Simulating a BlueScreen

Question

I am trying to make a program that records a whole bunch of things periodically. The specific reason is that if it bluescreens, a developer can go back and check a lot of the environment and see what was going on around that time.

My problem, is their a way to cause a bluescreen? Maybe with a windowsAPI call (ZeroMemory maybe?).

Anywhoo, if you can think of a way to cause a bluescreen on call I would be thankful.

The computer I am testing this on is designed to take stuff like this haha.

by the way the language I am using is C\C++. Thank you

Simmons

Load a device driver that promptly executes an illegal instruction? – Burley

Answer 1

You can configure a machine to crash on a keystroke (Ctrl-ScrollLock)

• http://support.microsoft.com/kb/244139

Since it appears that there are times when that won't work on some systems with USB keyboards, you can also get the Debugging Tools for Windows, install the kernel debugger, and use the ".crash" command to force a bugcheck.

• http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Depreciation

The only down side to this is it's a "fake" bluescreen. I don't mean fake as in you can recover, but there's a codepath in windows that specifically bluescreens when you hit the keys, or use the kernel debugger, where killing csrss is actually a crash. – Colic

For the keyboard option, the crash is in a driver handling the interrupt - can't get much more non-determinisitic than that. Pretty similar for the kd crash - break into kd using Ctrl-C and the system can be in any state. The CSRSS crash is actually caused by specific code in Windows. – Depreciation

@Michael, it's more violent than CSRSS, but still doesn't cause memory corruption etc, and so might be a bit less effective for testing. Though if one wants to be really violent, pulling the plug is effective :) – Silkweed

Answer 2

In order to cause a BSOD, a driver running in kernel mode needs to cause it. If you really want to do this, you can write a driver which exposes KeBugCheck to usermode.

http://msdn.microsoft.com/en-us/library/ms801640.aspx

Thanks to Andrew below for pointing this utility out:

http://download.sysinternals.com/files/NotMyFault.zip

Banuelos

SysInternals provides a utility called "NotMyFault" that can generate crashes (by calling KeBugCheckEx and a variety of other ways) if you don't want to write your own. – Montes

Answer 3

If you kill the csrss process you'll get a blue-screen rather quickly.

Colic

Will it happen every time? Or is it somewhat of a coin flip? – Simmons

CSRSS is a critical process - the system will always bugcheck when it crashes. – Depreciation

Answer 4

If you want to simulate a hard crash such as a bluescreen, you'd pretty much have to yank the power cord. NOT recommended.

In case of a crash, anything not saved to persistent storage will be lost. If you want to simulate a crash for purposes of logging, write a "kill switch" into your logger, which stops the logging. Now you can simulate a crash by killing the logging and making sure you have the data you would have wanted in case of an actual crash.

Wellturned

Their will be really no other programs running on the computer but mine so I am not worried about data loss. I am using this computer specifically for stress testing. I want an actual bluescreen for the accuracy. – Simmons

Answer 5

First of all, I would advise you to use a Virtual Machine to test this BSOD on. This will allow you to keep a backup just in case the BSOD does some damage to the system. Here's a tip on how to generate a BSOD simply by pressing CTRL+SCROLLLOCK+SCROLLLOCK.

Is there a Windows API to generate one? No, according to this article. Still, if you would call certain API's with invalid data, they could still cause a crash inside the kernel, which would result in your BSOD.

Grime

Answer 6

I'm not sure exactly what you'd be testing. Since your program runs periodically, surely it's enough to check that the information is being dumped at the frequency that you specify while the system is running? Are you checking that the information stays around after the blue screen? Depending on how you are dumping it (and whether you are flushing buffers), this may not be necessary.

Yarkand

I am trying to make a program to have developers understand what causes bluescreens. It works by storing a lot of runtime information at certain times. – Simmons

@Simmons -- my point is that the program stores information. since it stores it periodically, not at the time of the blue screen, it ought to be enough to test that the information is stored. I'm not sure what additional benefit you get from causing the blue screen. – Yarkand

@tvan, perhaps he wants to see whether the information will be useful at identifying the cause of the bluescreen? – Silkweed

Answer 7

If you dont want to write code (driver, IOCTL...) you can use DiskCryptor. Note that no disk encrypting is need.

Just need to install the driver:

dcinst.exe -setup

And then generate a bsod using the DC console:

dccon.exe -bsod

Gestation

Answer 8

Run process as critic and exit http://waleedassar.blogspot.co.uk/2012/03/rtlsetprocessiscritical.html

Undershot