Accessing UMDF Metadata in WER Reports
This topic describes the location and contents of the Windows Error Reporting (WER) reports that the operating system creates when a User-Mode Driver Framework (UMDF) crashes.
The system generates WER reports for three different UMDF event types: WUDFHostProblem, WUDFUnhandledException, and WUDFVerifierFailure.
When the reflector terminates the driver host process, sometimes due to the host timeout threshold being exceeded, the system generates a file called Report.wer, which contains the WER information. Specifically, Report.wer contains UMDF metadata that may be helpful if you are trying to debug a UMDF driver with no access to a live debugging target.
In Windows 8.1, you can find the Report.wer file in the C:\ProgramData\Microsoft\Windows\WER\ReportQueue directory. In this directory, open the most recent NonCritical_HostProblem_* folder and locate Report.wer.
You can also access WER reports for UMDF using the following PowerShell command:
get-winevent -providername "Windows Error Reporting" | where-object {$_.Message -like "*wudf*"} | format-list | out-file UmdfReports.txt
WUDFHostProblem sample report
The following is a sample UMDF WER report of type WUDFHostProblem. It was obtained from the ReportQueue directory described above. If you use PowerShell to retrieve the reports, the fields may be labeled P0, P1, P2 instead of Sig[0], Sig[1], Sig[2]. Otherwise, the fields are the same and contain the same possible values. This sample was generated from one of the WDK samples that use the OSR USB-FX2 hardware reference board.
Sig[0].Name=EventClass
Sig[0].Value=HostProblem
Sig[1].Name=Problem
Sig[1].Value=HostTimeout
Sig[2].Name=DetectedBy
Sig[2].Value=2
Sig[3].Name=UMDFVersion
Sig[3].Value=6.3.9600
Sig[4].Name=ExitCode
Sig[4].Value=103
Sig[5].Name=Operation
Sig[5].Value=3
Sig[6].Name=Message
Sig[6].Value=11b00
Sig[7].Name=Status
Sig[7].Value=ffffffff
Sig[8].Name=HardwareId
Sig[8].Value=USB\VID_0547&PID_1002&REV_0000
WUDFHostProblem fields
The following table describes the possible values for the fields in a report of type WUDFHostProblem.
| Index | Name | Values |
|---|---|---|
| 0 | EventClass | The framework sets this value to HostProblem. |
| 1 | Problem | This field contains one of the following values:
|
| 2 | DetectedBy | Contains one of the following enumeration values: cpp
WdfComponentInvalid = 0,
WdfComponentPlatform,
WdfComponentReflector,
WdfComponentDriverManager,
WdfComponentHost,
WdfComponentFramework,
WdfComponentTest,
WdfComponentMax
|
| 3 | UMDFVersion | Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries. |
| 4 | ExitCode | Contains one of the following enumeration values: cpp
WdfHostExit_StillActive = 0x103,
WdfHostExit_CodeUnknown = 0x70000000,
WdfHostExit_InternalDriverStopReported,
WdfHostExit_InternalDriverStopReportFailed,
WdfHostExit_ExternalTermination
WdfHostExit_StillActive indicates that the host process was running at the time the framework created the error report. |
| 5 | Operation | Contains one of the following enumeration values: cpp
WudfOperation_Invalid,
WudfOperation_Init,
WudfOperation_HostShutdown,
WudfOperation_Pnp,
WudfOperation_Cleanup,
WudfOperation_Close,
WudfOperation_Cancel,
WudfOperation_IO,
WudfOperation_Interrupt,
WudfOperation_PoFx,
WudfOperation_Other,
WudfOperation_Max
|
| 6 | Message | The first digit is of this field is always 1, which indicates that an IRP is involved in the operation. Subsequent pairs of digits indicate the MajorFunction and MinorFunction of the IRP, respectively. In the sample report above, for example, this field contains the value 11b00. This means that the operation was an IRP that the reflector handled on behalf of the driver host process with a major function value of IRP_MJ_PNP and minor function value of IRP_MN_START_DEVICE (1 = IRP message, 1b = IRP_MJ_PNP, 00 = IRP_MN_START_DEVICE). |
| 7 | Status | The framework always sets to this value to 0xffffffff. |
| 8 | HardwareId | This field contains the hardware ID of the device associated with the driver that had a problem. |
WUDFUnhandledException fields
The following table describes the possible values for the fields in a report of type WUDFUnhandledException.
| Index | Name | Values |
|---|---|---|
| 0 | EventClass | The framework sets this value to UnhandledException. |
| 1 | Component | This field contains one of the following values:
|
| 2 | ExceptionCode | The reason the exception occurred. For a list of values, see EXCEPTION_RECORD. |
| 3 | RelativeFaultingAddress | The address where the exception occurred. |
| 4 | CrashingModuleName | Name of the driver that raised the exception. |
| 5 | CrashingFileVersion | Framework version of the driver. |
| 6 | LastDriverName | Name of the first non-UMDF driver component in the driver stack. |
| 7 | LastDriverVersion | Version number of the first non-UMDF driver component in the driver stack. |
| 8 | UMDFVersion | Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries. |
| 9 | HardwareId | Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately. |
WUDFVerifierFailure fields
The following table describes the possible values for the fields in a report of type WUDFVerifierFailure.
| Index | Name | Values |
|---|---|---|
| 0 | EventClass | The framework sets this value to VerifierFailure. |
| 1 | FoundBy | The framework sets this value to Framework. |
| 2 | Category | This field contains one of the following values:
|
| 3 | ErrorNumber | Internal use only. |
| 4 | Location | Internal use only. |
| 5 | Driver | The name of the driver module that failed. |
| 6 | CallerAddress | The address of the routine that initiated generation of the report. |
| 7 | UMDFVersion | Specifies the version of the UMDF libraries currently in use. Note that this may be a later version than came with the operating system if the user took action to update the framework libraries. |
| 8 | HardwareId | Starting in Windows 8, the hardware ID is provided in a separate file. In this case, the framework sets this value to Dumped Separately. |