The KeRegisterBugCheckReasonCallback routine registers a BugCheckDumpIoCallback, BugCheckSecondaryDumpDataCallback, or BugCheckAddPagesCallback routine, which executes when the operating system issues a bug check.
BOOLEAN KeRegisterBugCheckReasonCallback( PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord, PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine, KBUGCHECK_CALLBACK_REASON Reason, PUCHAR Component );
A pointer to the callback routine to register. This parameter points to one of the following types of driver-implemented routine:
Specifies the type of callback routine that CallbackRoutine points to. Set Reason to one of the KBUGCHECK_CALLBACK_REASON enumeration values in the following table.
A pointer to a null-terminated ANSI string that identifies the caller. For example, you can select a string that describes the device driver, or that contains the device name. You can use the !bugdump debugger extension to display the crash dump data that is associated with this string.
KeRegisterBugCheckReasonCallback returns TRUE if the callback routine is successfully registered; otherwise, it returns FALSE.
Drivers can use KeRegisterBugCheckReasonCallback to register routines that execute during a system bug check.
BugCheckDumpIoCallback routines are called each time data is written to the crash dump file. Drivers for devices that monitor the system state can register a BugCheckDumpIoCallback routine to copy the crash dump data to the monitoring device.
BugCheckSecondaryDumpDataCallback routines are called to poll drivers for any device-specific information that should be added to the secondary data area of a crash dump file.
BugCheckAddPagesCallback routines are called to enable drivers to add pages of driver-specific data to the primary data area of a crash dump file. BugCheckAddPagesCallback routines are supported in Windows Server 2008 and later versions of Windows.
Drivers can use the KeDeregisterBugCheckReasonCallback routine to remove the BugCheckXxxCallback registration. Any driver that can be unloaded must remove the registrations of all of its callbacks in its Unload routine.
To display secondary dump data, you can use the .enumtag command or the IDebugDataSpaces3::ReadTagged method in a debugger extension. Another option is to debug the bug check callback routine itself. For more information about debuggers and debugger extensions, see Windows Debugging.
|Minimum supported client||Available in Windows XP Service Pack 1 (SP1), Windows Server 2003, and later versions of Windows.|
|Header||wdm.h (include Wdm.h, Ntddk.h, Ntifs.h)|
We'd love to hear your thoughts. Choose the type you'd like to provide:
Our feedback system is built on GitHub Issues. Read more on our blog.