How to retrieve data added to crash dump using KeAddTriageDumpDataBlock RRS feed

  • Question

  • I have added some data to crash dump using KeAddTriageDumpDataBlock function from my BugcheckReasonCallback routine of type KbCallbackTriageDumpData.
    How do I retrieve and view this data in the crash dump file .

    NTSTATUS KeAddTriageDumpDataBlock(
      PKTRIAGE_DUMP_DATA_ARRAY KtriageDumpDataArray,
      PVOID                    Address,
      SIZE_T                   Size

    Is the data block defined by address and size in the KeAddTriageDumpDataBlock should be of any format ?
    I have the data that is to be added to the DumpDataArray in a private data structure and 
    I have passed the address and size of that structure for 
    the address and size fields. 
    Is this correct ?

    • Edited by Rexlin S Thursday, February 27, 2020 10:33 AM
    Thursday, February 27, 2020 10:04 AM