How can I know Windows is boot from a crash?

NTDEV
1

Hi,

Is there any way for the driver to know that Windows is booting up from a last crash?

Thanks,
Xinhai

2

You can check for safe mode (*InitSafeBootMode) if you need to provide the option for the user to bypass your driver in the event that it crashes the system on boot, if that is your goal. (There is a kb article somewhere explaining the possible values IIRC; the WDK headers also have comments.)

  • S

-----Original Message-----
From: xxxxx@gmail.com
Sent: Tuesday, March 24, 2009 16:30
To: Windows System Software Devs Interest List
Subject: [ntdev] How can I know Windows is boot from a crash?

Hi,

Is there any way for the driver to know that Windows is booting up from a last crash?

Thanks,
Xinhai

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

3

wrote in message news:xxxxx@ntdev…
> Hi,
>
> Is there any way for the driver to know that Windows is booting up from a
> last crash?
>
> Thanks,
> Xinhai

Check the event log, some event gets written there after crash
( if configured so in system startup/recovery settings)

– PA

4

I searched around and found the MS KB (http://support.microsoft.com/kb/837643) you mentioned. It sounds like it tells whether Windows is booting in safe mode. Dont know if its value is something meaningful when Windows is booting from a previous crash. Anyway, I will try it.

Thanks to you all for reply.

5

No, it’s different. That’s why I said “if you need to provide your users a way to escape if you have a crashing boot start driver…”.

What are you actually trying to accomplish here that makes you believe that you need to do this, if not that?

  • S

-----Original Message-----
From: xxxxx@gmail.com
Sent: Wednesday, March 25, 2009 13:54
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] How can I know Windows is boot from a crash?

I searched around and found the MS KB (http://support.microsoft.com/kb/837643) you mentioned. It sounds like it tells whether Windows is booting in safe mode. Dont know if its value is something meaningful when Windows is booting from a previous crash. Anyway, I will try it.

Thanks to you all for reply.

—
NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

6

>

I searched around and found the MS KB
(http://support.microsoft.com/kb/837643) you mentioned. It sounds like
it tells whether Windows is booting in safe mode. Dont know if its
value is something meaningful when Windows is booting from a previous
crash. Anyway, I will try it.

It will only be meaningful if the user chooses to boot using safe mode
after a crash. Given that they may boot into safe mode without the
system necessarily crashing anyway I’m not sure how useful it will be.

James

7

How about NtQuerySystemInformation(SystemCrashDumpStateInformation, …) etc ? I have never used this but I suspect this is what you are looking for ?

Satya
http://www.winprogger.com

8

Before groveling around into undocumented and unsupported land, I’d try and look at this from the standpoint of “why is this needed, and what is really trying to be accomplished?”.

  • S

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of xxxxx@yahoo.com
Sent: Wednesday, March 25, 2009 9:30 PM
To: Windows System Software Devs Interest List
Subject: RE:[ntdev] How can I know Windows is boot from a crash?

How about NtQuerySystemInformation(SystemCrashDumpStateInformation, …) etc ? I have never used this but I suspect this is what you are looking for ?

Satya
http://www.winprogger.com

NTDEV is sponsored by OSR

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer

9

Try to google around ReportBootOk, I think there should be some registry flag set by Winlogon when it is reporting the boot as OK

This is an old NT3 mechanism which influenced the choice of LastKnownGood registry configuration once.

–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com

wrote in message news:xxxxx@ntdev…
> Hi,
>
> Is there any way for the driver to know that Windows is booting up from a last crash?
>
> Thanks,
> Xinhai
>
>

10

Thanks to you all.

Since what I am working on is a disk lower filter driver, I decided to write kind of open/closed signature to the disk to tell if the OS was gracefully shutdown last time.