BSOD - Driver Verifier Instructions

Please do not follow these instructions without suitable guidance otherwise you can end up with an unbootable machine. Please read the final section for instructions on how to overcome this if this does happen.

Please do not follow the Driver Verifier tutorial written for Windows 10 which is available on Ten Forums. This tutorial is not suitable for general use for reasons which will be explained in the "Problems with I/O Verification" section. It is not a "safer" option; in fact, it is more likely to cause you unrelated crashes which will muddle our troubleshooting efforts.

Driver Verifier is a very useful troubleshooting tool when used correctly, however, these instructions should only be followed with the supervision of an experienced analyst. They have been written with Windows 11 machines in mind and therefore some of the settings may have been excluded due to deprecation from Microsoft. The general recommendation is to run Driver Verifier for between 24-48 hours or until a Driver Verifier related crash is thrown. These are the following:

• STOP 0xC1: SPECIAL_POOL_DETECTED_MEMORY_CORRUPTION
• STOP 0xC4: DRIVER_VERIFIER_DETECTED_VIOLATION
• STOP 0xC6: DRIVER_CAUGHT_MODIFYING_FREED_POOL
• STOP 0xC9: DRIVER_VERIFIER_IOMANAGER_VIOLATION
• STOP 0xD6: DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION
• STOP 0xE6: DRIVER_VERIFIER_DMA_VIOLATION

Please note that Stop 0xE6 can be thrown when Driver Verifier is not enabled. The same applies to Stop 0xC1 but is usually very rare. Once a crash has occurred then disable Driver Verifier and upload any dump files which have been produced.

Step 1: Please create a suitable restore point or back up image. This will make it easier to revert back to a working system in case you run into any difficulties such as a BSOD boot loop from running Driver Verifier. This is usually caused by a boot driver throwing a bugcheck exception while Driver Verifier is running.

Step 2: Please search for "verifier" from the Start Menu and then accept the UAC prompt if presented with one. You should see a screen which looks like the following:



Please select the option called "Create custom settings (for code developers)". This will allow us to select the recommended tests to verify the drivers against.

Step 3:



Please enable the settings shown above, that means enable the following:

1. Special Pool
2. Force IRQL Checking
3. Pool Tracking
4. Deadlock Detection
5. Security Checks
6. Miscellaneous Checks
7. DDI Compliance Checking
8. DDI Compliance Checking (Additional)

These test are usually suffice to catch most of the common bugs found in drivers. Of course, there are additional tests which you can enable but these should be only enabled in specific circumstances, in which there is evidence to suggest that a driver may be causing a particular kind of bug. For example, you would only enable the "IRP Logging" setting for Stop 0x44 bugchecks, and even then, all this would do is include additional information within a log file for an analyst to read.


Problematic Settings:


Step 4:

Once you've selected the settings, you're now ready to select the drivers which you wish to verify. To do so, please select the option titled "Select driver names from a list" and then sort all the drivers by the Provider column. Please select all the drivers apart from those listed as "Microsoft".





We generally do not recommend testing Microsoft drivers with the exception of the following:

1. ndis.sys
2. fltmgr.sys
3. storport.sys
4. wdf01000.sys

These drivers should be enabled, for reasons which are explained in the following article: Analyst’s Perspective: My Driver Passes Driver Verifier! (Or Does It…)

I would also recommend not enabling verification on any drivers prefixed with dump_ or hiber_ since these drivers are responsible for managing dump and hibernation file creation, as mentioned here: What are these ghost drivers named dump_diskdump.sys and other dump_*.sys that didn't come from any file? - The Old New Thing

Once you've selected the desired drivers then select Finish and then reboot the computer to start Driver Verifier.

You do not need to continuously enable and disable different settings on different subsets of drivers in order to "catch" a driver. Just enable Driver Verifier with the above settings and the recommended driver verification list and let it run. Although, please take into consideration a very important point: Driver Verifier is only designed to test for a specific set of common programming bugs and therefore if it doesn't crash, then it doesn't necessarily mean that your BSODs are being not caused by problematic drivers.

---

Verifying Driver Verifier Settings:

To ensure that it is running then you can open an elevated (administrative) command prompt and enter the following command:


If Driver Verifier has been successfully started, then you should see the settings list of which options have been enabled. Otherwise, you’ll get a message indicating that no drivers are currently being verified.

To disable Driver Verifier, then please open an elevated command prompt and enter the following command:


You will need to reboot the machine.

---

Disabling Driver Verifier (Boot Loop):

To disable Driver Verifier outside of Windows, then you will need to enter the Windows Recovery Environment (Windows RE) and then open command prompt. From there, you will need to load your SYSTEM hive using the following command:


You can use any alias for the SYSTEM hive, as long as, it is not SYSTEM as a temporary version intended just for the recovery environment has already been loaded. Once the hive has been successfully loaded, then enter the following commands:


The control set number will vary between different machines but it will be mapped to your current control set, which you can find by querying the the following key:


If the command returned 1 for example, then the current control set would be ControlSet001. Once you have deleted the appropriate values then unload the SYSTEM hive and reboot the system.


The VerifyDrivers value simply contains a list of all the drivers which are being verified, whereas, the VerifyDriverLevel is a bitwise flag for the settings which have been enabled.

This is a great solution. I corrected my computer from the WRE. It was a smooth repair. FYI the command "reg unload LIVESYSTEM" required the addition of HKLM\ to work with my machine.

Thanks, I've corrected the tutorial now.

Hello, I have a Windows 10 machine that's randomly BSODing. If i were to run driver verifier to rule out software issues, do I follow the settings laid out in this thread, or the settings laid out in the tenforums thread? For instance, the tenforums only runs with 3 tests selected, but this tutorial here uses more. Any guidance would be appreciated!