Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Windows 8's Blue Screen of Death is different from the previous Windows versions' one:

Windows 8 BSOD

In order to find out what caused the problem you need to write down or remember the search term it presents you with. The two search terms I have seen suggested so far are
SYSTEM_SERVICE_EXCEPTION and HAL_INITIALIZATION_FAILED.

While it’s nice not to have to look at a blue screen full of text, the previous BSOD was more informative than the Windows 8 BSOD, since it contained a detailed error code (information for diagnostic purposes that was collected as the operating system performed a bug check), which could get you closer to tracking down the root of the problem.

How can I get more information about the error Windows 8 has encountered, in order to track down the root of the problem?

share|improve this question
1  
On previous versions of windows, the event was logged in the "system" category. HAL_INITIALIZATION_FAILED is an alias (a named constant) to the error code. The old BSOD gave the constant and its value, but they are the same thing. –  horatio Oct 24 '12 at 21:37
    
BSOD will make a dump file on the hard drive, either on the root of C: or in C:\Windows\minidump, then see this page to analyse the dump file...support.microsoft.com/kb/315263 –  Moab Oct 24 '12 at 21:37
    
Check for C:\Windows\MEMORY.DMP or the latest file in `C:\Windows\Minidumps`; if its the former see whether it's viable to upload it in a zip / rar / 7z file, if its the latter you can just upload it as it will be pretty small. We're happy to take a look for you... –  Tom Wijsman Oct 24 '12 at 22:40
add comment

2 Answers 2

up vote 6 down vote accepted

Ignoring the typical BSOD name, these are more formally referred to a as Bug Checks. In order to look up what a certain BSOD code actually means you can look it up in Bug Check Code Reference.

Bug Check 0x3B: SYSTEM_SERVICE_EXCEPTION and 0x5C: HAL_INITIALIZATION_FAILED sound familiar to you, you can read them there but I will detail things that might seem unclear to someone who doesn't do debugging or low-level driver programming.

SYSTEM_SERVICE_EXCEPTION

The description on the page is:

This indicates that an exception happened while executing a routine that transitions from non-privileged code to privileged code.

This happens when some code on your system attempts to execute other code that is of a higher privelege, when this happens without elevation of privileges it means that the non-privileged code would breach security. This is often what a malfunctioning driver does, but could also be a rootkit under the form of a driver that bumps into some form of protection.

That doesn't mean we should exclude other possible errors like memory corruption, which could be seen by investigating the crash dump to see whether the behavior points down to a driver or is more random. Even if the crash dump were random it wouldn't necessary point down to bad memory, but could again be the result of a driver corrupting the memory. Doing a memory test is therefore handy to check whether there is bad memory to get a more clear idea if we're down this road.

HAL_INITIALIZATION_FAILED

The description on the page is:

This indicates that the HAL initialization failed.

Yeah, that's all she said. Studying what the HAL is would be the logical next step to understand what's going on here, in short this part from the "In Operating Systems" section helps:

A hardware abstraction layer (HAL) is an abstraction layer, implemented in software, between the physical hardware of a computer and the software that runs on that computer. Its function is to hide differences in hardware from most of the operating system kernel, so that most of the kernel-mode code does not need to be changed to run on systems with different hardware.

On a PC, HAL can basically be considered to be the driver for the motherboard and allows instructions from higher level computer languages to communicate with lower level components, such as directly with hardware.

Yeah, it's still pretty long. But it points down some more interesting possible causes: Malfunctioning hardware, abstraction code, motherboard / chipset drivers or other drivers. Walking through these possible causes backwards allows us to see level-by-level where the problem might lie; and for this, we once again need to inspect the crash dump.

Inspecting a crash dump?!

As pointed out in the comments, you can visit this URL for some basic instructions although I'd suggest to upload the dump if possible so we can check it for you. I usually use WinDBG from the Debugging Tool for Windows to do this. Alternatively you can use the online Instant Online Crash Dump Analyzer from OSR Online, although that doesn't let you inspect things further than the generic analysis of the crash dump. So, once you have obtained the crash dump, let us know...

share|improve this answer
add comment

You can see the same information that was on the old Blue Screen in the Event Viewer. System log, Event-id 1001

http://msdn.microsoft.com/en-us/library/ff559069(v=vs.85).aspx

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.