Hello. I have problems with my bugcheck secondary callback (WinXP SP2). My
callback is indeed called, but there are two issues:
a) My callback is called only once, and I cannot see my information in the
kernel crash dump. I believe that the DDK mentions that my callback should
be called twice: once for buffer length and address acquisition, and then
again for actually copying the data. My callback code, which was adapted
from an archive, is shown below after this letter.
b) In some cases, when I tried the .enumtag command, I got a listing of
information (my GUID was not there). However, sometimes I got the following
error:
1: kd> .enumtag
Unable to start enumeration, HRESULT 0x80004002 (E_NOINTERFACE, what does it
mean here, and did I cause it?)
Any ideas?
thanks,
Philip Lukidis
bugcheck callback:
// watch out, called at IRQL==HIGH_LEVEL
VOID TestBugCheckSecondaryDumpDataCallback(
IN KBUGCHECK_CALLBACK_REASON Reason,
IN PKBUGCHECK_REASON_CALLBACK_RECORD Record,
IN OUT PVOID ReasonSpecificData,
IN ULONG ReasonSpecificDataLength
)
{
UNREFERENCED_PARAMETER(Reason);
UNREFERENCED_PARAMETER(Record);
PKBUGCHECK_SECONDARY_DUMP_DATA pData;
pData = (PKBUGCHECK_SECONDARY_DUMP_DATA) ReasonSpecificData;
if(pData &&
(ReasonSpecificDataLength==sizeof(KBUGCHECK_SECONDARY_DUMP_DATA)))
{
pData->Guid = TEST_CRASH_GUID;
// this is for acquiring the address and buffer length
if(pData->OutBuffer == NULL)
{
pData->OutBuffer = (PVOID)g_CRASH_STRING;
pData->OutBufferLength = g_CrashLen;
}
// request to copy the data (we never get here, we’re called only
once!)
if((pData->InBuffer == pData->OutBuffer) && pData->InBuffer)
{
if(g_CrashLen < pData->OutBufferLength)
{
RtlCopyMemory(pData->OutBuffer,g_CRASH_STRING,g_CrashLen);
pData->OutBufferLength = g_CrashLen;
}
}
}
}