viewer9 documentation

RegQueryMultipleValueKey PML Operation

The PML file does not capture data for this operation other than the Path but often you'll see ResultCode BUFFER OVERFLOW followed immediately by a repeat event with the same Path and ResultCode SUCCESS, showing the same underlying pattern as RegQueryKey so we know it is simply missing the data for fields such as BufferSize, and only serves to track calls rather than capture the data of calls.

Example from 64-bit PML

Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegQueryMultipleValueKey opcode=2,15

ev=416124

Time:	2022-05-17 16:07:13.1981425
Duration:	0.0000274
ResultCode:	BUFFER OVERFLOW
Tid:	6172

Path:	HKU\.DEFAULT\Control Panel\International

evdata[0-41] file offset 221920227

0	28 80 48 4b 55 5c 2e 44	(.HKU\.D
8	45 46 41 55 4c 54 5c 43	EFAULT\C
16	6f 6e 74 72 6f 6c 20 50	ontrol P
24	61 6e 65 6c 5c 49 6e 74	anel\Int
32	65 72 6e 61 74 69 6f 6e	ernation
40	61 6c	al

Call Stack stacksize=11

StackAddress	mod	ModName	ModPath
0xfffff80002c2e470	161	ntoskrnl.exe + 0x3e0470	C:\Windows\system32\ntoskrnl.exe
0xfffff80002b678e3	161	ntoskrnl.exe + 0x3198e3	C:\Windows\system32\ntoskrnl.exe
0xfffff800028eff53	161	ntoskrnl.exe + 0xa1f53	C:\Windows\system32\ntoskrnl.exe
0x77c8a9da	2	ntdll.dll + 0x6a9da	C:\Windows\SYSTEM32\ntdll.dll
0x7fefd7eb1ce	43	KERNELBASE.dll + 0x1b1ce	C:\Windows\system32\KERNELBASE.dll
0x7fefd7d7990	43	KERNELBASE.dll + 0x7990	C:\Windows\system32\KERNELBASE.dll
0x7fefd7da322	43	KERNELBASE.dll + 0xa322	C:\Windows\system32\KERNELBASE.dll
0xff6717c4	367	svchost.exe + 0x17c4	C:\Windows\system32\svchost.exe
0x7fefdf0a82d	50	sechost.dll + 0xa82d	C:\Windows\SYSTEM32\sechost.dll
0x77a1556d	0	kernel32.dll + 0x1556d	C:\Windows\system32\kernel32.dll
0x77c7372d	2	ntdll.dll + 0x5372d	C:\Windows\SYSTEM32\ntdll.dll