ProcMon does not recognize types of device/interface property values in the Registry

Eugene Muzychenko 21 Reputation points
2021-10-14T18:31:15.66+00:00

@Mark Russinovich
Since Windows 8, the system has changed the format of the device/interface property data stored in CCS\Enum...\Properties and CCS\Control\DeviceClasses...\Properties. The data type is encoded in the Registry value type as 0xFFFFnnnn, where the "nnnn" contains a DEVPROP_TYPE_xxx type. But ProcMon doesn't decode such types, displaying them as "unknown" with a decimal value (for example, 4294901785 or 4294901767).

In itself, this is not a big problem. But ProcMon does not display the data if value type is not recognized. So all ReqQueryValue/RegSetValue events for such values contain no data at all.

Until decoding of such types is implemented, it would be great to display the data at least in the form of a byte sequence.

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,095 questions
0 comments No comments
{count} votes