Edit

Accessing UMDF Metadata in WER Reports

  • Article

This topic describes the location and contents of the Windows Error Reporting (WER) reports that the operating system creates when a User-Mode Driver Framework (UMDF) crashes.

The system generates WER reports for three different UMDF event types: WUDFHostProblem, WUDFUnhandledException, and WUDFVerifierFailure.

When the reflector terminates the driver host process, sometimes due to the host timeout threshold being exceeded, the system generates a file called Report.wer, which contains the WER information. Specifically, Report.wer contains UMDF metadata that may be helpful if you are trying to debug a UMDF driver with no access to a live debugging target.

In Windows 8.1, you can find the Report.wer file in the C:\ProgramData\Microsoft\Windows\WER\ReportQueue directory. In this directory, open the most recent NonCritical_HostProblem_* folder and locate Report.wer.

You can also access WER reports for UMDF using the following PowerShell command:

get-winevent -providername "Windows Error Reporting" | where-object {$_.Message -like "*wudf*"} | format-list | out-file UmdfReports.txt

WUDFHostProblem sample report

The following is a sample UMDF WER report of type WUDFHostProblem. It was obtained from the ReportQueue directory described above. If you use PowerShell to retrieve the reports, the fields may be labeled P0, P1, P2 instead of Sig[0], Sig[1], Sig[2]. Otherwise, the fields are the same and contain the same possible values. This sample was generated from one of the WDK samples that use the OSR USB-FX2 hardware reference board.

Sig[0].Name=EventClass
Sig[0].Value=HostProblem
Sig[1].Name=Problem
Sig[1].Value=HostTimeout
Sig[2].Name=DetectedBy
Sig[2].Value=2
Sig[3].Name=UMDFVersion
Sig[3].Value=6.3.9600
Sig[4].Name=ExitCode
Sig[4].Value=103
Sig[5].Name=Operation
Sig[5].Value=3
Sig[6].Name=Message
Sig[6].Value=11b00
Sig[7].Name=Status
Sig[7].Value=ffffffff
Sig[8].Name=HardwareId
Sig[8].Value=USB\VID_0547&PID_1002&REV_0000

WUDFHostProblem fields

The following table describes the possible values for the fields in a report of type WUDFHostProblem.

Index Name Values
0 EventClass

The framework sets this value to HostProblem.
1 Problem

This field contains one of the following values:

  • HostFailure
  • SendFailure
  • HostTimeout
  • BadRequest
  • BadReply
  • HostFailure
  • Other
  • HostDisconnect
  • LeakedHandle
  • InvalidInterruptState
  • IsrTimedOut
2 DetectedBy

Contains one of the following enumeration values:

cpp WdfComponentInvalid = 0, WdfComponentPlatform, WdfComponentReflector, WdfComponentDriverManager, WdfComponentHost, WdfComponentFramework, WdfComponentTest, WdfComponentMax
3 UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.
4 ExitCode

Contains one of the following enumeration values:

cpp WdfHostExit_StillActive = 0x103, WdfHostExit_CodeUnknown = 0x70000000, WdfHostExit_InternalDriverStopReported, WdfHostExit_InternalDriverStopReportFailed, WdfHostExit_ExternalTermination

WdfHostExit_StillActive indicates that the host process was running at the time the framework created the error report.
5 Operation

Contains one of the following enumeration values:

cpp WudfOperation_Invalid, WudfOperation_Init, WudfOperation_HostShutdown, WudfOperation_Pnp, WudfOperation_Cleanup, WudfOperation_Close, WudfOperation_Cancel, WudfOperation_IO, WudfOperation_Interrupt, WudfOperation_PoFx, WudfOperation_Other, WudfOperation_Max
6 Message

The first digit is of this field is always 1, which indicates that an IRP is involved in the operation. Subsequent pairs of digits indicate the MajorFunction and MinorFunction of the IRP, respectively.

In the sample report above, for example, this field contains the value 11b00. This means that the operation was an IRP that the reflector handled on behalf of the driver host process with a major function value of IRP_MJ_PNP and minor function value of IRP_MN_START_DEVICE (1 = IRP message, 1b = IRP_MJ_PNP, 00 = IRP_MN_START_DEVICE).
7 Status

The framework always sets to this value to 0xffffffff.
8 HardwareId

This field contains the hardware ID of the device associated with the driver that had a problem.

WUDFUnhandledException fields

The following table describes the possible values for the fields in a report of type WUDFUnhandledException.

Index Name Values
0 EventClass

The framework sets this value to UnhandledException.
1 Component

This field contains one of the following values:

  • Invalid
  • Platform
  • Reflector
  • DriverManager
  • Host
  • Framework
  • Test
2 ExceptionCode

The reason the exception occurred. For a list of values, see EXCEPTION_RECORD.
3 RelativeFaultingAddress

The address where the exception occurred.
4 CrashingModuleName Name of the driver that raised the exception.
5 CrashingFileVersion Framework version of the driver.
6 LastDriverName Name of the first non-UMDF driver component in the driver stack.
7 LastDriverVersion Version number of the first non-UMDF driver component in the driver stack.
8 UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.
9 HardwareId

Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately.

WUDFVerifierFailure fields

The following table describes the possible values for the fields in a report of type WUDFVerifierFailure.

Index Name Values
0 EventClass

The framework sets this value to VerifierFailure.
1 FoundBy

The framework sets this value to Framework.
2 Category

This field contains one of the following values:

  • Internal
  • Driver
  • Caller
  • External
  • UnhandledException
3 ErrorNumber Internal use only.
4 Location Internal use only.
5 Driver The name of the driver module that failed.
6 CallerAddress The address of the routine that initiated generation of the report.
7 UMDFVersion

Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries.
8 HardwareId

Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately.