Driver Verifier Command Syntax

The following syntax is used when running the Verifier utility in a Command Prompt window.

You can type several options on the same single line. For example:

verifier /flags 7 /driver beep.sys disksdd.sys

Windows 11

  verifier /standard /all
  verifier /standard /driver NAME [NAME ...]
  verifier {/ruleclasses | /rc | dif} <options> [<ruleclass_1> <ruleclass_2> ...] /all
  verifier {/ruleclasses | /rc | dif} <options> [<ruleclass_1> <ruleclass_2> ...] /driver NAME [NAME ...]
  verifier /flags <options> /all
  verifier /flags <options> /driver NAME [NAME ...]
  verifier /rules [OPTION ...]
  verifier /dif [<ruleclass_1> <ruleclass_2> ...] /now /driver NAME [NAME ...]
  verifier /query
  verifier /querysettings
  verifier /bootmode [persistent | resetonbootfail | resetonunusualshutdown | oneboot]
  verifier /bc <number_of_reboots>
  verifier /reset
  verifier /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /faultssystematic [OPTION ...]
  verifier /log LOG_FILE_NAME [/interval SECONDS]
  verifier /volatile /flags <options>
  verifier /volatile /adddriver NAME [NAME ...]
  verifier /volatile /removedriver NAME [NAME ...]
  verifier /volatile /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /domain <types> <options> /driver ... [/logging | /livedump]
  verifier /logging
  verifier /livedump
  verifier /?
  verifier /help

Starting in Windows 11, these driver interception framework (DIF) enabled options can be enabled using the /dif option.

The /dif command automatically includes rule class 36, DIF mode, but /ruleclasses and /rc do not. Flags marked with (!) in the help text require DIF mode to be enabled. All Standard rule classes can be enabled without also enabling DIF mode.

Rules marked with (^) in the help text can be enabled without reboot using the /dif [<ruleclass_1> <ruleclass_2> <ruleclass_k>] /now command.

Standard Rule Classes

Value Rule /now
1 Special pool yes
2 Force IRQL checking no
4 Pool tracking yes
5 I/O verification yes
6 Deadlock detection no
8 DMA checking no
9 Security checks yes
12 Miscellaneous checks yes
18 DDI compliance checking yes
34 WDF verification no

Additional Rule Classes

Value Rule /now Needs DIF Mode?
3 Randomized low resources simulation no no
10 Force pending I/O requests no no
11 IRP logging no no
14 Invariant MDL checking for stack no no
15 Invariant MDL checking for driver no no
16 Power framework delay fuzzing no no
17 Port/miniport interface checking no no
19 Systematic low resources simulation yes yes
20 DDI compliance checking (additional) yes no
22 NDIS/WIFI verification no no
24 Kernel synchronization delay fuzzing no no
25 VM switch verification no no
26 Code integrity checks no no
33 Driver isolation checks no yes
35 DDI checking (additional IRQL rules) yes yes
36 DIF mode yes n/a

Windows 10

You can use the /volatile parameter with some Driver Verifier /flags options and with /standard. You cannot use /volatile with the /flags options for DDI compliance checking, Power Framework Delay Fuzzing or Storport Verification. For details, see Using Volatile Settings.

  verifier /standard /all
  verifier /standard /driver NAME [NAME ...]
  verifier {/ruleclasses | /rc} <options> [<ruleclass_1> <ruleclass_2> ...] /all
  verifier /flags <options> /all
  verifier /flags <options> /driver NAME [NAME ...]
  verifier /rules [OPTION ...]
  verifier /query
  verifier /querysettings
  verifier /bootmode [persistent | resetonbootfail | resetonunusualshutdown | oneboot]
  verifier /reset
  verifier /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /faultssystematic [OPTION ...]
  verifier /log LOG_FILE_NAME [/interval SECONDS]
  verifier /volatile /flags <options>
  verifier /volatile /adddriver NAME [NAME ...]
  verifier /volatile /removedriver NAME [NAME ...]
  verifier /volatile /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /domain <types> <options> /driver ... [/logging | /livedump]
  verifier /logging
  verifier /livedump
  verifier /?
  verifier /help

Windows 8.1

You can use the /volatile parameter with some Driver Verifier /flags options and with /standard. You cannot use /volatile with the /flags options for DDI compliance checking, Power Framework Delay Fuzzing, Storport Verification. For details, see Using Volatile Settings.

  verifier /standard /all
  verifier /standard /driver NAME [NAME ...]
  verifier /flags <options> /all
  verifier /flags <options> /driver NAME [NAME ...]
  verifier /rules [OPTION ...]
  verifier /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /faultssystematic [OPTION ...]
  verifier /log LOG_FILE_NAME [/interval SECONDS]
  verifier /query
  verifier /querysettings
  verifier /bootmode [persistent | disableafterfail | oneboot]
  verifier /reset
  verifier /volatile /flags <options>
  verifier /volatile /adddriver NAME [NAME ...]
  verifier /volatile /removedriver NAME [NAME ...]
  verifier /volatile /faults [Probability] [PoolTags] [Applications] [DelayMins]
  verifier /?

Windows 8, Windows 7 Syntax

You can use the /volatile parameter with some Driver Verifier /flags options and with /standard. You cannot use /volatile with the /flags options for DDI compliance checking, Power Framework Delay Fuzzing, Storport Verification, SCSI Verification or with /disk. For details, see Using Volatile Settings.

verifier [/volatile] [/standard | /flags Options ] [ /all | /driver DriverList ]
verifier /volatile /faults [Probability PoolTags Applications DelayMins] /driver DriverList
verifier /volatile {/adddriver | /removedriver} DriverList
verifier /reset
verifier /querysettings
verifier /query
verifier /log LogFileName [/interval Seconds]
verifier /?

Parameters

Verifier Command-Line Syntax

/all Directs Driver Verifier to verify all installed drivers after the next boot.

/bc <number_of_reboots> Sets the number of reboots for which verification should be active.

This option automatically sets the ResetOnUnusualShutdown boot mode.

/bootmode mode Controls whether the settings for Driver Verifier are enabled after a reboot. To set or change this option, you must reboot the computer.

Bootmode Description

persistent

Ensures that the Driver Verifier settings persist (stay in effect) over many reboots. This is the default setting.

resetonbootfail

Disables Driver Verifier for subsequent reboots if the system failed to start.

oneboot

Only enables the Driver Verifier settings for the next time the computer starts. Driver Verifier is disabled for subsequent reboots.

resetonunusualshutdown

(Introduced in Windows 10, build 1709) Driver Verifier will persist until an unusual shutdown occurs. Its abbreviation, 'rous', can be used.

/dif DifEnabledRule Enable checking using a Dif enabled rule. Checking will take effect the next time the system is rebooted. Added in Windows 11.

/dif /now DifEnabledRule Immediately enable checking using a Dif enabled rule. Enables the rule classes immediately without needing reboot. This option is only valid if no rule classes are already running. See the Windows 11 rule class descriptions for the rule classes capable of immediate activation.

/driver DriverList Specifies one or more drivers that will be verified. DriverList is a list of drivers by binary name, such as Driver.sys. Use a space to separate each driver name. Wildcard values, such as n*.sys, are not supported.

/driver.exclude DriverList Specifies one or more drivers that will be excluded from verification. This parameter is applicable only if all drivers are selected for verification. DriverList is a list of drivers by binary name, such as Driver.sys. Use a space to separate each driver name. Wildcard values, such as n*.sys, are not supported.

/faults Enables the Low Resources Simulation feature in Driver Verifier. You can use /faults in place of /flags 0x4. However, you cannot use /flags 0x4 with the /faults subparameters.

You can use the following subparameters of the /faults parameter to configure Low Resources Simulation.

Subparameter Description

Probability

Specifies the probability that Driver Verifier will fail a given allocation. Type a number (in decimal or hexadecimal) to represent the number of chances in 10,000 that Driver Verifier will fail the allocation. The default value, 600, means 600/10000 or 6%.

Pool Tags

Limits the allocations that Driver Verifier can fail to allocations with the specified pool tags. You can use a wildcard character (*) to represent multiple pool tags. To list multiple pool tags, separate the tags with spaces. By default, all allocations can fail.

Applications

Limits the allocations that Driver Verifier can fail to allocations for the specified program. Type the name of an executable file. To list programs, separate the program names with spaces. By default, all allocations can fail.

DelayMins

Specifies the number of minutes after booting during which Driver Verifier does not intentionally fail any allocations. This delay allows the drivers to load and the system to stabilize before the test begins. Type a number (in decimal or hexadecimal). The default value is 7 (minutes).

/faultssystematic Specifies the options for Systematic low resources simulation. Use the 0x40000 flag to select Systematic low resources simulation option.

OPTION Description

enableboottime

Enables fault injections across computer reboots.

disableboottime

Disables fault injections across computer reboots (this is the default setting).

recordboottime

Enables fault injections in what if mode across computer reboots.

resetboottime

Disables fault injections across computer reboots and clears the stack exclusion list.

enableruntime

Dynamically enables fault injections.

disableruntime

Dynamically disables fault injections.

recordruntime

Dynamically enables fault injections in what if mode.

resetruntime

Dynamically disables fault injections and clears the previously faulted stack list.

querystatistics

Shows the current fault injection statistics.

incrementcounter

Increments the test pass counter used to identify when a fault was injected.

getstackid COUNTER

Retrieves the indicated injected stack identifier.

excludestack STACKID

Excludes the stack from fault injection.

/flags Options Activates the specified options after the next reboot. This number can be entered in decimal or in hexadecimal (with an 0x prefix) format. Any combination of the following values is allowed.

Decimal Hexadecimal Standard Setting Option

1

0x1 (bit 0)

X

Special Pool

2

0x2 (bit 1)

X

Force IRQL Checking

4

0x4 (bit 2)

Low Resources Simulation

8

0x8 (bit 3)

X

Pool Tracking

16

0x10 (bit 4)

X

I/O Verification

32

0x20 (bit 5)

X

Deadlock Detection

64

0x40 (bit 6)

Enhanced I/O Verification This option is automatically activated when you select I/O Verification

128

0x80 (bit 7)

X

DMA Verification

256

0x100 (bit 8)

X

Security Checks

512

0x200 (bit 9)

Force Pending I/O Requests

1024

0x400 (bit 10)

IRP Logging

2048

0x800 (bit 11)

X

Miscellaneous Checks

8192

0x2000 (bit 13)

Invariant MDL Checking for Stack (Starting with Windows 8)

16384

0x4000 (bit 14)

Invariant MDL Checking for Driver (Starting with Windows 8)

32768

0x8000 (bit 15)

Power Framework Delay Fuzzing (Starting with Windows 8) (Deprecated in Windows 10 Build 19042 and above)

65536

0x10000 (bit 16)

Port/miniport interface checking (Starting with Windows 10)

131072

0x20000 (bit 17)

X

DDI compliance checking (Starting with Windows 8)

262144

0x40000 (bit 18)

Systematic low resources simulation (Starting with Windows 8.1) (Deprecated in Windows 10 Build 19042 and above)

524288

0x80000 (bit 19)

DDI compliance checking (additional) (Starting with Windows 8.1) (Deprecated in Windows 10 Build 19042 and above)

2097152

0x200000 (bit 21)

NDIS/WIFI verification (Starting with Windows 8.1)

8388608

0x800000 (bit 23)

Kernel synchronization delay fuzzing (Starting with Windows 8.1) (Deprecated in Windows 10 Build 19042 and above)

16777216

0x1000000 (bit 24)

VM switch verification (Starting with Windows 8.1)

33554432

0x2000000 (bit 25)

Code integrity checks (Starting with Windows 10)

You cannot use this method to activate the Storport Verification options. For information, see Storport Verification.

/flags VolatileOptions Specifies the Driver Verifier options that are changed immediately without rebooting.

You can use the /volatile parameter with all /flags values.)

Enter a number in decimal or in hexadecimal format (with an 0x prefix).

Any combination of the following values is permitted.

Hexadecimal Option

0x00000004 (bit 2)

Randomized Low Resources Simulation

0x00000020 (bit 5)

Deadlock detection

0x00000080 (bit 7)

DMA checking

0x00000200 (bit 9)

Force pending I/O requests

0x00000400 (bit 10)

IRP Logging

/ruleclasses or /rc <ruleclass_1> <ruleclass_2> ... <ruleclass_k>

The ruleclasses parameter is available starting with Windows Version 1803.

The ruleclasses parameter encompasses a larger set of verification classes than the '/flags' parameter above. While '/flags' is limited to a 32 bit bitmap expression, this option can include more than 32 verification classes. Each positive decimal integer represents a verification class. Multiple classes can be expressed by separating each class id with a space character. The following rule classes IDs are available.

Standard Rule Classes

Value Rule
1 Special pool
2 Force IRQL checking
4 Pool tracking
5 I/O verification
6 Deadlock detection
8 DMA checking
9 Security checks
12 Miscellaneous checks
18 DDI compliance checking
34 WDF Verification

Additional Rule Classes

These rule classes are intended for specific scenario testing. Rule classes are marked with (*) require I/O Verification (5) that will be automatically enabled. Flags marked with (**) support disabling of individual rules. Flags marked with (***) are in logging mode by default and require /onecheck in order to crash upon violation.

Flags marked with (!) require DIF mode (rule class 36) to be enabled.

Value Rule
3 Randomized low resources simulation
10 Force pending I/O requests (*)
11 IRP logging (*)
14 Invariant MDL checking for stack (*)
15 Invariant MDL checking for driver (*)
16 Power framework delay fuzzing
17 Port/miniport interface checking
19 Systematic low resources simulation
20 DDI compliance checking (additional)
22 NDIS/WIFI verification (**)
24 Kernel synchronization delay fuzzing
25 VM switch verification
26 Code integrity checks
33 Driver isolation checks (***, !)
36 DIF mode

Windows 11 Rule Classes

Starting with Windows 11 the following rule classes are available.

Standard Rule Classes

Value Rule
1 Special pool (^)
2 Force IRQL checking (^)
4 Pool tracking (^)
5 I/O verification (^)
6 Deadlock detection
8 DMA checking
9 Security checks (^)
12 Miscellaneous checks (^)
18 DDI compliance checking (^)
34 WDF Verification

The '/dif' command automatically includes rule class 36, DIF mode, but /ruleclasses and /rc do not. Flags marked with (!) require DIF mode to be enabled. Flags marked with (^) can be enabled without reboot using the '/dif [<ruleclass_1> <ruleclass_2> <ruleclass_k>] /now' command.

Additional Rule Classes

Flags marked with (!) require DIF mode (rule class 36) to be enabled.

Value Rule
3 Randomized low resources simulation
10 Force pending I/O requests (*)
11 IRP logging (*)
14 Invariant MDL checking for stack (*)
15 Invariant MDL checking for driver (*)
16 Power framework delay fuzzing
17 Port/miniport interface checking
19 Systematic low resources simulation (!, ^)
20 DDI compliance checking - additional (^)
22 NDIS/WIFI verification (**)
24 Kernel synchronization delay fuzzing
25 VM switch verification
26 Code integrity checks
33 Driver isolation checks (***, !)
36 DIF mode

/log LogFileName [/interval|Seconds] Creates a log file with name LogFileName. Driver Verifier periodically writes statistics to this file. For details, see Creating Log Files.

If a verifier /log command is typed at the command line, the command prompt does not return. To close the log file and return a prompt, use the CTRL+C key. After a reboot, to create a log, you must submit the verifier /log command again.

Option Description
/interval Seconds Specifies the interval between log file updates. The default is 30 seconds.

/rules Option Options for rules that can be disabled (advanced).

Option Description

query

Shows current status of controllable rules.

reset

resets all rules to their default state.

default ID

Sets rule ID to its default state. For the supported rules, the rule ID is the Bug Check 0xC4 (DRIVER_VERIFIER_DETECTED_VIOLATION) parameter 1 value.

disable ID

Disables specified rule ID. For the supported rules, the rule ID is the Bug Check 0xC4 (DRIVER_VERIFIER_DETECTED_VIOLATION) parameter 1 value.

/standard Activates the "standard" or default Driver Verifier options after the next boot. The standard options are Special Pool, Force IRQL Checking, Pool Tracking, I/O Verification, Deadlock Detection, DMA Verification. and WDF Verification The standard options also include Security Checks, Miscellaneous Checks and DDI compliance checking.

Note

Starting in Windows 10 versions after 1803, using /flags 0x209BB will no longer automatically enable WDF verification. Use the /standard syntax to enable standard options, with WDF verification included.

/stop Disables rule classes enabled via '/dif /now' to halt verification.

/volatile /flags Changes the settings without rebooting the computer. Volatile settings take effect immediately. You can use the /volatile parameter with the /flags parameter to enable and disable some options without rebooting. You can also use /volatile with the /adddriver and /removedriver parameters to start or stop the verification of a driver without rebooting, even if Driver Verifier is not already running.

Specifies the Driver Verifier options that are changed immediately without rebooting. Only the following flags can be used with volatile:

0x00000004 (bit 2) - Randomized low resources simulation 0x00000020 (bit 5) - Deadlock detection 0x00000080 (bit 7) - DMA checking 0x00000200 (bit 9) - Force pending I/O requests 0x00000400 (bit 10) - IRP logging

For details, see Using Volatile Settings.

Option Description

/adddriver VolatileDriverList

Adds the specified drivers to the volatile settings. To specify multiple drivers, list their names, separated by spaces. Wildcard values, such as n.sys, are not supported. See Using Volatile Settings for details.

/removedriver VolatileDriverList

Removes the specified drivers from the volatile settings. To specify multiple drivers, list their names, separated by spaces. Wildcard values, such as n.sys, are not supported. See Using Volatile Settings for details.

/reset Clears all Driver Verifier settings. After the next boot, no drivers will be verified.

/querysettings Displays a summary of the options that will be activated and drivers that will be verified after the next boot. The display does not include drivers and options added by using the /volatile parameter. For other ways to view these settings, see Viewing Driver Verifier Settings.

/query Displays a summary of Driver Verifier's current activity. The Level field in the display is the hexadecimal value of options set with the /volatile parameter. See Monitoring Global Counters and Monitoring Individual Counters for explanations of each statistic.

/domain Types **** Options Controls the verifier extension settings. The following verifier extension types are supported.

Types Description

wdm

Enables verifier extension for WDM drivers.

ndis

Enables verifier extension for networking drivers.

ks

Enables verifier extension for kernel mode streaming drivers.

audio

Enables verifier extension for audio drivers.

The following extension options are supported.

Options Description

rules.default

Enables default validation rules for the selected verifier extension.

rules.all

Enables all validation rules for the selected verifier extension.

/logging Enables logging for violated rules detected by the selected verifier extensions.

/livedump Enables live memory dump collection for violated rules detected by the selected verifier extensions.

/? Displays command-line help.

For more information about the use of these commands, see Controlling Driver Verifier and Monitoring Driver Verifier.

/help Displays command-line help.

For more information about the use of these commands, see Controlling Driver Verifier and Monitoring Driver Verifier.

Return Codes

The following values are returned after driver verifier has run.

0: EXIT_CODE_SUCCESS

1: EXIT_CODE_ERROR

2: EXIT_CODE_REBOOT_NEEDED