| viewer9 documentation | Index Home |
SetInformationFile PML Operations
All of these operations belong to opcode=3,26 and correspond to the different FileInformationClass values in the Microsoft documentation for NtSetInformationFile.
Although Procmon does not show it, the FileInformationClass is in the PML data at evdata[0] (see PML Binary Data and Results Offsets) and is provided by viewer9 in the FileInfoClass field. Not all of these operations have their fields completely parsed in viewer9, so for rare ones you can look up the structure in the Microsoft documentation for NtSetInformationFile. The struct documented there occurs in evdata immediately after Path, unlike in the QueryInformationFile PML Operations where the struct corresponds to evresults.
In addition to FileInfoClass, a 32-bit BufferSize and hex Buffer address (neither shown in Procmon) are extracted from the data to give insights into the way the underlying API was called.
To find SetInformationFile PML operations not explicitly named with Op in viewer9, query opcode=3,26 FileInfoClass=FileXYZInformation.
SetAllocationInformationFile
FileInfoClass is FileAllocationInformation. The AllocSize field name is "AllocationSize" in Procmon.
SetBasicInformationFile
FileInfoClass is FileBasicInformation. FileAttributes is described in QueryInformationFile PML Operations, and there are 4 timestamps: CreationTime LastAccessTime LastWriteTime ChangeTime
SetDispositionInformationEx
FileInfoClass is FileDispositionInformationEx. DisposInfo ("Flags" in Procmon) contains bit flags such as FILE_DISPOSITION_DELETE.
SetDispositionInformationFile
FileInfoClass is FileDispositionInformation. Delete is a boolean value.
SetEndOfFileInformationFile
FileInfoClass is FileEndOfFileInformation.
SetLinkInformationFile
FileInfoClass is FileLinkInformation. ReplaceIfExists is a boolean value. ToPath is "FileName" in Procmon.
SetPositionInformationFile
FileInfoClass is FilePositionInformation. Position is a 64-bit integer.
SetRenameInformationEx
FileInfoClass is FileRenameInformationEx. RenameInfo ("Flags" in Procmon) contains bit flags such as FILE_RENAME_REPLACE_IF_EXISTS. The other displayed fields are the same as for SetRenameInformationFile below, although ToPath ("FileName" in Procmon) has been seen to be optional.
SetRenameInformationFile
FileInfoClass is FileRenameInformation. ReplaceIfExists is a boolean value. DesiredName is not displayed in Procmon but appears to represent the form of the destination name that was passed to the API. ToPath is "FileName" in Procmon.
SetStorageReservedIdInformation
FileInfoClass is FileStorageReserveIdInformation.
SetValidDataLengthInformationFile
FileInfoClass is FileValidDataLengthInformation. ValidDataLen ("ValidDataLength" in Procmon) is a 64-bit integer.
Example of SetBasicInformationFile from 64-bit PML
Hover over field values like Time, ResultCode, timestamps, FileAttribute, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name.
SetBasicInformationFile opcode=3,26
ev=151896 advop=IRP_MJ_SET_INFORMATION modify=1
| Time: | 2022-05-17 16:06:40.9266002 |
| Duration: | 0.0000964 |
| ResultCode: | SUCCESS |
| Tid: | 3380 |
| Path: | C:\Users\johnk\AppData\Local\Temp\chrome_BITS_3444_1626878026\BIT11CF.tmp |
| FileInfoClass: | FileBasicInformation |
| BufferSize: | 40 |
| Buffer: | 0x0 |
| CreationTime: | 2022-01-12 17:23:41.0000000 |
| LastAccessTime: | 2022-01-12 17:23:41.0000000 |
| LastWriteTime: | 2022-01-12 17:23:41.0000000 |
| ChangeTime: | 2022-01-12 17:23:41.0000000 |
| FileAttributes: | H |
evdata[0-184] file offset 85016630
| 0 | 04 00 67 00 69 00 73 00 | ..g.i.s. |
| 8 | 34 08 06 00 09 00 00 00 | 4....... |
| 16 | 28 00 00 00 00 00 00 00 | (....... |
| 24 | 04 00 00 00 00 00 00 00 | ........ |
| 32 | 00 00 00 00 00 00 00 00 | ........ |
| 40 | 00 00 00 00 00 00 00 00 | ........ |
| 48 | 60 d8 b5 07 80 fa ff ff | `....... |
| 56 | 00 00 00 00 00 00 00 00 | ........ |
| 64 | 49 80 74 00 43 3a 5c 55 | I.t.C:\U |
| 72 | 73 65 72 73 5c 6a 6f 68 | sers\joh |
| 80 | 6e 6b 5c 41 70 70 44 61 | nk\AppDa |
| 88 | 74 61 5c 4c 6f 63 61 6c | ta\Local |
| 96 | 5c 54 65 6d 70 5c 63 68 | \Temp\ch |
| 104 | 72 6f 6d 65 5f 42 49 54 | rome_BIT |
| 112 | 53 5f 33 34 34 34 5f 31 | S_3444_1 |
| 120 | 36 32 36 38 37 38 30 32 | 62687802 |
| 128 | 36 5c 42 49 54 31 31 43 | 6\BIT11C |
| 136 | 46 2e 74 6d 70 80 d4 63 | F.tmp..c |
| 144 | 0d 03 08 d8 01 80 d4 63 | .......c |
| 152 | 0d 03 08 d8 01 80 d4 63 | .......c |
| 160 | 0d 03 08 d8 01 80 d4 63 | .......c |
| 168 | 0d 03 08 d8 01 02 00 00 | ........ |
| 176 | 00 00 00 00 00 00 00 00 | ........ |
| 184 | 00 | . |
Call Stack stacksize=17
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0xfffff880011730f7 | 194 | fltmgr.sys + 0x20f7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff88001173fc7 | 194 | fltmgr.sys + 0x2fc7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff880011726c7 | 194 | fltmgr.sys + 0x16c7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff80002d21241 | 161 | ntoskrnl.exe + 0x4d3241 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800028eff53 | 161 | ntoskrnl.exe + 0xa1f53 | C:\Windows\system32\ntoskrnl.exe |
| 0x77c89a1a | 2 | ntdll.dll + 0x69a1a | C:\Windows\SYSTEM32\ntdll.dll |
| 0x7fefd8087f2 | 43 | KERNELBASE.dll + 0x387f2 | C:\Windows\system32\KERNELBASE.dll |
| 0x7fef7131369 | 434 | qmgr.dll + 0x41369 | c:\windows\system32\qmgr.dll |
| 0x7fef717a56a | 434 | qmgr.dll + 0x8a56a | c:\windows\system32\qmgr.dll |
| 0x7fef71799bb | 434 | qmgr.dll + 0x899bb | c:\windows\system32\qmgr.dll |
| 0x7fef717a89f | 434 | qmgr.dll + 0x8a89f | c:\windows\system32\qmgr.dll |
| 0x7fef7109442 | 434 | qmgr.dll + 0x19442 | c:\windows\system32\qmgr.dll |
| 0x7fef71092a3 | 434 | qmgr.dll + 0x192a3 | c:\windows\system32\qmgr.dll |
| 0x77c323ec | 2 | ntdll.dll + 0x123ec | C:\Windows\SYSTEM32\ntdll.dll |
| 0x77d19d53 | 2 | ntdll.dll + 0xf9d53 | C:\Windows\SYSTEM32\ntdll.dll |
| 0x77a1556d | 0 | kernel32.dll + 0x1556d | C:\Windows\system32\kernel32.dll |
| 0x77c7372d | 2 | ntdll.dll + 0x5372d | C:\Windows\SYSTEM32\ntdll.dll |
Advanced names
These events all have the same advop IRP_MJ_SET_INFORMATION.
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.