viewer9 documentation

LoadImage PML Operation

ImageBase is 32-bit or 64-bit depending on the bitness of the capture file, and is displayed in hex.

ImageSize is 32-bit, displayed in hex.

Note that the Time for this event will coincide with a ModLoadKey for this module in the module list in the process view. This is because the ModLoadKey is based on the LoadImage event for loads that occur during the course of the capture. For loads that happened before, there will be no captured LoadImage event and the exact load time is not known, and ModLoadKey is an arbitrary timestamp from before the process's first encounter in the capture.

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

LoadImage opcode=1,5

ev=3

Time:	2022-05-17 20:43:17.3764716
Duration:	0.0000000
ResultCode:	SUCCESS
Tid:	8

Path:	C:\Windows\system32\ntoskrnl.exe
ImageBase:	0xfffff80002803000
ImageSize:	0x5dd000

evdata[0-49] file offset 1393

0	00 30 80 02 00 f8 ff ff	.0......
8	00 d0 5d 00 20 80 00 00	..]. ...
16	43 3a 5c 57 69 6e 64 6f	C:\Windo
24	77 73 5c 73 79 73 74 65	ws\syste
32	6d 33 32 5c 6e 74 6f 73	m32\ntos
40	6b 72 6e 6c 2e 65 78 65	krnl.exe
48	00 00	..

Call Stack stacksize=8

StackAddress	mod	ModName	ModPath
0xfffff80002d8ac48	49	ntoskrnl.exe + 0x587c48	C:\Windows\system32\ntoskrnl.exe
0xfffff80002d8ad9e	49	ntoskrnl.exe + 0x587d9e	C:\Windows\system32\ntoskrnl.exe
0xfffff80002d8b73a	49	ntoskrnl.exe + 0x58873a	C:\Windows\system32\ntoskrnl.exe
0xfffff80002d8c20f	49	ntoskrnl.exe + 0x58920f	C:\Windows\system32\ntoskrnl.exe
0xfffff80002d8f463	49	ntoskrnl.exe + 0x58c463	C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf25b9	49	ntoskrnl.exe + 0x4ef5b9	C:\Windows\system32\ntoskrnl.exe
0xfffff80002b422e8	49	ntoskrnl.exe + 0x33f2e8	C:\Windows\system32\ntoskrnl.exe
0xfffff8000289cec6	49	ntoskrnl.exe + 0x99ec6	C:\Windows\system32\ntoskrnl.exe

LoadImage is "Load Image" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: Image Base, Image Size.