Open WinDBG and press F1 for help
Forcing a System Crash from the Keyboard
A system crash can be directly caused from most keyboards. In Windows XP and later, this feature is available on i8042prt ports (PS/2 keyboards). In addition, it is available on USB keyboards only in Windows Server 2003 (with Service Pack 2 or later, or with Service Pack 1 if the hotfix available with KB 244139 is installed).
Two preparations must be made before this can be done:
If you wish a crash dump file to be written, you must enable such dump files, choose the path and file name, and select the size of the dump file. For details, see Enabling a Kernel-Mode Dump File.
With PS/2 keyboards, you must enable the keyboard-initiated crash in the registry. In the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters, create a value named CrashOnCtrlScroll, and set it equal to REG_DWORD 0x1 (or any nonzero value).
With USB keyboards (Windows Server 2003 only, with Service Pack 2 or later, or with Service Pack 1 if the hotfix is installed), you must set the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\kbdhid\Parameters and create a value named CrashOnCtrlScroll, and set it equal to REG_DWORD 0x1 (or any nonzero value).
Note There is a limitation with the Kbdhid.sys driver that allows you to generate the memory dump process by using a USB keyboard. The CTRL+SCROLL LOCK+SCROLL LOCK keyboard shortcut does not work if the computer stops responding at a high interrupt request level (IRQL). This limitation exists because the Kbdhid.sys driver operates at a lower IRQL than the i8042prt.sys driver. For more information on using this feature with the USB keyboards, refer to the article Generate a memory dump file by using the keyboard (KB 244139).
The system must be rebooted before these changes will take effect.
After this has been done, the keyboard crash can be initiated as follows. Hold down the rightmost CTRL key, and press the SCROLL LOCK key twice.
It is possible for a system to freeze in such a way that this CTRL+SCROLL LOCK+SCROLL LOCK sequence will not work. However, this should be a very rare occurrence. The CTRL+SCROLL LOCK+SCROLL LOCK crash initiation will work even in many instances where CTRL+ALT+DELETE does not work.
The system then calls KeBugCheck and issues bug check 0xE2 (MANUALLY_INITIATED_CRASH). Unless crash dumps have been disabled, a crash dump file is written at this point.
If a kernel debugger is attached to the frozen machine, the machine will break into the kernel debugger after the crash dump file has been written.
If it doesn't work send me a PM and I will fix you up with a few minidump files.
Discussion on:
Message 16 of 33

































