DUMP_WRITE callback function (ntdddump.h)

Article
02/22/2024

The Dump_Write callback routine is called before the write to the dump port driver. The filter driver can access the dump data at this time.

Syntax

DUMP_WRITE DumpWrite;

NTSTATUS DumpWrite(
  [in]      PFILTER_EXTENSION FilterExtension,
  [in, out] PLARGE_INTEGER DiskByteOffset,
  [in, out] PMDL Mdl
)
{...}

Parameters

[in] FilterExtension

A pointer to a FILTER_EXTENSION structure.

[in, out] DiskByteOffset

The value, in bytes, relative to the destination partition for the crash dump or hibernation. Filter drivers should not modify this field.

[in, out] Mdl

A pointer to an MDL structure that describes the data buffer. If the MDL is modified, the size of the write operation cannot change.

Return value

If the routine succeeds, it must return STATUS_SUCCESS. Otherwise, it must return one of the error status values defined in Ntstatus.h.

Remarks

Filter drivers can read the data that needs to be written. However, filter drivers cannot write to the buffer, as this could change the contents of the code or data that is being used by the crash dump process. Also, filter drivers are not allowed to change the size of the data.

To safely modify the data for the dump write, a filter driver should allocate a secondary buffer. The buffer's size will be the value of the MaxPagesPerWrite member of FILTER_INITIALIZATION_DATA multiplied by PAGE_SIZE. The data for the current buffer described by Mdl is copied into the secondary buffer and processed. After the filter is finished handling the dump data in the secondary buffer, the MDL pointed to by Mdl is updated with the address of the secondary buffer. The starting address of the secondary buffer set in the MDL must be page aligned.

Requirements

Requirement	Value
Minimum supported client	Available starting with Windows Vista and Windows Server 2008.
Target Platform	Desktop
Header	ntdddump.h (include Ntdddump.h)