viewer9 documentation

Device PNP PML Operations

These operations belong to opcode=3,47. evdata[0] corresponds to the PnP IRP minor function code (see PML Binary Data and Results Offsets).

DeviceUsageNotification

Corresponds to IRP_MN_DEVICE_USAGE_NOTIFICATION 0x16.

QueryDeviceRelations

Corresponds to IRP_MN_QUERY_DEVICE_RELATIONS 0x07.

Example of QueryDeviceRelations from 32-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata (like evdata[0] mentioned above) in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

QueryDeviceRelations opcode=3,47

ev=6330 advop=IRP_MJ_PNP

Time:2022-05-19 23:22:14.6848668
Duration:0.0000202
ResultCode:SUCCESS
Tid:36
Path:C:\$Mft

evdata[0-58] file offset 1452717

007 ff ff ff ff ff ff ff ........
800 00 00 00 01 00 00 00 ........
1604 00 00 00 00 00 00 00 ........
2400 00 00 00 00 00 00 00 ........
3200 00 00 00 00 00 00 00 ........
4000 00 00 00 07 80 ff ff ........
4843 3a 5c 24 4d 66 74 ff C:\$Mft.
56ff ff ff ...

Call Stack stacksize=13

StackAddressmodModNameModPath
0x8ac86df7159fltmgr.sys + 0x2df7C:\Windows\system32\drivers\fltmgr.sys
0x8ac89d38159fltmgr.sys + 0x5d38C:\Windows\system32\drivers\fltmgr.sys
0x8ac8a251159fltmgr.sys + 0x6251C:\Windows\system32\drivers\fltmgr.sys
0x8ac8a710159fltmgr.sys + 0x6710C:\Windows\system32\drivers\fltmgr.sys
0x82886f87128ntkrnlpa.exe + 0x39f87C:\Windows\system32\ntkrnlpa.exe
0x82a325b8128ntkrnlpa.exe + 0x1e55b8C:\Windows\system32\ntkrnlpa.exe
0x8286a2b2128ntkrnlpa.exe + 0x1d2b2C:\Windows\system32\ntkrnlpa.exe
0x829f387a128ntkrnlpa.exe + 0x1a687aC:\Windows\system32\ntkrnlpa.exe
0x829f375d128ntkrnlpa.exe + 0x1a675dC:\Windows\system32\ntkrnlpa.exe
0x8aeacc75166Ntfs.sys + 0xa2c75C:\Windows\System32\Drivers\Ntfs.sys
0x8ae223dc166Ntfs.sys + 0x183dcC:\Windows\System32\Drivers\Ntfs.sys
0x828b7b4b128ntkrnlpa.exe + 0x6ab4bC:\Windows\system32\ntkrnlpa.exe
0x82a62b38128ntkrnlpa.exe + 0x215b38C:\Windows\system32\ntkrnlpa.exe

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.