The KeRegisterBugCheckReasonCallback routine registers a BugCheckDumpIoCallback, BugCheckSecondaryDumpDataCallback, or BugCheckAddPagesCallback routine, which executes when the operating system issues a bug check.

BOOLEAN
  KeRegisterBugCheckReasonCallback(
    IN PKBUGCHECK_REASON_CALLBACK_RECORD  CallbackRecord,
    IN PKBUGCHECK_REASON_CALLBACK_ROUTINE  CallbackRoutine,
    IN KBUGCHECK_CALLBACK_REASON  Reason,
    IN PUCHAR  Component
    );

Parameters

CallbackRecord

A pointer to a KBUGCHECK_REASON_CALLBACK_RECORD structure that was initialized by a call to the KeInitializeCallbackRecord routine.

CallbackRoutine

A pointer to the callback routine to register. This parameter points to one of the following types of driver-implemented routine:

BugCheckDumpIoCallback

BugCheckSecondaryDumpDataCallback

BugCheckAddPagesCallback

Reason

Specifies the type of callback routine that CallbackRoutine points to. Set Reason to one of the KBUGCHECK_CALLBACK_REASON enumeration values in the following table.

Value	Callback routine
KbCallbackDumpIo	BugCheckDumpIoCallback
KbCallbackSecondaryDumpData	BugCheckSecondaryDumpDataCallback
KbCallbackAddPages	BugCheckAddPagesCallback

Component

A pointer to a null-terminated ANSI string that identifies the caller. For example, you can select a string that describes the device driver, or that contains the device name. You can use the !bugdump debugger extension to display the crash dump data that is associated with this string.

Return Value

KeRegisterBugCheckReasonCallback returns TRUE if the callback routine is successfully registered; otherwise, it returns FALSE.

Comments

Drivers can use KeRegisterBugCheckReasonCallback to register routines that execute during a system bug check.

BugCheckDumpIoCallback routines are called each time data is written to the crash dump file. Drivers for devices that monitor the system state can register a BugCheckDumpIoCallback routine to copy the crash dump data to the monitoring device.

BugCheckSecondaryDumpDataCallback routines are called to poll drivers for any device-specific information that should be attached as secondary data to the crash dump file.

BugCheckAddPagesCallback routines are called to enable drivers to add pages of driver-specific data to a crash dump file. BugCheckAddPagesCallback routines are supported in Windows Server 2008 and later versions of Windows.

Drivers can use the KeDeregisterBugCheckReasonCallback routine to remove the BugCheckXxxCallback registration. Any driver that can be unloaded must remove the registrations of all of its callbacks in its Unload routine.

To display secondary dump data, you can use the .enumtag command or the IDebugDataSpaces3::ReadTagged method in a debugger extension. Another option is to debug the bug check callback routine itself. For more information about debuggers and debugger extensions, see Debugging Tools for NT-Based Operating Systems.

Requirements

Versions: Available in Windows XP Service Pack 1 (SP1), Windows Server 2003, and later versions of the Windows operating system.

IRQL: Any level

Headers: Declared in Ntddk.h. Include Ntddk.h.

See Also

BugCheckAddPagesCallback, BugCheckCallback, BugCheckDumpIoCallback, BugCheckSecondaryDumpDataCallback, KBUGCHECK_CALLBACK_REASON, KBUGCHECK_REASON_CALLBACK_RECORD, KeDeregisterBugCheckReasonCallback, KeInitializeCallbackRecord, KeRegisterBugCheckCallback