Add a Custom Kernel Dump Filter Driver with Regedit

This guide provides a straightforward walkthrough on configuring Windows to load a custom kernel dump filter driver using the Registry Editor (Regedit). By modifying the system’s crash control settings, you can register a filter driver to process, encrypt, or redirect kernel memory dumps during a system crash (BSOD).

Prerequisites

Before modifying the registry: * Ensure your custom filter driver binary (.sys file) is placed in the C:\Windows\System32\drivers directory. * Verify the driver is properly compiled as a crash dump filter driver and digitally signed according to Windows Driver Signature Enforcement policies.

Step-by-Step Configuration

1. Open the Registry Editor

  1. Press Win + R to open the Run dialog box.
  2. Type regedit and press Enter.
  3. Select Yes if prompted by User Account Control (UAC).

In the address bar of the Registry Editor, paste or navigate to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl

3. Locate or Create the DumpFilters Value

  1. Check the right pane for a value named DumpFilters.
  2. If it does not exist:
    • Right-click an empty area in the right pane.
    • Select New > Multi-String Value.
    • Name the value DumpFilters.

4. Add the Custom Driver

  1. Double-click the DumpFilters value to edit it.
  2. In the Value data field, enter the name of your driver without the .sys extension (for example, if your driver is myfilter.sys, enter myfilter).
  3. If other filter drivers are already listed, place your driver name on a new line. The filter drivers execute in the order they are listed.
  4. Click OK to save the changes.

Verifying the Setup

  1. Restart the System: Reboot Windows to ensure the kernel recognizes the changes in the crash control configuration.
  2. Test Dump Generation: Use a controlled crash mechanism (such as the NotMyFault utility from Sysinternals or a configured crash-on-keyboard shortcut) to trigger a dump and verify that your filter driver processes the crash data as intended.