I wrote the original blue screen of death, sort of


We pick up the story with Windows 95. As I noted, the blue Ctrl+Alt+Del dialog was introduced in Windows 3.1, and in Windows 95; it was already gone. In Windows 95, hitting Ctrl+Alt+Del called up a dialog box that looked something like this:

Close Program × 
Explorer
Contoso Deluxe Composer [not responding]
Fabrikam Chart 2.0
LitWare Chess Challenger
Systray

WARNING: Pressing CTRL+ALT+DEL again will restart your computer. You will lose unsaved information in all programs that are running.
End Task

Shut Down

Cancel

(We learned about Systray some time ago.)

Whereas Windows 3.1 responded to fatal errors by crashing out to a black screen, Windows 95 switched to showing severe errors in blue. And I'm the one who wrote it. Or at least modified it last.

I was responsible for the code that displayed blue screen messages: Asking the kernel-mode video driver to switch into text mode, filling the screen with a blue background, drawing white text, waiting for the user to press a key, restoring the screen to its original contents, and reporting the user's response back to the component that asked to display the message.¹

When a device driver crashed, Windows 95 tried its best to limp along despite a catastrophic failure in a kernel-mode component. It wasn't a blue screen of death so much as a blue screen of lameness. For those fortunate never to have seen one, it looked like this:



 Windows 


An exception 0D has occurred at 0028:80014812. This was called from 0028:80014C34. It may be possible to continue normally.

* Press any key to attempt to continue.
* Press CTRL+ALT+DEL to restart your computer. You will
  lose any unsaved information in all applications.

Note the optimistic message "It may be possible to continue normally." Everybody forgets that after Windows 95 showed you a blue screen error, it tried its best to ignore the error and keep running anyway. I mean, sure your scanner driver crashed, so scanning doesn't work any more, but the rest of the system seems to be okay.

(Imagine if you did that today. "Press any key to ignore this kernel panic.")

Technically, what happened was that the virtual machine manager abandoned the event currently in progress and returned to the event dispatcher. It's the kernel-mode equivalent to swallowing exceptions in window procedures and returning to the message loop. If there was no event in progress, then the current application was terminated.

Sometimes the problem was global, and abandoning the current event or terminating the application did nothing to solve the problem; all that happened was that the next event or application to run encountered the same problem, and you got another blue screen message a few milliseconds later. After about a half dozen of these messages, you most likely gave up hope and hit Ctrl+Alt+Del.

Now, that's what the message looked like originally, but that message had a problem: Since the addresses at which device drivers were loaded into the kernel were not predictable, having the raw address didn't really tell you much. If you were someone who was told, "This senior executive got this crash message, can you figure out what happened?", all you had to work with was a bunch of mostly useless numbers.

That someone might have been me.

To help with this problem, I tweaked the message to include the name of the driver, the section number, and the offset within the section.



 Windows 


An exception 0D has occurred at 0028:80014812 in VxD CONTOSO(03) + 00000152. This was called from 0028:80014C34 in VxD CONTOSO(03) + 00000574. It may be possible to continue normally.

* Press any key to attempt to continue.
* Press CTRL+ALT+DEL to restart your computer. You will
  lose any unsaved information in all applications.

Now you had the name of the driver that crashed, which might give you a clue of where the problem is, even if you knew nothing else. And somebody with access to a MAP file for the driver could now look up the address and identify which line crashed. Not great, but better than nothing, and before I made this change, nothing is what you had.

So you could say that I wrote the Windows 95 blue screen of death lameness to make my own life easier.

Bonus chatter: Later, someone (I forget whether it was me, so let's say it was one of my colleagues) added some more code to inspect the crashing address, and if it was inside the kernel heap manager, the message changed slightly:



 Windows 


A 32-bit device driver has corrupted critical system memory, resulting in an exception 0D at 0028:80001812 in VxD VMM(01) + 00001812. This was called from 0028:80014C34 in VxD CONTOSO(03) + 00000575.

* Press any key to attempt to continue.
* Press CTRL+ALT+DEL to restart your computer. You will
  lose any unsaved information in all applications.

In this case, the sentence "It may be possible to continue normally" disappeared. Because we knew that, odds are, it won't be.

Bonus chatter: Nice job, Slashdot. You considered posting a correction, but your correction was also wrong. At least you realized your mistake.

¹ Since this code ran in the kernel, it didn't have access to keyboard layout information. It doesn't know that if you are using the Chinese-Bopomofo keyboard layout, then the way to type "OK" is to press C, followed by L, followed by 3. Not that it would help, because there is no IME in the kernel anyway. As much as possible, the responses were mapped to language-independent keys like Enter and ESC.

Comments (45)
  1. Ian Yates says:

    Loving these history articles.  Keep them coming :)

  2. Jack B Nimble says:

    Media outlets will now pick up this story and claim some Chinese guy named Bopomofo wrote the blue screen of death.

  3. Leonardo Herrera says:

    Ah, I loved Win95 so much. It was so modern, beautiful and different from anything else before. I've even forgotten the pain from BSDs in the middle of the night when working on an important Word document.

  4. Wladimir Palant says:

    Is it just me or is that footnote not referenced anywhere in the text? While it is some interesting info, the keys to be pressed aren't being discussed in the text at all.

    [Oops. Typo meant that an entire paragraph vanished. Restored. Thanks. -Raymond]
  5. Zack says:

    If memory serves, Windows NT 3.1 had its own variation on the blue screen; like Windows 95 it was reserved for catastrophic failures, but it dumped out a great deal more information, including a stack trace and a list of loaded kernel modules.  It wasn't all that useful to me as a kid trying to troubleshoot the file server in the high school library as a favor to his mother (the librarian) using only the manuals that came with the thing, but I remember being impressed that it <i>could</i> tell me that much.  

    (That file server, by the way, was an entertaining little diversion on the way to The Cloud.  In 1994, the state of the art way to keep your library's periodical collection up to date was CD-ROMs, delivered on subscription.  The file server had a stack of ten CD-ROM drives in a special enclosure, and served all of them as network drives to the student workstations, which were much less fancy and ran plain old DOS, because you see, each CD-ROM came with its own bundled little DOS program that searched the periodicals and displayed articles.  It was a pretty awful kludge, and my mother ditched it the instant the periodicals service started offering their collection over the Web, which was only a few years later.)

  6. Gabe says:

    Zack is right — the original BSOD was the Windows NT bugcheck screen. When you ran NT and you got a blue screen, it meant everything had died.

    If you were running Win3.1 or Win95 and got a blue screen, it just meant that something bad had happened, but you could continue. Nobody actually called it "death". In fact, I've never heard of a Win3.1 or Win9x user call anything a BSOD — that epithet is something I've only heard from NT users.

  7. xpclient says:

    I am more awed by the fact that Raymond wrote Tweak UI and then let it die thanks to Microsoft's policy of no unsupported downloads starting with Vista! :O

  8. Ace says:

    Your CSS/HTML skills to simulate screenshots continue to be awesome. :)

    [There was the time somebody asked "We'd like to cite your article in our publication. Do you have a higher-resolution version of the bitmap?" I didn't, and that was a problem. CSS/HTML allows my screenshots to scale to whatever resolution is necessary for whoever needs it. -Raymond]
  9. NB says:

    So NT could have let the user press a key to continue as well, but opted not to.

  10. THV says:

    FYI, the Slashdot link you posted is just an unpublished user submission. Looks like they did fix their original post: tech.slashdot.org/…/steve-ballmer-authored-your-blue-screen-of-death

  11. Jony says:

    Or you can open the: macilove.com/blue-screen and click V button :)

  12. Craig says:

    So one thing I notice about the Blue Screen of Death is that its commonly attributed to "Microsofts crappy OS" as opposed to a driver vendors crappy code, bug, or otherwise faulty driver. I suppose it is bad PR to say "Its not my fault that BIGNAMEHARDWAREVENDORCORP cant write a decent driver for our OS" but most it seemed that more could be communicated around this. Also, what were the percentages of faulty driver software causing a BSOD vs Windows bugs?

  13. CyberKid says:

    I don't consider these BSODs.  BSODs refer to a "Fatal Exception Error", and only show up on NT/XP Windows.

    There is no way to recover from BSODs since they are Fatal, and the font was quite a bit smaller than that shown.

  14. CyberKid says:

    Also, regarding systray, even Microsoft refers to it as both Notification Area and System Tray: windows.microsoft.com/…/remove-icons-from-the-notification-area-system-tray

  15. William says:

    @CyberKid: They're including the text "(system tray)" so that people using the wrong term can find the page anyway. Notice that it only appears in the title, not the body.

    [Exactly. -Raymond]
  16. Joshua says:

    > I don't think many people still use IE8.

    I do. Outstanding accessibility bug in all newer versions of IE.

  17. user says:

    You must be out of your mind Raymond, The whole world (minus some people who are not idiots) are gonna blame you for each and every time BSOD happened to them.

    Very very interesting story though.

  18. Andreas Rejbrand says:

    I should have consulted the statistics before posing my suggestion. Apparently IE8 is still widely used, so still many people cannot view SVG images on the WWW.

    [IE8 is still 4% of my traffic. IE7 is only 0.1%, so I stopped supporting it. -Raymond]
  19. aolszowka says:

    > There was the console window bug. Repeatedly printing TAB followed by 9 backspaces would cause a blue screen. I think that one lasted from NT4.0 to a service pack of XP.  You could crash the machine with TYPE.

    Fascinating, I'll have to start up my 95 Virtual to give this a shot

  20. Tim! says:

    Please don't encourage them by linking directly to the awful slashdot beta.

  21. SimonRev says:

    @aolzowka

    Considering that is described as an NT bug, I doubt it would reproduce in Win 95.  Anyway, Win 95 didn't have a console window it only had DOS windows.

  22. Pietro Gagliardi (andlabs) says:

    I've always known about continuing after a blue screen in 9x, but I'm afraid I can't remember how I figured that out. 9x were crazy times in my life, and I was between 5 and 10 years old at the time…

    Off-topic: Am I the only one who vaguely remembers a Windows 95 "fatal error" box (I was a kid so that was all I knew it as) that was all white, spanned the width of the screen, was in the System font, and had two lines of text (one of which was Windows) and an OK button? Or is my memory failing me? I can never seem to find a picture of it.

  23. JM says:

    I don't think I've *ever* been able to "continue normally" — I've only ever been in the scenario Raymond suggested ("all that happened was that the next event or application to run encountered the same problem, and you got another blue screen message a few milliseconds later"). I mean, if that had ever worked, I probably would have remembered because it would have been so exceptional. Alas, I got conditioned to simply press Ctrl-Alt-Del whenever this screen popped up, and sometimes (when *I* knew the system was hosed, but the system apparently didn't) I'd rattle off two of them in quick succession before even waiting for the screen to appear. I rather miss that combination — these days you need a dedicated reset button on the system or just power cycle.

  24. Zack says:

    NT, even as far back as 3.1, had comprehensive memory protection and a strong distinction between kernel and user code.  In theory, there was nothing a mere *application* could do to trigger its blue screen of death, and the only things that could go wrong in the kernel were catastrophic enough that you would want to reboot anyway.

    In practice, device drivers are just as buggy as they always have been.  I don't remember exactly how we got my mother's library's file server to stop crashing, but I think it was along the lines of "she dragged the consultants who set up the system back out, and they replaced the SCSI card repeatedly until they hit on a vendor whose drivers were reliable."

  25. ErikF says:

    @Pietro: IIRC you got that error when the GDI heap was exhausted and Windows couldn't paint the desktop correctly. This happened more often than now because the heap wasn't very large and programs tended to (and still do today!) leak resources like crazy.

  26. Floppy Disk says:

    I used to get these when back in middle school on our Windows 95 machines. In computer class, we had to each have a 3.5" floppy disk to save our files on, so that we wouldn't save them on the hard drive and then not have them when we came in some other day and sat somewhere else, or if the system crashed, or whatever. However, sometimes, I forgot mine, so I'd use my friends, and we'd just swap back and forth when needing to save documents. Sometimes, MS Word, or whatever program we were using, would I guess still try to access the floppy drive when no disk was in there, and I'd get the blue screen. It was harmless, and Word continued working just fine and was even able to save again once the disk returned. Good times.

  27. Sd says:

    "In theory, there was nothing a mere *application* could do to trigger its blue screen of death,"

    There was the console window bug. Repeatedly printing TAB followed by 9 backspaces would cause a blue screen. I think that one lasted from NT4.0 to a service pack of XP.  You could crash the machine with TYPE.

    [Not sure what your point is. That reality does not always match theory? This is hardly a news flash. -Raymond]
  28. Andreas Rejbrand says:

    If I were you, I'd consider switching to SVG images. It is a lot more sematic compared to using HTML to make what is essentially illustrations. (And, of course, from a semantic point of view, it is not very good to use tables for other things than presenting tabular data.) You could very well put yout SVG illustrations inline using <svg elements. (Since you use the XHTML 1.0 Transitional doctype, this will not validate. But, then again, your blog doesn't validate as it is now either: <validator.w3.org/check. For instance, you make use of HTML5 "data-" attributes.)

    A more 'severe' issue *might* be that SVG support is absent in most old browsers, but all modern browsers do support SVG. The only real problem, I would suppose, is Internet Explorer 8 and earlier. But I don't think many people still use IE8.

  29. VinDuv says:

    Useless trivia: On the Haiku operating system (a BeOS clone), panic() invokes the built-in kernel debugger, which has a handful of commands, including "cont" for continuing. In that case, the panic() call returns, and the kernel code continues running. Of course, if panic was invoked because of a double fault or some other problems, continuing will not work. But it can be used in case of assertion failures (not that it’s a good idea…)

  30. BS says:

    Could Raymond explain why the blue screen title text "Windows" is in gray (instead of white) background?

  31. GWO says:

    That's it, I'm reinstalling the BSOD screensaver from xscreensaver.  Nothing better than to come back after lunch and see an Amiga Guru Meditation or Mac Sys7 bomb screen.

  32. Bob says:

    @Craig:

    It's not just bad device drivers that hide behind the "crappy windows" excuse.  Bad hardware does as well.  blogs.msdn.com/…/407562.aspx   Overclocking, unreliable CPU, bad memory, etc.

  33. John Elliott says:

    @BS: Probably because the 'intensity' bit for background colours can also mean 'blink' depending how the video hardware is programmed.

    [Exactly. The system used mode 3 for these messages, and mode 3 has blink enabled. -Raymond]
  34. BS says:

    @John Elliott: That's exactly what I suspect, because I had seen the background in white with specific display modes/video drivers, suggesting the original color specified is indeed white. But then isn't the gray color a bug?

  35. ender says:

    @JM:

    > Alas, I got conditioned to simply press Ctrl-Alt-Del whenever this screen popped up, and sometimes (when *I* knew the system was hosed, but the system apparently didn't) I'd rattle off two of them in quick succession before even waiting for the screen to appear.

    I remember doing the same thing as well.

    > I rather miss that combination — these days you need a dedicated reset button on the system or just power cycle.

    There was one nice thing about resetting Windows with double Ctrl+Alt+Del: it usually managed to flush disk buffers before resetting, so you didn't risk filesystem corruption.

    @Pietro: those were system modal message boxes, and could be triggered by any application by simply passing MB_SYSTEMMODAL. Thankfully, they weren't abused, and usually only appeared when something really bad was happening.

  36. John Elliott says:

    If I try it in Virtual PC, the background of the title uses colour 7, low-intensity white, which Virtual PC renders as light grey (#aaaaaa). I don't know why Raymond used a darker grey (#808080) in his reconstructions, but I don't think it's worth losing sleep over. The Windows NT DOS box renders colour 7 as a paler grey (#c0c0c0) so there's no particular consistency in these matters.

    [I used #808080 because I misremembered. Will change to #AAAAAA. -Raymond]
  37. Zack says:

    You know, I bet that console-tab-then-backspace bug wasn't in NT 3.1, or would only have crashed the user space process in charge of maintaining the console window.  Wasn't 4.0 the version that moved a big chunk of the Win32 subsystem into kernel space?

    [The console subsystem has always been in user mode. The problem is that it crashes CSRSS, which is a critical process. -Raymond]
  38. Jonathan says:

    Ah, Win95. My workplace had a CD-R drive (JVC, 2X, SCSI), and my co-worker was convined that you must not touch the computer while burning. But I once got a BSOL (Blue Screen of Lameness) while burning a CD, and to my surprise, 20 minutes later the CD-R ejected the completed CD, while the BSOL was still displaying!

  39. Tagon says:

    @ Andreas Rejbrand

    > If I were you, I'd consider switching to SVG images.

    No, please not. As much as I like SVG, I do appreciate web sites (and blogs) that use the lowest tech possible to display a desired effect. And this way the text is search-able (with SVG, I assume it would very likely not be).

    Bonus chatter: OS/2's document viewer would display an RTF line graphic inside a Word-generated RTF document only as a cross-lined "gray box". Reason was that Word stored the line-graphic-RTF inside the Document-RTF as an "RTF comment" containing a hex-encoded BLOB. When I tried to replace this comment with the line-graphic-RTF code instead, it overlapped with the (top left) document text, instead of being rendered at the correct position in the text. Quite disappointing. /end

  40. Joshua says:

    [I used #808080 because I misremembered. Will change to #AAAAAA. -Raymond]

    Monitor excitation energy has changed so much in-between that the color constants don't mean the same colors anymore anyway.

  41. Danny says:

    "..For those fortunate never to have seen one…"

    Name one person….cause W95 blue screens were like one every 5-6 hours, which is lower then the 8 hours work period or equal to the 6 hours school hours. Everybody from kindergartner, pre/mid/high school, university has seen it. The problem only grew when DirectX 2 was finally starting to gain weight in gaming community with W95 OSR2. At that time I was seeing the BSoD like every 2 hours. Later W98 kinda lowered the frequency to a very acceptable pace, one per day on average, and W98 became "de facto" gaming platform. Of course, when W Me was released the BSoD frequency was high enough that eventually that OS became the 1st flop in Micro$$oft history (Vista and W8 being others), and with W98 still supported none could care less about it.

    [I can't say I never saw one, but they were far, far less frequent than once every 6 hours for me. -Raymond]
  42. Danny says:

    "I can't say I never saw one, but they were far, far less frequent than once every 6 hours for me"

    I remember when I 1st tried W95. Was fresh out of oven and we (me, a student in 3rd year at University, and 2 friends, both assistants of their teachers at the same Uni) install it on a 486 DX4 100MHz with 4 MB RAM. During the installation, which took like 4 hours, everything was smooth. The second we finished the 2nd restart of the installation and we actually got to the new desktop, I saw the BSoD. Was a panic that somehow some hardware failed, so we booted back to the original (we created a 2nd partition for W95 for dual booting purposes) operating system, which was Novell Netware 4 and Windows 3.11 for Workgroups (boot Netware then launch W 3.11). When we saw the original OS working like a charm, we realized that W95 BSoD was more of a nuisance then an actual failure and with time we grew accustom to it to the point we kinda simply ignore it. I never saw any W 3.1, or W 3.11 black screens of death, until these days when I read your posts I never knew they existed. That does say something about the stability of W95 vs. previous W 3.x(x) iterations on the same hardware.

  43. bp says:

    You are missing a br tag in the WARNING message of your lovingly recreated Close Program dialogue.

    [Intentional. The WARNING message word wraps, so the break point can vary. -Raymond]
  44. Marc K says:

    >> I don't think many people still use IE8.

    >I do. Outstanding accessibility bug in all newer versions of IE.

    For me the accessibility bug is forcing on font smoothing regardless of OS settings.  If I'm using IE, it's version 8.  When MS starts enforcing the pending "must use newest IE available" policy, I will start installing alternate browsers on systems that currently only have IE8.

  45. 640k says:

    @ Andreas Rejbrand: If I were you, I'd consider switching to SVG images

    No rush, Raymond just recently abandoned VML.

Comments are closed.

Skip to main content