viewer9 documentation

CreateFileMapping PML Operation

In a CreateFileMapping event, SyncType is "SyncTypeCreateSection" when evdata[16]=1 (see PML Binary Data and Results Offsets) and that's when it also has PageProt and Address fields, otherwise its value is displayed as "SyncTypeOther".

PageProt is the PageProtection bit flags -- see Microsoft documentation for Memory Protection Constants -- and corresponds to the PageProtection field displayed in Procmon. Note that there seems to be a bug in the way Procmon displays PageProtection in 64-bit captures, see Procmon Bug: CreateFileMapping PageProtection. But the data in the PML file appears correct, so it should be shown correctly in viewer9.

Address is 32/64 bit depending on the bitness of the capture, i.e. it is 8 bytes when Cap64Bit=1, 4 bytes otherwise. This field is not displayed in Procmon.

Example from 64-bit PML

Hover over field values like Time, ResultCode, PageProt, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

CreateFileMapping opcode=3,19

ev=5317 advop=FASTIO_ACQUIRE_FOR_SECTION_SYNCHRONIZATION

Time:2022-05-17 19:41:45.9243091
Duration:0.0000036
ResultCode:FILE LOCKED WITH ONLY READERS
Tid:8732
Path:C:\Windows\System32\smartscreenps.dll
SyncType:SyncTypeCreateSection
PageProt:PAGE_EXECUTE
Address:0xffffeb0b891bf640

evdata[0-108] file offset 2317688

000 7f 00 00 89 e6 7a 91 ......z.
800 00 00 00 04 00 00 00 ........
1601 00 00 00 10 00 00 00 ........
2440 f6 1b 89 0b eb ff ff @.......
3200 00 00 00 00 00 00 00 ........
4000 00 00 00 00 00 00 00 ........
4800 00 00 00 00 00 00 00 ........
5600 00 00 00 00 00 00 00 ........
6425 80 53 00 43 3a 5c 57 %.S.C:\W
7269 6e 64 6f 77 73 5c 53 indows\S
8079 73 74 65 6d 33 32 5c ystem32\
8873 6d 61 72 74 73 63 72 smartscr
9665 65 6e 70 73 2e 64 6c eenps.dl
1046c 44 00 5c 00 lD.\.

Call Stack stacksize=39

StackAddressmodModNameModPath
0xfffff80434e8608c172FLTMGR.SYS + 0x608cC:\WINDOWS\System32\drivers\FLTMGR.SYS
0xfffff80434e82801172FLTMGR.SYS + 0x2801C:\WINDOWS\System32\drivers\FLTMGR.SYS
0xfffff80437c82147174ntoskrnl.exe + 0x282147C:\WINDOWS\system32\ntoskrnl.exe
0xfffff80438031071174ntoskrnl.exe + 0x631071C:\WINDOWS\system32\ntoskrnl.exe
0xfffff80438030cdb174ntoskrnl.exe + 0x630cdbC:\WINDOWS\system32\ntoskrnl.exe
0xfffff80438030bb7174ntoskrnl.exe + 0x630bb7C:\WINDOWS\system32\ntoskrnl.exe
0xfffff804380308bd174ntoskrnl.exe + 0x6308bdC:\WINDOWS\system32\ntoskrnl.exe
0xfffff804380300a4174ntoskrnl.exe + 0x6300a4C:\WINDOWS\system32\ntoskrnl.exe
0xfffff8043802fe87174ntoskrnl.exe + 0x62fe87C:\WINDOWS\system32\ntoskrnl.exe
0xfffff8043802fc6c174ntoskrnl.exe + 0x62fc6cC:\WINDOWS\system32\ntoskrnl.exe
0xfffff80437e077b5174ntoskrnl.exe + 0x4077b5C:\WINDOWS\system32\ntoskrnl.exe
0x7ffc927ed66477ntdll.dll + 0x9d664C:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc927afc1e77ntdll.dll + 0x5fc1eC:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc927af9a077ntdll.dll + 0x5f9a0C:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc927aec3f77ntdll.dll + 0x5ec3fC:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc9276fb5377ntdll.dll + 0x1fb53C:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc927673e477ntdll.dll + 0x173e4C:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc92766af477ntdll.dll + 0x16af4C:\WINDOWS\SYSTEM32\ntdll.dll
0x7ffc9050a9d257KERNELBASE.dll + 0x2a9d2C:\WINDOWS\System32\KERNELBASE.dll
0x7ffc91fcd43572combase.dll + 0x7d435C:\WINDOWS\System32\combase.dll
0x7ffc91fcd37e72combase.dll + 0x7d37eC:\WINDOWS\System32\combase.dll
0x7ffc91fcd15072combase.dll + 0x7d150C:\WINDOWS\System32\combase.dll
0x7ffc91f7bba972combase.dll + 0x2bba9C:\WINDOWS\System32\combase.dll
0x7ffc91f7e0f572combase.dll + 0x2e0f5C:\WINDOWS\System32\combase.dll
0x7ffc8e198ac039windows.storage.dll + 0x1a8ac0C:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc8e198a0739windows.storage.dll + 0x1a8a07C:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc8e14d9a339windows.storage.dll + 0x15d9a3C:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc8e14ef0039windows.storage.dll + 0x15ef00C:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc8e14c13d39windows.storage.dll + 0x15c13dC:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc8e14c05539windows.storage.dll + 0x15c055C:\WINDOWS\SYSTEM32\windows.storage.dll
0x7ffc90e4dfda60SHELL32.dll + 0xcdfdaC:\WINDOWS\System32\SHELL32.dll
0x7ffc90e4e0ca60SHELL32.dll + 0xce0caC:\WINDOWS\System32\SHELL32.dll
0x7ffc90de478c60SHELL32.dll + 0x6478cC:\WINDOWS\System32\SHELL32.dll
0x7ffc90de460d60SHELL32.dll + 0x6460dC:\WINDOWS\System32\SHELL32.dll
0x7ffc90fdd70560SHELL32.dll + 0x25d705C:\WINDOWS\System32\SHELL32.dll
0x7ffc91291ed960SHELL32.dll + 0x511ed9C:\WINDOWS\System32\SHELL32.dll
0x7ffc917ae68964shcore.dll + 0x2e689C:\WINDOWS\System32\shcore.dll
0x7ffc91c1703470KERNEL32.DLL + 0x17034C:\WINDOWS\System32\KERNEL32.DLL
0x7ffc927a265177ntdll.dll + 0x52651C:\WINDOWS\SYSTEM32\ntdll.dll

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.