Order of BugCheck callback and memory dump?

NTDEV
1

It used to be that the BugCheck Callback was called *before* the memory dump
occurred.

I have a very vague memory of someone mentioning a few months back that this
changed on some version of NT, or in some service pack, and the callback is
now called *after* the memory dump.

Does anyone have a pointer to anything like this, or am I just remembering
phantoms?

Loren

2

It changed in XP and the DDI KeRegisterBugCheckReasonCallback was added in
XP SP1. Use this routine to get your dumpdata in the dump. I think that
there might be an undocumented interface in XP SP0 that might look a lot
like this documented interface. Hopefully nobody is actually running XP SP0.

=====================
Mark Roddy DDK MVP
Windows 2003/XP/2000 Consulting
Hollis Technology Solutions 603-321-1032
www.hollistech.com

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Loren Wilton
Sent: Tuesday, November 29, 2005 6:30 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] Order of BugCheck callback and memory dump?

It used to be that the BugCheck Callback was called *before*
the memory dump occurred.

I have a very vague memory of someone mentioning a few months
back that this changed on some version of NT, or in some
service pack, and the callback is now called *after* the memory dump.

Does anyone have a pointer to anything like this, or am I
just remembering phantoms?

Loren

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as:
xxxxx@hollistech.com To unsubscribe send a blank email to
xxxxx@lists.osr.com

3

> It changed in XP and the DDI KeRegisterBugCheckReasonCallback was added in

XP SP1. Use this routine to get your dumpdata in the dump. I think that
there might be an undocumented interface in XP SP0 that might look a lot
like this documented interface. Hopefully nobody is actually running XP
SP0.

I’m actually more interested in W2K3 Server and the like, either SP0 or SP1.
Indications seem to be that this may have changed in W2K3 SP1 from the old
way in SP0.