0xdeaddead STOP, not manually initiated

[adamt]

Dear all,

I have a server which had a BSOD (STOP error if you will) with the bugcheck of 0xdeaddead

According to MSDN, this means that a crash was manually initiated (see http://msdn2.microsoft.com/en-us/library/ms797162.aspx and http://support.microsoft.com/kb/244139 ). Problem is that it couldn't have been.

Firstly - a registry key would need to have been added to enable manual crash, but it wasn't present on the server.

Secondly - the server is locked away in a datacenter, and a manual crash dump would need to have been initiated at the console.

The server is not running a checked build of Windows, either.

Any ideas?

[cluberti]

The only other thing that can cause a deaddead bugcheck is if a driver specifically calls KeBugCheck and passes it this code.

[adamt]

Thanks for the heads up - will take a look at writing a 'proof of concept' piece of code now.

[cluberti]

You've probably already found it, but here's the API documentation on KeBugCheck - note the only parameter you can pass is the bugcheck code you want to use. You can also try KeBugCheckEx, which gives you 5 parameters - first is code, next 4 are bugcheck parameters you can pass.