How to track down a Blue Screen of Death triggered by an (usermode) application

Question

We have a .Net application consisting of mixed managed and unmanaged code. We have a number of reports of users getting BSOD while using our application. These blue screens happen on different versions of Windows. Mostly XP but one user claims it happens on Windows 7. Some users see it happening when doing one thing, other see it happening when doing something completely different. Of course, we cannot reproduce the problem.

Needless to say, I'm stumped. A user mode application shouldn't be able to blue screen the OS so we are running into a bug in a common kernel space application, perhaps buggy antivirus software?

Does anyone have any tips on how to track something like this down? We don't have access to a computer where this is happening so we wouldn't be able to hook up a kernel debugger or anything like that.

Answer 1

https://serverfault.com/questions/238/how-to-diagnose-a-windows-blue-screen

Answer 2

About the only thing you can do is convince users to send you data:

• Crash dumps. Post a walkthru on your website showing how to enable full/mini dumps and where to find them. Here's a KB article with the gory details -- probably want to simplify this with screenshots & so on.
• Installed software. Best to find a tool that collects this info for them; humans aren't especially reliable or thorough. WinAudit looks good.
• Installed hardware & drivers. (ditto)

Answer 3

Can you get a copy of the crash/mini dump?

If so you can use WinDbg and SOS to figure out where the code is at when it blows up.

Tess Fernandez has a good blog on managed debugging with low level tools.