How find address of specific pool that allocated by specific tag
e.g. address of pool that allocated by CM7 tag?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
The !poolfind extension finds all instances of a specific pool tag in either nonpaged or paged memory pools.
kd> !poolfind SeSd 0 Scanning large pool allocation table for Tag: SeSd (827d1000 : 827e9000) Searching NonPaged pool (823b1000 : 82800000) for Tag: SeSd 826fa130 size: c0 previous size: 40 (Allocated) SeSd 82712000 size: c0 previous size: 0 (Allocated) SeSd 82715940 size: a0 previous size: 60 (Allocated) SeSd 8271da30 size: c0 previous size: 10 (Allocated) SeSd 82721c00 size: 10 previous size: 30 (Free) SeSd 8272b3f0 size: 60 previous size: 30 (Allocated) SeSd 8272d770 size: 60 previous size: 40 (Allocated) SeSd 8272d7d0 size: a0 previous size: 60 (Allocated) SeSd 8272d960 size: a0 previous size: 70 (Allocated) SeSd