| viewer9 documentation | Index Home |
WriteFile PML Operation
IoFlags ("I/O Flags" in Procmon) is bit flags derived from evdata[8] and the 0x40 bit of evdata[10]. (see PML Binary Data and Results Offsets). Priority is an enumerated code from the 0x0f nibble of evdata[10]. Size is a 32-bit integer ("Length" in Procmon). Offset is a 64-bit integer. Address (not shown in Procmon) is one of the memory addresses observed in the data that might reflect something about the way the API was called, and it is displayed in hex.
The PML file does not contain evresults for this operation like it does for ReadFile as it can be assumed the full Size was written on ResultCode SUCCESS.
Example from 64-bit PML
Hover over field values like Time, ResultCode, IoFlags, Priority, and bytes of evdata in this example to see tooltips as they appear in viewer9. The tooltip of the first byte of a color patch tells the field name. Because the source bytes of IoFlags and Priority are intertwined the color patches do not perfectly illustrate their locations.
WriteFile opcode=3,24
ev=27536 advop=IRP_MJ_WRITE modify=1 filewrite=4096 B
| Time: | 2022-05-17 16:06:21.9530633 |
| Duration: | 0.0002822 |
| ResultCode: | SUCCESS |
| Tid: | 40 |
| Path: | C:\$Mft |
| IoFlags: | Non-cached, Paging I/O, Synchronous Paging I/O |
| Priority: | Normal |
| Size: | 4096 |
| Offset: | 4096 |
| Address: | 0xfffff880031aa880 |
evdata[0-78] file offset 15941625
| 0 | 00 01 00 00 00 00 00 00 | ........ |
| 8 | 43 00 06 00 01 00 00 00 | C....... |
| 16 | 00 10 00 00 00 00 00 00 | ........ |
| 24 | 00 00 00 00 00 00 00 00 | ........ |
| 32 | 00 10 00 00 00 00 00 00 | ........ |
| 40 | 00 00 00 00 00 00 00 00 | ........ |
| 48 | 80 a8 1a 03 80 f8 ff ff | ........ |
| 56 | 00 00 00 00 00 00 00 00 | ........ |
| 64 | 07 80 00 00 43 3a 5c 24 | ....C:\$ |
| 72 | 4d 66 74 30 16 19 01 | Mft0... |
Call Stack stacksize=12
| StackAddress | mod | ModName | ModPath |
|---|---|---|---|
| 0xfffff880011730f7 | 194 | fltmgr.sys + 0x20f7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff88001173fc7 | 194 | fltmgr.sys + 0x2fc7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff880011726c7 | 194 | fltmgr.sys + 0x16c7 | C:\Windows\system32\drivers\fltmgr.sys |
| 0xfffff80002891922 | 161 | ntoskrnl.exe + 0x43922 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800029b7f36 | 161 | ntoskrnl.exe + 0x169f36 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800029ae848 | 161 | ntoskrnl.exe + 0x160848 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002895a49 | 161 | ntoskrnl.exe + 0x47a49 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002893dc6 | 161 | ntoskrnl.exe + 0x45dc6 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002898780 | 161 | ntoskrnl.exe + 0x4a780 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002891dc9 | 161 | ntoskrnl.exe + 0x43dc9 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff80002b8d2e8 | 161 | ntoskrnl.exe + 0x33f2e8 | C:\Windows\system32\ntoskrnl.exe |
| 0xfffff800028e7ec6 | 161 | ntoskrnl.exe + 0x99ec6 | C:\Windows\system32\ntoskrnl.exe |
Advanced names
These events can also be queried with advop which varies based on evdata[12] (see PML Binary Data and Results Offsets):
- FASTIO_WRITE evdata[12]=0x02
- IRP_MJ_WRITE evdata[12]=0x01
See also
Posted 4 Jul 2022 last updated 15 Nov 2022 As viewer9 is just starting out, discussion is invited via email. Please send questions and comments to forum@viewer9.com directly. Threads that might be valuable to other users will be posted as part of the documentation. Posted messages will not include your address or your full name, and might be shortened for brevity.
Copyright 2022, bryantlite, Inc.