Generate kernel dump using keyboard

Just copy and paste from KB article:

Article ID: 244139 – Last Review: July 16, 2009 – Revision: 23.1

Windows feature lets you generate a memory dump file by using the keyboard

Hotfix Download Available
View and request hotfix downloads
This article was previously published under Q244139

On This Page

SUMMARY

Windows includes a feature that you can use to cause the system to stop respond…

Windows includes a feature that you can use to cause the system to stop responding and to generate a memory dump file (Memory.dmp). When you do this, you receive a Stop error message that resembles the following:

*** STOP: 0x000000E2 (0x00000000,0x00000000,0x00000000,0x00000000)
The end-user manually generated the crashdump.

After you enable the feature, you can generate a memory dump file by holding down the right CTRL key and pressing the SCROLL LOCK key two times. The feature is available for both PS/2 and universal serial bus (USB) keyboards. PS/2 keyboards use the i8042prt.sys driver that is included with the keyboard. However, for USB keyboards that are attached to Windows Server 2003-based systems, you must install a hotfix for the Kbdhid.sys driver. For more information about this hotfix, see the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.

Note There is a limitation with the Kbdhid.sys driver that allows for you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver.

Note The USB keyboard feature can only be used in Windows Server 2008 if Service Pack 2 or later is installed.

MORE INFORMATION

Important This section, method, or task contains steps that tell you how to modi…

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756  (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

By default, this feature is disabled. To enable this feature on a computer that uses a PS/2 Keyboard, modify the registry as indicated in this article, and then restart the computer. After you restart the computer, you can generate a Memory.dmp file by holding down the CTRL key and pressing the SCROLL LOCK key two times. You must use the CTRL key on the right side of the spacebar. On a computer that uses a USB keyboard, you do not have to restart the computer. Unplugging the keyboard and plugging it back again is sufficient. After that, the Memory.dmp file can be generated.

To enable the feature on a computer that uses a PS/2 keyboard, follow these steps:

  1. Start Registry Editor.
  2. Locate the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters
  3. On the Edit menu, click Add Value, and then add the following registry entry:
    Name: CrashOnCtrlScroll
    Data Type: REG_DWORD
    Value: 1
  4. Exit Registry Editor, and then restart the computer.

To enable the feature on a computer that uses a USB keyboard, install the hotfix that is mentioned in the "Windows Server 2003 resolution" subsection at the end of the "More Information" section.

To make sure that the feature is enabled on a computer that uses a USB keyboard, follow these steps:

  1. Start Registry Editor.
  2. Locate the following registry subkey:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kbdhid\Parameters
  3. Make sure that the following registry entry is enabled:
    Name: CrashOnCtrlScroll
    Data Type: REG_DWORD
    Value: 1
  4. Exit Registry Editor.

How to select memory dump file options

Three types of memory dump files can be generated. Select one before you manually trigger the dump file. To do this, follow these steps:

  1. Right-click My Computer, and then click Properties.
  2. Click the Advanced tab, and then click the Startup and Recovery button.
  3. Click Write Debugging Information, and then click to select either Complete Memory Dump, Kernel Memory Dump, or Small Memory Dump.

For more information about memory dump file options, click the following article number to view the article in the Microsoft Knowledge Base:

254649  (http://support.microsoft.com/kb/254649/ ) Overview of memory dump file options for Windows Server 2003, Windows XP, and Windows 2000

Note If the server has a feature such as the Automatic System Restart (ASR) feature that is found in some Compaq computers, disable the feature. It can interrupt the dump process. On a Compaq computer, you can disable the ASR feature by modifying the basic input/output system (BIOS) settings.

Note Complete memory dumps may not be available on a computer that has 2 or more gigabytes (GB) of RAM. To limit the memory that Windows 2000 can access, add the <MaxMem=2000> parameter to the Boot.ini file.

If you have installed the security update that is described in article 835732 in the Microsoft Knowledge Base, or you have installed a service pack that contains this security update, visit the following Microsoft Knowledge Base article:

885117  (http://support.microsoft.com/kb/885117/ ) "Kernel Memory Dump" is displayed in Startup and Recovery, but a complete memory dump is performed in Windows 2000 or in Windows Server 2003

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

835732  (http://support.microsoft.com/kb/835732/ ) MS04-011: Security Update for Microsoft Windows

Service pack information

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100  (http://support.microsoft.com/kb/889100/ ) How to obtain the latest service pack for Windows Server 2003

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Note This hotfix applies only to Windows Server 2003-based systems.

Prerequisites

To apply this hotfix, you must have Windows Server 2003 or Windows Server 2003 Service Pack 1 installed on the computer.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, 32-bit (x86-based) versions
Collapse this tableExpand this table
File name File version File size Date Time Platform SP requirement Service branch
Kbdhid.sys 5.2.3790.493 16,896 28-Feb-2006 00:03 x86 None RTMQFE
Kbdhid.sys 5.2.3790.2649 17,408 28-Feb-2006 03:11 x86 SP1 SP1QFE
Windows Server 2003, x64-based versions
Collapse this tableExpand this table
File name File version File size Date Time Platform
Kbdhid.sys 5.2.3790.2649 24,576 13-Apr-2006 15:59 x64
Windows Server 2003, Itanium-based versions
Collapse this tableExpand this table
File name File version File size Date Time Platform SP requirement Service branch
Kbdhid.sys 5.2.3790.493 47,104 13-Apr-2006 15:54 IA-64 None RTMQFE
Kbdhid.sys 5.2.3790.2649 49,664 13-Apr-2006 15:59 IA-64 SP1 SP1QFE

How to configure registry keys to generate the memory dump file

You can configure entries under the following registry subkey to generate the memory dump file:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\crashdump

The REG_DWORD entries are as follows:

Dump1Keys
Dump2Key

The Dump1Keys entry is a bit map of the modifier keys to use. The values are as follows:

#define CRASH_R_SHIFT 0x01
#define CRASH_R_CTRL 0x02
#define CRASH_R_ALT 0x04
#define CRASH_L_SHIFT 0x10
#define CRASH_L_CTRL 0x20
#define CRASH_L_ALT 0x40

The Dump2Key entry is the index into the scancode table for the keyboard layout. The following is the actual table in the driver.

Note Index 124 (sysreq) is a special case because an 84-key keyboard has a different scan code.

const UCHAR keyToScanTbl[134] = { 

        0x00,0x29,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,

        0x0A,0x0B,0x0C,0x0D,0x7D,0x0E,0x0F,0x10,0x11,0x12,

        0x13,0x14,0x15,0x16,0x17,0x18,0x19,0x1A,0x1B,0x00,

        0x3A,0x1E,0x1F,0x20,0x21,0x22,0x23,0x24,0x25,0x26,

        0x27,0x28,0x2B,0x1C,0x2A,0x00,0x2C,0x2D,0x2E,0x2F,

        0x30,0x31,0x32,0x33,0x34,0x35,0x73,0x36,0x1D,0x00,

        0x38,0x39,0xB8,0x00,0x9D,0x00,0x00,0x00,0x00,0x00,

        0x00,0x00,0x00,0x00,0x00,0xD2,0xD3,0x00,0x00,0xCB,

        0xC7,0xCF,0x00,0xC8,0xD0,0xC9,0xD1,0x00,0x00,0xCD,

        0x45,0x47,0x4B,0x4F,0x00,0xB5,0x48,0x4C,0x50,0x52,

        0x37,0x49,0x4D,0x51,0x53,0x4A,0x4E,0x00,0x9C,0x00,

        0x01,0x00,0x3B,0x3C,0x3D,0x3E,0x3F,0x40,0x41,0x42,

        0x43,0x44,0x57,0x58,0x00,0x46,0x00,0x00,0x00,0x00,

        0x00,0x7B,0x79,0x70 };

For more information about how to generate
a memory dump file in Windows Server 2008, click the following article number to view the article in the Microsoft Knowledge Base:

969028 

(http://support.microsoft.com/kb/969028/
)

How to generate a kernel or a complete memory dump file in Windows Server 2008

The third-party products that this
article discusses are manufactured by companies that are independent of
Microsoft. Microsoft makes no warranty, implied or otherwise, about the
performance or reliability of these products.


APPLIES TO
  • Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
  • Microsoft Windows Server 2003, Datacenter x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Windows Vista Service Pack 1
  • Windows Server 2008 for Itanium-Based Systems
  • Windows Server 2008 Datacenter
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Standard
  • Windows Web Server 2008
Keywords: 

kbautohotfix kbwinserv2003sp2fix kbexpertiseadvanced kbwinserv2003presp2fix kbbug kbfix kbhotfixserver kbqfe kbpubtypekc KB244139
Advertisements

Posted on August 20, 2009, in Uncategorized. Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: