How to get more info out of the uninformative Windows 8 BSOD?

Ignoring the typical BSOD name, these are more formally referred to a as Bug Checks. In order to look up what a certain BSOD code actually means you can look it up in Bug Check Code Reference.

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION and 0x5C: HAL_INITIALIZATION_FAILED sound familiar to you, you can read them there but I will detail things that might seem unclear to someone who doesn't do debugging or low-level driver programming.

SYSTEM_SERVICE_EXCEPTION

The description on the page is:

This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

This happens when some code on your system attempts to execute other code that is of a higher privelege, when this happens without elevation of privileges it means that the non-privileged code would breach security. This is often what a malfunctioning driver does, but could also be a rootkit under the form of a driver that bumps into some form of protection.

That doesn't mean we should exclude other possible errors like memory corruption, which could be seen by investigating the crash dump to see whether the behavior points down to a driver or is more random. Even if the crash dump were random it wouldn't necessary point down to bad memory, but could again be the result of a driver corrupting the memory. Doing a memory test is therefore handy to check whether there is bad memory to get a more clear idea if we're down this road.

HAL_INITIALIZATION_FAILED

The description on the page is:

This indicates that the HAL initialization failed.

Yeah, that's all she said. Studying what the HAL is would be the logical next step to understand what's going on here, in short this part from the "In Operating Systems" section helps:

A hardware abstraction layer (HAL) is an abstraction layer, implemented in software, between the physical hardware of a computer and the software that runs on that computer. Its function is to hide differences in hardware from most of the operating system kernel, so that most of the kernel-mode code does not need to be changed to run on systems with different hardware.

On a PC, HAL can basically be considered to be the driver for the motherboard and allows instructions from higher level computer languages to communicate with lower level components, such as directly with hardware.

Yeah, it's still pretty long. But it points down some more interesting possible causes: Malfunctioning hardware, abstraction code, motherboard / chipset drivers or other drivers. Walking through these possible causes backwards allows us to see level-by-level where the problem might lie; and for this, we once again need to inspect the crash dump.

Inspecting a crash dump?!

As pointed out in the comments, you can visit this URL for some basic instructions although I'd suggest to upload the dump if possible so we can check it for you. I usually use WinDBG from the Debugging Tool for Windows to do this. Alternatively you can use the online Instant Online Crash Dump Analyzer from OSR Online, although that doesn't let you inspect things further than the generic analysis of the crash dump. So, once you have obtained the crash dump, let us know...


You can see the same information that was on the old Blue Screen in the Event Viewer. System log, Event-id 1001

http://msdn.microsoft.com/en-us/library/ff559069(v=vs.85).aspx

Tags:

Bsod

Windows 8