ProcMonXv2 icon indicating copy to clipboard operation
ProcMonXv2 copied to clipboard

Published 20 hours ago • verified publisher icon zodiacon

Any way to open a captured session file?

Open LainUnchained opened this issue 1 year ago • 6 comments

Sup

I did a trace in a remote machine, copy the saved file (.pmx) but i cannot open it on the app... Already tried perfview and others but seems the file is not compatible... and i dont have enough c++ knowledge to add this functionality... Any alternative?

Thanks

LainUnchained avatar Mar 14 '23 16:03 LainUnchained

I haven't added that functionality I don't know what a .pmx file is... for ETW it should be ETL. ETL files should be openable at least with WPA (Windows Performance Analyzer).

zodiacon avatar Mar 14 '23 16:03 zodiacon

Hey bud, thanks for the reply. PMX is the format that ProcMonXv2 offers to save the captured session. PmxFileFormat

Thanks!

LainUnchained avatar Mar 14 '23 17:03 LainUnchained

right... it's been a while. This is a private format, so will not work anywhere else. I think it's text... open in Notepad I need to get back to this to look closer.

zodiacon avatar Mar 14 '23 17:03 zodiacon

OK, not a text file :) There is a CSV option in Save... Anyway, you can open pmx file in a compound file viewer (like SSView)

zodiacon avatar Mar 14 '23 19:03 zodiacon

I tried to save (.csv format), but "failed to save data".

GKSONG avatar Mar 24 '23 01:03 GKSONG

@GKSONG this is why:

https://github.com/zodiacon/ProcMonXv2/blob/e5486fb473fcce8a1cc387b06db41bb17b12488a/ProcMonX/CSVEventDataSerializer.cpp#L11-L13

the CSV serializer is totally unimplemented, even if it "is an option"

#12

LoganDark avatar Apr 17 '24 15:04 LoganDark