Windows System Software -- Consulting, Training, Development -- Unique Expertise, Guaranteed Results


More Info on Driver Writing and Debugging

The free OSR Learning Library has more than 50 articles on a wide variety of topics about writing and debugging device drivers and Minifilters. From introductory level to advanced. All the articles have been recently reviewed and updated, and are written using the clear and definitive style you've come to expect from OSR over the years.

Check out The OSR Learning Library at:

Before Posting...

Please check out the Community Guidelines in the Announcements and Administration Category.

Surprise Removal and User mode driver crash

umeshkumar10umeshkumar10 Member Posts: 3


We have developed a WBF driver for fingerprint. Occasionally we are observing below issue.
Details are from event viewer
1. Surprise removal
USB device draining system power when system is idle.
Removal action failed: SkippedAsPersistentIoObserved
Source : USB-USBHUB3
Task category: Surprise Removal

then crash event
2. A problem has occurred with one or more user-mode drivers and the hosting process has been terminated. This may temporarily interrupt your ability to access the devices.
Task category: User-mode Driver problems.

Not able to capture details in the driver logs.
How to find the root cause ? What could be possible issue.
Please help.



  • craig_howardcraig_howard Member Posts: 196

    There are quite a few reasons for a surprise removal event, all of which are outside of your control. I would first see if you can get a surprise removal notification from the PnP stack (UMDF v2 drivers can) and also firewall your driver to be able to handle resources that go away (try/ catch, device interface notifications, etc.) ... is the crash happening in your WBF driver, or somewhere else in the stack?

  • umeshkumar10umeshkumar10 Member Posts: 3

    How I can check whether crash happened in the WBF driver?

  • gordon_lewisgordon_lewis Member Posts: 9

    Attach a kernel mode debugger through windbg.exe and an external cable such as USB, Ethernet or a similar connection.

    With the kernel mode debugger attached, see what the result is from !analyze -v

    Since this is a UMDF driver, you probably also want to add calls to DebugBreak and maybe even WPP tracing or calls to OutputDebugString in the driver through the calls to Surprise Removal and possibly other PNP callbacks. In this call:

    You can implement a callback to SurpriseRemoval through setting the member EvtDeviceSurpriseRemoval in the structure PnpPowerEventCallbacks.

Sign In or Register to comment.

Howdy, Stranger!

It looks like you're new here. Sign in or register to get started.

Upcoming OSR Seminars
OSR has suspended in-person seminars due to the Covid-19 outbreak. But, don't miss your training! Attend via the internet instead!
Internals & Software Drivers 15 November 2021 Live, Online
Writing WDF Drivers 24 January 2022 Live, Online
Developing Minifilters 7 February 2022 Live, Online
Kernel Debugging 21 March 2022 Live, Online