DbgkLkmdRegisterCallback这是一个WINDOWS 7新增的无文档内核函数

用于创建一个Live kernel memory dump的回调

函数原型为：NTSTATUS DbgkLkmdRegisterCallback(PLKMD_CALLBACK CallBack , PVOID Context , ULONG CallbackType);

CallBackType有两个可能值:

#define SNAP_THREAD 1

#define SNAP_PROCESS 2

相关函数:

NTSTATUS DbgkLkmdUnregisterCallback(PLKMD_CALLBACK CallBack);

反注册callback

NTSTATUS DbgkpLkmdFireCallbacks(PLKMD_INFORMATION LkmdInfomation , ULONG CallbackType, PVOID ProcessOrThreadObject);

调用callbacks(未导出）

回调函数形如:

NTSTATUS DbgLkmdCallback(PVOID DbgkpLkmdSnapDataRoutine , PVOID DbgkpLkmdIsMemoryBlockPresentFromCallbackRoutine , PLKMD_INFORMATION LkmdInformation , PVOID Context);

若CALLBACK返回值<0,则调用DbgkpTriageDumpRestoreState,