- 282
- IGN
- videogamesm12
I am typing this while booted into my computer's Fedora installation because I no longer trust my Windows install to safely keep my data. This morning, I woke my computer up from hibernation to continue where I left off the day before. This is what I do so that I don't have to worry about my computer turning on at like 2 in the morning and it allows me to start right where I left off the day before. This time, it instead booted freshly as if I had restarted the system completely, which from my experience indicated that the system either failed to restore itself from hibernation or outright crashed entirely. Various applications I was using were also misbehaving. Something had clearly gone terribly wrong.
The second issue was that changes I made to my Linux partition (which were done using an external tool) were completely reverted as if I hadn't even done anything. That didn't make any sense because literally the day before I was grabbing about 100 GB worth of Roblox clients using a tool I wrote and using the Linux partition as a temporary holding position (it's a long story). When I went to redo everything that had been completely memory holed, Java refused to accept the compiled JAR of the tool and said it was corrupted - something I confirmed very quickly by opening it in HxD - the entire file had been replaced with an equal-sized version consisting entirely of NUL bytes. This is where I realized something had gone terribly wrong because the exact same thing had happened - system crashed while trying to come out of hibernation and everything I had opened and saved the day before the crash were corrupted like this.
Antivirus scans turned up nothing and the drive was reported to be healthy. I confirmed that my system had in fact crashed because Windows was generous enough to note an event in the Event Viewer of a bugcheck that happened at around the same time I started my computer this morning. I decided that I could not trust my Windows installation so I have booted into my Linux installation to do further analysis.
Evaluating the situation
I first noticed that things weren't exactly right when I opened Firefox only for the last session to not be saved and all of the extensions I had installed before to be disabled. When I re-enabled them, the browser showed a warning around the lines of "another application installed this extension and it wants to do this and that", which would imply that the flags telling Firefox where exactly the extension came from were corrupted or somehow got reset. I brushed it off as Firefox being retarded, but apparently I was wrong to make that assumption.The second issue was that changes I made to my Linux partition (which were done using an external tool) were completely reverted as if I hadn't even done anything. That didn't make any sense because literally the day before I was grabbing about 100 GB worth of Roblox clients using a tool I wrote and using the Linux partition as a temporary holding position (it's a long story). When I went to redo everything that had been completely memory holed, Java refused to accept the compiled JAR of the tool and said it was corrupted - something I confirmed very quickly by opening it in HxD - the entire file had been replaced with an equal-sized version consisting entirely of NUL bytes. This is where I realized something had gone terribly wrong because the exact same thing had happened - system crashed while trying to come out of hibernation and everything I had opened and saved the day before the crash were corrupted like this.
Antivirus scans turned up nothing and the drive was reported to be healthy. I confirmed that my system had in fact crashed because Windows was generous enough to note an event in the Event Viewer of a bugcheck that happened at around the same time I started my computer this morning. I decided that I could not trust my Windows installation so I have booted into my Linux installation to do further analysis.
My theory after reading the minidump
I mentioned the issue to Alco and he suggested reading through the Minidump files Windows generates when it crashes. BlueScreenView by Nirsoft proved to be the best tool for the job since it works under Linux with Wine, and this is what I know so far:- The core cause of the bugcheck was a DRIVER_POWER_STATE_FAILURE error thrown by NTOSKRNL at address 406ee6. No other modules are highlighted as for the possible culprit.
- Attempting to search for information about that error being thrown by NTOSKRNL were inconclusive and the symptoms people were experiencing with the results that did came up did not match mine. Their dumps also did not match mine in terms of parameters.
- If you read the bugcheck parameters, think like a programmer, and read documentation obviously meant for kernel developers and not the average user, it is possible to at least understand what exactly went wrong. In this case, the documentation for parameter 1 (0x4) and parameter 2 (0x12c) basically mean that something timed out trying to transition the power state for a specific Plug 'n Play system. In other words, it fucking died trying to go from hibernation to active because it took too long.
- The bugchecks in both incidents are very similar and have the same crash address, bugcheck, and first two parameters.
- On the day before Christmas 2024 (which is when the first time the incident occurred), I vaguely remember plugging in an external hard drive consisting of movies into my computer to facilitate ripping a few movies that I had just gotten. Once the rip was complete, I wanted to use the hard drive to watch one of the two movies with my family. I do not remember how ejecting went, but I supect it went the same way where it hanged because I ended up just using the Blu-ray copy I had instead for some reason. The next morning I powered my computer on and it went the same way, except different files were corrupted instead.
- On the day before today, I plugged a flash drive into my computer to quickly and conveniently copy over specific jar files for use in an unrelated project. When I went to safely eject the flash drive, literally nothing happened. I repeatedly went to eject it but Windows did jack chicken shit. I ultimately decided to just say fuck it and unplug the drive (nothing on the drive itself was corrupted and was pretty much fine), but Windows didn't register that I had unplugged it at all. I distinctly remember holding the now-unplugged drive in my hand and seeing the entries for Ventoy's drives still in the Windows Explorer like as if nothing had happened. It remained like this up until I put my computer into hibernation.