Accessing UMDF Metadata in WER Reports

This topic describes the location and contents of the Windows Error Reporting (WER) reports that the operating system creates when a User-Mode Driver Framework (UMDF) crashes.

The system generates WER reports for three different UMDF event types: WUDFHostProblem, WUDFUnhandledException, and WUDFVerifierFailure.

When the reflector terminates the driver host process, sometimes due to the host timeout threshold being exceeded, the system generates a file called Report.wer, which contains the WER information. Specifically, Report.wer contains UMDF metadata that may be helpful if you are trying to debug a UMDF driver with no access to a live debugging target.

In Windows 8.1, you can find the Report.wer file in the C:\ProgramData\Microsoft\Windows\WER\ReportQueue directory. In this directory, open the most recent NonCritical_HostProblem_* folder and locate Report.wer.

You can also access WER reports for UMDF using the following PowerShell command:


get-winevent -providername "Windows Error Reporting" | where-object {$_.Message -like "*wudf*"} | format-list | out-file UmdfReports.txt

WUDFHostProblem sample report

The following is a sample UMDF WER report of type WUDFHostProblem. It was obtained from the ReportQueue directory described above. If you use PowerShell to retrieve the reports, the fields may be labeled P0, P1, P2 instead of Sig[0], Sig[1], Sig[2]. Otherwise, the fields are the same and contain the same possible values. This sample was generated from one of the WDK samples that use the OSR USB-FX2 hardware reference board.

Sig[0].Name=EventClass
Sig[0].Value=HostProblem
Sig[1].Name=Problem
Sig[1].Value=HostTimeout
Sig[2].Name=DetectedBy
Sig[2].Value=2
Sig[3].Name=UMDFVersion
Sig[3].Value=6.3.9600
Sig[4].Name=ExitCode
Sig[4].Value=103
Sig[5].Name=Operation
Sig[5].Value=3
Sig[6].Name=Message
Sig[6].Value=11b00
Sig[7].Name=Status
Sig[7].Value=ffffffff
Sig[8].Name=HardwareId
Sig[8].Value=USB\VID_0547&PID_1002&REV_0000

WUDFHostProblem fields

The following table describes the possible values for the fields in a report of type WUDFHostProblem.

Index NameValues
0EventClass

The framework sets this value to HostProblem.

1Problem

This field contains one of the following values:

  • HostFailure
  • SendFailure
  • HostTimeout
  • BadRequest
  • BadReply
  • HostFailure
  • Other
  • HostDisconnect
  • LeakedHandle
  • InvalidInterruptState
  • IsrTimedOut
2DetectedBy

Contains one of the following enumeration values:


WdfComponentInvalid = 0,
WdfComponentPlatform,
WdfComponentReflector,
WdfComponentDriverManager,
WdfComponentHost,
WdfComponentFramework,
WdfComponentTest,
WdfComponentMax

3UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.

4ExitCode

Contains one of the following enumeration values:


    WdfHostExit_StillActive = 0x103,
    WdfHostExit_CodeUnknown = 0x70000000,
    WdfHostExit_InternalDriverStopReported,
    WdfHostExit_InternalDriverStopReportFailed,
    WdfHostExit_ExternalTermination


WdfHostExit_StillActive indicates that the host process was running at the time the framework created the error report.

5Operation

Contains one of the following enumeration values:


    WudfOperation_Invalid,
    WudfOperation_Init,
    WudfOperation_HostShutdown,
    WudfOperation_Pnp,
    WudfOperation_Cleanup,
    WudfOperation_Close,
    WudfOperation_Cancel,
    WudfOperation_IO,
    WudfOperation_Interrupt,
    WudfOperation_PoFx,
    WudfOperation_Other,
    WudfOperation_Max


6Message

The first digit is of this field is always 1, which indicates that an IRP is involved in the operation. Subsequent pairs of digits indicate the MajorFunction and MinorFunction of the IRP, respectively.

In the sample report above, for example, this field contains the value 11b00. This means that the operation was an IRP that the reflector handled on behalf of the driver host process with a major function value of IRP_MJ_PNP and minor function value of IRP_MN_START_DEVICE (1 = IRP message, 1b = IRP_MJ_PNP, 00 = IRP_MN_START_DEVICE).

7Status

The framework always sets to this value to 0xffffffff.

8HardwareId

This field contains the hardware ID of the device associated with the driver that had a problem.

 

WUDFUnhandledException fields

The following table describes the possible values for the fields in a report of type WUDFUnhandledException.

Index NameValues
0EventClass

The framework sets this value to UnhandledException.

1Component

This field contains one of the following values:

  • Invalid
  • Platform
  • Reflector
  • DriverManager
  • Host
  • Framework
  • Test
2ExceptionCode

The reason the exception occurred. For a list of values, see EXCEPTION_RECORD.

3RelativeFaultingAddress

The address where the exception occurred.

4CrashingModuleNameName of the driver that raised the exception.
5CrashingFileVersionFramework version of the driver.
6LastDriverNameName of the first non-UMDF driver component in the driver stack.
7LastDriverVersionVersion number of the first non-UMDF driver component in the driver stack.
8UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.

9HardwareId

Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately.

 

WUDFVerifierFailure fields

The following table describes the possible values for the fields in a report of type WUDFVerifierFailure.

Index NameValues
0EventClass

The framework sets this value to VerifierFailure.

1FoundBy

The framework sets this value to Framework.

2Category

This field contains one of the following values:

  • Internal
  • Driver
  • Caller
  • External
  • UnhandledException
3ErrorNumberInternal use only.
4LocationInternal use only.
5DriverThe name of the driver module that failed.
6CallerAddressThe address of the routine that initiated generation of the report.
7UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.

8HardwareId

Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately.

 

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft