only appeared if the system crashed during the boot sequence, although it would later be fully utilized in all bugchecks around the time of build 7880's compilation. It would be quickly replaced with a simplified black screen in build 7887, and later redesigned in build 8045 to additionally feature a sad emoticon.[a] The background color was later changed to a light cerulean shade in build 8061 and then slightly adjusted in later builds of the operating system.

In Windows 10 build 14316.1000, a QR code was added to the blue screen that links to Microsoft's website for diagnosing blue screen errors. From build 14993 onwards, the background color was changed to green for Insider builds together with a slight wording change in order to be able to quickly distinguish between Insider and production build bug reports; although this can be toggled off with the use of a DisplayPreReleaseColor DWORD in the HKLM/SYSTEM/ControlSet001/Control/CrashControl key. In Windows 10 May 2020 Update and above, the message was altered to refer to the user's device as opposed to the user's PC.

The default background color for bug checks was temporarily changed in Windows 11 build 22000.51 to black, although the green color remained for users in the Insider program. The change was later reverted with build 22000.346, albeit with a darker shade of blue. The QR code was dropped in Windows Server build 22463 for a short period and was reinstated afterwards.

Implementation

In classic Windows, the blue screen is implemented by the SHELL_SYSMODAL_Message routine in the Shell VxD. The routine temporarily halts the system and then proceeds to tell the display driver to switch the display to text mode. It sets the background and foreground color, clears the screen and displays the message. It then waits for a valid keypress before switching back to graphics mode and resuming operation. On Windows 9x, it is most commonly called from VWIN32_BlueScreenPopup in VWIN32.VXD, which displayed the infamous message about an occurring exception. It is possible to change the color of the screen by changing MessageBackColor (background color) and MessageTextColor (text color) values in SYSTEM.INI (under 386Enh section).

The blue screen on NT-based systems is implemented in the KeBugCheck and KeBugCheckEx functions, which are contained in the kernel executable. The difference between the two functions is that the former accepts only the bugcheck code as an integer parameter, while the latter also accepts four more integers as bugcheck parameter codes, which can have different meaning depending on the bug check code. A component running in kernel mode can call either function to bring the system down in a controlled manner if it detects a fatal uncorrectable error that can lead to data corruption.[6][7] The respective function then takes care of switching to a compatible video mode, rendering the blue screen itself, saving a memory dump, and, if enabled, restarting the system. The colors are hardcoded within the kernel but can be changed using a driver such as NotMyFault.[8]

User mode processes can also trigger a bug check if they hold the shutdown privilege by using the NtRaiseHardError system call in ntdll.dll with the OPTION_SHUTDOWN_SYSTEM flag, which transitions the system to kernel mode and then triggers a FATAL_UNHANDLED_HARD_ERROR bug check.

Gallery

Windows 95 to Windows Me

Windows NT 3.1 to Windows NT 4.0

Windows 2000 to Windows 7

Windows 8 and later

Early system crash

Server variants

Notes

  1. ↑ The sad emoticon is not displayed in server builds or Japanese language builds. It is also possible to toggle it by changing or creating the DisableEmoticon registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl.

References

  1. ↑ Microsoft Docs. Interpreting a Bug Check Code, 20 April 2017.
  2. ↑ Chen, Raymond. Steve Ballmer did not write the text for the blue screen of death, The Old New Thing. 9 September 2014.
  3. ↑ Chen, Raymond. Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?, The Old New Thing. 2 September 2014.
  4. ↑ Chen, Raymond. I wrote the original blue screen of death, sort of, The Old New Thing. 10 September 2014.
  5. ↑ Vert, John. Response to "Who designed the original Windows Blue Screen of Death?" question, Quora. 19 October 2012.
  6. ↑ https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-kebugcheck
  7. ↑ https://docs.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/nf-wdm-kebugcheckex
  8. ↑ Chen, Raymond. How do I customize the color of the Windows blue screen?, The Old New Thing. 1 February 2022.
Retrieved from "https://betawiki.net/index.php?title=Blue_screen_of_death&oldid=360178"