KeRegisterBugCheckReasonCallback

The KeRegisterBugCheckReasonCallback routine registers BugCheckDumpIoCallback and BugCheckSecondaryDumpDataCallback routines, which execute when the system issues a bug check.

NTKERNELAPI
BOOLEAN
  KeRegisterBugCheckReasonCallback (
    IN PKBUGCHECK_REASON_CALLBACK_RECORD CallbackRecord,
    IN PKBUGCHECK_REASON_CALLBACK_ROUTINE CallbackRoutine,
    IN KBUGCHECK_CALLBACK_REASON Reason,
    IN PUCHAR Component 
    );

Parameters

CallbackRecord

Pointer to a KBUGCHECK_REASON_CALLBACK_RECORD structure that was initialized by KeInitializeCallbackRecord.

CallbackRoutine

Pointer to the BugCheckDumpIoCallback or BugCheckSecondaryDumpDataCallback routine to register.

Reason

Specifies a KBUGCHECK_CALLBACK_REASON value that determines when the callback is called. Use KbCallbackDumpIo to specify a BugCheckDumpIoCallback routine, or KbCallbackSecondaryDumpData to specify a BugCheckSecondaryDumpDataCallback routine.

Component

Pointer to a zero-terminated ANSI string that identifies the caller. This string usually describes the name of the device driver, or possibly of its device.

Return Value

KeRegisterBugCheckReasonCallback returns TRUE if the callback is successfully registered; otherwise, this routine returns FALSE.

Headers

Declared in ntddk.h. Include ntddk.h.

Comments

This routine is only available in Windows XP Service Pack 1 (SP1), Windows Server 2003, and later operating systems.

Drivers can use KeRegisterBugCheckReasonCallback to register routines that execute during a system bug check. BugCheckSecondaryDumpDataCallback routines are called to poll drivers for any device-specific information that should be attached to the crash dump file. BugCheckDumpIoCallback routines are called each time data is written to the crash dump file. Drivers for devices that monitor the system state can register a BugCheckDumpIoCallback routine to copy the crash dump data to the monitoring device.

Drivers can use the KeDeregisterBugCheckReasonCallback routine to remove the callback. Any driver that can be unloaded must remove all of its callbacks in its Unload routine.

To display secondary dump data, you can use the .enumtag command or the IDebugDataSpaces3::ReadTagged method in a debugger extension. It is also possible to debug the bug check callback routine itself. For information about debuggers and debugger extensions, see Debugging Tools for NT-Based Operating Systems.

Callers of KeRegisterBugCheckReasonCallback can be running at any IRQL.

See Also

KeDeregisterBugCheckReasonCallback, KeInitializeCallbackRecord, KeRegisterBugCheckCallback, BugCheckCallback, BugCheckDumpIoCallback, BugCheckSecondaryDumpDataCallback