How I Debug Blue Screen Crashes

Thank you Steve!

And thanks again Dave; your compliments are high praise indeed.

Stephen, you can PM me anytime; you know that. You have a lot of knowledgeable users who are offering to let you pick their brains, too. Hope you take everyone up on it. I learned from everyone I could (and still do) and have tried to incorporate a little of all styles/methods into my debugging. :)

writhziden said:

Stephen, you can PM me anytime; you know that. You have a lot of knowledgeable users who are offering to let you pick their brains, too. Hope you take everyone up on it. I learned from everyone I could (and still do) and have tried to incorporate a little of all styles/methods into my debugging. :)

That's good to know. Check your PM inbox..............

Thanks for everything Mike,
Stephen

Really nice tutorial that lays it out from start to finish of someone not previously acquainted with analyzing BSODs. Also, I had completely forgotten about the Modules window in Windbg, which is very beneficial in that you can sort by various means (like timestamp). I've been trying to rough it out by doing so with lmsm t!

Also, again, if you haven't heard it from me before than you should hear it now: the most important means of understanding BSODs means gettin down and dirty and learning all the mechanics on how Windows operates. The book Windows Internals is your best - and really, only - option for doing just that. Any books on OS design also will greatly assist the endeavor. Without a thorough comprehension of this, then you're left only following very strict protocol on finding causes of crashes; protocol which will leave you stranded when the crash doesn't turn out exactly as you expect it, or it'll lead you onto false assumptions. Remember: thorough analysis equates to less suspects.

Thank you both. :)

I also appreciate the added info regarding Windows Internals. A good resource, indeed.

Great write-up, Mike!

Thank you John. :)

It's amazing how many things I could still add to it, but I feel the info is already a lot to take in at once. I still need to clean up one section a little before I feel it is completely finished.

I agree, Mike - it is a lot to take in at once. Seeing your write-up for the 1st time certainly made me sit back. It's hard to believe that we actually go through all that in the time we do, isn't it?

But as you know from your own experience, once you familiarize yourself with the contents, it becomes rather routine.

I really like what you did, Mike. I could not have done a better job myself!

Thanks!

John

Thanks Frederik. Appreciate your kind words, and I was glad to add your tutorial. Yours is also a great tutorial for beginner analysts to learn the basics. :)