0

How find address of specific pool that allocated by specific tag

e.g. address of pool that allocated by CM7 tag?

thanks

3

In WinDbg, you can use the !poolfind command:

The !poolfind extension finds all instances of a specific pool tag in either nonpaged or paged memory pools.

...

kd> !poolfind SeSd 0

Scanning large pool allocation table for Tag: SeSd (827d1000 : 827e9000)

Searching NonPaged pool (823b1000 : 82800000) for Tag: SeSd

826fa130 size:   c0 previous size:   40  (Allocated) SeSd
82712000 size:   c0 previous size:    0  (Allocated) SeSd
82715940 size:   a0 previous size:   60  (Allocated) SeSd
8271da30 size:   c0 previous size:   10  (Allocated) SeSd
82721c00 size:   10 previous size:   30  (Free)      SeSd
8272b3f0 size:   60 previous size:   30  (Allocated) SeSd
8272d770 size:   60 previous size:   40  (Allocated) SeSd
8272d7d0 size:   a0 previous size:   60  (Allocated) SeSd
8272d960 size:   a0 previous size:   70  (Allocated) SeSd
| improve this answer | |
  • when is use !poolfind output is: Unable to get MmSystemRangeStart !!! on loop – forbiddenhi Jun 9 '16 at 7:16

Not the answer you're looking for? Browse other questions tagged or ask your own question.