| viewer9 documentation | Index Home |
CreateFileMapping PML Operation
In a CreateFileMapping event, SyncType is "SyncTypeCreateSection" when evdata[16]=1 (see PML Binary Data and Results Offsets) and that's when it also has PageProt and Address fields, otherwise its value is displayed as "SyncTypeOther".
PageProt is the PageProtection bit flags -- see Microsoft documentation for Memory Protection Constants -- and corresponds to the PageProtection field displayed in Procmon. Note that there seems to be a bug in the way Procmon displays PageProtection in 64-bit captures, see Procmon Bug: CreateFileMapping PageProtection. But the data in the PML file appears correct, so it should be shown correctly in viewer9.
Address is 32/64 bit depending on the bitness of the capture, i.e. it is 8 bytes when Cap64Bit=1, 4 bytes otherwise. This field is not displayed in Procmon.
Example from 64-bit PML
Hover over field values like Time, ResultCode, PageProt, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
CreateFileMapping opcode=3,19
ev=5317 advop=FASTIO_ACQUIRE_FOR_SECTION_SYNCHRONIZATION
| Time: | 2022-05-17 19:41:45.9243091 |
| Duration: | 0.0000036 |
| ResultCode: | FILE LOCKED WITH ONLY READERS |
| Tid: | 8732 |
| Path: | C:\Windows\System32\smartscreenps.dll |
| SyncType: | SyncTypeCreateSection |
| PageProt: | PAGE_EXECUTE |
| Address: | 0xffffeb0b891bf640 |
evdata[0-108] file offset 2317688
| 0 | 00 7f 00 00 89 e6 7a 91 | ......z. |
| 8 | 00 00 00 00 04 00 00 00 | ........ |
| 16 | 01 00 00 00 10 00 00 00 | ........ |
| 24 | 40 f6 1b 89 0b eb ff ff | @....... |
| 32 | 00 00 00 00 00 00 00 00 | ........ |
| 40 | 00 00 00 00 00 00 00 00 | ........ |
| 48 | 00 00 00 00 00 00 00 00 | ........ |
| 56 | 00 00 00 00 00 00 00 00 | ........ |
| 64 | 25 80 53 00 43 3a 5c 57 | %.S.C:\W |
| 72 | 69 6e 64 6f 77 73 5c 53 | indows\S |
| 80 | 79 73 74 65 6d 33 32 5c | ystem32\ |
| 88 | 73 6d 61 72 74 73 63 72 | smartscr |
| 96 | 65 65 6e 70 73 2e 64 6c | eenps.dl |
| 104 | 6c 44 00 5c 00 | lD.\. |
Call Stack stacksize=39
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0xfffff80434e8608c | 172 | FLTMGR.SYS + 0x608c | C:\WINDOWS\System32\drivers\FLTMGR.SYS |
| 0xfffff80434e82801 | 172 | FLTMGR.SYS + 0x2801 | C:\WINDOWS\System32\drivers\FLTMGR.SYS |
| 0xfffff80437c82147 | 174 | ntoskrnl.exe + 0x282147 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff80438031071 | 174 | ntoskrnl.exe + 0x631071 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff80438030cdb | 174 | ntoskrnl.exe + 0x630cdb | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff80438030bb7 | 174 | ntoskrnl.exe + 0x630bb7 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff804380308bd | 174 | ntoskrnl.exe + 0x6308bd | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff804380300a4 | 174 | ntoskrnl.exe + 0x6300a4 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8043802fe87 | 174 | ntoskrnl.exe + 0x62fe87 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff8043802fc6c | 174 | ntoskrnl.exe + 0x62fc6c | C:\WINDOWS\system32\ntoskrnl.exe |
| 0xfffff80437e077b5 | 174 | ntoskrnl.exe + 0x4077b5 | C:\WINDOWS\system32\ntoskrnl.exe |
| 0x7ffc927ed664 | 77 | ntdll.dll + 0x9d664 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc927afc1e | 77 | ntdll.dll + 0x5fc1e | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc927af9a0 | 77 | ntdll.dll + 0x5f9a0 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc927aec3f | 77 | ntdll.dll + 0x5ec3f | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc9276fb53 | 77 | ntdll.dll + 0x1fb53 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc927673e4 | 77 | ntdll.dll + 0x173e4 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc92766af4 | 77 | ntdll.dll + 0x16af4 | C:\WINDOWS\SYSTEM32\ntdll.dll |
| 0x7ffc9050a9d2 | 57 | KERNELBASE.dll + 0x2a9d2 | C:\WINDOWS\System32\KERNELBASE.dll |
| 0x7ffc91fcd435 | 72 | combase.dll + 0x7d435 | C:\WINDOWS\System32\combase.dll |
| 0x7ffc91fcd37e | 72 | combase.dll + 0x7d37e | C:\WINDOWS\System32\combase.dll |
| 0x7ffc91fcd150 | 72 | combase.dll + 0x7d150 | C:\WINDOWS\System32\combase.dll |
| 0x7ffc91f7bba9 | 72 | combase.dll + 0x2bba9 | C:\WINDOWS\System32\combase.dll |
| 0x7ffc91f7e0f5 | 72 | combase.dll + 0x2e0f5 | C:\WINDOWS\System32\combase.dll |
| 0x7ffc8e198ac0 | 39 | windows.storage.dll + 0x1a8ac0 | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc8e198a07 | 39 | windows.storage.dll + 0x1a8a07 | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc8e14d9a3 | 39 | windows.storage.dll + 0x15d9a3 | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc8e14ef00 | 39 | windows.storage.dll + 0x15ef00 | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc8e14c13d | 39 | windows.storage.dll + 0x15c13d | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc8e14c055 | 39 | windows.storage.dll + 0x15c055 | C:\WINDOWS\SYSTEM32\windows.storage.dll |
| 0x7ffc90e4dfda | 60 | SHELL32.dll + 0xcdfda | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc90e4e0ca | 60 | SHELL32.dll + 0xce0ca | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc90de478c | 60 | SHELL32.dll + 0x6478c | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc90de460d | 60 | SHELL32.dll + 0x6460d | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc90fdd705 | 60 | SHELL32.dll + 0x25d705 | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc91291ed9 | 60 | SHELL32.dll + 0x511ed9 | C:\WINDOWS\System32\SHELL32.dll |
| 0x7ffc917ae689 | 64 | shcore.dll + 0x2e689 | C:\WINDOWS\System32\shcore.dll |
| 0x7ffc91c17034 | 70 | KERNEL32.DLL + 0x17034 | C:\WINDOWS\System32\KERNEL32.DLL |
| 0x7ffc927a2651 | 77 | ntdll.dll + 0x52651 | C:\WINDOWS\SYSTEM32\ntdll.dll |
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.