viewer9 documentation

SetInformationFile PML Operations

All of these operations belong to opcode=3,26 and correspond to the different FileInformationClass values in the Microsoft documentation for NtSetInformationFile.

Although Procmon does not show it, the FileInformationClass is in the PML data at evdata[0] (see PML Binary Data and Results Offsets) and is provided by viewer9 in the FileInfoClass field. Not all of these operations have their fields completely parsed in viewer9, so for rare ones you can look up the structure in the Microsoft documentation for NtSetInformationFile. The struct documented there occurs in evdata immediately after Path, unlike in the QueryInformationFile PML Operations where the struct corresponds to evresults.

In addition to FileInfoClass, a 32-bit BufferSize and hex Buffer address (neither shown in Procmon) are extracted from the data to give insights into the way the underlying API was called.

To find SetInformationFile PML operations not explicitly named with Op in viewer9, query opcode=3,26 FileInfoClass=FileXYZInformation.

SetAllocationInformationFile

FileInfoClass is FileAllocationInformation. The AllocSize field name is "AllocationSize" in Procmon.

SetBasicInformationFile

FileInfoClass is FileBasicInformation. FileAttributes is described in QueryInformationFile PML Operations, and there are 4 timestamps: CreationTime LastAccessTime LastWriteTime ChangeTime

SetDispositionInformationEx

FileInfoClass is FileDispositionInformationEx. DisposInfo ("Flags" in Procmon) contains bit flags such as FILE_DISPOSITION_DELETE.

SetDispositionInformationFile

FileInfoClass is FileDispositionInformation. Delete is a boolean value.

SetEndOfFileInformationFile

FileInfoClass is FileEndOfFileInformation.

SetLinkInformationFile

FileInfoClass is FileLinkInformation. ReplaceIfExists is a boolean value. ToPath is "FileName" in Procmon.

SetPositionInformationFile

FileInfoClass is FilePositionInformation. Position is a 64-bit integer.

SetRenameInformationEx

FileInfoClass is FileRenameInformationEx. RenameInfo ("Flags" in Procmon) contains bit flags such as FILE_RENAME_REPLACE_IF_EXISTS. The other displayed fields are the same as for SetRenameInformationFile below, although ToPath ("FileName" in Procmon) has been seen to be optional.

SetRenameInformationFile

FileInfoClass is FileRenameInformation. ReplaceIfExists is a boolean value. DesiredName is not displayed in Procmon but appears to represent the form of the destination name that was passed to the API. ToPath is "FileName" in Procmon.

SetStorageReservedIdInformation

FileInfoClass is FileStorageReserveIdInformation.

SetValidDataLengthInformationFile

FileInfoClass is FileValidDataLengthInformation. ValidDataLen ("ValidDataLength" in Procmon) is a 64-bit integer.

Example of SetBasicInformationFile from 64-bit PML

Hover over field values like Time, ResultCode, timestamps, FileAttribute, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.

SetBasicInformationFile opcode=3,26

ev=151896 advop=IRP_MJ_SET_INFORMATION modify=1

Time:2022-05-17 16:06:40.9266002
Duration:0.0000964
ResultCode:SUCCESS
Tid:3380
Path:C:\Users\johnk\AppData\Local\Temp\chrome_BITS_3444_1626878026\BIT11CF.tmp
FileInfoClass:FileBasicInformation
BufferSize:40
Buffer:0x0
CreationTime:2022-01-12 17:23:41.0000000
LastAccessTime:2022-01-12 17:23:41.0000000
LastWriteTime:2022-01-12 17:23:41.0000000
ChangeTime:2022-01-12 17:23:41.0000000
FileAttributes:H

evdata[0-184] file offset 85016630

004 00 67 00 69 00 73 00 ..g.i.s.
834 08 06 00 09 00 00 00 4.......
1628 00 00 00 00 00 00 00 (.......
2404 00 00 00 00 00 00 00 ........
3200 00 00 00 00 00 00 00 ........
4000 00 00 00 00 00 00 00 ........
4860 d8 b5 07 80 fa ff ff `.......
5600 00 00 00 00 00 00 00 ........
6449 80 74 00 43 3a 5c 55 I.t.C:\U
7273 65 72 73 5c 6a 6f 68 sers\joh
806e 6b 5c 41 70 70 44 61 nk\AppDa
8874 61 5c 4c 6f 63 61 6c ta\Local
965c 54 65 6d 70 5c 63 68 \Temp\ch
10472 6f 6d 65 5f 42 49 54 rome_BIT
11253 5f 33 34 34 34 5f 31 S_3444_1
12036 32 36 38 37 38 30 32 62687802
12836 5c 42 49 54 31 31 43 6\BIT11C
13646 2e 74 6d 70 80 d4 63 F.tmp..c
1440d 03 08 d8 01 80 d4 63 .......c
1520d 03 08 d8 01 80 d4 63 .......c
1600d 03 08 d8 01 80 d4 63 .......c
1680d 03 08 d8 01 02 00 00 ........
17600 00 00 00 00 00 00 00 ........
18400 .

Call Stack stacksize=17

StackAddressmodModNameModPath
0xfffff880011730f7194fltmgr.sys + 0x20f7C:\Windows\system32\drivers\fltmgr.sys
0xfffff88001173fc7194fltmgr.sys + 0x2fc7C:\Windows\system32\drivers\fltmgr.sys
0xfffff880011726c7194fltmgr.sys + 0x16c7C:\Windows\system32\drivers\fltmgr.sys
0xfffff80002d21241161ntoskrnl.exe + 0x4d3241C:\Windows\system32\ntoskrnl.exe
0xfffff800028eff53161ntoskrnl.exe + 0xa1f53C:\Windows\system32\ntoskrnl.exe
0x77c89a1a2ntdll.dll + 0x69a1aC:\Windows\SYSTEM32\ntdll.dll
0x7fefd8087f243KERNELBASE.dll + 0x387f2C:\Windows\system32\KERNELBASE.dll
0x7fef7131369434qmgr.dll + 0x41369c:\windows\system32\qmgr.dll
0x7fef717a56a434qmgr.dll + 0x8a56ac:\windows\system32\qmgr.dll
0x7fef71799bb434qmgr.dll + 0x899bbc:\windows\system32\qmgr.dll
0x7fef717a89f434qmgr.dll + 0x8a89fc:\windows\system32\qmgr.dll
0x7fef7109442434qmgr.dll + 0x19442c:\windows\system32\qmgr.dll
0x7fef71092a3434qmgr.dll + 0x192a3c:\windows\system32\qmgr.dll
0x77c323ec2ntdll.dll + 0x123ecC:\Windows\SYSTEM32\ntdll.dll
0x77d19d532ntdll.dll + 0xf9d53C:\Windows\SYSTEM32\ntdll.dll
0x77a1556d0kernel32.dll + 0x1556dC:\Windows\system32\kernel32.dll
0x77c7372d2ntdll.dll + 0x5372dC:\Windows\SYSTEM32\ntdll.dll

Advanced names

These events all have the same advop IRP_MJ_SET_INFORMATION.

See also

Posted 4 Jul 2022 last updated 15 Nov 2022   As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.

Copyright 2022, bryantlite, Inc.