Windows sysinternals

112 Part II Usage Guide
■ When the process started, and when it ended (if it has).
■ Architecture (32-bit or 64-bit executable code).
■ Whether UAC file and registry virtualization is enabled for this process (Windows Vista
and newer only).
■ The integrity level of the process (Windows Vista and newer only).
■ The list of modules (executable images) loaded into the process’ address space at the
time this event occurred. A newly launched process will have an empty list until after
some Load Image events load the exe, Ntdll.dll, and other modules.
Stack Tab
The Stack tab of the Event Properties dialog box, shown in Figure 4-6, displays the thread
call stack when the event was recorded. The stack can be useful for determining the reason
an event took place and the component responsible for the event. See the “Call Stacks
and Symbols” section in Chapter 2 to understand what a call stack is and how to configure
Procmon to maximize the information you can get from one.
Each row represents one stack frame, with five columns of data:
■ Frame Displays the frame number, and a K for a kernel-mode frame or a U for a
user-mode frame. (User-mode stack frames are not captured on x64 versions of
Windows prior to Windows Vista SP1 and Windows Server 2008.)
■ Module The name of the file containing the code being executed in this frame.
■ Location The specific location within the module where the code is executing. If
symbols are available, the location is expressed as a function name and an offset from
the beginning of that function; if source file information is also available, the location
will include the path to and the line number within the source file. If symbols are not
available and the module has an export table, the location is given as the nearest preceding
exported name and an offset from that location. If no symbols or exports are
available, the location is expressed as an offset from the base address of the module in
memory. See the “Call Stacks and Symbols” section in Chapter 2 for more information.
■ Address The address of the code instruction in the virtual address space of the
executing process.
■ Path The full path of the file identified in the Module column. With the default size of
the dialog box, you need to scroll or resize the dialog box to see this column. This can
help you verify which version of a DLL is executing.
www.it-ebooks.info