viewer9 documentation | Index Home |
LoadImage PML Operation
ImageBase is 32-bit or 64-bit depending on the bitness of the capture file, and is displayed in hex.
ImageSize is 32-bit, displayed in hex.
Note that the Time for this event will coincide with a ModLoadKey for this module in the module list in the process view. This is because the ModLoadKey is based on the LoadImage event for loads that occur during the course of the capture. For loads that happened before, there will be no captured LoadImage event and the exact load time is not known, and ModLoadKey is an arbitrary timestamp from before the process's first encounter in the capture.
Example from 64-bit PML
Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
LoadImage opcode=1,5
ev=3
Time: | 2022-05-17 20:43:17.3764716 |
Duration: | 0.0000000 |
ResultCode: | SUCCESS |
Tid: | 8 |
Path: | C:\Windows\system32\ntoskrnl.exe |
ImageBase: | 0xfffff80002803000 |
ImageSize: | 0x5dd000 |
evdata[0-49] file offset 1393
0 | 00 30 80 02 00 f8 ff ff | .0...... |
8 | 00 d0 5d 00 20 80 00 00 | ..]. ... |
16 | 43 3a 5c 57 69 6e 64 6f | C:\Windo |
24 | 77 73 5c 73 79 73 74 65 | ws\syste |
32 | 6d 33 32 5c 6e 74 6f 73 | m32\ntos |
40 | 6b 72 6e 6c 2e 65 78 65 | krnl.exe |
48 | 00 00 | .. |
Call Stack stacksize=8
StackAddress | mod | ModName | ModPath |
---|---|---|---|
0xfffff80002d8ac48 | 49 | ntoskrnl.exe + 0x587c48 | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002d8ad9e | 49 | ntoskrnl.exe + 0x587d9e | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002d8b73a | 49 | ntoskrnl.exe + 0x58873a | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002d8c20f | 49 | ntoskrnl.exe + 0x58920f | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002d8f463 | 49 | ntoskrnl.exe + 0x58c463 | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002cf25b9 | 49 | ntoskrnl.exe + 0x4ef5b9 | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002b422e8 | 49 | ntoskrnl.exe + 0x33f2e8 | C:\Windows\system32\ntoskrnl.exe |
0xfffff8000289cec6 | 49 | ntoskrnl.exe + 0x99ec6 | C:\Windows\system32\ntoskrnl.exe |
LoadImage is "Load Image" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: Image Base, Image Size.
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.