Moschtermeedchen
Level 1 (8 points)
Windows Software

Q: Boot camp Win 7 0x34 blue screen when starting windows after restore with system image.

The hard disc on the Macbook pro had been repartioned, all boot camp and other drivers updated and Windows installed from the installation DVD. All available Windows updates from 2012 (installation disc is from 2012) until today were installed and Boot camp 5.1 with all its drivers installed. Restoring was started with a system repair disc and system image from an external hard disc. Once Windows loads after the log-in screen, it crashes. A blue screen appears with the error code 0x00000034 and mentioning cache_manager.... Windows restarts itself and I can only use it in safe mode which means that I can neither download nor install upgrades or programs.

Analysing the dmp-file from the first crash with Windows Debugger Tool showed that the problem seems to lie with

AppleHFS.sys and svchost.exe, with Bug Check 34 {107, ffffffffc0000420,0,0}.

 

 

 

Here is the link to the complete analysis of the dmp file for further details:

https://1drv.ms/u/s!AuzUtP_j9nLagwWWqWUTre4qNYmu

 

Many thanks in advance for your help

Moschtermeedchen

MacBook Pro (13-inch Mid 2012), OS X El Capitan (10.11.6), blue screen 0x34

Posted on Aug 11, 2016 1:20 AM

by Loner T,Solvedanswer
Loner T Loner T
Level 7 (23,603 points)
Safari
A:

A Windows System Image restore on a Mac is tricky. In your specific case, the restore created entries which were appropriate for the original size of System Image (297GB), but the underlying partition was 400GB. Since the image was legacy BIOS/MBR mode, which is on page 2. You can see two entries for index 2 and 3, each. AppleHFS.sys should show you entry GPT 2 (start sector 409640), but the System Image has the same entry at start sector 195523144. This causes AppleHFS.sys to bug check and cause the BSoD. There is no device at the start sector 195523144. This causes an endless BSoD loop unless AppleHFS.sys is disabled.

 

We did two fixes.

 

1. Removed the spurious entries 2 and 3 at start sector 195523144 and start sector 389081512. The GPT was rebuilt leaving Free Space between 195523144 and 390352896 (this is the 'missing' 103 GB).

2. After GPT was corrected, trying to repair the original 297GB system image caused the BCD to be renamed as BCD.old. We restored bcd.old to BCD, repaired the original installation and used GParted to coalesce the 297 and 103 GB parts. This required a second repair, reusing the bcd.old. Once Windows was working and GPT was corrected, we rebuilt the MBR to match. Since there are no more spurious entries for GPT2 and GPT3, AppleHFS.sys/AppleMNT.sys now correctly map the partitions and show them on the Windows side.

 

You should create a new System Image backup of this 400GB Windows and discard the old 297GB System Image.

Posted on Aug 15, 2016 3:01 PM

Close
Moschtermeedchen

Q: Boot camp Win 7 0x34 blue screen when starting windows after restore with system image.

  • All replies
  • Helpful answers

Page 1 of 9 last Next

  • by Loner T,Helpful

    Loner T Loner T Aug 12, 2016 9:03 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 12, 2016 9:03 AM in response to Moschtermeedchen

    AppleHFS.sys/AppleMNT.sys are drivers used to allow access to OSX JHFS+ file systems. Restoring Windows backups on Macs can be painful. If you have W7 already clean-installed on the internal disk, try the restore without installing any BC drivers. Please be aware that such a restore is not aware of partitions on your internal disk and may wipe your internal disk.

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 11, 2016 4:58 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 11, 2016 4:58 AM in response to Loner T

    Thanks for your answer, LonerT.

    Do you mean not installing Boot camp 5.1 and its drivers on Win7 before doing the restore with the system image? Won't I have trouble with the hardware if I don't have any drivers? And what do you mean with it wiping my internal disk?

    Thanks in advance for any answer!

  • by Loner T,

    Loner T Loner T Aug 11, 2016 6:01 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 11, 2016 6:01 AM in response to Moschtermeedchen

    Assuming your system image backup of Windows is on an external USB disk, you will only need USB drivers. By default, the W7 has built in USB2 drivers, but not USB3. Unless your external backup is on a USB3 disk, a W7 without BC drivers will support this.

     

    If your system image was created after BC drivers were installed, when it is restored, it will bring back the other BC drivers anyway.

     

    W7 restore can assume that it needs to use the entire disk, which means it can erase and try to restore the whole disk and remove OS X. I suggest creating an external OS X Boot disk and a backup, before you start.

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 11, 2016 8:34 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 11, 2016 8:34 AM in response to Loner T

    Thanks for your explanation.

    This is actually the second time that I have this problem. The first time I reinstalled and used the system image I didn't install any boot camp driver but forgot to do any of the windows updates. That time I got the same error screen with the same bugcheck, so I don't know if that time it had something to do with the missing Windows updates that I got this error.

    Additionally, my windows partition, when looking at it in Windows, only reads 297 GB aka the size it had at the time of the system image. However, when I did the partitioning for the installation of Win 7 I put the Boot camp partition at 400 GB. How can I change my partition to the correct size of 400, or, where does Windows put the missing 103 GB?

     

    In the meantime I renamed the AppleHFS.sys and the AppleMNT.sys so that they don't autostart. I didn't get the error screen anymore and it seems to work fine but I remember reading other post with the same problem were you said that disabling these drivers is not ideal. Any further thoughts?

    Again, thank you for your swift answers I really appreciate it!

  • by Loner T,

    Loner T Loner T Aug 11, 2016 9:36 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 11, 2016 9:36 AM in response to Moschtermeedchen

    The underlying disk partition is 400Gb, but only 297 Gb (from System Image) is occupied. Please post a screen shot of the Windows Disk Management. We may need to use Gparted Live CD to correct anomaly.

     

    Once the restore is complete, you rename the AppleHFS.sys/AppleMNT.sys to be able to read OSX JHFS+ file systems.

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 11, 2016 11:06 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 11, 2016 11:06 AM in response to Loner T

    Here is the screenshot:

    Windows disk management.PNG

    Everything is in German,some of the words I can translate: "Fehlerfrei" means something akin to "no error", "Einfach" means "simple", "Startpartition" means "boot partition", "Auslagerungsdatei" means (I'm not sure about the correct translation) "swap file" or "page file", "Absturzabbild" means "crash dump data", "Schutzpartition" means something like "protection partition" (?). I hope this bit of translation helps for figuring things out whithout you having to google everything.

  • by Loner T,

    Loner T Loner T Aug 11, 2016 2:40 PM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 11, 2016 2:40 PM in response to Moschtermeedchen

    Thank you for the translations.

     

    Can you download GPT Fdisk - https://sourceforge.net/projects/gptfdisk/ - on the Windows side and install it?

     

    If you are not familiar with Gdisk, please see http://www.rodsbooks.com/gdisk/walkthrough.html . There are few minor Windows differences.

     

    On a 2012, if a MBR is used, you may see a difference between Gdisk and Disk Management output. We can also use Gdisk on the OSX side, if you are more familiar with it.

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 12, 2016 1:00 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 12, 2016 1:00 AM in response to Loner T

    I've installed Gdisk on the windows side and read the walkthrough. I've worked a little with fdisk on the Mac side before so I understood most of it but I'm very new to all of this.

    Gdisk did a scan of my harddrive and this is what it found.

     

    MBR: hybrid

    BSD: not present

    APM:not present

    GPT: present

    Found valid GPT with hybrid MBR; using GPT

     

    How should I proceed now?

  • by Loner T,

    Loner T Loner T Aug 12, 2016 3:20 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 12, 2016 3:20 AM in response to Moschtermeedchen

    Can you post the output of

     

    1. the 'p'(rint) command.

    2. 'r'(recovery) -> 'o' (print MBR). This is very similar to fdisk -l command.

     

    Here is an example...

     

    sudo gdisk /dev/disk0

    Password:

    GPT fdisk (gdisk) version 1.0.0

     

    Warning: Devices opened with shared lock will not have their

    partition table automatically reloaded!

    Partition table scan:

      MBR: hybrid

      BSD: not present

      APM: not present

      GPT: present

     

    Found valid GPT with hybrid MBR; using GPT.

     

    Command (? for help): p

    Disk /dev/disk0: 1000215216 sectors, 476.9 GiB

    Logical sector size: 512 bytes

    Disk identifier (GUID): 27F1F78B-B899-41D8-BA3C-37843C1662D8

    Partition table holds up to 128 entries

    First usable sector is 34, last usable sector is 1000215182

    Partitions will be aligned on 8-sector boundaries

    Total free space is 701 sectors (350.5 KiB)

     

    Number  Start (sector)    End (sector)  Size       Code  Name

       1              40          409639   200.0 MiB   EF00  EFI System Partition

       2          409640       743086263   354.1 GiB   AF00  OSX-MBP13

       3       743086264       744355799   619.9 MiB   AB00  Recovery HD

       4       744355840      1000214527   122.0 GiB   0700  BOOTCAMP

     

    Command (? for help): r

     

    Recovery/transformation command (? for help): o

     

    Disk size is 1000215216 sectors (476.9 GiB)

    MBR disk identifier: 0x028A47A7

    MBR partitions:

     

    Number  Boot  Start Sector   End Sector   Status      Code

       1                     1       409639   primary     0xEE

       2                409640    743086263   primary     0xAF

       3             743086264    744355799   primary     0xAB

       4      *      744355840   1000214527   primary     0x07

     

    Recovery/transformation command (? for help):

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 12, 2016 3:52 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 12, 2016 3:52 AM in response to Loner T

    Here is the screenshot of the print, recovery and print MBR command:

    gdisk print recovery o command.PNG

  • by Loner T,

    Loner T Loner T Aug 12, 2016 4:02 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 12, 2016 4:02 AM in response to Moschtermeedchen

    Under normal circumstances, the start/end values in the output of the 'p' (GPT) and 'o' (MBR) commands are the same. In your case, since Windows works, the MBR entry 4 is correct, not the GPT 4. OS X uses GPT 2.

     

    Please test if you can boot into Command+R (Local Recovery) before we make changes. I also suggest that you create a backup of OS X and Windows.

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 12, 2016 5:59 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 12, 2016 5:59 AM in response to Loner T

    I can successfully boot into Local Recovery and I have a time capsule of OS X and a system image of Windows.

    I think I'm ready to go.

  • by Loner T,

    Loner T Loner T Aug 12, 2016 7:39 AM in response to Moschtermeedchen
    Level 7 (23,603 points)
    Safari
    Aug 12, 2016 7:39 AM in response to Moschtermeedchen

    We need to correct the MBR for the OSX and then correct the GPT for Bootcamp. Once you do that, you will see a gap between Bootcamp and Recovery HD.

     

    Since you have El Capitan, boot into Local Recovery and run csrutil disable and check csrutil status to disable SIP. Once it is disabled, boot normally, and check csrutil status in OSX Terminal, and ensure that it is disabled.

     

    1. Correct the MBR for OSX. You can do this when normally booted in OSX.

         sudo fdisk -e /dev/disk0

         p

         setpid 2

         AF

         p

         w

         y

     

    2. Correct the GPT4 in OSX. Delete and recreate GPT4. Install GPT Fdisk on the OSX side, if necessary.

         sudo gdisk /dev/disk0

         p

         d

         4

         n

         4

         390352896

         976773119

         p

         w

         y

      

     

    Reboot and test OSX and Windows boot properly and local Recovery works. 

  • by Moschtermeedchen,

    Moschtermeedchen Moschtermeedchen Aug 12, 2016 8:33 AM in response to Loner T
    Level 1 (8 points)
    Windows Software
    Aug 12, 2016 8:33 AM in response to Loner T

    I don't have the p command when typing in sudo fdisk -e /dev/disk0.

    Here's the screenshot:

    Screen Shot 2016-08-12 at 17.31.47.png

Page 1 of 9 last Next