viewer9 documentation

RegLoadKey PML Operation

HivePath ("Hive Path" in Procmon) is the pathname of the hive file.

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegLoadKey opcode=2,12

ev=36481 modify=1

Time:2022-05-17 20:43:22.9569535
Duration:0.2611349
ResultCode:SUCCESS
Tid:312
Path:HKLM\BCD00000000
HivePath:C:\Boot\BCD

evdata[0-32] file offset 11218482

010 80 0b 80 48 4b 4c 4d ....HKLM
85c 42 43 44 30 30 30 30 \BCD0000
1630 30 30 30 43 3a 5c 42 0000C:\B
246f 6f 74 5c 42 43 44 a8 oot\BCD.
32ad .

Call Stack stacksize=20

StackAddressmodModNameModPath
0xfffff80002be347049ntoskrnl.exe + 0x3e0470C:\Windows\system32\ntoskrnl.exe
0xfffff80002b9e93949ntoskrnl.exe + 0x39b939C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf0ff149ntoskrnl.exe + 0x4edff1C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf101b49ntoskrnl.exe + 0x4ee01bC:\Windows\system32\ntoskrnl.exe
0xfffff80002cf117e49ntoskrnl.exe + 0x4ee17eC:\Windows\system32\ntoskrnl.exe
0xfffff80002cf12b049ntoskrnl.exe + 0x4ee2b0C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf146449ntoskrnl.exe + 0x4ee464C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf15e149ntoskrnl.exe + 0x4ee5e1C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf1da049ntoskrnl.exe + 0x4eeda0C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf204b49ntoskrnl.exe + 0x4ef04bC:\Windows\system32\ntoskrnl.exe
0xfffff800028a4f5349ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0xfffff8000289a6c049ntoskrnl.exe + 0x976c0C:\Windows\system32\ntoskrnl.exe
0xfffff80002cf1f0f49ntoskrnl.exe + 0x4eef0fC:\Windows\system32\ntoskrnl.exe
0xfffff800028a4f5349ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0x7708a54a4ntdll.dll + 0x6a54aC:\Windows\System32\ntdll.dll
0x4811e0ef0smss.exe + 0xe0efC:\Windows\System32\smss.exe
0x4811da410smss.exe + 0xda41C:\Windows\System32\smss.exe
0x481253860smss.exe + 0x15386C:\Windows\System32\smss.exe
0x48127d690smss.exe + 0x17d69C:\Windows\System32\smss.exe
0x770737354ntdll.dll + 0x53735C:\Windows\System32\ntdll.dll

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.