viewer9 documentation

Directory PML Operation

These operations belong to opcode=3,32.

NotifyChangeDirectory

CompletionFilter ("Filter" in Procmon) is bit flags.

QueryDirectory

Filter is a string field which doesn't always exist. FileInfoClass ("FileInformationClass" in Procmon) is an enumerated code. Filenames is a list of strings (in the Procmon detail they appear as a numbered list rather than under a single label).

Example of QueryDirectory from 64-bit PML

Hover over field values like Time, ResultCode, FileInfoClass, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

QueryDirectory opcode=3,32

ev=35249 advop=IRP_MJ_DIRECTORY_CONTROL

Time:2022-05-17 16:06:22.5988778
Duration:0.0000132
ResultCode:SUCCESS
Tid:1040
Path:C:\Windows
Filter:Windows
FileInfoClass:FileBothDirectoryInformation
Filenames:Windows

evdata[0-90] file offset 20300850

001 00 00 00 4c b1 0b 3f ....L..?
800 08 26 00 01 00 00 00 ..&.....
1668 02 00 00 00 00 00 00 h.......
2470 ba b8 07 80 fa ff ff p.......
3203 00 00 00 00 00 00 00 ........
4000 00 00 00 00 00 00 00 ........
4870 e1 f3 10 00 00 00 00 p.......
5600 00 00 00 00 00 00 00 ........
6403 80 68 00 43 3a 5c 07 ..h.C:\.
7200 57 00 69 00 6e 00 64 .W.i.n.d
8000 6f 00 77 00 73 00 65 .o.w.s.e
8800 76 00 .v.

evresults[0-615] file offset 20300943

000 00 00 00 00 00 00 00 ........
87c c7 b0 fd 31 04 ca 01 ....1...
16ea d0 d9 4b 70 35 d6 01 ...Kp5..
24ea d0 d9 4b 70 35 d6 01 ...Kp5..
32ea d0 d9 4b 70 35 d6 01 ...Kp5..
4000 00 00 00 00 00 00 00 ........
4800 00 00 00 00 00 00 00 ........
5610 00 00 00 0e 00 00 00 ........
6400 00 00 00 00 00 00 00 ........
7200 00 00 00 00 00 00 00 ........
8000 00 00 00 00 00 00 00 ........
8800 00 00 00 00 00 57 00 ......W.
9669 00 6e 00 64 00 6f 00 i.n.d.o.
10477 00 73 00 00 00 00 00 w.s.....
11200 00 00 00 00 00 00 00 ........
omit 22 rows of zeros
29600 00 00 00 00 00 00 00 ........
30450 b3 92 1a 00 00 00 00 P.......
31200 00 00 00 00 00 00 00 ........
32000 00 00 00 00 00 00 00 ........
32800 00 00 00 00 00 00 00 ........
33600 00 00 00 00 00 00 00 ........
34460 86 96 00 00 00 00 00 `.......
35200 00 00 00 00 00 00 00 ........
36058 88 96 00 00 00 00 00 X.......
36800 8c 96 00 00 00 00 00 ........
37600 00 00 00 00 00 00 00 ........
omit 3 rows of zeros
40800 00 00 00 00 00 00 00 ........
41628 31 c2 77 00 00 00 00 (1.w....
42400 00 00 00 00 00 00 00 ........
43230 00 00 00 00 00 00 00 0.......
44000 00 96 00 00 00 00 00 ........
44822 00 00 00 00 00 00 00 ".......
45622 00 00 00 00 00 00 00 ".......
464a8 02 96 00 00 00 00 00 ........
47214 7b c4 77 00 00 00 00 ...w....
48000 00 00 00 6a 00 00 00 ....j...
48822 00 00 00 00 00 00 00 ".......
4962d 00 76 01 e7 84 4f be -.v...O.
50450 8a 96 00 00 00 00 00 P.......
51200 00 00 00 00 00 00 00 ........
52070 cb 98 00 00 00 00 00 p.......
52800 05 22 00 6a 00 00 00 ..".j...
53660 06 27 00 6a 00 00 00 `.'.j...
54404 01 00 00 00 00 00 00 ........
55260 06 27 00 6a 00 00 00 `.'.j...
56000 00 00 00 00 00 00 00 ........
56860 06 27 00 6a 00 00 00 `.'.j...
57680 6c 9d 00 00 00 00 00 .l......
58476 2f 7d fd fe 07 00 00 v/......
59200 98 96 00 00 00 00 00 ........
60000 00 00 00 00 00 00 00 ........
60800 00 00 00 00 00 00 00 ........

Call Stack stacksize=24

StackAddressmodModNameModPath
0xfffff880011730f7194fltmgr.sys + 0x20f7C:\Windows\system32\drivers\fltmgr.sys
0xfffff88001173fc7194fltmgr.sys + 0x2fc7C:\Windows\system32\drivers\fltmgr.sys
0xfffff880011726c7194fltmgr.sys + 0x16c7C:\Windows\system32\drivers\fltmgr.sys
0xfffff80002b54c5a161ntoskrnl.exe + 0x306c5aC:\Windows\system32\ntoskrnl.exe
0xfffff800028eff53161ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0x77c89afa2ntdll.dll + 0x69afaC:\Windows\SYSTEM32\ntdll.dll
0x7fefd7efc5b43KERNELBASE.dll + 0x1fc5bC:\Windows\system32\KERNELBASE.dll
0x7fefd7d717c43KERNELBASE.dll + 0x717cC:\Windows\system32\KERNELBASE.dll
0x77a1ae840kernel32.dll + 0x1ae84C:\Windows\system32\kernel32.dll
0x13ff5e826681chrome.exe + 0x2e826C:\Program Files\Google\Chrome\Application\chrome.exe
0x13ff6c83c681chrome.exe + 0x3c83cC:\Program Files\Google\Chrome\Application\chrome.exe
0x13ff6c297681chrome.exe + 0x3c297C:\Program Files\Google\Chrome\Application\chrome.exe
0x7fee7dcc75a683chrome.dll + 0x26ac75aC:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee688a3aa683chrome.dll + 0x116a3aaC:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee688a05c683chrome.dll + 0x116a05cC:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee788e576683chrome.dll + 0x216e576C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee8bd8f60683chrome.dll + 0x34b8f60C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee5a7b955683chrome.dll + 0x35b955C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee936f18b683chrome.dll + 0x3c4f18bC:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee936dce0683chrome.dll + 0x3c4dce0C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee5a7c388683chrome.dll + 0x35c388C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x7fee60739d1683chrome.dll + 0x9539d1C:\Program Files\Google\Chrome\Application\101.0.4951.67\chrome.dll
0x77a1556d0kernel32.dll + 0x1556dC:\Windows\system32\kernel32.dll
0x77c7372d2ntdll.dll + 0x5372dC:\Windows\SYSTEM32\ntdll.dll

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.