Win 2000/XP blue screen solution practical skills

Although the stability of the Windows 2000/XP system based on the NT architecture has been greatly enhanced, even Windows XP claims to “never crash”, but we will still see the blue alarm information shown in Figure 1 from time to time. It is what is commonly called "blue screen", what is going on?

First, Windows 2000/XP outbreak blue alarm reason Windows 2000/XP uses a layered structure, its two layers are also called mode, respectively user mode (User Mode) and kernel mode (Kernel Mode), the application is unable to directly access the hardware device, and can only be accessed directly by means of the driver. However, even if the NT architecture is stable, it may cause drivers or for some reasons, such as hardware conflicts, hardware problems, registry errors, insufficient virtual memory, loss of dynamic link library files, and exhausted resources. The application has an error and even spreads to the kernel layer in severe cases. In this case, Windows will abort the system and start a function called KeBugCheck. After checking all the interrupted processing and comparing it with the preset stop code and parameters, the screen will turn blue and display the corresponding Error messages and fault prompts, because of this phenomenon actually means a crash, so often referred to as "Blue Screen of Death" (BSOD), also known as "STOP information" or "stop information". Second, know the hidden information in the blue alarm Windows 2000/XP BSOD window and Windows NT4 previous BOSD window is very different, the biggest difference is that NT's BSOD window only includes a generic stop message code, but Windows 2000 /XP's BSOD contains two types of stop messages and hardware messages. The former is the error message generated when an unrecoverable software error is found, and the latter is the error message generated when a serious hardware error is found. Although the information in the window of Figure 1 seems complicated, it generally consists of the following three parts: The error message is in the section between "*** Stop:” to “****** wdmaud.sys", which is the so-called error message, consisting of error code, custom parameters, error symbols, etc. Composition, the meaning of each part is as follows: Error code: hexadecimal number after STOP; Custom parameter: the composition of the error code character, defined by the programmer, the general user is difficult to understand; Error symbol: KMODE_EXCEPTION_NOT_HANDLED Behind the error symbol, here It also shows a memory location and file name to understand the memory location and source files when the error occurred. For us, the most useful thing is the previous error code information, which will be used when searching the Microsoft Knowledge Base.