Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 12 down vote favorite
5

While Windows XP came out I heard about a testing feature that existed to manually cause a BSOD (Blue Screen Of Death). I also heard this was supposed to be removed in XP Service Pack 2. It didn't get removed, it's also in Vista and Windows 7. To Enable this navigate to this location in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters

and add CrashOnCtrlScroll as a REG_DWORD with the value of 1.

Now reboot and Press Ctrl+Scroll Lock+Scroll Lock, and you get a BSOD.

Why is this feature still here? When (if ever) will they remove it?

share|improve this question
3  
I think you'll need to ask Microsoft about that one. – DLH Jul 27 '09 at 19:45
14  
Since it requires a mandatory registry hack, I don't think there's a downside to leaving it in the system. Nobody's likely to trigger it by mistake. – sangretu Jul 27 '09 at 19:57
Will the key sequence also work if triggered from an RDP session? – Axxmasterr Jul 27 '09 at 20:16
3  
Since it has a legitimate use case that matters to the people who actually write and debug the kernel and device drivers, I wouldn't expect to see it removed. Enabling it requires write access to HKLM, and even if enabled all you get is a BSOD. – RBerteig Jul 28 '09 at 22:52
1  
@Axxmaster: No, it won't since the key sequence is implemented in the device drivers for keyboards. Those aren't needed or even used in an RDP session. – Joey May 3 '10 at 19:24
show 4 more comments

8 Answers

up vote 26 down vote accepted

It's there to allow a break into the Kernel Debugger or generate a kernel-mode dump file. Typically an expert would want to do this when the OS looks locked up and won't even respond to CTRL+ALT+DELETE in order to get the dump file and investigate it for which driver is having trouble.

It's logically equivelent to calling the kernel API KeBugCheck with bugcheck 0xE2 (MANUALLY_INITIATED_CRASH). Also note that the reg values can be set in different reg keys for the USB (kbdhid) keyboard driver versus the ps2 (i8042prt) driver. There is more information on that and customizing which keystoke is used in KB Article 244139.

Since this is implemented in the actual keyboard drivers, I don't expect this would work from and RDP session even if it was enabled.

share|improve this answer
It's also there for hardware and driver developers who need to trap into the debugger at a certain point. And I definitely think this should be the accepted answer. – Joey May 3 '10 at 19:25
up vote 7 down vote

If we're generous, could it perhaps be used as an over-enthusiastic way of forcing a crash dump for manually investigating the system state? (primarily for debugging)

OK - a pretty weird way to do it, but...

share|improve this answer
7  
That is being very generous indeed. It might be a method that was intended to allow software to crash the system to "stop the bleeding" in case of a serious compromise. Forcing the system to shut down would prevent anyone from stealing data. – Axxmasterr Jul 27 '09 at 20:18
up vote 6 down vote

Let's call it an easter egg.

Congratulations.....you found it!

share|improve this answer
up vote 5 down vote

This sounds like a fun practical joke, really.

share|improve this answer
4  
I used to use it a school when my teacher was coming and I was playing a fullsceen game. – Lucas McCoy Jul 27 '09 at 21:44
@Lucas: Wait, you have administrator access in a place where you're a student? :O – Joey May 3 '10 at 19:25
@Johannes: Yes. It was very lax. – Lucas McCoy May 3 '10 at 21:11
up vote 3 down vote

It sounds like something that wasn't worth the time and effort to remove from the codebase.

share|improve this answer
up vote 1 down vote

That's a great way to manually test if code is crash proof.

share|improve this answer
up vote 1 down vote

I'd imagine Microsoft performs unit testing on their OS before releasing updates etc. Presumably one of the tests would be to see if BSOD still behaves as it should. It also makes sense to run unit tests on the real active code-version for a more reliable test.

share|improve this answer
up vote 1 down vote

You should watch Mark Russinovich's videos where he shows how to diagnose system hangs with this "feature". I think it was just set to off in SP2, not removed.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.