QueryInformationFile PML Operations

All of these operations belong to opcode=3,25 and correspond to the different FileInformationClass values in the Microsoft documentation for NtQueryInformationFile.

Although Procmon does not show it, the FileInformationClass is in the PML data at evdata[0] (see PML Binary Data and Results Offsets) and is provided by viewer9 in the FileInfoClass field. Not all of these operations have their evresults parsed into fields in viewer9, so for rare ones you can look up the evresults structure in the Microsoft documentation for NtQueryInformationFile (see how to do this in QueryCaseSensitiveInformation and QueryCompressionInformationFile below).

In addition to FileInfoClass, a 32-bit BufferSize and hex Buffer address (neither shown in Procmon) are extracted from the data to give insights into the way the underlying API was called.

To find QueryInformationFile PML operations not explicitly named with Op in viewer9, query opcode=3,25 FileInfoClass=FileXYZInformation.

QueryAllInformationFile

FileInfoClass is FileAllInformation. This operation is named "All" because it returns a lot of the same fields as the other QueryInformationFile operations, so field descriptions will not be duplicated here. An example of a QueryAllInformationFile event is after the descriptions of the other operations below.

QueryAttributeTagFile

FileInfoClass is FileAttributeTagInformation.

FileAttributes is mostly enumerated in short-form, for example A instead of FILE_ATTRIBUTE_ARCHIVE:

0x1, "R", // FILE_ATTRIBUTE_READONLY 0x2, "H", // FILE_ATTRIBUTE_HIDDEN 0x4, "S", // FILE_ATTRIBUTE_SYSTEM 0x10, "D", // FILE_ATTRIBUTE_DIRECTORY 0x20, "A", // FILE_ATTRIBUTE_ARCHIVE 0x40, "FILE_ATTRIBUTE_DEVICE", // no short-form 0x80, "N", // FILE_ATTRIBUTE_NORMAL 0x100, "T", // FILE_ATTRIBUTE_TEMPORARY 0x200, "SF", // FILE_ATTRIBUTE_SPARSE_FILE 0x400, "RP", // FILE_ATTRIBUTE_REPARSE_POINT 0x800, "C", // FILE_ATTRIBUTE_COMPRESSED 0x1000, "O", // FILE_ATTRIBUTE_OFFLINE 0x2000, "NCI", // FILE_ATTRIBUTE_NOT_CONTENT_INDEXED 0x4000, "E", // FILE_ATTRIBUTE_ENCRYPTED 0x8000, "IS", // FILE_ATTRIBUTE_INTEGRITY_STREAM

ReparseTag is a 32-bit integer displayed in hex.

QueryBasicInformationFile

FileInfoClass is FileBasicInformation. FileAttributes is described above, and there are 4 timestamps: CreationTime, LastAccessTime, LastWriteTime, ChangeTime.

QueryCaseSensitiveInformation

FileInfoClass is FileCaseSensitiveInformation.

This is an example of an operation not completely implemented in viewer9, so here is a description of how to examine this event data further (and illustrate the process for any QueryInformationFile operation):

Searching on "NtQueryInformationFile FileCaseSensitiveInformation" brings you to the FILE_CASE_SENSITIVE_INFORMATION struct, which is the structure of evresultsfor this operation in the PML file. It only has one member, a 32-bit (4-byte) ULONG integer Flags. A bit of deduction suggests Flags can be 0 or 1 if it is a case-sensitive directory.

Since it is only 1 or 0, it can be accessed with just the first byte of evresults, i.e. evresults[0]. For example, it can be queried with Op=QueryCaseSensitiveInformation evresults[0].

QueryCompressionInformationFile

FileInfoClass is FileCompressionInformation.

This is another example of an operation not completely implemented/parsed in viewer9. Searching on "NtQueryInformationFile FileCompressionInformation" brings you to the FILE_COMPRESSION_INFORMATION struct for the evresults section. Hovering the mouse over the evresults in the event view will give you:

evresults[0] CompressedFileSize (8 bytes) evresults[8] CompressionFormat (2 bytes) evresults[10] CompressionUnitShift (1 byte) evresults[11] ChunkShift (1 byte) evresults[12] ClusterShift (1 byte)

QueryEaInformationFile

FileInfoClass is FileEaInformation. EaSize is a 32-bit integer.

QueryFileInternalInformationFile

FileInfoClass is FileInternalInformation. IndexNumber is a 64-bit number.

QueryIdInformation

FileInfoClass is FileIdInformation.

QueryNameInformationFile

FileInfoClass is FileNameInformation.

QueryNetworkOpenInformationFile

FileInfoClass is FileNetworkOpenInformation. FileAttributes is described above, AllocSize and EndOfFile are 64-bit, and there are 4 timestamps: CreationTime LastAccessTime LastWriteTime ChangeTime.

QueryNetworkPhysicalNameInformationFile

FileInfoClass is FileNetworkPhysicalNameInformation.

QueryNormalizedNameInformationFile

FileInfoClass is FileNormalizedNameInformation.

QueryPositionInformationFile

FileInfoClass is FilePositionInformation. Position is a 64-bit integer.

QueryRemoteProtocolInformation

FileInfoClass is FileRemoteProtocolInformation.

QueryStandardInformationFile

FileInfoClass is FileStandardInformation. AllocSize and EndOfFile are 64-bit, NumberOfLinks is 32-bit, DelPending and Directory are 1-byte flags.

QueryStandardLinkInformation

FileInfoClass is FileStandardLinkInformation.

QueryStatInformation

FileInfoClass is FileStatInformation.

QueryStreamInformationFile

FileInfoClass is FileStreamInformation. This operation is for Alternate Data Streams (ADS). The fields are 64-bit StreamSize (not displayed in Procmon), 64-bit AllocSize, and Streams, which is a list of the stream filenames (shown as a numbered list in the Procmon detail, rather than under a single label). Note that sometimes Procmon does not display the last stream, but viewer9 does (see Procmon Bug: QueryStreamInformationFile Alternate Data Stream).

Example of QueryAllInformationFile from 64-bit PML

Hover over field values like Time, ResultCode, timestamps, FileAttributes, FileAccess, AccessMode, AlignReq, Length, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

Advanced names

These events can also be queried with advop which varies based on d[12]. For d[12]=0x02 it is FASTIO_QUERY_INFORMATION, and for d[12]=0x09 it is either IRP_MJ_QUERY_INFORMATION or IRP_MN_QUERY_INFORMATION.

In some cases, viewer9 uses different field names than Procmon. In addition to those already mentioned in this article, other different Procmon field names are Access, AlignmentRequirement, AllocationSize, and Mode. There are no Length or Name fields in Procmon.

See also

• PML Binary Data and Results Offsets
• Procmon Bug: QueryStreamInformationFile Alternate Data Stream
• PML Operations
• SetInformationFile PML Operations
• QueryInformationVolume PML Operations