--- title: Using Windows Error Reporting in .NET | daily.dev description: A deep technical walkthrough of using Windows Error Reporting (WER) to collect crash telemetry in .NET applications, built with NativeAOT to write the crash... canonical: https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Using Windows Error Reporting in .NET | daily.dev og:description: A deep technical walkthrough of using Windows Error Reporting (WER) to collect crash telemetry in .NET applications, built with NativeAOT to write the crash... og:url: https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg og:image: https://api.daily.dev/og/posts/ZJdkhOOlg.png og:image:alt: Using Windows Error Reporting in .NET og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Using Windows Error Reporting in .NET **[Kevin Gosse \(minidump.net\)](https://daily.dev/sources/minidump)** · 14 min read · 0 upvotes · 0 comments ## Summary A deep technical walkthrough of using Windows Error Reporting (WER) to collect crash telemetry in .NET applications, built with NativeAOT to write the crash handler in C# instead of C++. Covers implementing the three required callback exports, registering the handler in the Windows registry, debugging registration conflicts with Windbg (including discovering that .NET Framework and .NET Core register their own competing crash handlers), reordering handlers via WerUnregisterRuntimeExceptionModule, and passing custom metadata (version and status) into the crash report. The author also reports and links a bug they filed against .NET Core's broken WER registration logic, which has since been fixed. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why isn't my custom WER crash handler being invoked on .NET Framework or .NET 9? Both .NET Framework and .NET Core register their own built-in WER crash handler, and handlers are invoked in registration order, so the runtime's handler claims the crash before a custom one gets a chance. The fix is to call WerUnregisterRuntimeExceptionModule to remove the runtime's handler, register the custom handler first, then re-register the runtime's handler using g_pMSCorEE (clr.dll) or coreclr.dll as the context value. _Developers wiring up native crash telemetry on daily.dev can track this kind of .NET runtime gotcha before it costs debugging hours._ ### Is there a known bug with WerRegisterRuntimeExceptionModule in .NET Core? Yes, the registration logic in .NET Core's WerRegisterRuntimeExceptionModule was broken so the .NET Core handler never actually claimed the crash, unlike .NET Framework which registers successfully. A bug report was filed against the dotnet/runtime repository and the issue has since been fixed, meaning the WerUnregisterRuntimeExceptionModule workaround to reorder handlers will likely be needed again in future .NET versions. _Teams relying on crash reporting pipelines follow fixes like this on daily.dev to avoid stale workarounds after a runtime patch._ ### How do I pass custom metadata into a Windows Error Reporting crash report from a .NET application? Allocate a struct with native memory (so it isn't moved by the garbage collector), populate it with the desired fields such as a version number and status string, then pass its address as the context argument to WerRegisterRuntimeExceptionModule. In the OutOfProcessExceptionEventCallback, use ReadProcessMemory to read the struct from the crashing process, claim the crash, and set signatureCount so OutOfProcessExceptionEventSignatureCallback is called once per field to populate the event log metadata. _Developers building crash telemetry for shipped apps can dig into implementation patterns like this via daily.dev._ ## Similar posts on daily.dev - [Your Stack Traces Are Love Letters to Attackers — Daily DevOps & .NET](https://daily.dev/posts/your-stack-traces-are-love-letters-to-attackers-daily-devops-net-e0zhzx66u) · We Are .NET · 2 upvotes · 0 comments - [I stopped opening Event Viewer after finding this buried Windows tool that actually makes sense](https://daily.dev/posts/i-stopped-opening-event-viewer-after-finding-this-buried-windows-tool-that-actually-makes-sense-f2cb7wqq1) · XDA Developers · 0 upvotes · 0 comments - [Monitor your .NET MAUI apps with Datadog RUM](https://daily.dev/posts/monitor-your-net-maui-apps-with-datadog-rum-i9ipeqdjp) · Datadog · 0 upvotes · 0 comments - [On HotSpot Error Files and Useful Tools - Mostly nerdless](https://daily.dev/posts/on-hotspot-error-files-and-useful-tools---mostly-nerdless-yicfglo4s) · Mostly Nerdless · 0 upvotes · 0 comments --- Tags: [#.net](https://daily.dev/tags/.net) [View this post on daily.dev](https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Using Windows Error Reporting in .NET","url":"https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg"},"datePublished":"2026-10-04T13:06:36.657Z","dateModified":"2026-10-04T13:15:06.775Z","description":"A deep technical walkthrough of using Windows Error Reporting (WER) to collect crash telemetry in .NET applications, built with NativeAOT to write the crash...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/790eb0d3c1afcca05d0b5e7edebec730?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/790eb0d3c1afcca05d0b5e7edebec730?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Kevin Gosse (minidump.net)","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Kevin Gosse (minidump.net)","logo":"https://media.daily.dev/image/upload/s--8KHn1aFB--/f_auto,q_auto/v1791119046/logos/minidump?_a=BAMAMicg0","url":"https://daily.dev/sources/minidump"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":".net","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Kevin Gosse (minidump.net)","item":"https://daily.dev/sources/minidump"},{"@type":"ListItem","position":3,"name":"Using Windows Error Reporting in .NET"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/using-windows-error-reporting-in-net-zjdkhoolg#faq","mainEntity":[{"@type":"Question","name":"Why isn't my custom WER crash handler being invoked on .NET Framework or .NET 9?","acceptedAnswer":{"@type":"Answer","text":"Both .NET Framework and .NET Core register their own built-in WER crash handler, and handlers are invoked in registration order, so the runtime's handler claims the crash before a custom one gets a chance. The fix is to call WerUnregisterRuntimeExceptionModule to remove the runtime's handler, register the custom handler first, then re-register the runtime's handler using g_pMSCorEE (clr.dll) or coreclr.dll as the context value. Developers wiring up native crash telemetry on daily.dev can track this kind of .NET runtime gotcha before it costs debugging hours."}},{"@type":"Question","name":"Is there a known bug with WerRegisterRuntimeExceptionModule in .NET Core?","acceptedAnswer":{"@type":"Answer","text":"Yes, the registration logic in .NET Core's WerRegisterRuntimeExceptionModule was broken so the .NET Core handler never actually claimed the crash, unlike .NET Framework which registers successfully. A bug report was filed against the dotnet/runtime repository and the issue has since been fixed, meaning the WerUnregisterRuntimeExceptionModule workaround to reorder handlers will likely be needed again in future .NET versions. Teams relying on crash reporting pipelines follow fixes like this on daily.dev to avoid stale workarounds after a runtime patch."}},{"@type":"Question","name":"How do I pass custom metadata into a Windows Error Reporting crash report from a .NET application?","acceptedAnswer":{"@type":"Answer","text":"Allocate a struct with native memory (so it isn't moved by the garbage collector), populate it with the desired fields such as a version number and status string, then pass its address as the context argument to WerRegisterRuntimeExceptionModule. In the OutOfProcessExceptionEventCallback, use ReadProcessMemory to read the struct from the crashing process, claim the crash, and set signatureCount so OutOfProcessExceptionEventSignatureCallback is called once per field to populate the event log metadata. Developers building crash telemetry for shipped apps can dig into implementation patterns like this via daily.dev."}}]} ```