DUMP_WRITE callback function (ntdddump.h)
The Dump_Write callback routine is called before the write to the dump port driver. The filter driver can access the dump data at this time.
Syntax
DUMP_WRITE DumpWrite;
NTSTATUS DumpWrite(
[in] PFILTER_EXTENSION FilterExtension,
[in, out] PLARGE_INTEGER DiskByteOffset,
[in, out] PMDL Mdl
)
{...}
Parameters
[in] FilterExtension
A pointer to a FILTER_EXTENSION structure.
[in, out] DiskByteOffset
The value, in bytes, relative to the destination partition for the crash dump or hibernation. Filter drivers should not modify this field.
[in, out] Mdl
A pointer to an MDL structure that describes the data buffer. If the MDL is modified, the size of the write operation cannot change.
Return value
If the routine succeeds, it must return STATUS_SUCCESS. Otherwise, it must return one of the error status values defined in Ntstatus.h.
Remarks
Filter drivers can read the data that needs to be written. However, filter drivers cannot write to the buffer, as this could change the contents of the code or data that is being used by the crash dump process. Also, filter drivers are not allowed to change the size of the data.
To safely modify the data for the dump write, a filter driver should allocate a secondary buffer. The buffer's size will be the value of the MaxPagesPerWrite member of FILTER_INITIALIZATION_DATA multiplied by PAGE_SIZE. The data for the current buffer described by Mdl is copied into the secondary buffer and processed. After the filter is finished handling the dump data in the secondary buffer, the MDL pointed to by Mdl is updated with the address of the secondary buffer. The starting address of the secondary buffer set in the MDL must be page aligned.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Available starting with Windows Vista and Windows Server 2008. |
| Target Platform | Desktop |
| Header | ntdddump.h (include Ntdddump.h) |