BlueScreen Screen Saver v3.2

By Mark Russinovich

Published: November 1, 2006

Download BlueScreen (64 KB)

Introduction

One of the most feared colors in the NT world is blue. The infamous Blue Screen of Death (BSOD) will pop up on an NT system whenever something has gone terribly wrong. Bluescreen is a screen saver that not only authentically mimics a BSOD, but will simulate startup screens seen during a system boot.

• On NT 4.0 installations it simulates chkdsk of disk drives with errors!
• On Windows 2000, Windows 95, and Windows 98 it presents the Windows 2000 startup splash screen, complete with rotating progress band and progress control updates!
• On Windows XP and Windows Server 2003 it presents the XP/Server 2003 startup splash screen with progress bar!

Bluescreen cycles between different Blue Screens and simulated boots every 15 seconds or so. Virtually all the information shown on Bluescreen’s BSOD and system start screen is obtained from your system configuration — its accuracy will fool even advanced NT developers. For example, the NT build number, processor revision, loaded drivers and addresses, disk drive characteristics, and memory size are all taken from the system Bluescreen is running on.

Use Bluescreen to amaze your friends and scare your enemies!

Installation and Use

Note: before you can run Bluescreen on Windows 95 or 98, you must copy \winnt\system32\ntoskrnl.exe from a Windows 2000 system to your \Windows directory. Simply copy Sysinternals BLUESCRN.SCR to your \system32 directory if on Windows NT/2K, or \Windows\System directory if on Windows 95 or 98. Right click on the desktop to bring up the Display settings dialog and then select the «Screen Saver» tab. Use the pull down list to find «Sysinternals Bluescreen» and apply it as your new screen saver. Select the «Settings» button to enable fake disk activity, which adds an extra touch of realism!

More Information

You can find out how real Blue Screens are generated, and what the information on the Blue Screen means in my December 1997 Windows ITPro Magazine NT Internals column, «Inside the Blue Screen.»

Note: Some virus scanners flag the Bluescreen screen saver as a virus. If this is the case with your virus scanner, you may not be able to use this screen saver.

Download BlueScreen (64 KB)

Runs on:

• Client: Windows Vista and higher.
• Server: Windows Server 2008 and higher.

—>

Blue screens from windows

Versions History

• Version 1.55:
  • Added Drag & Drop support: You can now drag a single MiniDump file from Explorer into the main window of BlueScreenView.
  • Fixed bug: BlueScreenView failed to remember the last size/position of the main window if it was not located in the primary monitor.
• Version 1.52:
  • Added ‘Google Search — Bug Check’ and ‘Google Search — Bug Check + Parameter 1’ options.
• Version 1.51:
  • Added automatic secondary sorting (‘Crash Time’ column).
  • Added 64-bit build.
• Version 1.50:
  • The ‘Crash Time’ now displays more accurate date/time of the crash. In previous versions, the value of ‘Crash Time’ column was taken from the date/time of dump file, which actually represents that time that Windows loaded again, after the crash. The actual crash time is stored inside the dump file , and now the ‘Crash Time’ displays this value.
  • Added ‘Dump File Time’ column, which displays the modified time of the dump file.
• Version 1.47:
  • Added ‘Auto Size Columns+Headers’ option, which allows you to automatically resize the columns according to the row values and column headers.
• Version 1.46:
  • Fixed issue: The properties and the ‘Advanced Options’ windows opened in the wrong monitor, on multi-monitors system.
• Version 1.45:
  • You can now choose to open only a specific dump file — from the user interface or from command-line.
  • You can now also specify the MiniDump folder or MiniDump file as a single parameter, and BlueScreenView will be opened with the right dump file/folder, for example: BlueScreenView.exe C:\windows\minidump\Mini011209-01.dmp
• Version 1.40:
  • Added ‘Raw Data’ mode on the lower pane, which displays the processor registers and memory hex dump.
• Version 1.35:
  • Added ‘Crash Address’ column.
  • Added 3 columns that display that last 3 calls found in the stack (Only for 32-bit crashes)
• Version 1.32:
  • Added ‘Mark Odd/Even Rows’ option, under the View menu. When it’s turned on, the odd and even rows are displayed in different color, to make it easier to read a single line.
• Version 1.31:
  • Added ‘Google Search — Bug Check+Driver’ for searching in Google the driver name and bug check code of the selected blue screen.
• Version 1.30:
  • Added ‘Dump File Size’ column.
• Version 1.29:
  • You can now send the list of blue screen crashes to stdout by specifying an empty filename («») in the command-line of all save parameters.
    For example: bluescreenview.exe /stab «» > c:\temp\blue_screens.txt
• Version 1.28:
  • Added ‘Add Header Line To CSV/Tab-Delimited File’ option. When this option is turned on, the column names are added as the first line when you export to csv or tab-delimited file.
• Version 1.27:
  • Fixed issue: removed the wrong encoding from the xml string, which caused problems to some xml viewers.
• Version 1.26:
  • Fixed ‘DumpChk’ mode to work properly when DumpChk processing takes more than a few seconds.
• Version 1.25:
  • Added ‘DumpChk’ mode, which displays the output of Microsoft DumpChk utility (DumpChk.exe). You can set the right path and parameters of DumpChk in ‘Advanced Options’ window. By default, BlueScreenView tries to run DumpChk from ‘%programfiles%\Debugging Tools for Windows’
  • The default MiniDump folder is now taken from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl
• Version 1.20:
  • Added 3 new columns in the upper pane: Processors Count, Major Version, Minor Version.
  • Added ‘Explorer Copy’ option, which allows you to copy dump files to the clipboard and then paste them into Explorer window.
• Version 1.15:
  • Added option to view the blue screen list of multiple computers on your network. The computer names are specified in a simple text file. (See below).
  • Added Combo-Box to easily choose the MiniDump folders available in the hard-disks currently attached to your computer.
  • Added ‘Computer Name’ and ‘Full Path’ columns.
• Version 1.11:
  • Added /sort command-line option.
• Version 1.10:
  • Added accelerator keys for allowing you to toggle between modes more easily.
  • Added command-line options for saving the crash dumps list to text/csv/html/xml file.
  • Added command-line option for opening BlueScreenView with the desired MiniDump folder.
  • Fixed focus problems when opening the ‘Advanced Options’ window.
  • Added ‘default’ button to the ‘Advanced Options’ window.
  • Added ‘processor’ column — 32-bit or x64.
• Version 1.05 — Added support for x64 MiniDump files.
• Version 1.00 — First release.

BlueScreenView Features

• Automatically scans your current minidump folder and displays the list of all crash dumps, including crash dump date/time and crash details.
• Allows you to view a blue screen which is very similar to the one that Windows displayed during the crash.
• BlueScreenView enumerates the memory addresses inside the stack of the crash, and find all drivers/modules that might be involved in the crash.
• BlueScreenView also allows you to work with another instance of Windows, simply by choosing the right minidump folder (In Advanced Options).
• BlueScreenView automatically locate the drivers appeared in the crash dump, and extract their version resource information, including product name, file version, company, and file description.

System Requirements

• BlueScreenView works with Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, Windows 7, Windows 8, Windows 10, as long as Windows is configured to save minidump files during BSOD crashes. If your system doesn’t create MiniDump files on a blue screen crash, try to configure it according to the following article: How to configure Windows to create MiniDump files on BSOD
• BlueScreenView can read the MiniDump files of both 32-bit and x64 systems.
• Be aware that on Windows 10, some of the created MiniDump files might be empty and BlueScreenView will not display them.

Using BlueScreenView

Crashes Information Columns (Upper Pane)

• Dump File: The MiniDump filename that stores the crash data.
• Crash Time: The created time of the MiniDump filename, which also matches to the date/time that the crash occurred.
• Bug Check String: The crash error string. This error string is determined according to the Bug Check Code, and it’s also displayed in the blue screen window of Windows.
• Bug Check Code: The bug check code, as displayed in the blue screen window.
• Parameter 1/2/3/4: The 4 crash parameters that are also displayed in the blue screen of death.
• Caused By Driver: The driver that probably caused this crash. BlueScreenView tries to locate the right driver or module that caused the blue screen by looking inside the crash stack. However, be aware that the driver detection mechanism is not 100% accurate, and you should also look in the lower pane, that display all drivers/modules found in the stack. These drivers/modules are marked in pink color.
• Caused By Address: Similar to ‘Caused By Driver’ column, but also display the relative address of the crash.
• File Description: The file description of the driver that probably caused this crash. This information is loaded from the version resource of the driver.
• Product Name: The product name of the driver that probably caused this crash. This information is loaded from the version resource of the driver.
• Company: The company name of the driver that probably caused this crash. This information is loaded from the version resource of the driver.
• File Version: The file version of the driver that probably caused this crash. This information is loaded from the version resource of the driver.
• Crash Address: The memory address that the crash occurred. (The address in the EIP/RIP processor register) In some crashes, this value might be identical to ‘Caused By Address’ value, while in others, the crash address is different from the driver that caused the crash.
• Stack Address 1 — 3: The last 3 addresses found in the call stack. Be aware that in some crashes, these values will be empty. Also, the stack addresses list is currently not supported for 64-bit crashes.

Drivers Information Columns (Lower Pane)

• Filename: The driver/module filename
• Address In Stack: The memory address of this driver that was found in the stack.
• From Address: First memory address of this driver.
• To Address: Last memory address of this driver.
• Size: Driver size in memory.
• Time Stamp: Time stamp of this driver.
• Time String: Time stamp of this driver, displayed in date/time format.
• Product Name: Product name of this driver, loaded from the version resource of the driver.
• File Description: File description of this driver, loaded from the version resource of the driver.
• File Version: File version of this driver, loaded from the version resource of the driver.
• Company: Company name of this driver, loaded from the version resource of the driver.
• Full Path: Full path of the driver filename.

Lower Pane Modes

Crashes of Remote Network Computer

Notice: If you fail to get full administrator access to the remote computer, you should read the instructions in the following Blog post: How to connect a remote Windows 7/Vista/XP computer with NirSoft utilities.

Watching the crashes of multiple computers on your network

In order to use this feature, prepare a list of all computer names/IP addresses that you want to inspect, and save it to a simple text file. The computer names in the list can be delimited by comma, semicolon, tab character, or Enter (CRLF).
Example for computer names list: After you have a text file contains the computers list, you can go to Advanced Options window (Ctrl+O), choose the second option and type the computers list filename.

Command-Line Options

/LoadFrom	Specifies the source to load from. 1 -> Load from a single MiniDump folder (/MiniDumpFolder parameter) 2 -> Load from all computers specified in the computer list file. (/ComputersFile parameter) 3 -> Load from a single MiniDump file (/SingleDumpFile parameter)
/MiniDumpFolder	Start BlueScreenView with the specified MiniDump folder.
/SingleDumpFile	Start BlueScreenView with the specified MiniDump file. (For using with /LoadFrom 3)
/ComputersFile	Specifies the computers list filename. (When LoadFrom = 2)
/LowerPaneMode	Start BlueScreenView with the specified mode. 1 = All Drivers, 2 = Only Drivers Found In Stack, 3 = Blue Screen in XP Style.
/stext	Save the list of blue screen crashes into a regular text file.
/stab	Save the list of blue screen crashes into a tab-delimited text file.
/scomma	Save the list of blue screen crashes into a comma-delimited text file (csv).
/stabular	Save the list of blue screen crashes into a tabular text file.
/shtml	Save the list of blue screen crashes into HTML file (Horizontal).
/sverhtml	Save the list of blue screen crashes into HTML file (Vertical).
/sxml	Save the list of blue screen crashes into XML file.
/sort	This command-line option can be used with other save options for sorting by the desired column. If you don’t specify this option, the list is sorted according to the last sort that you made from the user interface. The parameter can specify the column index (0 for the first column, 1 for the second column, and so on) or the name of the column, like «Bug Check Code» and «Crash Time». You can specify the ‘

‘ prefix character (e.g: «

Crash Time») if you want to sort in descending order. You can put multiple /sort in the command-line if you want to sort by multiple columns.