viewer9 documentation

ProcessProfiling PML Operation

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

ProcessProfiling opcode=4,1

ev=15

Time:2022-05-17 19:41:45.3306235
Duration:0.0000000
ResultCode:SUCCESS
Tid:0
UserTime:0.0000000
KernelTime:1037700.1718750
WorkingSet:8192
PrivateBytes:61440

evdata[0-31] file offset 7354

000 00 00 00 00 00 00 00 ........
8de 53 80 15 70 09 00 00 .S..p...
1600 20 00 00 00 00 00 00 . ......
2400 f0 00 00 00 00 00 00 ........

ProcessProfiling is "Process Profiling" with a space in Procmon. And likewise, these corresponding detail field names have spaces in Procmon: User Time, Kernel Time, Private Bytes, Working Set.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.