viewer9 documentation

LoadImage PML Operation

ImageBase is 32-bit or 64-bit depending on the bitness of the capture file, and is displayed in hex.

ImageSize is 32-bit, displayed in hex.

Note that the Time for this event will coincide with a ModLoadKey for this module in the module list in the process view. This is because the ModLoadKey is based on the LoadImage event for loads that occur during the course of the capture. For loads that happened before, there will be no captured LoadImage event and the exact load time is not known, and ModLoadKey is an arbitrary timestamp from before the process's first encounter in the capture.

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

LoadImage opcode=1,5

ev=3

Time:2022-05-17 20:43:17.3764716
Duration:0.0000000
ResultCode:SUCCESS
Tid:8
Path:C:\Windows\system32\ntoskrnl.exe
ImageBase:0xfffff80002803000
ImageSize:0x5dd000

evdata[0-49] file offset 1393

000 30 80 02 00 f8 ff ff .0......
800 d0 5d 00 20 80 00 00 ..]. ...
1643 3a 5c 57 69 6e 64 6f C:\Windo
2477 73 5c 73 79 73 74 65 ws\syste
326d 33 32 5c 6e 74 6f 73 m32\ntos
406b 72 6e 6c 2e 65 78 65 krnl.exe
4800 00 ..

Call Stack stacksize=8

StackAddressmodModNameModPath
0xfffff80002d8ac4849ntoskrnl.exe + 0x587c48C:\Windows\system32\ntoskrnl.exe
0xfffff80002d8ad9e49ntoskrnl.exe + 0x587d9eC:\Windows\system32\ntoskrnl.exe
0xfffff80002d8b73a49ntoskrnl.exe + 0x58873aC:\Windows\system32\ntoskrnl.exe
0xfffff80002d8c20f49ntoskrnl.exe + 0x58920fC:\Windows\system32\ntoskrnl.exe
0xfffff80002d8f46349ntoskrnl.exe + 0x58c463C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf25b949ntoskrnl.exe + 0x4ef5b9C:\Windows\system32\ntoskrnl.exe
0xfffff80002b422e849ntoskrnl.exe + 0x33f2e8C:\Windows\system32\ntoskrnl.exe
0xfffff8000289cec649ntoskrnl.exe + 0x99ec6C:\Windows\system32\ntoskrnl.exe

LoadImage is "Load Image" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: Image Base, Image Size.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.