viewer9 documentation

RegEnumKey PML Operation

BufferSize is a 32-bit integer ("Length" in Procmon, though it is not shown on SUCCESS). Index (0-based) is a 32-bit integer. On SUCCESS, evresults contains the Name of the enumerated subkey and the timestamp LastWriteTime (not shown in Procmon).

Example from 64-bit PML

Hover over field values like Time, ResultCode, LastWriteTime, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegEnumKey opcode=2,7

ev=221 regread=76 B

Time:	2012-03-06 11:36:31.3321245
Duration:	0.0000061
ResultCode:	SUCCESS
Tid:	4336

Path:	HKLM\SOFTWARE\Microsoft\CTF\TIP
BufferSize:	288
Index:	6

LastWriteTime:	2006-11-02 10:31:08.2820755
Name:	{81D4E9C9-1D3B-41BC-9E6C-4B40BF79E35E}

evdata[0-46] file offset 94734

0	1f 80 5c 00 20 01 00 00	..\. ...
8	06 00 00 00 00 00 00 00	........
16	48 4b 4c 4d 5c 53 4f 46	HKLM\SOF
24	54 57 41 52 45 5c 4d 69	TWARE\Mi
32	63 72 6f 73 6f 66 74 5c	crosoft\
40	43 54 46 5c 54 49 50	CTF\TIP

evresults[0-91] file offset 94783

0	93 50 fe ea 93 fe c6 01	.P......
8	00 00 00 00 4c 00 00 00	....L...
16	7b 00 38 00 31 00 44 00	..8.1.D.
24	34 00 45 00 39 00 43 00	4.E.9.C.
32	39 00 2d 00 31 00 44 00	9.-.1.D.
40	33 00 42 00 2d 00 34 00	3.B.-.4.
48	31 00 42 00 43 00 2d 00	1.B.C.-.
56	39 00 45 00 36 00 43 00	9.E.6.C.
64	2d 00 34 00 42 00 34 00	-.4.B.4.
72	30 00 42 00 46 00 37 00	0.B.F.7.
80	39 00 45 00 33 00 35 00	9.E.3.5.
88	45 00 7d 00	E...

Call Stack stacksize=80

StackAddress	mod	ModName	ModPath
0xfffff80001d9119d	1	ntoskrnl.exe + 0x38819d	C:\Windows\system32\ntoskrnl.exe
0xfffff80001d39131	1	ntoskrnl.exe + 0x330131	C:\Windows\system32\ntoskrnl.exe
0xfffff80001a62f33	1	ntoskrnl.exe + 0x59f33	C:\Windows\system32\ntoskrnl.exe
0x77cb6eba	0	ntdll.dll + 0x46eba	C:\Windows\System32\ntdll.dll
0x758877f6	266	wow64.dll + 0x277f6	C:\Windows\System32\wow64.dll
0x7587244c	266	wow64.dll + 0x1244c	C:\Windows\System32\wow64.dll
0x7586a996	266	wow64.dll + 0xa996	C:\Windows\System32\wow64.dll
0x758c3688	267	wow64cpu.dll + 0x3688	C:\Windows\System32\wow64cpu.dll
0x7586ab46	266	wow64.dll + 0xab46	C:\Windows\System32\wow64.dll
0x7586621a	266	wow64.dll + 0x621a	C:\Windows\System32\wow64.dll
0x7562aa32	260	wow64win.dll + 0x1aa32	C:\Windows\System32\wow64win.dll
0x77cb6ac6	0	ntdll.dll + 0x46ac6	C:\Windows\System32\ntdll.dll
0xfffff80001cdcb7d	1	ntoskrnl.exe + 0x2d3b7d	C:\Windows\system32\ntoskrnl.exe
0xfffff960001365bc	3	win32k.sys + 0xc65bc	C:\Windows\System32\win32k.sys
0xfffff96000135db6	3	win32k.sys + 0xc5db6	C:\Windows\System32\win32k.sys
0xfffff960001325e3	3	win32k.sys + 0xc25e3	C:\Windows\System32\win32k.sys
0xfffff960001a3c03	3	win32k.sys + 0x133c03	C:\Windows\System32\win32k.sys
0xfffff9600010ec74	3	win32k.sys + 0x9ec74	C:\Windows\System32\win32k.sys
0xfffff96000100240	3	win32k.sys + 0x90240	C:\Windows\System32\win32k.sys
0xfffff9600009be86	3	win32k.sys + 0x2be86	C:\Windows\System32\win32k.sys
0xfffff960000adae5	3	win32k.sys + 0x3dae5	C:\Windows\System32\win32k.sys
0xfffff96000112071	3	win32k.sys + 0xa2071	C:\Windows\System32\win32k.sys
0xfffff96000103b8a	3	win32k.sys + 0x93b8a	C:\Windows\System32\win32k.sys
0xfffff96000100972	3	win32k.sys + 0x90972	C:\Windows\System32\win32k.sys
0xfffff96000103ae9	3	win32k.sys + 0x93ae9	C:\Windows\System32\win32k.sys
0xfffff9600014a04b	3	win32k.sys + 0xda04b	C:\Windows\System32\win32k.sys
0xfffff80001a62f33	1	ntoskrnl.exe + 0x59f33	C:\Windows\system32\ntoskrnl.exe
0x7564a29a	260	wow64win.dll + 0x3a29a	C:\Windows\System32\wow64win.dll
0x75633e96	260	wow64win.dll + 0x23e96	C:\Windows\System32\wow64win.dll
0x7586a996	266	wow64.dll + 0xa996	C:\Windows\System32\wow64.dll
0x758c3688	267	wow64cpu.dll + 0x3688	C:\Windows\System32\wow64cpu.dll
0x7586ab46	266	wow64.dll + 0xab46	C:\Windows\System32\wow64.dll
0x7586a14c	266	wow64.dll + 0xa14c	C:\Windows\System32\wow64.dll
0x77cab913	0	ntdll.dll + 0x3b913	C:\Windows\System32\ntdll.dll
0x77cab59c	0	ntdll.dll + 0x3b59c	C:\Windows\System32\ntdll.dll
0x77c963be	0	ntdll.dll + 0x263be	C:\Windows\System32\ntdll.dll
0x75a67ff4	271	advapi32.dll + 0x47ff4	C:\Windows\SysWOW64\advapi32.dll
0x7691cafe	277	msctf.dll + 0xcafe	C:\Windows\SysWOW64\msctf.dll
0x76923558	277	msctf.dll + 0x13558	C:\Windows\SysWOW64\msctf.dll
0x7691cce5	277	msctf.dll + 0xcce5	C:\Windows\SysWOW64\msctf.dll
0x76921376	277	msctf.dll + 0x11376	C:\Windows\SysWOW64\msctf.dll
0x769212e0	277	msctf.dll + 0x112e0	C:\Windows\SysWOW64\msctf.dll
0x76921662	277	msctf.dll + 0x11662	C:\Windows\SysWOW64\msctf.dll
0x7692171b	277	msctf.dll + 0x1171b	C:\Windows\SysWOW64\msctf.dll
0x7691990a	277	msctf.dll + 0x990a	C:\Windows\SysWOW64\msctf.dll
0x76921f43	277	msctf.dll + 0x11f43	C:\Windows\SysWOW64\msctf.dll
0x76921ef9	277	msctf.dll + 0x11ef9	C:\Windows\SysWOW64\msctf.dll
0x76920322	277	msctf.dll + 0x10322	C:\Windows\SysWOW64\msctf.dll
0x76920011	277	msctf.dll + 0x10011	C:\Windows\SysWOW64\msctf.dll
0x7691ff9d	277	msctf.dll + 0xff9d	C:\Windows\SysWOW64\msctf.dll
0x76920729	277	msctf.dll + 0x10729	C:\Windows\SysWOW64\msctf.dll
0x7691da10	277	msctf.dll + 0xda10	C:\Windows\SysWOW64\msctf.dll
0x7691d986	277	msctf.dll + 0xd986	C:\Windows\SysWOW64\msctf.dll
0x759d2eb9	270	imm32.dll + 0x12eb9	C:\Windows\SysWOW64\imm32.dll
0x759d2e10	270	imm32.dll + 0x12e10	C:\Windows\SysWOW64\imm32.dll
0x759d1da7	270	imm32.dll + 0x11da7	C:\Windows\SysWOW64\imm32.dll
0x759d21c0	270	imm32.dll + 0x121c0	C:\Windows\SysWOW64\imm32.dll
0x7676fb70	275	user32.dll + 0x1fb70	C:\Windows\SysWOW64\user32.dll
0x7676c8eb	275	user32.dll + 0x1c8eb	C:\Windows\SysWOW64\user32.dll
0x7676d071	275	user32.dll + 0x1d071	C:\Windows\SysWOW64\user32.dll
0x76769d85	275	user32.dll + 0x19d85	C:\Windows\SysWOW64\user32.dll
0x77e4e496	291	ntdll.dll + 0x1e496	C:\Windows\SysWOW64\ntdll.dll
0x40ca35	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0xca35	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x401816	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0x1816	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x40ca01	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0xca01	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x76768817	275	user32.dll + 0x18817	C:\Windows\SysWOW64\user32.dll
0x7677542a	275	user32.dll + 0x2542a	C:\Windows\SysWOW64\user32.dll
0x767754f9	275	user32.dll + 0x254f9	C:\Windows\SysWOW64\user32.dll
0x7678f6ed	275	user32.dll + 0x3f6ed	C:\Windows\SysWOW64\user32.dll
0x767775a2	275	user32.dll + 0x275a2	C:\Windows\SysWOW64\user32.dll
0x76778445	275	user32.dll + 0x28445	C:\Windows\SysWOW64\user32.dll
0x7678247a	275	user32.dll + 0x3247a	C:\Windows\SysWOW64\user32.dll
0x767a63b2	275	user32.dll + 0x563b2	C:\Windows\SysWOW64\user32.dll
0x40b5f9	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0xb5f9	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x40b67b	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0xb67b	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x40c016	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0xc016	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x410f08	218	javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe + 0x10f08	C:\jdk\regdeploy\javafx-2_1_0-beta-b15-windows-i586-28_feb_2012.exe
0x76a6eccb	278	kernel32.dll + 0x8eccb	C:\Windows\SysWOW64\kernel32.dll
0x77ead80d	291	ntdll.dll + 0x7d80d	C:\Windows\SysWOW64\ntdll.dll
0x77eada1f	291	ntdll.dll + 0x7da1f	C:\Windows\SysWOW64\ntdll.dll