Simulating a BlueScreen

Question

I am trying to make a program that records a whole bunch of things periodically. The specific reason is that if it bluescreens, a developer can go back and check a lot of th

Answer 1

Run process as critic and exit http://waleedassar.blogspot.co.uk/2012/03/rtlsetprocessiscritical.html

Answer 2

In order to cause a BSOD, a driver running in kernel mode needs to cause it. If you really want to do this, you can write a driver which exposes KeBugCheck to usermode.

http://msdn.microsoft.com/en-us/library/ms801640.aspx

Thanks to Andrew below for pointing this utility out:

http://download.sysinternals.com/files/NotMyFault.zip

Answer 3

If you want to simulate a hard crash such as a bluescreen, you'd pretty much have to yank the power cord. NOT recommended.

In case of a crash, anything not saved to persistent storage will be lost. If you want to simulate a crash for purposes of logging, write a "kill switch" into your logger, which stops the logging. Now you can simulate a crash by killing the logging and making sure you have the data you would have wanted in case of an actual crash.

Answer 4

If you dont want to write code (driver, IOCTL...) you can use DiskCryptor. Note that no disk encrypting is need.

Just need to install the driver:

dcinst.exe -setup

And then generate a bsod using the DC console:

dccon.exe -bsod

Answer 5

You can configure a machine to crash on a keystroke (Ctrl-ScrollLock)

• http://support.microsoft.com/kb/244139

Since it appears that there are times when that won't work on some systems with USB keyboards, you can also get the Debugging Tools for Windows, install the kernel debugger, and use the ".crash" command to force a bugcheck.

• http://www.microsoft.com/whdc/devtools/debugging/default.mspx

Answer 6

I'm not sure exactly what you'd be testing. Since your program runs periodically, surely it's enough to check that the information is being dumped at the frequency that you specify while the system is running? Are you checking that the information stays around after the blue screen? Depending on how you are dumping it (and whether you are flushing buffers), this may not be necessary.