viewer9 documentation

CreateFile PML Operation

Address is a memory address observed in the data that might reflect something about the way the API was called, and is displayed in hex. CreateOptions is bit flags. FileDispos is an enumerated code. FileAttributes is bit flags described in QueryInformationFile PML Operations. ShareMode is bit flags. AllocSize is a 64-bit integer. FileAccess is bit flags. Impers is the impersonated SID. OpenResult is in the evresults, and is an enumerated code.

Example from 64-bit PML

Hover over field values like Time, ResultCode, CreateOptions, FileDispos, FileAttributes, ShareMode, FileAccess, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

CreateFile opcode=3,20

ev=26 advop=IRP_MJ_CREATE modify=1

Time:2022-05-17 16:06:20.1750706
Duration:0.0001808
ResultCode:SUCCESS
Tid:3320
Path:C:\Windows\System32\LogFiles\WMI\RtBackup\EtwRTNT Kernel Logger.etl
Address:0xfffff880061d6588
CreateOptions:Synchronous IO Non-Alert
FileDispos:OverwriteIf
FileAttributes:N
ShareMode:Read, Delete
AllocSize:0
FileAccess:Write Data/Add File, Delete, Generic Read
Impers:None
OpenResult:Created

evdata[0-146] file offset 6210

000 00 61 00 72 00 61 00 ..a.r.a.
884 08 00 00 09 00 00 00 ........
1688 65 1d 06 80 f8 ff ff .e......
2420 00 00 05 00 00 00 00 .......
3280 00 05 00 00 00 00 00 ........
4000 00 00 00 00 00 00 00 ........
4800 00 00 00 00 00 00 00 ........
5600 00 00 00 00 00 00 00 ........
6443 80 30 00 43 3a 5c 57 C.0.C:\W
7269 6e 64 6f 77 73 5c 53 indows\S
8079 73 74 65 6d 33 32 5c ystem32\
884c 6f 67 46 69 6c 65 73 LogFiles
965c 57 4d 49 5c 52 74 42 \WMI\RtB
10461 63 6b 75 70 5c 45 74 ackup\Et
11277 52 54 4e 54 20 4b 65 wRTNT Ke
12072 6e 65 6c 20 4c 6f 67 rnel Log
12867 65 72 2e 65 74 6c 8b ger.etl.
13600 13 00 00 00 00 00 00 ........
144f8 ff ff ...

evresults[0-7] file offset 6359

002 00 00 00 00 00 00 00 ........

Call Stack stacksize=16

StackAddressmodModNameModPath
0xfffff880011730f7194fltmgr.sys + 0x20f7C:\Windows\system32\drivers\fltmgr.sys
0xfffff88001175a0a194fltmgr.sys + 0x4a0aC:\Windows\system32\drivers\fltmgr.sys
0xfffff880011912a3194fltmgr.sys + 0x202a3C:\Windows\system32\drivers\fltmgr.sys
0xfffff80002d36b12161ntoskrnl.exe + 0x4e8b12C:\Windows\system32\ntoskrnl.exe
0xfffff80002c5ac64161ntoskrnl.exe + 0x40cc64C:\Windows\system32\ntoskrnl.exe
0xfffff80002b48776161ntoskrnl.exe + 0x2fa776C:\Windows\system32\ntoskrnl.exe
0xfffff80002d04328161ntoskrnl.exe + 0x4b6328C:\Windows\system32\ntoskrnl.exe
0xfffff80002b96ee4161ntoskrnl.exe + 0x348ee4C:\Windows\system32\ntoskrnl.exe
0xfffff800028eff53161ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0xfffff800028e56c0161ntoskrnl.exe + 0x976c0C:\Windows\system32\ntoskrnl.exe
0xfffff80002b8ef3e161ntoskrnl.exe + 0x340f3eC:\Windows\system32\ntoskrnl.exe
0xfffff80002b8ed1f161ntoskrnl.exe + 0x340d1fC:\Windows\system32\ntoskrnl.exe
0xfffff80002bd9610161ntoskrnl.exe + 0x38b610C:\Windows\system32\ntoskrnl.exe
0xfffff80002b60103161ntoskrnl.exe + 0x312103C:\Windows\system32\ntoskrnl.exe
0xfffff80002b8d2e8161ntoskrnl.exe + 0x33f2e8C:\Windows\system32\ntoskrnl.exe
0xfffff800028e7ec6161ntoskrnl.exe + 0x99ec6C:\Windows\system32\ntoskrnl.exe

In some cases, viewer9 uses different field names than Procmon. The different Procmon field names are AllocationSize, Options, Desired Access, Attributes, Disposition, and Impersonating. There is no Address field in Procmon.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.