How to Read a Blue Screen: Stop Codes, Parameters, and Dumps

A blue screen (also called a stop error or BSOD) is Windows’ way of halting the system when it detects a condition from which it cannot safely continue. The machine was running normally (or under load) when the kernel encountered an error it considered fatal. The screen displays a stop code, a set of parameters, and sometimes a driver or file name. These are not random; they are structured diagnostic information. This page explains how to read that information and how to use the crash dump to find the root cause.

What the Blue Screen Shows

The blue screen has three main parts:

1. Stop code – a short, uppercase string like IRQL_NOT_LESS_OR_EQUAL or KMODE_EXCEPTION_NOT_HANDLED. This is the primary error classification.
2. Parameters – four hexadecimal values in parentheses after the stop code. They provide additional context, such as memory addresses or specific flags.
3. File name – often a driver file (e.g., ntoskrnl.exe, dxgkrnl.sys, or a third-party driver). This is the module that was executing when the crash occurred, but not necessarily the cause.

How to Find the Stop Code and Parameters

When the blue screen appears, write down the stop code and the four parameters. If the screen disappears too quickly, disable automatic restart:

1. Boot into Windows (if possible) or use Safe Mode.
2. Open System Properties (Win + Pause, then “Advanced system settings”).
3. Under “Startup and Recovery”, click “Settings”.
4. Uncheck “Automatically restart”.

If you cannot boot, the parameters are also stored in the crash dump file (see below).

What the Parameters Mean

The four parameters are specific to each stop code. For example, for IRQL_NOT_LESS_OR_EQUAL:

• Parameter 1: The memory address that was accessed at the IRQL.
• Parameter 2: The IRQL that was current when the crash occurred.
• Parameter 3: The type of memory access (0 = read, 1 = write, 8 = execute).
• Parameter 4: The address of the instruction that attempted the access.

For KMODE_EXCEPTION_NOT_HANDLED, parameter 1 is the exception code, and parameter 2 is the address where the exception occurred.

You do not need to memorize these. The Windows Debugger (WinDbg) will interpret them for you. The parameters help narrow down the cause when the stop code alone is ambiguous.

Which File Name Matters

The file name on the blue screen is the module that was in the call stack when the crash happened. It is often the culprit, but not always. For example, a faulty driver might call into ntoskrnl.exe, and the crash appears in the kernel. The file name is a starting point, not a verdict.

Finding and Reading the Crash Dump

By default, Windows writes a memory dump to %SystemRoot%\Minidump (small dump) or %SystemRoot%\MEMORY.DMP (kernel dump). To read the dump, use the Windows Debugging Tools (WinDbg), which is part of the Windows SDK. You can install it from the Microsoft Store or the SDK installer.

To analyze the dump:

1. Open WinDbg (x64) as Administrator.
2. Go to File > Open Crash Dump and select the dump file.
3. Run the command !analyze -v in the command line.

!analyze -v

This command produces a detailed analysis, including the stop code, parameters, the faulting module, and a stack trace. The output will often identify the likely cause, such as a specific driver.

If you do not have WinDbg, you can use the dumpchk.exe tool from the Windows SDK to verify the dump, but it does not give a full analysis.

Common Stop Codes and Their Meanings

What People Get Wrong About Blue Screens

A common mistake is to assume the file name on the blue screen is the culprit. For example, if the screen shows ntoskrnl.exe, many conclude the kernel is broken. In reality, ntoskrnl.exe is the core kernel, and it is rarely the root cause. The actual faulty driver is often a third-party driver that called into the kernel. This is a natural mistake because the screen gives prominence to the file name, but the file is simply the location of the crash, not the cause.

Another mistake is to immediately blame hardware when the stop code is memory-related. While failing RAM can cause PAGE_FAULT_IN_NONPAGED_AREA, a misconfigured driver or a buggy application can also trigger it. The parameters and the dump analysis will help distinguish. For instance, if the faulting address is in a driver’s memory range, it is a driver bug, not a hardware failure.

Repairs: Least-Destructive First

1. Check for Recent Changes

If the blue screen started after a driver or Windows update, uninstall that update or roll back the driver.

• Open Device Manager (Win + X > Device Manager).
• Find the device, right-click, select Properties > Driver > Roll Back Driver.
• If the option is greyed out, uninstall the driver and let Windows reinstall the previous version.

2. Run Windows Memory Diagnostic

Faulty RAM is a common cause. Run the built-in memory test:

1. Press Win + R, type mdsched.exe, and press Enter.
2. Choose “Restart now and check for problems”.

The test will run and restart Windows. If errors are found, the RAM module is likely failing.

3. Use System File Checker and DISM

Corrupted system files can cause blue screens. Run these tools in an elevated Command Prompt:

sfc /scannow

This checks and repairs system files. If it finds issues, run DISM to repair the system image:

dism /online /cleanup-image /restorehealth

After DISM, run sfc /scannow again.

4. Check Disk for Errors

A failing hard drive can cause blue screens. Run chkdsk to check for bad sectors:

chkdsk C: /f /r

This will require a restart. It attempts to repair file system errors and mark bad sectors. This does not destroy data, but it may take a long time.

5. Update or Reinstall Drivers

If the dump analysis points to a specific driver, update it from the manufacturer’s website. Do not use third-party driver updaters; they are not reliable and can install incorrect drivers. Use Device Manager to update the driver manually, or download the driver from the hardware vendor’s site.

6. Disable Automatic Restart to See the Error

If the blue screen flashes and reboots, disable automatic restart as described earlier. This gives you time to note the stop code and parameters.

7. Check for Overheating

Overheating can cause blue screens. Use a hardware monitor to check CPU and GPU temperatures. If they are high, clean the fans and ensure proper ventilation.

8. Reset Windows (Last Resort)

If all else fails, you can reset Windows. This will reinstall the operating system while keeping your files (if you choose “Keep my files”). It will remove installed applications and drivers. This is destructive to installed programs, so back up your data first.

To reset:

1. Go to Settings > Update & Security > Recovery.
2. Under “Reset this PC”, click “Get started”.
3. Choose “Keep my files” or “Remove everything”.

This will reinstall Windows and may fix system-level corruption.

When to Replace Hardware

If the memory test fails, replace the RAM. If the disk check shows bad sectors, back up data and replace the drive. If the dump analysis consistently points to a specific component (e.g., a graphics card driver), test with a different component if possible.

Summary of the Process

1. Record the stop code and parameters.
2. Find and analyze the crash dump with WinDbg.
3. Check for recent changes and revert them.
4. Run memory and disk diagnostics.
5. Repair system files with SFC and DISM.
6. Update or reinstall the faulty driver.
7. If the problem persists, reset Windows or replace hardware.

This systematic approach will resolve the majority of blue screens without resorting to guesswork.