viewer9 documentation

RegQueryKey PML Operation

BufferSize (not shown in Procmon) indicates the byte size of the buffer for returning results. For ResultCode BUFFER OVERFLOW, the event will often be followed by a repeat event with a larger BufferSize.

QueryKeyType ("Query" in Procmon) is an enumerated code indicating the type of information requested.

Name is a string returned on SUCCESS when QueryKeyType is "Basic" or "Name".

LastWriteTime (not shown in Procmon), SubKeys, and Values are returned on SUCCESS when QueryKeyType is "Full" or "Cached".

UserFlags is a 32-bit hex number returned on SUCCESS when QueryKeyType is "UserFlags".

HandleTags is a 32-bit hex number returned on SUCCESS when QueryKeyType is "HandleTags".

Example from 32-bit PML

Hover over field values like Time, ResultCode, QueryKeyType, LastWriteTime, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegQueryKey opcode=2,3

ev=316

Time:2022-05-17 14:24:32.1466212
Duration:0.0000027
ResultCode:SUCCESS
Tid:2820
Path:HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion
BufferSize:176
QueryKeyType:Full
LastWriteTime:2022-05-17 13:58:44.9251478
SubKeys:83
Values:20

evdata[0-60] file offset 75529

031 80 6f 5a b0 00 00 00 1.oZ....
802 00 00 00 48 4b 4c 4d ....HKLM
165c 53 4f 46 54 57 41 52 \SOFTWAR
2445 5c 4d 69 63 72 6f 73 E\Micros
326f 66 74 5c 57 69 6e 64 oft\Wind
406f 77 73 20 4e 54 5c 43 ows NT\C
4875 72 72 65 6e 74 56 65 urrentVe
5672 73 69 6f 6e rsion

evresults[0-43] file offset 75592

096 0c 3a c0 17 6a d8 01 ..:..j..
800 00 00 00 ff ff ff ff ........
1600 00 00 00 53 00 00 00 ....S...
2438 00 00 00 00 00 00 00 8.......
3214 00 00 00 2c 00 00 00 ....,...
40f8 04 00 00 ....

Call Stack stacksize=37

StackAddressmodModNameModPath
0x816d40c871ntoskrnl.exe + 0x26b0c8C:\Windows\system32\ntoskrnl.exe
0x81724a6871ntoskrnl.exe + 0x2bba68C:\Windows\system32\ntoskrnl.exe
0x8155ce2b71ntoskrnl.exe + 0xf3e2bC:\Windows\system32\ntoskrnl.exe
0x7714a50a57ntdll.dll + 0x6a50aC:\Windows\SYSTEM32\ntdll.dll
0x74b9c88937KERNELBASE.dll + 0x2c889C:\Windows\system32\KERNELBASE.dll
0x74b9c7a537KERNELBASE.dll + 0x2c7a5C:\Windows\system32\KERNELBASE.dll
0x74b9c98037KERNELBASE.dll + 0x2c980C:\Windows\system32\KERNELBASE.dll
0x6661ba08561framedynos.dll + 0xba08C:\Windows\System32\framedynos.dll
0x666e52ea668cimwin32.dll + 0x252eaC:\Windows\system32\wbem\cimwin32.dll
0x666e4eab668cimwin32.dll + 0x24eabC:\Windows\system32\wbem\cimwin32.dll
0x666e62b6668cimwin32.dll + 0x262b6C:\Windows\system32\wbem\cimwin32.dll
0x66623cd3561framedynos.dll + 0x13cd3C:\Windows\System32\framedynos.dll
0x66624c88561framedynos.dll + 0x14c88C:\Windows\System32\framedynos.dll
0x3e57da660wmiprvse.exe + 0x157daC:\Windows\system32\wbem\wmiprvse.exe
0x3e5476660wmiprvse.exe + 0x15476C:\Windows\system32\wbem\wmiprvse.exe
0x76a27f9b50RPCRT4.dll + 0x7f9bC:\Windows\system32\RPCRT4.dll
0x76ad924650RPCRT4.dll + 0xb9246C:\Windows\system32\RPCRT4.dll
0x76e8968d55combase.dll + 0x13968dC:\Windows\SYSTEM32\combase.dll
0x76a4147c50RPCRT4.dll + 0x2147cC:\Windows\system32\RPCRT4.dll
0x66ff1da81FastProx.dll + 0x21da8C:\Windows\system32\wbem\fastprox.dll
0x76e8953f55combase.dll + 0x13953fC:\Windows\SYSTEM32\combase.dll
0x76d5d73655combase.dll + 0xd736C:\Windows\SYSTEM32\combase.dll
0x76e89d9f55combase.dll + 0x139d9fC:\Windows\SYSTEM32\combase.dll
0x76e897ed55combase.dll + 0x1397edC:\Windows\SYSTEM32\combase.dll
0x76e9233855combase.dll + 0x142338C:\Windows\SYSTEM32\combase.dll
0x76a285e950RPCRT4.dll + 0x85e9C:\Windows\system32\RPCRT4.dll
0x76a284d950RPCRT4.dll + 0x84d9C:\Windows\system32\RPCRT4.dll
0x76a28f4650RPCRT4.dll + 0x8f46C:\Windows\system32\RPCRT4.dll
0x76a28af050RPCRT4.dll + 0x8af0C:\Windows\system32\RPCRT4.dll
0x76a288a850RPCRT4.dll + 0x88a8C:\Windows\system32\RPCRT4.dll
0x76a2dc2750RPCRT4.dll + 0xdc27C:\Windows\system32\RPCRT4.dll
0x76a2da4350RPCRT4.dll + 0xda43C:\Windows\system32\RPCRT4.dll
0x7710811b57ntdll.dll + 0x2811bC:\Windows\SYSTEM32\ntdll.dll
0x7710730c57ntdll.dll + 0x2730cC:\Windows\SYSTEM32\ntdll.dll
0x754241a846KERNEL32.DLL + 0x41a8C:\Windows\system32\KERNEL32.DLL
0x77132e3157ntdll.dll + 0x52e31C:\Windows\SYSTEM32\ntdll.dll
0x77132dff57ntdll.dll + 0x52dffC:\Windows\SYSTEM32\ntdll.dll

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.