| viewer9 documentation | Index Home |
CreateFile PML Operation
Address is a memory address observed in the data that might reflect something about the way the API was called, and is displayed in hex. CreateOptions is bit flags. FileDispos is an enumerated code. FileAttributes is bit flags described in QueryInformationFile PML Operations. ShareMode is bit flags. AllocSize is a 64-bit integer. FileAccess is bit flags. Impers is the impersonated SID. OpenResult is in the evresults, and is an enumerated code.
Example from 64-bit PML
Hover over field values like Time, ResultCode, CreateOptions, FileDispos, FileAttributes, ShareMode, FileAccess, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
CreateFile opcode=3,20
ev=26 advop=IRP_MJ_CREATE modify=1
| Time: | 2022-05-17 16:06:20.1750706 |
| Duration: | 0.0001808 |
| ResultCode: | SUCCESS |
| Tid: | 3320 |
| Path: | C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTNT Kernel Logger.etl |
| Address: | 0xfffff880061d6588 |
| CreateOptions: | Synchronous IO Non-Alert |
| FileDispos: | OverwriteIf |
| FileAttributes: | N |
| ShareMode: | Read, Delete |
| AllocSize: | 0 |
| FileAccess: | Write Data/Add File, Delete, Generic Read |
| Impers: | None |
| OpenResult: | Created |
evdata[0-146] file offset 6210
| 0 | 00 00 61 00 72 00 61 00 | ..a.r.a. |
| 8 | 84 08 00 00 09 00 00 00 | ........ |
| 16 | 88 65 1d 06 80 f8 ff ff | .e...... |
| 24 | 20 00 00 05 00 00 00 00 | ....... |
| 32 | 80 00 05 00 00 00 00 00 | ........ |
| 40 | 00 00 00 00 00 00 00 00 | ........ |
| 48 | 00 00 00 00 00 00 00 00 | ........ |
| 56 | 00 00 00 00 00 00 00 00 | ........ |
| 64 | 43 80 30 00 43 3a 5c 57 | C.0.C:\W |
| 72 | 69 6e 64 6f 77 73 5c 53 | indows\S |
| 80 | 79 73 74 65 6d 33 32 5c | ystem32\ |
| 88 | 4c 6f 67 46 69 6c 65 73 | LogFiles |
| 96 | 5c 57 4d 49 5c 52 74 42 | \WMI\RtB |
| 104 | 61 63 6b 75 70 5c 45 74 | ackup\Et |
| 112 | 77 52 54 4e 54 20 4b 65 | wRTNT Ke |
| 120 | 72 6e 65 6c 20 4c 6f 67 | rnel Log |
| 128 | 67 65 72 2e 65 74 6c 8b | ger.etl. |
| 136 | 00 13 00 00 00 00 00 00 | ........ |
| 144 | f8 ff ff | ... |
evresults[0-7] file offset 6359
| 0 | 02 00 00 00 00 00 00 00 | ........ |
Call Stack stacksize=16
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0xfffff880011730f7 | 194 | fltmgr.sys + 0x20f7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff88001175a0a | 194 | fltmgr.sys + 0x4a0a | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff880011912a3 | 194 | fltmgr.sys + 0x202a3 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff80002d36b12 | 161 | ntoskrnl.exe + 0x4e8b12 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002c5ac64 | 161 | ntoskrnl.exe + 0x40cc64 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b48776 | 161 | ntoskrnl.exe + 0x2fa776 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002d04328 | 161 | ntoskrnl.exe + 0x4b6328 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b96ee4 | 161 | ntoskrnl.exe + 0x348ee4 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800028eff53 | 161 | ntoskrnl.exe + 0xa1f53 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800028e56c0 | 161 | ntoskrnl.exe + 0x976c0 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b8ef3e | 161 | ntoskrnl.exe + 0x340f3e | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b8ed1f | 161 | ntoskrnl.exe + 0x340d1f | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002bd9610 | 161 | ntoskrnl.exe + 0x38b610 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b60103 | 161 | ntoskrnl.exe + 0x312103 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b8d2e8 | 161 | ntoskrnl.exe + 0x33f2e8 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800028e7ec6 | 161 | ntoskrnl.exe + 0x99ec6 | C:\Windows\system32\ntoskrnl.exe |
In some cases, viewer9 uses different field names than Procmon. The different Procmon field names are AllocationSize, Options, Desired Access, Attributes, Disposition, and Impersonating. There is no Address field in Procmon.
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.