KeRegisterBugCheckReasonCallback function

The KeRegisterBugCheckReasonCallback function registers one of the callback routines defined in defined in the KBUGCHECK_CALLBACK_REASON enumeration, which executes when the operating system issues a bug check.

Syntax

BOOLEAN KeRegisterBugCheckReasonCallback(
  PKBUGCHECK_REASON_CALLBACK_RECORD  CallbackRecord,
  PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine,
  KBUGCHECK_CALLBACK_REASON          Reason,
  PUCHAR                             Component
);

Parameters

CallbackRecord

A pointer to a KBUGCHECK_REASON_CALLBACK_RECORD structure that was initialized by a call to the KeInitializeCallbackRecord routine.

CallbackRoutine

A pointer to the callback routine to register. This parameter points to one of the types of driver-implemented routine defined in the KBUGCHECK_CALLBACK_REASON enumeration. For information about how to implement this callback routine, see Writing a Bug Check Callback Routine.

Reason

Specifies the type of callback routine that CallbackRoutine points to. Set Reason to one of the KBUGCHECK_CALLBACK_REASON enumeration values in the following table.

Value Data Structure
KbCallbackAddPages KBUGCHECK_ADD_PAGES structure
KbCallbackDumpIo KBUGCHECK_DUMP_IO structure
KbCallbackSecondaryDumpData KBUGCHECK_SECONDARY_DUMP_DATA structure
KbCallbackSecondaryMultiPartDumpData KBUGCHECK_SECONDARY_DUMP_DATA_EX
KbCallbackRemovePages KBUGCHECK_REMOVE_PAGES
KbCallbackTriageDumpData KBUGCHECK_TRIAGE_DUMP_DATA

Component

A pointer to a null-terminated ANSI string that identifies the caller. For example, you can select a string that describes the device driver, or that contains the device name. You can use the !bugdump debugger extension to display the crash dump data that is associated with this string.

Return Value

KeRegisterBugCheckReasonCallback returns TRUE if the callback routine is successfully registered; otherwise, it returns FALSE.

Remarks

Drivers can use KeRegisterBugCheckReasonCallback to register routines that execute during a system bug check.

KbCallbackDumpIo routines are called each time data is written to the crash dump file. Drivers for devices that monitor the system state can register a KbCallbackDumpIo routine to copy the crash dump data to the monitoring device.

KbCallbackSecondaryDumpData routines are called to poll drivers for any device-specific information that should be added to the secondary data area of a crash dump file.

KbCallbackAddPages routines are called to enable drivers to add pages of driver-specific data to the primary data area of a crash dump file. They are supported in Windows Server 2008 and later versions of Windows.

Drivers can use the KeDeregisterBugCheckReasonCallback routine to remove the bug check callback registration. Any driver that can be unloaded must remove the registrations of all of its callbacks in its Unload routine.

For information about how to implement these callback routines, see Writing a Bug Check Callback Routine.

To display secondary dump data, you can use the .enumtag command or the IDebugDataSpaces3::ReadTagged method in a debugger extension. Another option is to debug the bug check callback routine itself. For more information about debuggers and debugger extensions, see Windows Debugging.

Requirements

   
Minimum supported client Available in Windows XP Service Pack 1 (SP1), Windows Server 2003, and later versions of Windows.
Target Platform Universal
Header wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)
Library NtosKrnl.lib
DLL NtosKrnl.exe
IRQL Any level

See Also

Writing a Bug Check Callback Routine.

KBUGCHECK_CALLBACK_REASON

KBUGCHECK_REASON_CALLBACK_RECORD

KeDeregisterBugCheckReasonCallback

KeInitializeCallbackRecord

KeRegisterBugCheckCallback