viewer9 documentation | Index Home |
RegQueryMultipleValueKey PML Operation
The PML file does not capture data for this operation other than the Path but often you'll see ResultCode BUFFER OVERFLOW followed immediately by a repeat event with the same Path and ResultCode SUCCESS, showing the same underlying pattern as RegQueryKey so we know it is simply missing the data for fields such as BufferSize, and only serves to track calls rather than capture the data of calls.
Example from 64-bit PML
Hover over field values like Time, ResultCode, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
RegQueryMultipleValueKey opcode=2,15
ev=416124
Time: | 2022-05-17 16:07:13.1981425 |
Duration: | 0.0000274 |
ResultCode: | BUFFER OVERFLOW |
Tid: | 6172 |
Path: | HKU\.DEFAULT\Control Panel\International |
evdata[0-41] file offset 221920227
0 | 28 80 48 4b 55 5c 2e 44 | (.HKU\.D |
8 | 45 46 41 55 4c 54 5c 43 | EFAULT\C |
16 | 6f 6e 74 72 6f 6c 20 50 | ontrol P |
24 | 61 6e 65 6c 5c 49 6e 74 | anel\Int |
32 | 65 72 6e 61 74 69 6f 6e | ernation |
40 | 61 6c | al |
Call Stack stacksize=11
StackAddress | mod | ModName | ModPath |
---|---|---|---|
0xfffff80002c2e470 | 161 | ntoskrnl.exe + 0x3e0470 | C:\Windows\system32\ntoskrnl.exe |
0xfffff80002b678e3 | 161 | ntoskrnl.exe + 0x3198e3 | C:\Windows\system32\ntoskrnl.exe |
0xfffff800028eff53 | 161 | ntoskrnl.exe + 0xa1f53 | C:\Windows\system32\ntoskrnl.exe |
0x77c8a9da | 2 | ntdll.dll + 0x6a9da | C:\Windows\SYSTEM32\ntdll.dll |
0x7fefd7eb1ce | 43 | KERNELBASE.dll + 0x1b1ce | C:\Windows\system32\KERNELBASE.dll |
0x7fefd7d7990 | 43 | KERNELBASE.dll + 0x7990 | C:\Windows\system32\KERNELBASE.dll |
0x7fefd7da322 | 43 | KERNELBASE.dll + 0xa322 | C:\Windows\system32\KERNELBASE.dll |
0xff6717c4 | 367 | svchost.exe + 0x17c4 | C:\Windows\system32\svchost.exe |
0x7fefdf0a82d | 50 | sechost.dll + 0xa82d | C:\Windows\SYSTEM32\sechost.dll |
0x77a1556d | 0 | kernel32.dll + 0x1556d | C:\Windows\system32\kernel32.dll |
0x77c7372d | 2 | ntdll.dll + 0x5372d | C:\Windows\SYSTEM32\ntdll.dll |
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.