How to retrieve data added to crash dump using KeAddTriageDumpDataBlock

[Rexlin S]

I have added some data to crash dump using KeAddTriageDumpDataBlock function from my BugcheckReasonCallback routine of type KbCallbackTriageDumpData.
How do I retrieve and view this data in the crash dump file .

NTSTATUS KeAddTriageDumpDataBlock(
PKTRIAGE_DUMP_DATA_ARRAY KtriageDumpDataArray,
PVOID Address,
SIZE_T Size
);

Is the data block defined by address and size in the KeAddTriageDumpDataBlock should be of any format ?
I have the data that is to be added to the DumpDataArray in a private data structure and
I have passed the address and size of that structure for
the address and size fields.
Is this correct ?

Continue reading...