viewer9 documentation

PML Operations

PML event classes

PML events fall into 5 classes. Events can be queried by class, e.g. q class=Registry.

1 Process
2 Registry
3 File aka File System
4 Profiling
5 Network

Op vs opcode

Op ("Operation" in Procmon) is the field that has the operation name of an event. For example, to query ReadFile events enter q Op=ReadFile. Op values never have a space even though the corresponding names in Procmon sometimes have a space, e.g. ProcessCreate is "Process Create" in Procmon.

Rare types of events may not have an Op implemented in viewer9 but they will always have an opcode. The opcode field has the form "c,o" where c is the class number 1-5 (described above) and o is an operation number within that class. For example, opcode=1,1 is ProcessCreate and opcode=1,2 is ProcessExit, etc. This is the internal way the PML format identifies operations but it is not 1-to-1 with the Op, often many Op variations occur for one opcode like with the QueryInformationFile PML Operations.

advop

In Procmon, enabling "Advanced Output" mode shows "advanced" operation names where available instead of the normal operation names. In viewer9 there is no mode, but advanced names are provided in the advop field.

List of PML operations

Posted 4 Jul 2022 last updated 22 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.