Microsoft-Windows-Kernel-XDV

Event	Title	Channel	Sample	Rule
1	XDV driver loaded!	System	N	N
2	XDV driver unloaded!	Analytic	N	N
3	Driver Event: entry function/DDI calls	Analytic	N	N
4	A Driver Verifier rule violation has been detected by VerifierExt.	System	N	N

Event ID 1: XDV driver loaded!

Channel: System
Opcode: Start

Event ID 2: XDV driver unloaded!

Channel: Analytic
Opcode: Stop

Event ID 3: Driver Event: entry function/DDI calls

Channel: Analytic
Opcode: Start

Fields #

Name	Description
`IRP_Address` Pointer
`IRP_Stack_Loc_Code` UInt32
`IRP_Parameters` UInt32
`Module` UnicodeString
`UInt32_Event_Number` UInt32
`Address_Stack` Pointer

Event ID 4: A Driver Verifier rule violation has been detected by VerifierExt.

Channel: System
Opcode: Start

Fields #

Name	Description
`RuleId` HexInt32
`ErrorMessage` AnsiString
`Module` UnicodeString
`Irql` UInt8
`ErrorLevel` HexInt32

Provenance

ETW provider GUID f029ac39-38f0-4a40-b7de-404d244004cb

Defined in VerifierExt.sys, the binary that emits these events.

WS2022-20348.4893, schema read from the registered manifest, binary version 10.0.20348.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 10.0.26100.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB