EugeneMuzychenko-6299 avatar image
0 Votes"
EugeneMuzychenko-6299 asked

ProcMon does not recognize types of device/interface property values in the Registry

Since Windows 8, the system has changed the format of the device/interface property data stored in CCS\Enum...\Properties and CCS\Control\DeviceClasses...\Properties. The data type is encoded in the Registry value type as 0xFFFFnnnn, where the "nnnn" contains a DEVPROP_TYPE_xxx type. But ProcMon doesn't decode such types, displaying them as "unknown" with a decimal value (for example, 4294901785 or 4294901767).

In itself, this is not a big problem. But ProcMon does not display the data if value type is not recognized. So all ReqQueryValue/RegSetValue events for such values contain no data at all.

Until decoding of such types is implemented, it would be great to display the data at least in the form of a byte sequence.

5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

0 Answers