Does Windows XP have an interactive booting mode, or could I load an additional driver when booting?

[luweitest]

My Windows XP would go to BSOD in booting to safe mode. If there is an interactive booting mode like Windows 98, letting me choose whether to load a driver or not, I think the troubleshooting would be easier.

I could boot into recovery console mode, in which I see SATA driver iaStor.sy_ is loaded. So I think of a possibility that in safe mode Windows XP do not load AHCI|SATA drivers. If I could add the driver to that "minimal" driver list of safe mode, the problem may be solved. Could that be done?

Edited October 11, 2021 by luweitest
add info

[Nokiamies]

What chipset and what driver do you use?

Did you install driver during or after setup?

Also what BSOD you got? 0x0000007?

[luweitest]

5 hours ago, Mr.Scienceman2000 said:

What chipset and what driver do you use?

Did you install driver during or after setup?

Also what BSOD you got? 0x0000007?

My chipset:

BSOD message is STOP: 0x0000007E (0xC0000005, 0xF76E0211,0xF78EA700,0xF78EA3FC)

The Intel's SATA driver is installed after Windows XP is installed in compatibility mode, then restart and change to AHCI mode in BIOS, and then Windows XP works in new mode. But I am not sure if this driver is the culprit; It is only my speculation. Thus I hope there's a way to check drivers one by one. "/sos" parameter just lets drivers loading flashes away and I can't catch up.

 

Edited October 11, 2021 by luweitest

[Nokiamies]

1 hour ago, luweitest said:

 

The Intel's SATA driver is installed after Windows XP is installed in compatibility mode, then restart and change to AHCI mode in BIOS, and then Windows XP works in new mode. But I am not sure if this driver is the culprit; It is only my speculation. Thus I hope there's a way to check drivers one by one. "/sos" parameter just lets drivers loading flashes away and I can't catch up.

 

Did you use offical driver? Maybe try reinstall sata drivers. And that bsod means inaccessible boot device

Edited October 11, 2021 by Mr.Scienceman2000

[luweitest]

33 minutes ago, Mr.Scienceman2000 said:

Did you use offical driver? Maybe try reinstall sata drivers. And that bsod means inaccessible boot device

Yes, all drivers are official and latest (except wifi card I deliberately installed a little older one, which should not matter). "inaccessible boot device" seems accord with my speculation that the SATA disk driver (iastore.sys) is not loaded in safe mode. Reasonable because I guess safe mode only includes drivers at OS setup stage. Another evidence is, if I add "/bootlog" parameter to normal boot, it will get BSOD too. I suspect the disk driver is not loaded yet when trying opening the log file.

[Nokiamies]

43 minutes ago, luweitest said:

Yes, all drivers are official and latest (except wifi card I deliberately installed a little older one, which should not matter). "inaccessible boot device" seems accord with my speculation that the SATA disk driver (iastore.sys) is not loaded in safe mode. Reasonable because I guess safe mode only includes drivers at OS setup stage. Another evidence is, if I add "/bootlog" parameter to normal boot, it will get BSOD too. I suspect the disk driver is not loaded yet when trying opening the log file.

there was some way to "include" driver to setup after been installed, but forgot which way. Then it should prompt press to esc to cancel loading iastor.sys when going safe mode.

 

[jaclaz]

3 hours ago, Mr.Scienceman2000 said:

And that bsod means inaccessible boot device

Not really.

7b is inaccessible boot device, Luweitest posted 7e.

Basically:

1) an issue with the SATA driver (or any other boot disk related driver) will cause 7b

2) nearly *anything* can cause 7e, usually it is also a driver but not necessarily one related/connected to boot disk.

jaclaz

[luweitest]

I got two new places to check for possible drivers list:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal

Don't know which one takes precedence, but they both have iaStor.sys related item as:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\pci#ven_8086&dev_2829&cc_0106

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}

And as @jaclaz pointed out about 7E error, it seems SATA driver is loaded.

I recorded a video of safe mode booting. After a screen of drivers list (iaStor.sys is in the last of that screen list), the following drivers only flashes at the bottom line. After "press Esc to cancel loading d347bus.sys" (strange the driver was shown at the first screen before, but loaded after sometime. It is from virtual CD driver Daemon tools and has been excluded from suspicion),  I pressed Esc and then BSOD. The last driver I can catch before that "cancel loading" screen is  APS***.sys, which is APSX86.sys or ApsHM86.sys from hardware driver (ThinkVantage active protection to suspend hard disk when shaking, should be excluded from suspicion).

I now don't know what to look for, since SATA driver iaStor.sys seems to be excluded.

Edited October 15, 2021 by luweitest
add video

[luweitest]

I've got some new information, from https://atkdinosaurus.wordpress.com/2015/08/01/windows-services-and-service-start-order/:

"The HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder subkey determines the order in which Service Groups are loaded. The List value is a REG_MULT_SZ entry that specifies the Service Group order.

The HKEY_LOCAL_MACHINE\CurrentControlSet\Control\GroupOrderList subkey determines the order in which services within a Service Group are loaded. Services in a Service Group are assigned a tag, a unique numeric value within a Service Group which determines the service load order. Each value entry in GroupOrderList represents a Service Group. The value of the entry is a series of tags in a specified order. The first entry in this REG_BINARY value is the number of services in the group, followed by the tags in load sequence. "

So I tried two methods:

1, Delete items from HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal which are not in the ServiceGroupOrder;

2, Add items to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal which are in the ServiceGroupOrder, with the value "Driver Group" .

Both method failed to work.

[luweitest]

The problem gets more interesting. I could use F8 to select boot logging. The normal boot and safe mode boot log is attached below.

It is strange that safe mode log only has one line, not the first driver, nor likely the last driver. The more strange thing is: it cannot be opened in recovery console, either using "type ntbtlog.txt" or "more ntbtlog.txt", which will trigger BSoD of BAD_POOL_HEADER 0x19.

I did some experiment: Changing the file name has same BSoD effect; Changing the file length could make it open;  Changing the file encoding could make it open (It is natively Unicode LE encoded, i.e. starting with FFFE); Changing the file content while keeping the length has same effect; Hex editing the ending 0D00 0A00, if edited to 0D00 6100 or 6100 0A00, same effect; if edited to 6100 6100, it opens.

So it seems recovery console and safe mode boot of my machine cannot handle this specific text: 112 bytes of Unicode LE encoded text with one or half new line ending. Could someone try opening the attached ntbtlog_safe.txt in recovery console or safe mode command line?

ntbtlog_normal.txt ntbtlog_safe.txt

[pangoomis]

I've noticed ThrottleStop in the normal log. Have you tried disabling it? I don't see you mentioning it. It shouldn't load in safe mode but maybe it does for whatever reason.

[luweitest]

On 11/4/2021 at 3:09 AM, MrMateczko said:

I've noticed ThrottleStop in the normal log. Have you tried disabling it? I don't see you mentioning it. It shouldn't load in safe mode but maybe it does for whatever reason.

ThrottleStop is loaded in startup folder. I removed the link, restarted and no effect.

Now I think maybe safe mode loads different driver suit to normal mode, and the difference is related to file system.

[pangoomis]

I can only think of putting the HDD in a different machine and see how it behaves.