Menu Close

How To Change the Key Sequence for a Memory Dump

​Most people try to avoid Windows blue screens whenever possible.  They are disruptive and can cause you to lose any data you are working on at the time.  That is why I usually advise my clients to update all software and firmware on their Windows devices to reduce the likelihood of blue screens.

 

However, there are some situations where you would want to intentionally cause your Windows machine to blue screen.  A very common scenario is when a machine hangs.  Hangs are difficult to troubleshoot because of the lack of diagnostic data.  In many cases when a machine hangs, there is no log file or error message generated to provide insight into the cause of the hang.  This is why I recommend generating a memory dump (a.k.a. intentionally causing a blue screen).  The state of the machine’s memory is your best lead to determining the cause of the hang.

 

There is a well-known procedure for configuring a Windows PC to blue screen on demand.  The following registry must be added:

 

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesi8042prtParameters

Name : CrashOnCtrlScroll
Data Type : REG_DWORD
Value : 1 

Once the PC is rebooted, the key sequency RIGHT CTRL+SCROLL LOCK + SCROLL LOCK will cause the machine to blue screen.  The event recorded for this blue screen will appear as follows:

 

Event ID: 1001
Source: BugCheck
Description:
The computer has rebooted from a bugcheck. The bugcheck was : 0xc00000E2 (0xffffffffffffffff, 0x0000000000000001, 0x0000000000000000, 0x0000000000000000). A dump was saved in: C:WINDOWSMEMORY.DMP.

 

This is documented in the following Microsoft KB article:


https://support.microsoft.com/en-us/kb/972110/

 

A problem arises if the keyboard that the PC uses does not have a RIGHT CTRL and/or SCROLL LOCK key.  Not having these keys available means that the above method for generating a manual dump file will not work.

 

Fortunately, there is an alternative approach.  Instead of the CrashOnCtrlScroll key, the following registry keys can be added:

 

HKLMSystemCurrentControlSetServicesi8042prtcrashdump

Name : Dump1Keys
Data Type : REG_DWORD
Value :  0x20 

Name : Dump2Key
Data Type : REG_DWORD
Value :  0x21

 

Once the PC is rebooted, the key sequency LEFT CTRL + D will cause the machine to blue screen.  This is a much simpler key sequence to type.  Also, it avoids the problem of a machine that is lacking the standard set of keys on the keyboard.

 

If you need help troubleshooting a blue screen or a hang on a Windows PC, please contact H Tech Solutions for assistance.

 

Creative Commons License
H Tech Solutions Blog by Harris Schneiderman is licensed under a Creative Commons Attribution 4.0 International License.
Permissions beyond the scope of this license may be available at https://htechsolutions.biz/contact-us