| viewer9 documentation | Index Home |
RegQueryKey PML Operation
BufferSize (not shown in Procmon) indicates the byte size of the buffer for returning results. For ResultCode BUFFER OVERFLOW, the event will often be followed by a repeat event with a larger BufferSize.
QueryKeyType ("Query" in Procmon) is an enumerated code indicating the type of information requested.
Name is a string returned on SUCCESS when QueryKeyType is "Basic" or "Name".
LastWriteTime (not shown in Procmon), SubKeys, and Values are returned on SUCCESS when QueryKeyType is "Full" or "Cached".
UserFlags is a 32-bit hex number returned on SUCCESS when QueryKeyType is "UserFlags".
HandleTags is a 32-bit hex number returned on SUCCESS when QueryKeyType is "HandleTags".
Example from 32-bit PML
Hover over field values like Time, ResultCode, QueryKeyType, LastWriteTime, and bytes of evdata and evresults in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
RegQueryKey opcode=2,3
ev=316
| Time: | 2022-05-17 14:24:32.1466212 |
| Duration: | 0.0000027 |
| ResultCode: | SUCCESS |
| Tid: | 2820 |
| Path: | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion |
| BufferSize: | 176 |
| QueryKeyType: | Full |
| LastWriteTime: | 2022-05-17 13:58:44.9251478 |
| SubKeys: | 83 |
| Values: | 20 |
evdata[0-60] file offset 75529
| 0 | 31 80 6f 5a b0 00 00 00 | 1.oZ.... |
| 8 | 02 00 00 00 48 4b 4c 4d | ....HKLM |
| 16 | 5c 53 4f 46 54 57 41 52 | \SOFTWAR |
| 24 | 45 5c 4d 69 63 72 6f 73 | E\Micros |
| 32 | 6f 66 74 5c 57 69 6e 64 | oft\Wind |
| 40 | 6f 77 73 20 4e 54 5c 43 | ows NT\C |
| 48 | 75 72 72 65 6e 74 56 65 | urrentVe |
| 56 | 72 73 69 6f 6e | rsion |
evresults[0-43] file offset 75592
| 0 | 96 0c 3a c0 17 6a d8 01 | ..:..j.. |
| 8 | 00 00 00 00 ff ff ff ff | ........ |
| 16 | 00 00 00 00 53 00 00 00 | ....S... |
| 24 | 38 00 00 00 00 00 00 00 | 8....... |
| 32 | 14 00 00 00 2c 00 00 00 | ....,... |
| 40 | f8 04 00 00 | .... |
Call Stack stacksize=37
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0x816d40c8 | 71 | ntoskrnl.exe + 0x26b0c8 | C:\Windows\system32\ntoskrnl.exe |
| 0x81724a68 | 71 | ntoskrnl.exe + 0x2bba68 | C:\Windows\system32\ntoskrnl.exe |
| 0x8155ce2b | 71 | ntoskrnl.exe + 0xf3e2b | C:\Windows\system32\ntoskrnl.exe |
| 0x7714a50a | 57 | ntdll.dll + 0x6a50a | C:\Windows\SYSTEM32\ntdll.dll |
| 0x74b9c889 | 37 | KERNELBASE.dll + 0x2c889 | C:\Windows\system32\KERNELBASE.dll |
| 0x74b9c7a5 | 37 | KERNELBASE.dll + 0x2c7a5 | C:\Windows\system32\KERNELBASE.dll |
| 0x74b9c980 | 37 | KERNELBASE.dll + 0x2c980 | C:\Windows\system32\KERNELBASE.dll |
| 0x6661ba08 | 561 | framedynos.dll + 0xba08 | C:\Windows\System32\framedynos.dll |
| 0x666e52ea | 668 | cimwin32.dll + 0x252ea | C:\Windows\system32\wbem\cimwin32.dll |
| 0x666e4eab | 668 | cimwin32.dll + 0x24eab | C:\Windows\system32\wbem\cimwin32.dll |
| 0x666e62b6 | 668 | cimwin32.dll + 0x262b6 | C:\Windows\system32\wbem\cimwin32.dll |
| 0x66623cd3 | 561 | framedynos.dll + 0x13cd3 | C:\Windows\System32\framedynos.dll |
| 0x66624c88 | 561 | framedynos.dll + 0x14c88 | C:\Windows\System32\framedynos.dll |
| 0x3e57da | 660 | wmiprvse.exe + 0x157da | C:\Windows\system32\wbem\wmiprvse.exe |
| 0x3e5476 | 660 | wmiprvse.exe + 0x15476 | C:\Windows\system32\wbem\wmiprvse.exe |
| 0x76a27f9b | 50 | RPCRT4.dll + 0x7f9b | C:\Windows\system32\RPCRT4.dll |
| 0x76ad9246 | 50 | RPCRT4.dll + 0xb9246 | C:\Windows\system32\RPCRT4.dll |
| 0x76e8968d | 55 | combase.dll + 0x13968d | C:\Windows\SYSTEM32\combase.dll |
| 0x76a4147c | 50 | RPCRT4.dll + 0x2147c | C:\Windows\system32\RPCRT4.dll |
| 0x66ff1da8 | 1 | FastProx.dll + 0x21da8 | C:\Windows\system32\wbem\fastprox.dll |
| 0x76e8953f | 55 | combase.dll + 0x13953f | C:\Windows\SYSTEM32\combase.dll |
| 0x76d5d736 | 55 | combase.dll + 0xd736 | C:\Windows\SYSTEM32\combase.dll |
| 0x76e89d9f | 55 | combase.dll + 0x139d9f | C:\Windows\SYSTEM32\combase.dll |
| 0x76e897ed | 55 | combase.dll + 0x1397ed | C:\Windows\SYSTEM32\combase.dll |
| 0x76e92338 | 55 | combase.dll + 0x142338 | C:\Windows\SYSTEM32\combase.dll |
| 0x76a285e9 | 50 | RPCRT4.dll + 0x85e9 | C:\Windows\system32\RPCRT4.dll |
| 0x76a284d9 | 50 | RPCRT4.dll + 0x84d9 | C:\Windows\system32\RPCRT4.dll |
| 0x76a28f46 | 50 | RPCRT4.dll + 0x8f46 | C:\Windows\system32\RPCRT4.dll |
| 0x76a28af0 | 50 | RPCRT4.dll + 0x8af0 | C:\Windows\system32\RPCRT4.dll |
| 0x76a288a8 | 50 | RPCRT4.dll + 0x88a8 | C:\Windows\system32\RPCRT4.dll |
| 0x76a2dc27 | 50 | RPCRT4.dll + 0xdc27 | C:\Windows\system32\RPCRT4.dll |
| 0x76a2da43 | 50 | RPCRT4.dll + 0xda43 | C:\Windows\system32\RPCRT4.dll |
| 0x7710811b | 57 | ntdll.dll + 0x2811b | C:\Windows\SYSTEM32\ntdll.dll |
| 0x7710730c | 57 | ntdll.dll + 0x2730c | C:\Windows\SYSTEM32\ntdll.dll |
| 0x754241a8 | 46 | KERNEL32.DLL + 0x41a8 | C:\Windows\system32\KERNEL32.DLL |
| 0x77132e31 | 57 | ntdll.dll + 0x52e31 | C:\Windows\SYSTEM32\ntdll.dll |
| 0x77132dff | 57 | ntdll.dll + 0x52dff | C:\Windows\SYSTEM32\ntdll.dll |
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.