DbgkpWerWriteTriageDump
NTSTATUS __stdcall DbgkpWerWriteTriageDump(_DBGKWER_CONTEXT *WerContext){
__int64 v2;
int v3;
int updated;
NTSTATUS v5;
NTSTATUS v6;
_IO_STATUS_BLOCK IoStatusBlock;
VOID *FileHandle;
FileHandle = 0i64;
v2 = *((_QWORD *)WerContext + 13);
IoStatusBlock = 0i64;
v3 = WerLiveKernelOpenDumpFile(v2, &FileHandle);
updated = v3;
if( v3 >= 0 )
{
updated = DbgkpWerUpdateTriageDumpHeader(WerContext);
if( updated >= 0 )
{
v5 = ZwWriteFile(
(_HANDLE)FileHandle,
0,
0i64,
0i64,
&IoStatusBlock,
*((PVOID *)WerContext + 18),
WerContext[38],
0i64,
0i64);
updated = v5;
if( v5 >= 0 )
{
v6 = DbgkpWerWriteSecondaryData(WerContext, FileHandle);
updated = v6;
if( v6 < 0 )
DbgPrintEx(5u, 0, "DBGK: Writing secondary data failed with Status 0x%X\n", (unsigned int)v6);
}
else
{
DbgPrintEx(5u, 0, "DBGK: Triage dump write failed with Status 0x%X\n", (unsigned int)v5);
}
}
}
else
{
DbgPrintEx(5u, 0, "DBGK: DbgkWerWriteTriageDump: WerLiveKernelOpenDumpFile failed, status 0x%X\n", (unsigned int)v3);
}
if( FileHandle )
ZwClose((_HANDLE)FileHandle);
return updated;
}Referenced by:
DbgkpWerCaptureLiveTriageDump