ctrl+scroll lock+scroll lock

NTDEV
1

Michal Vodicka was kind enough to point out that there is a way to create a
crash dump by using keyboard presses.

The WinDbg documentation says that a registry entry must be changed (easy to
do) and that the crash will occur if one presses
(rightmost ctrl) + scroll lock + scroll lock
from a non-USB keyboard.

Of course, my Toshiba A45-S250 laptop has neither a right-ctrl key nor a
separate scroll lock key (scroll lock is Fn+F12).

Nor does it have a PS/2 port.

I assume that getting a PS/2 to USB converter and hooking up a PS/2 keyboard
probably own’t work.

So, is there some other way to trigger a crash dump from the keyboard?

Ralph Shnelvar

2

Anees:

OSR’s bang.exe isn’t what I need, either.

Apparently,
(rightmost ctrl) + scroll lock + scroll lock
will work under almost any system hang.

You’ve got to have a live system for the unbelievably complicated bang.exe
to work.

In fact, my current device driver does an excellent job of simulating
bang.exe even though I don’t want it to.

Ralph Shnelvar

On Tue, 8 Feb 2005 21:55:00 +0530, you wrote:

Try this
http://www.osronline.com/article.cfm?id=153

-Ans

On Tue, 08 Feb 2005 09:23:32 -0700, Ralph Shnelvar wrote:
>> Michal Vodicka was kind enough to point out that there is a way to create a
>> crash dump by using keyboard presses.
>>
>> The WinDbg documentation says that a registry entry must be changed (easy to
>> do) and that the crash will occur if one presses
>> (rightmost ctrl) + scroll lock + scroll lock
>> from a non-USB keyboard.
>>
>> Of course, my Toshiba A45-S250 laptop has neither a right-ctrl key nor a
>> separate scroll lock key (scroll lock is Fn+F12).
>>
>> Nor does it have a PS/2 port.
>>
>> I assume that getting a PS/2 to USB converter and hooking up a PS/2 keyboard
>> probably own’t work.
>>
>> So, is there some other way to trigger a crash dump from the keyboard?
>>
>> Ralph Shnelvar
>>
>> —
>> Questions? First check the Kernel Driver FAQ at http://www.osronline.com/article.cfm?id=256
>>

3

The code to do this is in ddk//src/input/pnpi8042, so if you don’t
have an 8042 in the machine, it probably won’t work (unless the USB
keyboard does the same thing, haven’t looked).

You can change the key combo needed with:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters
\Dump1Keys

and

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\i8042prt\Parameters\Dump2Key

Dump1Keys is the combination of shift/ctrl keys that you want to use, and
Dump2Key is the scan-code of the key that actuates the crash-dump.

Here’s the flags for shift-keys…

//
// Flags to represent modifier key states
//
#define CRASH_R_SHIFT 0x01
#define CRASH_R_CTRL 0x02
#define CRASH_R_ALT 0x04

#define CRASH_L_SHIFT 0x10
#define CRASH_L_CTRL 0x20
#define CRASH_L_ALT 0x40

–
Mats

-------- Notice --------
The information in this message is confidential and may be legally
privileged. It is intended solely for the addressee. Access to this
message by anyone else is unauthorized. If you are not the intended
recipient, any disclosure, copying or distribution of the message, or any
action taken by you in reliance on it, is prohibited and may be unlawful.
If you have received this message in error, please delete it and contact
the sender immediately. Thank you.

xxxxx@lists.osr.com wrote on 02/08/2005 04:23:32 PM:

> Michal Vodicka was kind enough to point out that there is a way to create
a
> crash dump by using keyboard presses.
>
> The WinDbg documentation says that a registry entry must be changed (easy
to
> do) and that the crash will occur if one presses
> (rightmost ctrl) + scroll lock + scroll lock
> from a non-USB keyboard.
>
>
> Of course, my Toshiba A45-S250 laptop has neither a right-ctrl key nor a
> separate scroll lock key (scroll lock is Fn+F12).
>
> Nor does it have a PS/2 port.
>
> I assume that getting a PS/2 to USB converter and hooking up a PS/2
keyboard
> probably own’t work.
>
> So, is there some other way to trigger a crash dump from the keyboard?
>
>
> Ralph Shnelvar
>
> —
> Questions? First check the Kernel Driver FAQ at http://www.
> osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@3dlabs.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

> ForwardSourceID:NT0000C666

4

You can actually specify any key combination to do this. Look at the
pnpi8042 example in the ddk for the src which implements this (kbddep.c,
I8xServiceCrashDump).

Roughly, it is
Create a key called CrashDump under
HKLM\System\CCS\Services\i8042prt\Parameters

There are 2 DWORD values: Dump1Keys, Dump2Key

Dump1Keys specifics which modifier keys (left or right, alt/ctrl/shift).
It is a bit field as such:
#define CRASH_R_SHIFT 0x01
#define CRASH_R_CTRL 0x02
#define CRASH_R_ALT 0x04

#define CRASH_L_SHIFT 0x10
#define CRASH_L_CTRL 0x20
#define CRASH_L_ALT 0x40

Dump2Key is the key number as per the scan code layout of the keyboard
(not the scancode nor the ascii value). There is a table at the top of
I8xServiceCrashDump which goes from key number to scancode value.

Set these values and reboot.

d

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ralph Shnelvar
Sent: Tuesday, February 08, 2005 8:38 AM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] ctrl+scroll lock+scroll lock

Anees:

OSR’s bang.exe isn’t what I need, either.

Apparently,
(rightmost ctrl) + scroll lock + scroll lock
will work under almost any system hang.

You’ve got to have a live system for the unbelievably complicated
bang.exe
to work.

In fact, my current device driver does an excellent job of simulating
bang.exe even though I don’t want it to.

Ralph Shnelvar

On Tue, 8 Feb 2005 21:55:00 +0530, you wrote:

Try this
http://www.osronline.com/article.cfm?id=153

-Ans

On Tue, 08 Feb 2005 09:23:32 -0700, Ralph Shnelvar
wrote:
>> Michal Vodicka was kind enough to point out that there is a way to
create a
>> crash dump by using keyboard presses.
>>
>> The WinDbg documentation says that a registry entry must be changed
(easy to
>> do) and that the crash will occur if one presses
>> (rightmost ctrl) + scroll lock + scroll lock
>> from a non-USB keyboard.
>>
>> Of course, my Toshiba A45-S250 laptop has neither a right-ctrl key
nor a
>> separate scroll lock key (scroll lock is Fn+F12).
>>
>> Nor does it have a PS/2 port.
>>
>> I assume that getting a PS/2 to USB converter and hooking up a PS/2
keyboard
>> probably own’t work.
>>
>> So, is there some other way to trigger a crash dump from the
keyboard?
>>
>> Ralph Shnelvar
>>
>> —
>> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>>

—
Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@windows.microsoft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

5

The source code for the 8042 port driver is in the DDK - you can see
where it looks for the specific sequence of scan codes. You could, of
course, replace the standard 8042 driver with your own modified version
using some other set of scan codes (ctrl+F12+F12 for example…) Then
you’ll just have to fight with the System File Protection daemon to
replace that standard OS provided file.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

Looking forward to seeing you at the Next OSR File Systems Class April
4, 2005 in Boston!
-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Ralph Shnelvar
Sent: Tuesday, February 08, 2005 11:24 AM
To: ntdev redirect
Subject: [ntdev] ctrl+scroll lock+scroll lock

Michal Vodicka was kind enough to point out that there is a way to
create a
crash dump by using keyboard presses.

The WinDbg documentation says that a registry entry must be changed
(easy to
do) and that the crash will occur if one presses
(rightmost ctrl) + scroll lock + scroll lock
from a non-USB keyboard.

Of course, my Toshiba A45-S250 laptop has neither a right-ctrl key nor a
separate scroll lock key (scroll lock is Fn+F12).

Nor does it have a PS/2 port.

I assume that getting a PS/2 to USB converter and hooking up a PS/2
keyboard
probably own’t work.

So, is there some other way to trigger a crash dump from the keyboard?

Ralph Shnelvar

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@osr.com
To unsubscribe send a blank email to xxxxx@lists.osr.com