Enable wpp trace in crash dump

NTDEV
1

Hi, I have integrated wpp trace along with inflight trace recorder in my kernel mode driver, so that in case of crash, the minidump can contain trace messages. I use default macro DoTraceMessage().( As given in the documentation). To test this, i purposefully introduced crash in my driver and produced minidump to see if I can see trace messages. Now how do I know that, trace information is actually stored in crash minidump? Does WinDbg provide any commands to display trace when i load the dump?

2

https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/-rcdrkd-rcdrcrashdump

3

Thanks for the hint.

I tried this command with one of the provided driver sample (TraceDrv). I created crash dump (by purposefully introducing crash) to see if i can see the tracelogs (without starting and stopping tracelog commands).

Here is my windbg output

kd> !rcdrkd.rcdrcrashdump {d58c126f-b309-11d1-969e-0000f875a5bc}
Trace searchpath is:

Retrieving crashdump recorder logs…
Could not find necessary interfaces.
This debug command is designed to run on crash dumps, not running systems.
kd> !rcdrkd.rcdrlogdump tracedrv.sys
Trace searchpath is:

Error: couldn’t retreive autolog header.
Driver is not built with autologger support
Trace format prefix is: %7!u!: %!FUNC! -
Trying to extract TMF information from - c:\windows-driver-samples-main\windows-driver-samples-main\general\tracing\tracedriver\tracedrv\x64\debug\tracedrv.pdb

I purposefully did not start trace session before running the application (since this is my actual use case).

Actually my original driver application is used by one of the external customer, and they are seeing a crash in driver.
I need to troubleshoot the problem by asking customers to enable crash dump and sending me the dump.
I cannot ask them to start/stop trace session before running driver .

Is there any way that these WPP trace logs will be part of crash dump, without starting/stopping trace session with tracelog command ?

i found something line AutoLogging
https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session

Will this atutologging help ? basically i want to produce trace messages in my driver at specific points in the code.