viewer9 documentation

QueryOpen PML Operation

Address (not displayed in Procmon) is a memory address observed in the data that might reflect something about the way the API was called and it is displayed in hex.

In evresults there are 4 timestamps (CreationTime, LastAccessTime, LastWriteTime, and ChangeTime), 2 64-bit integers (AllocSize and EndOfFile), and FileAttributes is bit flags as described in QueryInformationFile PML Operations. AllocSize is "AllocationSize" in Procmon.

Example from 64-bit PML

Hover over field values like Time, ResultCode, timestamps, FileAttributes, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

QueryOpen opcode=3,6

ev=34849 advop=FASTIO_NETWORK_QUERY_OPEN

Time:2022-05-17 20:43:22.5785616
Duration:0.0012853
ResultCode:SUCCESS
Tid:312
Path:C:\Windows\System32\autochk.exe
Address:0xfffffa8007962010
CreationTime:2014-05-21 11:45:21.2415235
LastAccessTime:2014-05-21 11:45:21.2415235
LastWriteTime:2010-11-20 04:24:28.0000000
ChangeTime:2014-05-21 12:35:01.1028516
AllocSize:778240
EndOfFile:777728
FileAttributes:A

evdata[0-102] file offset 10715572

000 f8 ff ff 1e b9 b1 02 ........
800 00 00 00 02 00 00 00 ........
1610 20 96 07 80 fa ff ff . ......
24e8 39 08 04 80 f8 ff ff .9......
3200 00 00 00 00 00 00 00 ........
4000 00 00 00 00 00 00 00 ........
4800 00 00 00 00 00 00 00 ........
5600 00 00 00 00 00 00 00 ........
641f 80 ff ff 43 3a 5c 57 ....C:\W
7269 6e 64 6f 77 73 5c 53 indows\S
8079 73 74 65 6d 33 32 5c ystem32\
8861 75 74 6f 63 68 6b 2e autochk.
9665 78 65 5c 00 52 00 exe\.R.

evresults[0-55] file offset 10715677

003 59 46 ac 0b 75 cf 01 .YF..u..
803 59 46 ac 0b 75 cf 01 .YF..u..
1600 ee c1 ba 94 88 cb 01 ........
2424 1a 69 9c 12 75 cf 01 $.i..u..
3200 e0 0b 00 00 00 00 00 ........
4000 de 0b 00 00 00 00 00 ........
4820 00 00 00 00 00 00 00 .......

Call Stack stacksize=19

StackAddressmodModNameModPath
0xfffff880011440f782fltmgr.sys + 0x20f7C:\Windows\system32\drivers\fltmgr.sys
0xfffff8800114688d82fltmgr.sys + 0x488dC:\Windows\system32\drivers\fltmgr.sys
0xfffff88001162a9f82fltmgr.sys + 0x20a9fC:\Windows\system32\drivers\fltmgr.sys
0xfffff80002ceb88849ntoskrnl.exe + 0x4e8888C:\Windows\system32\ntoskrnl.exe
0xfffff80002c0fc6449ntoskrnl.exe + 0x40cc64C:\Windows\system32\ntoskrnl.exe
0xfffff80002afd77649ntoskrnl.exe + 0x2fa776C:\Windows\system32\ntoskrnl.exe
0xfffff80002b0c60249ntoskrnl.exe + 0x309602C:\Windows\system32\ntoskrnl.exe
0xfffff800028a4f5349ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0x77089b7a4ntdll.dll + 0x69b7aC:\Windows\System32\ntdll.dll
0x7706146d4ntdll.dll + 0x4146dC:\Windows\System32\ntdll.dll
0x77062c7b4ntdll.dll + 0x42c7bC:\Windows\System32\ntdll.dll
0x770646514ntdll.dll + 0x44651C:\Windows\System32\ntdll.dll
0x48120d050smss.exe + 0x10d05C:\Windows\System32\smss.exe
0x4812135d0smss.exe + 0x1135dC:\Windows\System32\smss.exe
0x4811dfe50smss.exe + 0xdfe5C:\Windows\System32\smss.exe
0x4811da410smss.exe + 0xda41C:\Windows\System32\smss.exe
0x481253860smss.exe + 0x15386C:\Windows\System32\smss.exe
0x48127d690smss.exe + 0x17d69C:\Windows\System32\smss.exe
0x770737354ntdll.dll + 0x53735C:\Windows\System32\ntdll.dll

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.