viewer9 documentation

RegRestoreKey PML Operation

HivePath ("File Name" in Procmon) is the file path from which the key is loaded.

RegRestoreFlags ("Flags" in Procmon) is enumerated "REG_FORCE_RESTORE" or "REG_WHOLE_HIVE_VOLATILE".

Example from 64-bit PML

Hover over field values like Time, ResultCode, CreatedTime, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

RegRestoreKey opcode=2,19

ev=3 modify=1

Time:2022-10-10 18:52:01.6555219
Duration:0.0011071
ResultCode:SUCCESS
Tid:3316
Path:HKCU\test1
RegRestoreFlags:REG_FORCE_RESTORE
HivePath:C:\test1.sav

evdata[0-31] file offset 1784

00a 80 0c 80 08 00 00 00 ........
848 4b 43 55 5c 74 65 73 HKCU\tes
1674 31 43 3a 5c 74 65 73 t1C:\tes
2474 31 2e 73 61 76 69 00 t1.savi.

Call Stack stacksize=14

StackAddressmodModNameModPath
0xfffff80002bf847049ntoskrnl.exe + 0x3e0470C:\Windows\system32\ntoskrnl.exe
0xfffff80002d055ab49ntoskrnl.exe + 0x4ed5abC:\Windows\system32\ntoskrnl.exe
0xfffff800028b9f5349ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0xfffff800028af6c049ntoskrnl.exe + 0x976c0C:\Windows\system32\ntoskrnl.exe
0xfffff80002d054b149ntoskrnl.exe + 0x4ed4b1C:\Windows\system32\ntoskrnl.exe
0xfffff800028b9f5349ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0x77bbac0a4ntdll.dll + 0x6ac0aC:\Windows\System32\ntdll.dll
0x77ab47df3kernel32.dll + 0x847dfC:\Windows\System32\kernel32.dll
0x77ac81cd3kernel32.dll + 0x981cdC:\Windows\System32\kernel32.dll
0xff844777203reg.exe + 0x4777C:\Windows\System32\reg.exe
0xff8421a4203reg.exe + 0x21a4C:\Windows\System32\reg.exe
0xff84ff1d203reg.exe + 0xff1dC:\Windows\System32\reg.exe
0x77a4556d3kernel32.dll + 0x1556dC:\Windows\System32\kernel32.dll
0x77ba372d4ntdll.dll + 0x5372dC:\Windows\System32\ntdll.dll

See also

Posted 22 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.