| viewer9 documentation | Index Home |
PML Binary Data and Results Offsets
Each event has a fixed header containing the Time, Duration, ResultCode and Tid, and then the rest of the fields come from dynamic data and results sections. The results section only appears for certain operations when results are returned, and it actually occurs asynchronously in the PML file, i.e., not necessarily directly after the data section. In viewer9, the raw binary data of these sections is exposed in the evdata and evresults fields.
The event view shows these raw binary data fields.
Hovering the mouse over a byte in either section will show a tooltip interpreting 1 2 4 and 8 bytes at that location in hex (and decimal in parentheses). Hovering over the first byte of a colored stripe will also show the label or name of the corresponding field, here it is "Name":
Displaying the binary has led to the discovery of fields not displayed in Procmon such as CreatedTime in ProcessCreate, DesiredName in SetRenameInformationFile, LastWriteTime in RegEnumKey and RegQueryKey, Name for QueryKeyType Name in RegQueryKey which is likely a bug (see Procmon Bug: RegQueryKey QueryKeyType Name).
These sections can also be queried as evdata and evresults arrays, where the first byte of evdata is evdata[0] and the first byte of evresults is evresults[0]. For example, q evdata[4]=32 evdata[16]>0x5c evresults[24]=0x68, would show events where evata byte 4 (zero-based) was 32, evdata byte 16 was greater than 0x5c, and evresults byte 24 was 0x68. Queries do not yet support OR logic, only AND. Comparison values can be in decimal or hex. Hex is indicated with the 0x prefix.
The size of these sections can also be queried with evdatasize and evresultsize, e.g. q evresultsize!=0.
A search term without a comparison value means just display it. To just see the byte values in a query, don't specify comparison values. For example, to show the first 4 bytes of the evdata in every event, enter q evdata[0] evdata[1] evdata[2] evdata[3]:
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.