From 68951386dabdfbdebe34e06900ce739145eda255 Mon Sep 17 00:00:00 2001 From: Pavel Yosifovich Date: Mon, 29 May 2017 22:14:19 +0300 Subject: [PATCH] Rebranded to PoolMonX. Added columns for driver name --- PoolListCtrl.cpp | 616 ++- PoolListCtrl.h | 19 +- PoolMonEx.rc | 12 +- PoolMonEx.sln => PoolMonX.sln | 6 +- PoolMonEx.vcxproj => PoolMonX.vcxproj | 12 +- ...cxproj.filters => PoolMonX.vcxproj.filters | 1 + PoolView.cpp | 6 +- PoolView.h | 4 +- res/PoolMonEx.ico | Bin 26694 -> 26694 bytes res/pooltag.txt | 4386 +++++++++++++++++ resource.h | 5 +- stdafx.h | 1 + 12 files changed, 4787 insertions(+), 281 deletions(-) rename PoolMonEx.sln => PoolMonX.sln (85%) rename PoolMonEx.vcxproj => PoolMonX.vcxproj (97%) rename PoolMonEx.vcxproj.filters => PoolMonX.vcxproj.filters (98%) create mode 100644 res/pooltag.txt diff --git a/PoolListCtrl.cpp b/PoolListCtrl.cpp index df93fd5..9f2a5ff 100644 --- a/PoolListCtrl.cpp +++ b/PoolListCtrl.cpp @@ -13,401 +13,497 @@ IMPLEMENT_DYNAMIC(CPoolListCtrl, CMFCListCtrl) CPoolListCtrl::CPoolListCtrl() { - m_pPoolInfo = (SYSTEM_POOLTAG_INFORMATION*)::malloc(m_PoolInfoSize); + m_pPoolInfo = (SYSTEM_POOLTAG_INFORMATION*)::malloc(m_PoolInfoSize); } CPoolListCtrl::~CPoolListCtrl() { - ::free(m_pPoolInfo); + ::free(m_pPoolInfo); } BEGIN_MESSAGE_MAP(CPoolListCtrl, CMFCListCtrl) - ON_WM_CREATE() - ON_NOTIFY(HDN_ITEMCLICKA, 0, &CPoolListCtrl::OnHdnItemclick) - ON_NOTIFY(HDN_ITEMCLICKW, 0, &CPoolListCtrl::OnHdnItemclick) - ON_WM_TIMER() - ON_COMMAND(ID_VIEW_REFRESH, &CPoolListCtrl::OnViewRefresh) - ON_COMMAND_RANGE(ID_REFRESHINTERVAL_5SECONDS, ID_REFRESHINTERVAL_5SECONDS + 3, OnIntervalChange) - ON_UPDATE_COMMAND_UI_RANGE(ID_REFRESHINTERVAL_5SECONDS, ID_REFRESHINTERVAL_5SECONDS + 3, OnIntervalChangeUpdateUI) - ON_COMMAND(ID_VIEW_DYNAMICSORT, &CPoolListCtrl::OnViewDynamicsort) - ON_UPDATE_COMMAND_UI(ID_VIEW_DYNAMICSORT, &CPoolListCtrl::OnUpdateViewDynamicsort) + ON_WM_CREATE() + ON_NOTIFY(HDN_ITEMCLICKA, 0, &CPoolListCtrl::OnHdnItemclick) + ON_NOTIFY(HDN_ITEMCLICKW, 0, &CPoolListCtrl::OnHdnItemclick) + ON_WM_TIMER() + ON_COMMAND(ID_VIEW_REFRESH, &CPoolListCtrl::OnViewRefresh) + ON_COMMAND_RANGE(ID_REFRESHINTERVAL_5SECONDS, ID_REFRESHINTERVAL_5SECONDS + 3, OnIntervalChange) + ON_UPDATE_COMMAND_UI_RANGE(ID_REFRESHINTERVAL_5SECONDS, ID_REFRESHINTERVAL_5SECONDS + 3, OnIntervalChangeUpdateUI) + ON_COMMAND(ID_VIEW_DYNAMICSORT, &CPoolListCtrl::OnViewDynamicsort) + ON_UPDATE_COMMAND_UI(ID_VIEW_DYNAMICSORT, &CPoolListCtrl::OnUpdateViewDynamicsort) END_MESSAGE_MAP() int CPoolListCtrl::OnCreate(LPCREATESTRUCT lpCreateStruct) { - if (CMFCListCtrl::OnCreate(lpCreateStruct) == -1) - return -1; + if (CMFCListCtrl::OnCreate(lpCreateStruct) == -1) + return -1; - m_Images.Create(16, 16, ILC_COLOR32, 4, 2); - m_Images.Add(AfxGetApp()->LoadIconW(IDI_PAGED)); - m_Images.Add(AfxGetApp()->LoadIconW(IDI_NONPAGED)); + m_Images.Create(16, 16, ILC_COLOR32, 4, 2); + m_Images.Add(AfxGetApp()->LoadIconW(IDI_PAGED)); + m_Images.Add(AfxGetApp()->LoadIconW(IDI_NONPAGED)); - SetImageList(&m_Images, LVSIL_SMALL); + SetImageList(&m_Images, LVSIL_SMALL); - //EnableMarkSortedColumn(FALSE); + //EnableMarkSortedColumn(FALSE); - CFont font; - font.CreatePointFont(100, L"Consolas"); + CFont font; + font.CreatePointFont(100, L"Consolas"); - LOGFONT lf; - GetFont()->GetLogFont(&lf); + LOGFONT lf; + GetFont()->GetLogFont(&lf); - SetFont(&font); - font.Detach(); + SetFont(&font); + font.Detach(); - font.DeleteObject(); - font.CreateFontIndirectW(&lf); - GetHeaderCtrl().SetFont(&font); - font.Detach(); + font.DeleteObject(); + font.CreateFontIndirectW(&lf); + GetHeaderCtrl().SetFont(&font); + font.Detach(); - InsertColumn(0, L"Tag", LVCFMT_CENTER, 80); - InsertColumn(1, L"Type", LVCFMT_CENTER, 80); - InsertColumn(2, L"Allocs", LVCFMT_RIGHT, 100); - InsertColumn(3, L"Frees", LVCFMT_RIGHT, 100); - InsertColumn(4, L"Diff", LVCFMT_RIGHT, 80); - InsertColumn(5, L"Bytes", LVCFMT_RIGHT, 100); - InsertColumn(6, L"KBytes", LVCFMT_RIGHT, 100); - InsertColumn(7, L"B / Alloc", LVCFMT_RIGHT, 80); + InsertColumn(ColumnType::TagName, L"Tag", LVCFMT_CENTER, 80); + InsertColumn(ColumnType::PoolType, L"Type", LVCFMT_CENTER, 80); + InsertColumn(ColumnType::Allocs, L"Allocs", LVCFMT_RIGHT, 100); + InsertColumn(ColumnType::Frees, L"Frees", LVCFMT_RIGHT, 100); + InsertColumn(ColumnType::Diff, L"Diff", LVCFMT_RIGHT, 80); + InsertColumn(ColumnType::Usage, L"Bytes", LVCFMT_RIGHT, 100); + InsertColumn(ColumnType::UsageKB, L"KBytes", LVCFMT_RIGHT, 100); + InsertColumn(ColumnType::PerAlloc, L"B / Alloc", LVCFMT_RIGHT, 80); + InsertColumn(ColumnType::SourceName, L"Source", LVCFMT_LEFT, 150); + InsertColumn(ColumnType::SourceDescription, L"Source Description", LVCFMT_LEFT, 350); - BuildPoolData(); + LoadPoolTags(); - SetTimer(1, m_Interval, nullptr); + BuildPoolData(); - return 0; + SetTimer(1, m_Interval, nullptr); + + return 0; +} + +void CPoolListCtrl::LoadPoolTags() { + using namespace std; + + auto hModule = AfxGetResourceHandle(); + auto hResource = ::FindResource(hModule, MAKEINTRESOURCE(IDR_POOLTAG), L"TXT"); + ASSERT(hResource); + + auto hGlobal = ::LoadResource(hModule, hResource); + ASSERT(hGlobal); + + auto data = static_cast(::LockResource(hGlobal)); + auto next = data; + for (; next; data = next + 1) { + next = strchr(data, '\n'); + + if (strncmp(data, "//", 2) == 0 || _strnicmp(data, "rem", 3) == 0 + || strncmp(data, "\r\n", 2) == 0) + continue; + + // read the tag + string tag(data, data + 4); + + // locate the first dash + auto dash1 = strchr(data, '-'); + if (dash1 == nullptr) + continue; + + // locate second dash + auto dash2 = strchr(dash1 + 1, '-'); + if (dash2 == nullptr) + continue; + + if (dash2 > next) { + dash2 = dash1; + dash1 = nullptr; + } + + CStringA trimmedTag(tag.c_str()); + //trimmedTag.Trim(); + + CStringW trimmedDriverName(L""); + if (dash1) { + string driverName(dash1 + 1, dash2); + trimmedDriverName = driverName.c_str(); + trimmedDriverName.Trim(); + } + + string driverDesc(dash2 + 1, next - 1); + CStringW trimmedDriverDesc(driverDesc.c_str()); + trimmedDriverDesc.Trim(); + + m_PoolTagMap.insert(make_pair(trimmedTag, make_pair(wstring(trimmedDriverName), wstring(trimmedDriverDesc)))); + } } void CPoolListCtrl::BuildPoolData() { - CWaitCursor wait; + CWaitCursor wait; - ULONG size; - auto status = ::NtQuerySystemInformation(SystemInformationClass::SystemPoolTagInformation, m_pPoolInfo, m_PoolInfoSize, &size); - if (status == 0) { - char tag[5] = { 0 }; - int count = m_pPoolInfo->Count; - m_Tags.clear(); + ULONG size; + auto status = ::NtQuerySystemInformation(SystemInformationClass::SystemPoolTagInformation, m_pPoolInfo, m_PoolInfoSize, &size); + if (status == 0) { + char tag[5] = { 0 }; + int count = m_pPoolInfo->Count; + m_Tags.clear(); - for (auto i = 0; i < count; i++) { - const auto& item = m_pPoolInfo->TagInfo[i]; - ::CopyMemory(tag, &item.Tag, 4); + for (auto i = 0; i < count; i++) { + const auto& item = m_pPoolInfo->TagInfo[i]; + ::CopyMemory(tag, &item.Tag, 4); - if (item.NonPagedAllocs > 0) { - AddItem(i, item, tag, true); - } - if (item.PagedAllocs > 0) { - AddItem(i, item, tag, false); - } + if (item.NonPagedAllocs > 0) { + AddItem(i, item, tag, true); + } + if (item.PagedAllocs > 0) { + AddItem(i, item, tag, false); + } - } - } + } + } } -void CPoolListCtrl::UpdateItem(int n, const SYSTEM_POOLTAG& item, bool nonpaged) +void CPoolListCtrl::UpdateItem(int n, PoolTagInfo& info, bool nonpaged) { - SetItemText(n, ColumnType::PoolType, nonpaged ? L"Non Paged" : L"Paged"); - CString value; - value.Format(L"%u", nonpaged ? item.NonPagedAllocs : item.PagedAllocs); - SetItemText(n, ColumnType::Allocs, value); + const auto& item = info.Tag; - value.Format(L"%u", nonpaged ? item.NonPagedFrees : item.PagedFrees); - SetItemText(n, ColumnType::Frees, value); + SetItemText(n, ColumnType::PoolType, nonpaged ? L"Non Paged" : L"Paged"); + CString value; + value.Format(L"%u", nonpaged ? item.NonPagedAllocs : item.PagedAllocs); + SetItemText(n, ColumnType::Allocs, value); - int diff; - value.Format(L"%u", nonpaged ? diff = item.NonPagedAllocs - item.NonPagedFrees : diff = item.PagedAllocs - item.PagedFrees); - SetItemText(n, ColumnType::Diff, value); + value.Format(L"%u", nonpaged ? item.NonPagedFrees : item.PagedFrees); + SetItemText(n, ColumnType::Frees, value); - auto used = nonpaged ? item.NonPagedUsed : item.PagedUsed; - value.Format(L"%u", used); - SetItemText(n, ColumnType::Usage, value); + int diff; + value.Format(L"%u", nonpaged ? diff = item.NonPagedAllocs - item.NonPagedFrees : diff = item.PagedAllocs - item.PagedFrees); + SetItemText(n, ColumnType::Diff, value); - value.Format(L"%u KB", (used + 512) >> 10); - SetItemText(n, ColumnType::UsageKB, value); + auto used = nonpaged ? item.NonPagedUsed : item.PagedUsed; + value.Format(L"%u", used); + SetItemText(n, ColumnType::Usage, value); - value.Format(L"%u", diff == 0 ? 0 : used / diff); - SetItemText(n, ColumnType::PerAlloc, value); + value.Format(L"%u KB", (used + 512) >> 10); + SetItemText(n, ColumnType::UsageKB, value); + + value.Format(L"%u", diff == 0 ? 0 : used / diff); + SetItemText(n, ColumnType::PerAlloc, value); + + auto driver = m_PoolTagMap.find(std::string((const char*)&item.Tag, (const char*)&item.Tag + 4)); + if (driver != m_PoolTagMap.end()) { + SetItemText(n, ColumnType::SourceName, info.SourceName = driver->second.first.c_str()); + SetItemText(n, ColumnType::SourceDescription, info.SourceDesc = driver->second.second.c_str()); + } } void CPoolListCtrl::AddColor(int row, int col, COLORREF color) { - m_CellColors.insert(std::make_pair(std::make_pair(row, col), color)); + m_CellColors.insert(std::make_pair(std::make_pair(row, col), color)); } -bool CPoolListCtrl::ProcessChanges(int row, const SYSTEM_POOLTAG & newTag, const SYSTEM_POOLTAG & oldTag, bool nonpaged) +bool CPoolListCtrl::ProcessChanges(int row, const SYSTEM_POOLTAG& newTag, const SYSTEM_POOLTAG& oldTag, bool nonpaged) { - if (::memcmp(&newTag, &oldTag, sizeof(newTag)) == 0) - return false; + if (::memcmp(&newTag, &oldTag, sizeof(newTag)) == 0) + return false; - const COLORREF PlusColor = Green, MinusColor = Red; + const COLORREF PlusColor = Green, MinusColor = Red; - if (nonpaged) { - if (newTag.NonPagedAllocs > oldTag.NonPagedAllocs) - AddColor(row, ColumnType::Allocs, PlusColor); - if (newTag.NonPagedFrees > oldTag.NonPagedFrees) - AddColor(row, ColumnType::Frees, PlusColor); - if (newTag.NonPagedUsed > oldTag.NonPagedUsed) { - AddColor(row, ColumnType::Usage, PlusColor); - AddColor(row, ColumnType::UsageKB, PlusColor); - } - else if (newTag.NonPagedUsed < oldTag.NonPagedUsed) { - AddColor(row, ColumnType::Usage, MinusColor); - AddColor(row, ColumnType::UsageKB, MinusColor); - } - if (newTag.NonPagedAllocs - newTag.NonPagedFrees > oldTag.NonPagedAllocs - oldTag.NonPagedFrees) - AddColor(row, ColumnType::Diff, PlusColor); - else if(newTag.NonPagedAllocs - newTag.NonPagedFrees < oldTag.NonPagedAllocs - oldTag.NonPagedFrees) - AddColor(row, ColumnType::Diff, MinusColor); - } - else { - if (newTag.PagedAllocs > oldTag.PagedAllocs) - AddColor(row, ColumnType::Allocs, PlusColor); - if (newTag.PagedFrees > oldTag.PagedFrees) - AddColor(row, ColumnType::Frees, PlusColor); - if (newTag.PagedUsed > oldTag.PagedUsed) { - AddColor(row, ColumnType::Usage, PlusColor); - AddColor(row, ColumnType::UsageKB, PlusColor); - } - else if (newTag.PagedUsed < oldTag.PagedUsed) { - AddColor(row, ColumnType::Usage, MinusColor); - AddColor(row, ColumnType::UsageKB, MinusColor); - } - if (newTag.PagedAllocs - newTag.PagedFrees > oldTag.PagedAllocs - oldTag.PagedFrees) - AddColor(row, ColumnType::Diff, PlusColor); - else if (newTag.PagedAllocs - newTag.PagedFrees < oldTag.PagedAllocs - oldTag.PagedFrees) - AddColor(row, ColumnType::Diff, MinusColor); - } - return true; + if (nonpaged) { + if (newTag.NonPagedAllocs > oldTag.NonPagedAllocs) + AddColor(row, ColumnType::Allocs, PlusColor); + if (newTag.NonPagedFrees > oldTag.NonPagedFrees) + AddColor(row, ColumnType::Frees, PlusColor); + if (newTag.NonPagedUsed > oldTag.NonPagedUsed) { + AddColor(row, ColumnType::Usage, PlusColor); + AddColor(row, ColumnType::UsageKB, PlusColor); + } + else if (newTag.NonPagedUsed < oldTag.NonPagedUsed) { + AddColor(row, ColumnType::Usage, MinusColor); + AddColor(row, ColumnType::UsageKB, MinusColor); + } + if (newTag.NonPagedAllocs - newTag.NonPagedFrees > oldTag.NonPagedAllocs - oldTag.NonPagedFrees) + AddColor(row, ColumnType::Diff, PlusColor); + else if (newTag.NonPagedAllocs - newTag.NonPagedFrees < oldTag.NonPagedAllocs - oldTag.NonPagedFrees) + AddColor(row, ColumnType::Diff, MinusColor); + } + else { + if (newTag.PagedAllocs > oldTag.PagedAllocs) + AddColor(row, ColumnType::Allocs, PlusColor); + if (newTag.PagedFrees > oldTag.PagedFrees) + AddColor(row, ColumnType::Frees, PlusColor); + if (newTag.PagedUsed > oldTag.PagedUsed) { + AddColor(row, ColumnType::Usage, PlusColor); + AddColor(row, ColumnType::UsageKB, PlusColor); + } + else if (newTag.PagedUsed < oldTag.PagedUsed) { + AddColor(row, ColumnType::Usage, MinusColor); + AddColor(row, ColumnType::UsageKB, MinusColor); + } + if (newTag.PagedAllocs - newTag.PagedFrees > oldTag.PagedAllocs - oldTag.PagedFrees) + AddColor(row, ColumnType::Diff, PlusColor); + else if (newTag.PagedAllocs - newTag.PagedFrees < oldTag.PagedAllocs - oldTag.PagedFrees) + AddColor(row, ColumnType::Diff, MinusColor); + } + return true; } int CPoolListCtrl::AddItem(int index, const SYSTEM_POOLTAG& item, PCSTR tag, bool nonpaged) { - int n = InsertItem(index, CString(tag), nonpaged ? 1 : 0); + PoolTagInfo info = { item }; - UpdateItem(n, item, nonpaged); + int n = InsertItem(index, CString(tag), nonpaged ? 1 : 0); - ULONG key = nonpaged ? (item.TagUlong | NonPagedBit) : item.TagUlong; + UpdateItem(n, info, nonpaged); - m_Tags.insert(std::make_pair(key, item)); + ULONG key = nonpaged ? (item.TagUlong | NonPagedBit) : item.TagUlong; - SetItemData(n, key); + m_Tags.insert(std::make_pair(key, info)); - return n; + SetItemData(n, key); + + return n; +} + +static int CompareStrings(PCWSTR s1, PCWSTR s2) { + if (s1 == s2) + return 0; + + if (s1 == nullptr) + return -1; + + if (s2 == nullptr) + return 1; + + return ::wcscmp(s1, s2); } int CPoolListCtrl::OnCompareItems(LPARAM lParam1, LPARAM lParam2, int iColumn) { - ASSERT(m_Tags.find(lParam1) != m_Tags.end()); - ASSERT(m_Tags.find(lParam2) != m_Tags.end()); + ASSERT(m_Tags.find(lParam1) != m_Tags.end()); + ASSERT(m_Tags.find(lParam2) != m_Tags.end()); - const auto& item1 = m_Tags[lParam1]; - const auto& item2 = m_Tags[lParam2]; + const auto& info1 = m_Tags[lParam1]; + const auto& info2 = m_Tags[lParam2]; - auto nonPaged1 = ((ULONG)lParam1) & NonPagedBit; - auto nonPaged2 = ((ULONG)lParam2) & NonPagedBit; + const auto& item1 = info1.Tag; + const auto& item2 = info2.Tag; - long long order; + auto nonPaged1 = ((ULONG)lParam1) & NonPagedBit; + auto nonPaged2 = ((ULONG)lParam2) & NonPagedBit; - switch (iColumn) { - case ColumnType::TagName: - order = (long long)ReverseTag(item1.TagUlong) - ReverseTag(item2.TagUlong); - break; + long long order; - case ColumnType::PoolType: - if (nonPaged1 == nonPaged2) - return 0; + switch (iColumn) { + case ColumnType::TagName: + order = (long long)ReverseTag(item1.TagUlong) - ReverseTag(item2.TagUlong); + break; - order = nonPaged1 ? -1 : 1; - break; + case ColumnType::PoolType: + if (nonPaged1 == nonPaged2) + return 0; - case ColumnType::Allocs: - order = (long long)(nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs) - (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs); - break; + order = nonPaged1 ? -1 : 1; + break; - case ColumnType::Frees: - order = (long long)(nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees) - (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); - break; + case ColumnType::Allocs: + order = (long long)(nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs) - (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs); + break; - case ColumnType::Diff: - { - auto diff1 = (nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs) - (nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees); - auto diff2 = (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs) - (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); - order = (long long)(diff1) - diff2; - break; - } + case ColumnType::Frees: + order = (long long)(nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees) - (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); + break; - case ColumnType::Usage: - case ColumnType::UsageKB: - order = (long long)(nonPaged1 ? item1.NonPagedUsed : item1.PagedUsed) - (nonPaged2 ? item2.NonPagedUsed : item2.PagedUsed); - break; + case ColumnType::Diff: + { + auto diff1 = (nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs) - (nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees); + auto diff2 = (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs) - (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); + order = (long long)(diff1)-diff2; + break; + } - case ColumnType::PerAlloc: - auto allocs1 = (nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs); - auto allocs2 = (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs); - auto frees1 = (nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees); - auto frees2 = (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); - auto used1 = (nonPaged1 ? item1.NonPagedUsed : item1.PagedUsed); - auto used2 = (nonPaged2 ? item2.NonPagedUsed : item2.PagedUsed); + case ColumnType::Usage: + case ColumnType::UsageKB: + order = (long long)(nonPaged1 ? item1.NonPagedUsed : item1.PagedUsed) - (nonPaged2 ? item2.NonPagedUsed : item2.PagedUsed); + break; - auto diff1 = allocs1 - frees1, diff2 = allocs2 - frees2; + case ColumnType::PerAlloc: { + auto allocs1 = (nonPaged1 ? item1.NonPagedAllocs : item1.PagedAllocs); + auto allocs2 = (nonPaged2 ? item2.NonPagedAllocs : item2.PagedAllocs); + auto frees1 = (nonPaged1 ? item1.NonPagedFrees : item1.PagedFrees); + auto frees2 = (nonPaged2 ? item2.NonPagedFrees : item2.PagedFrees); + auto used1 = (nonPaged1 ? item1.NonPagedUsed : item1.PagedUsed); + auto used2 = (nonPaged2 ? item2.NonPagedUsed : item2.PagedUsed); - order = (long long)(diff1 ? used1 / diff1 : 0) - (diff2 ? used2 / diff2 : 0); - break; - } + auto diff1 = allocs1 - frees1, diff2 = allocs2 - frees2; - if (order == 0) - return 0; + order = (long long)(diff1 ? used1 / diff1 : 0) - (diff2 ? used2 / diff2 : 0); + break; + } - return order > 0 ? 1 : -1; + case ColumnType::SourceName: + return CompareStrings(info1.SourceName, info2.SourceName); + + case ColumnType::SourceDescription: + return CompareStrings(info1.SourceDesc, info2.SourceDesc); + + } + + if (order == 0) + return 0; + + return order > 0 ? 1 : -1; } ULONG CPoolListCtrl::ReverseTag(ULONG tagUlong) { - BYTE* tag = (BYTE*)&tagUlong; - std::swap(tag[0], tag[3]); - std::swap(tag[1], tag[2]); - return tagUlong; + BYTE* tag = (BYTE*)&tagUlong; + std::swap(tag[0], tag[3]); + std::swap(tag[1], tag[2]); + return tagUlong; } void CPoolListCtrl::OnHdnItemclick(NMHDR *pNMHDR, LRESULT *pResult) { - auto phdr = reinterpret_cast(pNMHDR); + auto phdr = reinterpret_cast(pNMHDR); - if (m_SortColumn != phdr->iItem) { - m_SortColumn = phdr->iItem; - m_Ascending = true; - } - else { - m_Ascending = !m_Ascending; - } + if (m_SortColumn != phdr->iItem) { + m_SortColumn = phdr->iItem; + m_Ascending = true; + } + else { + m_Ascending = !m_Ascending; + } - Sort(m_SortColumn, m_Ascending ? TRUE : FALSE); + Sort(m_SortColumn, m_Ascending ? TRUE : FALSE); - *pResult = 0; + *pResult = 0; } void CPoolListCtrl::RefreshPoolData() { - CWaitCursor wait; + CWaitCursor wait; - ULONG size; - auto status = ::NtQuerySystemInformation(SystemInformationClass::SystemPoolTagInformation, m_pPoolInfo, m_PoolInfoSize, &size); - if (status == 0) { - char tag[5] = { 0 }; - int count = m_pPoolInfo->Count; - LVFINDINFO lvfi = { LVFI_PARAM }; + ULONG size; + auto status = ::NtQuerySystemInformation(SystemInformationClass::SystemPoolTagInformation, m_pPoolInfo, m_PoolInfoSize, &size); + if (status == 0) { + char tag[5] = { 0 }; + int count = m_pPoolInfo->Count; + LVFINDINFO lvfi = { LVFI_PARAM }; - int row; - CRect rc; - m_Update = true; - for (const auto& cell : m_CellColors) { - row = cell.first.first; - RedrawItems(row, row); - } - m_Update = false; + int row; + CRect rc; + m_Update = true; + for (const auto& cell : m_CellColors) { + row = cell.first.first; + RedrawItems(row, row); + } + m_Update = false; - LockWindowUpdate(); + LockWindowUpdate(); - m_CellColors.clear(); + m_CellColors.clear(); - for (auto i = 0; i < count; i++) { - const auto& item = m_pPoolInfo->TagInfo[i]; - ::CopyMemory(tag, &item.Tag, 4); + for (auto i = 0; i < count; i++) { + PoolTagInfo info{ }; + info.Tag = m_pPoolInfo->TagInfo[i]; + const auto& item = info.Tag; - if (item.NonPagedAllocs > 0) { - // find the tag (if exists) - auto it = m_Tags.find(item.TagUlong | NonPagedBit); - if (it == m_Tags.end()) - AddItem(GetItemCount(), item, tag, true); - else { - // find existing item - lvfi.lParam = item.TagUlong | NonPagedBit; - int n = FindItem(&lvfi); - ASSERT(n >= 0); - if (ProcessChanges(n, item, it->second, true)) { - UpdateItem(n, item, true); - m_Tags[lvfi.lParam] = item; - } - } - } - if (item.PagedAllocs > 0) { - auto it = m_Tags.find(item.TagUlong); - if (it == m_Tags.end()) - AddItem(GetItemCount(), item, tag, false); - else { - // find existing item - lvfi.lParam = item.TagUlong; - int n = FindItem(&lvfi); - ASSERT(n >= 0); - if (ProcessChanges(n, item, it->second, false)) { - UpdateItem(n, item, false); - m_Tags[item.TagUlong] = item; - } - } - } - } - if (m_DynamicSort && m_SortColumn >= 0) - Sort(m_SortColumn, m_Ascending); + ::CopyMemory(tag, &item.Tag, 4); - UnlockWindowUpdate(); + if (item.NonPagedAllocs > 0) { + // find the tag (if exists) + auto it = m_Tags.find(item.TagUlong | NonPagedBit); + if (it == m_Tags.end()) + AddItem(GetItemCount(), item, tag, true); + else { + // find existing item + lvfi.lParam = item.TagUlong | NonPagedBit; + int n = FindItem(&lvfi); + ASSERT(n >= 0); + if (ProcessChanges(n, item, it->second.Tag, true)) { + UpdateItem(n, info, true); + m_Tags[lvfi.lParam] = info; + } + } + } + if (item.PagedAllocs > 0) { + auto it = m_Tags.find(item.TagUlong); + if (it == m_Tags.end()) + AddItem(GetItemCount(), item, tag, false); + else { + // find existing item + lvfi.lParam = item.TagUlong; + int n = FindItem(&lvfi); + ASSERT(n >= 0); + if (ProcessChanges(n, item, it->second.Tag, false)) { + UpdateItem(n, info, false); + m_Tags[item.TagUlong] = info; + } + } + } + } + if (m_DynamicSort && m_SortColumn >= 0) + Sort(m_SortColumn, m_Ascending); - } + UnlockWindowUpdate(); + + } } void CPoolListCtrl::Pause(bool pause) { - if (pause) - KillTimer(1); - else - SetTimer(1, m_Interval, nullptr); - m_Paused = pause; + if (pause) + KillTimer(1); + else + SetTimer(1, m_Interval, nullptr); + m_Paused = pause; } void CPoolListCtrl::OnTimer(UINT_PTR nIDEvent) { - if (nIDEvent == 1) { - RefreshPoolData(); - TRACE(L"refresh: %d\n", ::GetTickCount()); - } + if (nIDEvent == 1) { + RefreshPoolData(); + TRACE(L"refresh: %d\n", ::GetTickCount()); + } } void CPoolListCtrl::OnViewRefresh() { - RefreshPoolData(); + RefreshPoolData(); } COLORREF CPoolListCtrl::OnGetCellBkColor(int row, int col) { - if (m_Update) - return GetBkColor(); + if (m_Update) + return GetBkColor(); - auto it = m_CellColors.find(std::make_pair(row, col)); - return it == m_CellColors.end() ? GetBkColor() : it->second; + auto it = m_CellColors.find(std::make_pair(row, col)); + return it == m_CellColors.end() ? GetBkColor() : it->second; } void CPoolListCtrl::OnIntervalChange(UINT id) { - m_IntervalIndex = id - ID_REFRESHINTERVAL_5SECONDS; + m_IntervalIndex = id - ID_REFRESHINTERVAL_5SECONDS; - const int intervals[] = { 5000, 10000, 30 * 1000, 60 * 1000 }; + const int intervals[] = { 5000, 10000, 30 * 1000, 60 * 1000 }; - if (!m_Paused) - SetTimer(1, intervals[m_IntervalIndex], nullptr); + if (!m_Paused) + SetTimer(1, intervals[m_IntervalIndex], nullptr); } void CPoolListCtrl::OnIntervalChangeUpdateUI(CCmdUI* pCmdUI) { - pCmdUI->SetRadio(pCmdUI->m_nID - ID_REFRESHINTERVAL_5SECONDS == m_IntervalIndex); + pCmdUI->SetRadio(pCmdUI->m_nID - ID_REFRESHINTERVAL_5SECONDS == m_IntervalIndex); } void CPoolListCtrl::OnViewDynamicsort() { - m_DynamicSort = !m_DynamicSort; + m_DynamicSort = !m_DynamicSort; } void CPoolListCtrl::OnUpdateViewDynamicsort(CCmdUI *pCmdUI) { - pCmdUI->SetCheck(m_DynamicSort); + pCmdUI->SetCheck(m_DynamicSort); } diff --git a/PoolListCtrl.h b/PoolListCtrl.h index 8f3d7cb..905e8b4 100644 --- a/PoolListCtrl.h +++ b/PoolListCtrl.h @@ -18,15 +18,21 @@ public: static const unsigned NonPagedBit = 0x80000000; private: + struct PoolTagInfo { + SYSTEM_POOLTAG Tag; + PCWSTR SourceName; + PCWSTR SourceDesc; + }; + CImageList m_Images; - std::map m_Tags; + std::map m_Tags; std::map, COLORREF> m_CellColors; int m_SortColumn = -1; bool m_Ascending = true; int AddItem(int index, const SYSTEM_POOLTAG&, PCSTR tag, bool nonpaged); - void UpdateItem(int index, const SYSTEM_POOLTAG& tag, bool nonpaged); + void UpdateItem(int index, PoolTagInfo& tag, bool nonpaged); bool ProcessChanges(int row, const SYSTEM_POOLTAG& newTag, const SYSTEM_POOLTAG& oldTag, bool nonpaged); void AddColor(int row, int col, COLORREF color); @@ -51,7 +57,9 @@ private: Diff, Usage, UsageKB, - PerAlloc + PerAlloc, + SourceName, + SourceDescription }; bool m_Update = false; @@ -60,6 +68,11 @@ private: bool m_DynamicSort = true; int m_IntervalIndex = 1; + std::map> m_PoolTagMap; + +private: + void LoadPoolTags(); + protected: DECLARE_MESSAGE_MAP() public: diff --git a/PoolMonEx.rc b/PoolMonEx.rc index 0bf3cd6..9f846bb 100644 --- a/PoolMonEx.rc +++ b/PoolMonEx.rc @@ -148,7 +148,7 @@ FONT 8, "MS Shell Dlg", 0, 0, 0x1 BEGIN ICON IDR_MAINFRAME,IDC_STATIC,14,14,20,20 LTEXT "Kernel Pool Monitor, Version 1.0",IDC_STATIC,42,14,175,8,SS_NOPREFIX - LTEXT "Copyright (C) 2016 by Pavel Yosifovich",IDC_STATIC,42,26,177,8 + LTEXT "Copyright (C) 2016-2017 by Pavel Yosifovich",IDC_STATIC,42,26,177,8 DEFPUSHBUTTON "OK",IDOK,103,59,50,14,WS_GROUP END @@ -242,6 +242,14 @@ BEGIN END +///////////////////////////////////////////////////////////////////////////// +// +// TXT +// + +IDR_POOLTAG TXT "res\\pooltag.txt" + + ///////////////////////////////////////////////////////////////////////////// // // String Table @@ -254,7 +262,7 @@ END STRINGTABLE BEGIN - IDR_MAINFRAME "Kernel Pool Monitor" + IDR_MAINFRAME "Kernel Pool Monitor (C)2016-2017 by Pavel Yosifovich" END STRINGTABLE diff --git a/PoolMonEx.sln b/PoolMonX.sln similarity index 85% rename from PoolMonEx.sln rename to PoolMonX.sln index 9b4dcff..fe20977 100644 --- a/PoolMonEx.sln +++ b/PoolMonX.sln @@ -1,9 +1,9 @@  Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 14 -VisualStudioVersion = 14.0.25420.1 +# Visual Studio 15 +VisualStudioVersion = 15.0.26430.6 MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PoolMonEx", "PoolMonEx.vcxproj", "{26A93265-52DE-4226-9974-AC437B0EC988}" +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PoolMonX", "PoolMonX.vcxproj", "{26A93265-52DE-4226-9974-AC437B0EC988}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution diff --git a/PoolMonEx.vcxproj b/PoolMonX.vcxproj similarity index 97% rename from PoolMonEx.vcxproj rename to PoolMonX.vcxproj index fe05518..bce0fff 100644 --- a/PoolMonEx.vcxproj +++ b/PoolMonX.vcxproj @@ -1,5 +1,5 @@  - + Debug @@ -23,19 +23,20 @@ PoolMonEx 8.1 MFCProj + PoolMonX Application true - v140 + v141 Unicode Dynamic Application false - v140 + v141 true Unicode Static @@ -43,14 +44,14 @@ Application true - v140 + v141 Unicode Dynamic Application false - v140 + v141 true Unicode Dynamic @@ -184,6 +185,7 @@ + diff --git a/PoolMonEx.vcxproj.filters b/PoolMonX.vcxproj.filters similarity index 98% rename from PoolMonEx.vcxproj.filters rename to PoolMonX.vcxproj.filters index 8093309..e63ea26 100644 --- a/PoolMonEx.vcxproj.filters +++ b/PoolMonX.vcxproj.filters @@ -16,6 +16,7 @@ + diff --git a/PoolView.cpp b/PoolView.cpp index b891f94..6053f51 100644 --- a/PoolView.cpp +++ b/PoolView.cpp @@ -3,6 +3,7 @@ // #include "stdafx.h" +#include "resource.h" #include "PoolMonEx.h" #include "PoolView.h" @@ -10,7 +11,6 @@ #define new DEBUG_NEW #endif - // CPoolView CPoolView::CPoolView() { @@ -30,8 +30,6 @@ BEGIN_MESSAGE_MAP(CPoolView, CWnd) ON_UPDATE_COMMAND_UI(ID_VIEW_PAUSE, &CPoolView::OnUpdateViewPause) END_MESSAGE_MAP() - - // CPoolView message handlers BOOL CPoolView::PreCreateWindow(CREATESTRUCT& cs) { @@ -58,7 +56,7 @@ int CPoolView::OnCreate(LPCREATESTRUCT lpCreateStruct) { m_List.Create(WS_CHILD | WS_VISIBLE | LVS_REPORT | LVS_SHOWSELALWAYS | LVS_SINGLESEL | WS_CLIPSIBLINGS, CRect(), this, 123); m_List.SetExtendedStyle(LVS_EX_FULLROWSELECT | LVS_EX_AUTOSIZECOLUMNS | LVS_EX_DOUBLEBUFFER); - return 0; + return 0; } diff --git a/PoolView.h b/PoolView.h index 4ab3f09..7c2c262 100644 --- a/PoolView.h +++ b/PoolView.h @@ -34,6 +34,8 @@ public: public: virtual ~CPoolView(); + virtual BOOL OnCmdMsg(UINT nID, int nCode, void* pExtra, AFX_CMDHANDLERINFO* pHandlerInfo); + // Generated message map functions protected: CPoolListCtrl m_List; @@ -41,12 +43,10 @@ protected: afx_msg void OnPaint(); DECLARE_MESSAGE_MAP() -public: afx_msg int OnCreate(LPCREATESTRUCT lpCreateStruct); afx_msg void OnSize(UINT nType, int cx, int cy); afx_msg BOOL OnEraseBkgnd(CDC* pDC); afx_msg void OnEditCopy(); - virtual BOOL OnCmdMsg(UINT nID, int nCode, void* pExtra, AFX_CMDHANDLERINFO* pHandlerInfo); afx_msg void OnViewPause(); afx_msg void OnUpdateViewPause(CCmdUI *pCmdUI); }; diff --git a/res/PoolMonEx.ico b/res/PoolMonEx.ico index 56e16b0c7ea829e793dabec1597931b64e7fba17..b5313127c53d4f11dfb22fa3ec49b4278817a3f7 100644 GIT binary patch literal 26694 zcmeHv1z1&ExAu$Jh27mA13Qn3-6#eYwt#_!sGy?Qb-+XsR8YDML{P-S?(U9b>ycwC z?(x5KZ8mN>9;_U97d{T64@A^BrTnYXc_8h#Wbf9fzg^<^U*AK!1KX zJ@A6pN|ex_hhzj|vI5nrC7)*p`sGFP^Cd7eEs(y9;rSAnmkAhE!SH+ugs`5s)eX<{ zyezP`8NedoEwCC*4jy1(qW=GD5)r&w$m?M@P$;?zhKoPm?wE#<@_?h4BkJ(}o~a#J zG2c1X7ZV&yqsBD{v{`=$`|L8H@|4QJML{R`PDr~pBc^*cL!*_e;nS-KB&Hh*FOEak z7p^F`{RHx??}VG~4Y6n02n_a)g2@L#g#>FHYX#KV)EJl)ht|U@q2gV^u`y*Jr#x|M zG!V)A1>6dtyDY`p`Z-b2?+`FO2Xd{h3oO|O42eLN-FJ}7{~VC;9>*rvL5rK?AwEF1 z-vyNqG{?z>onYr@hg|~;AZtioq+6aJ*=B8l9GZX!)7bt+?5`b-fT@5Sor7MBBT$}g zhtEl*cZonQr(B3@3gikehe9h4U`x|1z?KI%vTP8}PpgUyi?SlDCa|p|Pr*kShGXiC&D_IqZhTbBTc}EIn*wgskKf9-&48ER$m-b&d>K_csJ@}}zDj;+ zw8LNiQ+oD|k}Bv5@@**sJ6VbMyJjK0Bw+0}5p{V#*0m#+{`m$NHU~A2+XB=PPLqE@ zi+#5-!6yQ>7H&i>w_3n0!I^H9J-$8Mx}=BOI!iR@-4Ae$!G$U1(RoE@U?tG;sS6%@ zTVn9FXZYnnV{Dk`h^=0)UkegY5Z9?&icBtoV@n4EdtM{|nAK=7 zBM56{JY)wfJBSmro59Q{ALl|KI=x?vKchyYK*R|Y z+*}Wqp9Be1sm-qs!P>ZRJJ2^@Xy&6Jx z3`Vz84`Grd$l{y@W*$4J%QHfCNrGb)^j^>#gO-Kk)}m%;I4I?XpBaLHQt_>EVR~(} znID0Si!#B+%LWHVmOvJ#K$Km)4ZmI(h1)~91h$(ay>B*T4=#)t%k;?jSn%oK66)qi zY_zL^gh^eH&oLiL1{}lQw!m?x^4Raz2KiPWK`=$@{CE~O=`%p=6Drs{u=(hT;*SJ! za0c4kae!>?itJ&h@jBKSTjtmz+o)_PvZ*4vzg&cx(>DTa$9c{RwHM@`oExPllt!`G z#@IQuIILG&!(@ajK5^d&XL2Z@_ZICn4O2B4>`lZthcWqaAU0MoT0eTETe; zR6WA7``#mn<9V9fo7&UNxTgMO)oLHy+>X~)9tB4G!^B}G_DL zP9GE4iZ>o|9=?ekj{tV<_O2}VW9h^5Ddt8cbB@qXigfZkyeoT({_0*OI_}<5wBL2O z+XqJ4@_IRJls2U_v6js;oCe9d*0x{`kR`bnR7IUi;GX%@K;{Lo<3=L_^{^z z_R-O!vrkp-_|oP6xM6;+Bi}D^;Emi=e3dI--S?uz%a?nCuVfo*H#1_$;g*Mcac$eY z$g`|mmO_R4HX6`i?x%D+J`HMl_!rJaOUq1+2TrX0wqX9#1wz*sTVQe0q8`WZ*PHXA zY}#b3(PZlR3HEEu);6~-xj0Ns^0EQ5ZC>Zy(xuDwwr6Kt%TTqvw`#4Hf*hAK-JVwF ztnTz0!$lq^AG}?$V#R~Q%kV~1qw5Jtfq{WZy{+%uDRb8N`tRFSx>fx6@jGR7M&;dB zr%97$_39Q|<@lYmM%OQHeD=(0U4=j2w3Fjy&V9L2H{Zez{patjRruJ}t#_zH4XM(F zOSPQSyEpv2;YcjktWomF+^6fPRi!7@>{-g_>NoyWdxz+XBk8>vUY5v!JurnEcbxC# zJut(2H2Fp@&TA?+fsR?dTkT^dm@SwM`4sqYH-e(VA?i;0dwx-_X7C&n{x~=R66E71)+LVJ_48h&yE#PwZ z8TxhvoP#^#&T!)2Nd-}u^}YxjLiq$erxK*@eg*5>?@-KT1;XY!K>|ynfY%<38$mtZ zH492doJHkl0@L}WkZneLRP?Bb6_)u?FsL4SEZc}`M+N}g&$<)SH{)h0+xp;qznt9D zHlf<8{h*3Qi&IZ2+c8vJuo>Z#2P1M&6CC7YmLbgd960Nk1;0IWQt(DB0@92muQI53bl z&TRDIKyI}ufWB;(gjPj)VuUl~W4+>E;XMy1OB59?P42Rl%|cBg$5R0IV!o{ag@L{b{h*&`F zp9Q1paIUa#7ZL~Un}UAav$9Tag2p!nBT((L;(@#yDq%z0Oo*H|0=JiU#1@Wwh1g&9 z`}I{F&f8@H=I2KruRi+yYw{J*D9LrvR&Ox>LkhY*?xE*Edig?b`SnhF6xwmKb&xf3T zg(>_`q?K2$5H|f?8Xcfg-mh;@$$V+Lx-zq2K!ByCWzPV!D_;uORL|_;@#>Px(yo(v z&yq_0L_mPqqWAg|jeqy>a8Eq;$|JL5LG5O#Ql$>C1~W5lqwN05J+Z{gZFOIHTzbAR zFpxJ7cj+=fiC|{N7c^Ek+qPYw-~E-x^R4QpZuR5Gp_Z1a0P+1jb#whg(>CgUeRVS; z!r%XMPwoD4Am{q^rrbi$RC9Otc)l~Ox;bY~vHOFy7d+s7-aBJwXV=f&{Z-4poq4a= z-MLR!Ol3O)0w~~h-iwbnH$R$~=-x6!yV>N~yuF)MLjz_2?aa;16A}_^9ZIPCAD{AO zvlYc>e^9+-$xb}Nd$wD0dpW!;k=U}q-FLj{G<){!bVJmAD#mqNc+;X%m2BloBp%Px zs7TY`*|T37ZmzDb-EP#JIMMp*Rjt4(!?4{M_CWrSjZ>!{lbNMY`j>xa^;Ji-j;p6 zIBslYs{T`NTata`wtiQH}?W+=`zm*F;Gx`)|~(BTJj zhTEJeNz8;>Ka}ORiB_}1Db<((vH_>Gy*mmu_7mtRoU)}8OeRx{j1Gj^ z$V@m-n>Ko8zprr$v3nafxQj;@q;w?*NF+kiEv ziBoFAWV{LYUK8S!sTd%BNaNB97B`0=uyHa@iTnlYTjfOf35{lW!zsaCDiWvIqr~32 zMmQw{aY`)4yb=0Vc4;^zUvNpt$<-(|y%aujD?{XMTqI7ZdZ+~=#`naV$Ube181}G``dq zIm1e!_v5MbGkn1*{ogOehlGVlvmjo>DLV(`&~VDNd3A8aJ~JNpbl|g&8cwNxq`e-e zG*vjo1dZko;x^y7cAM11XK@t_mj-f4!`$m3J&i zDKvyu>aYQ$sRxLHRMLPP!P>TMZ53Eka4)5>PPcmXZpx#Hl-vgQ68ge~Z*2&^JT5sF zRN#*QPa(XBh_wLuj% zd}w#{rM^7N5?v|?d3WyI7sQxa4f^u;+UkKO(PX^CF`~&=9t|Q?SylLHlO|1GD9ouO zQm~f5_MwJ62|dlt9cpO;HJGaKrz-sH*}QkNH4LgA(B^4QQ@&UaMia6nmv3Y!+)QE8 z1(t#O8Z_LU(=Hjg+HTpBt!@cbL7u66^SpV@?yo3b-08*aYd!T31ZZHeUA%(13d(wU zWvfdx>+X?faFchc@Lm=sYMq_#gZ};6glK2Z7puY+l_q2>x2;5CqDP)ajaKZ{3cq-9 zjTm>W(=|~~Xfy7JDy+b+L$+Z%hB?$tOl(# zs&J(VM+uD;{;jtrM~0%lVMMpT78&zIU-%JW@P}Q470hON3yU4Y>gfv;EoUIgymjkV z9fgN~E%`b0(JqCV&pA6E=p3N=2k+T=X@wIK;vd{5vQA1ObiCR}q1!Ouq6G#hgzen< zL{H08T5+J&Hq&_9gaq@1(%vknq3wPZwhFT|H7YN z9{3y7>tnDD)UkOV!h2N#ZHQDhhM^LlSe7%`3(X60;PeuuwmH6(Hx#A?(L7Fr|Eh+f zscaBK`KxJSlZ_2kzK7nR-~&Zd*(8SY9Z$2IGCx#mUY7QSvOsQG74$v!*aFt@cje!VQw5o#{`ez(`a$Xcuugw*@l{In zH}CJUxN>@yV^RhZEu^<^%f7u>woh0p8_^&S3dfE8vrnPLJ<75mt*JtN{;YE=EG+VG zhRg8SrX|@+j~_pNRfp{D|7PMCO8yf^%~+!Q%J^ueKTk5%A77fN$9L#3juFMaYE+Zc z^te%Qj(ki0ija#V+2?H4k&h$f=Lk79LjH=77bJx?RM1ftA&*Ef6v{H!r+M2?l4B#} zvj`$?>543k*O7A~z}%m}$A!nmiv0kMY1vHa*2a#@6293huR$e|H( zUWD8rA)iOc#SwChgnS?&PesUY5w_z<%JcqL?vpblOd*cq6l+-qgp-9Z`{7Dno`k$2A$Lp26%+EQguEo7KSCE;1euJVG5-6?Ak-q?OvvXF^0$QC zF(HplF1nfP_V&%BBVS1v>ds^QjPc(O$0FT1=ZbEZ=UHsHG`r!Mb8a;gPfe`!_?Tmv zbB9J&jNjck({IM*{}X>}y5kV_D_4^nd*)mD$N48EG?51UZ4dn?B>oS-V?44_H;rIE z#s6<&3^l`#rXd$hF+RKt#zc5x@(#FIUUJxYK1VaVUl zBTU$x4P!$oiO&u49K>XNhz?@{srxoZV}^B8YOYY~#E;-R$zjoSBQ>I!`4;$0`Stp3 z7>-lVa8or(Gh(yAHFiG62L6HZA%ZCz1v6tM$KsuoDTq38y^#0AYhT_;UV~r-vyX`s zjjF1n{uWJ#a(z=fKV_f&l2XIOaCc1IESSAb$mbApa|EkS3VA4kalzDyfs}2GkQXE- zUhEH_bV44BWC_S8bK zFX=ELj5;$^$ng+zY530kLOz9%Ga~snRb#Fx0F* z*JHuX!)lMva_kc!uSBr>jgV&~n8bdYxKYRp5%PP4Tp%H5M(8UP@?eDg4k7dn_R&fq?@Gvb z5^}MG+#<2nc?-E_LSBxLn<5QQ_S9+br+()+Urc#__=P8oZ;J`vNiLd@yCvjINyf(_ zydc}zmyn2@t2_YFNtW$eX}{Kb&VnZ_1TsxY+D%=F@Dwe{=V1&bMJ61Ug4Ug8($RV;0E!_ZD;Q9 z(`(BHzCW@x@d5W{RmYmT{JS11e(#;e_m1_zZ{#V-UCuX#--WJidBAx`3Y3snC!0AI z^yLb5L7Q{4pQ$boLiapw7w15^@qHx&tvqC&(u5%c>o!4Uu)x z{Kwu-KJoyp_(YsQ3WJbWDQ_1;J}iYKF_T{?aipM;d!=Cq)sA3}cUUcA;U7%b?BGrA zn|!9eWaxl+B%_c+C*(>Bd0;~RmyoY0+c?LzbmSc3c!bx6%@4jFcN|Q7$=?+6{e*l+ zAx}}r0TlA)M2`Cid7MHnoNQwsZDU=k4IAoW*pI&d< zg&a*GKTSUEa@9Q#?yI{n&0M#wb9&ugiy!YFCC7z9u-MTV4!f+eC}B{xsKZ0^T{=80 z{~vn?n%&=Ko#Di$b|x`Fjo{~3AM-a_px2Me{+}*Kwe#P|pDLk=@1_jE|KF1niW0lc zCJwpCnR$Wu$B|7=^KUiV>0l0w4$ku3cetZ2_pl(=_Cdoc)Qu(+>CvG5LX5P9yr6%v z_r(ORfvqq$BnEb?KQYGj2BX6k!a4BE9^j00#Cg{IpyvSXH(iP?srJzskgQ8`5hwC* zg`0-q3T;&eiT{h_xGy6nh7ZD+WoI$eO9ux(F>wn14CiniMy%y~*51L$ZB|%H#5xnV zG}~3#uc}T1PNY61CYAglr9UUPUynhDBaw1;`=$gl4&=t9=xOA_KEy~r;y&U}7hReF&YWQ>&h?#1C*6^tluc?0EUPz3}wrHO~ zeGy~s-clGJ_K^G|VxkSiI$QLZb-_-)GeOA1BR(XaR5GbP7|e1r>23Lq?=z~?#K%;~ zw~`EgX3ROI#z`x^e}Q|XhGW0Tp!^oqQUq`gpRU@8IokybchP6DpKUmz$F)AEggiuI z!AN3NV)Rk#^!3lr&-;)x-e2m>?4MV%1r?SYp(UA1OXI79_1I0}LWQ9fmR9p|IP(yr zac~Y_q1EX{T)yhK9!vYO&Fe2PUzV0F2M~jY3uFC~!9S~zhs8RJu)b2n z))gh+#wx=2GW{d9g*+|E{2Tj8;YZr=DHxl$1a|yqNG_4>Ja=dP?366umGOoFX!O2AvauW6R8)Q)a z8Z{0>ISUMFazq3|SYP-}eVrRgu!!PET3bni-}+R@b>urZKCYYC29EvkNFfJO3U8|^ zMYbC1Y$0WKww3aGIuWCHlS=!0O1s~uN%8P1di<}}hmwI;P?ZGk@pyWR-7d$j9f^z(8O$6?ea$vU%Wz5%PtFd|u%<2OI;A!?;)>Pguyq74m`UOY;(PJ!#9VrfsuQ$ZZsIC8gW*snY4O zGsj`7^nN{0S2VPePScmlmKuvQDfKVi_dAkU=SSK)I+13qkNj65Z&uRX=Jm_Wx9G=v zE|PZPE*&|`LTs4B$jUiArPDJPA?KBL+)$3kK-zS@rT*Ej^c(im znICAKlxBhHXU@T^DfO>7aE*LXA-`0rvcGYi{XjcW*(>TuzN?V0EaV;wdAmX$rjU;- zvC1y$nngky63149tfxIezO*#DJy^)KmOAIHrPe7++VO2TSDH!reGR2(bXCc+ET@j+ zFe#;eud{Xtyzl|>dK(GHS+BBHPl%9TD&%a-L1J^#d1Y@e$o{^N1N})C9?WaD1to+y zI>>_d4CM%>96|I?l0z-!4_QdzICCLSRMIcX^qQz(5BI29+`GueO_lr~7lHS=5mwkr;<2bEnUu>&JeDIU$sx=;5=bmwi_Tyzoz1>GjZi?-9lX~RN(iU3% z8{2-d%K|wcl?kcbu0NhATks}zCh0nw5BLuCm&%%r$m5f>RyNpP$(5EU)~oDBC4=%S zD;d;Ss6L3OORfKt>8c&xyqL!}Qg<5Ltm>MwTVK+rP0qS(r5&bhKIN0vY%sR`8#a;H>d)WkKPRR$wr$_h&Xs*GvYqwr;M$C}`XYm}pOt+ZS)XX^ zC(=Sv&C$&yt;88CT#sjq9eDLD{~_hF5(+ z``!O1s>h9%NPBt&KFb=`v5IxkH_2}!gxq)GcN!ugl|@3UiJbKma^qz$?P6tnD;Z)s z>+NqfAH(Wk)6dlZ&>or2kISm#cPT=Cz3{sQ;rAW1%k5~FJF?%WGOoaw!o?7|)hiPiG?=qlRoONIP> z;deItTloi8$gAjyy1Oen=}wL>uiIg5BD4}@V?*rt*K5~5@q9Ffo|{ng_0@R|b+?wa zmxsQ+<$0K`yo|J$=fMNyNkC6|?AJy3t$^I~Y%ctEfU%Woa?+);?$GE;x{Yl!Chcj4 z9zR>ZdhS|pWZK&WmDm2JjM&iHJbmFdk5t#Bx`2{zGp=S@H4 zto8LV(!U|BV;i9Czf<>r$Ftn_nf|x%r%Px}cKcu7YyTZ1^M7@u^nf#cCn_R0411aB zmtee$^!Jqe|6Bi@#m4ZQ_!{<{Q{(>wx_UxnVT|yf1KU+kV7E%|t8(yV%qf(9Fve1cdM9CIfFJ!R z`BK`k0QqT`xDqAa*L)4}CYQo?+M~Tl)CMvcF$b zcKQXFRX;1+R`qi#nKeHdaU6)>%512cq^$$m7Fs(-@kslIZTQ4CxKi~0+F#pmzbRZc zcVN7IC*}IA`Nfos1|OdC)l83;f?oT`ZHZtUlJRCW2E*4V`RT)2OCQ`oy${h?W@2kY zKhtg#+KQUYT8w&?DSd9HQYo&PvY+*_V|7&XNVP$Y!%)sS2W;iK_u=l5i$ zyr!$uOS-k0>66SZ8Q0~Ix`(@|HLcc%z70wzeccANzQ6c~jOUWmhV0ZQ_ced8;tME$ z%uM=3l<#tWygtsqc%MGj?|DS{Z4&1*+opVn%6F&ym&%80%cE-zA*V~UeqP2S=LS}p zh>0e12Fjd8^QC55pIeLHE8k{T`Wl;EvDeG3){1I_YKx%_O1JX!Am+#4oJY>#o!Hkp z_OT9g>C;j^UXQ(cpX>5N0)r1!@xOddOUq;Q$xY$7D8HNXzmDO3ojU3=NPH^_0=5WTA0#UOnpti+0S~J%TVSD^s!bZ zU!uC^V^zN09*J|ltasH0XQMVKouoK(8tO0nW=S#y=H%Qcp!uN9LQ0UES4Q$gDxa{Dxf*4zrSUR~ zY;CCdhKt5D7Mph-VmdpWeos(3OYIScHW+l$Fl`JJZSw0hdBa3)zNkJ{d=urb4!lfR zuj+l)iYKD{)`}|9KK{1MMPnLD@oi0{#P(*I zKU?{F6|bb<`=yNSO8)Q~~@5tK%<@erv zU(ZL;eBV#RF;Pb!KG(I1iKz9SvKItPx`~}N|9inGH8=GAY>>HR+!vY4?Y5K(d#yC? z$}jtRNWXVWCGXl2`h7y_UgI_xbdnw;{dGT^7Ud3a&K=dq-;!DJXq5k4acSaS%4GU9 z&6e%qUcfn|^s9;~sl8xikffj3LkdJzk)rgGtA18-gVOP>G=8RD<}RAd{BB*U9_p+4 z)~g>KBz@m4lj4!)`goVx>x|oA&`D|?4<{=%b#jaL(&mlw^+!L{`}?;&rL52OKL1^b zdLMkk8^PXpGK+rTJgd0Q$;;B_kXpxT490{=hDkP3IHCq)0Btmx%kQz2iV3M@9!Or# z5UF!&m^3^;N}61Dqi{4JUHGgfo( z1G%f8H2&%WT9<|W7|WW?{ek;&${Zp$E2GO`DH>8oe%Y_$CDx23^b+&Ks-Kn2wka}O zTp34SwljU&u3B7S$mdnU?RmFc#AF*&ONp%3b(9p%$Cyl{j0ntjwX8UG3qi+o1M@(dt)( zQl*(OaazACc~yMoD6{g@pQF4ghN0pGiW~KmIgu0*_J5hsGnAiec$U!|8WSv;CXbQ= zp5>+H;X%^q;#e(qV=QyG=W|8HQwDrk#<<2Ra<;r>$mbR0Z7q?(Ny`}PxcJlI((~}u5a+W@C7KqL31v-ACsh53bavRjXFcvX?k$+a)DO_Qn-=~}^R`Lh) zYi9DT6<4hx<(1Jq7mbM&eorlpJgSKOph7aQ zWhPlXqO928m?8tjPX>}7*YCYS=2+;k^SMR8` zF3r3&I&Cc|ojMkWzajrMyrit`VBn{ zgz>oi!RK}S7F`_L)fV6SX(Y5ZeccV|b8o^U{oNroAnpST3BNxVelsmriPOaL(Zpn# z9a3a&a=9PlQoW?!neI~iWM`>ytUcFITV1`g-9MRm=l`VXR7V{Ai~RF;o`a5YF~-U& zFfQ8YPm$_suB&;k=D(U#Dt?$Ovzll5qb~`+W0$!-E6Zle8b!bKX8Pziw&Agz-fzFP zdp0d@5NyHNK?8jpX;J&k(%-*@@H<{aQ z%W6uE^IgRJOb0PP(wZ_iBX7|{leuJUb;%o0T*DNmZl<3o_c_`X_LTjvK7%z^vt!xu zP%PsQ&V&#{#B-n3mjzLK)%jeQG{?6*o}v8`Xw&953IxJeotiYeIS~C@V$w){*?=8)RFNOHAjQzN6kb z$hh7@&ihWZ-SYpX&%brS=XN2iIBAE)hoWf%yw<+=P)aK9sm_xU@5=wqgq@TT4(qn1*rPd|hUZg+Z9CM0{w67JH)j0O4;*wfy zlD6v;-;T1e^%w4@AqJ<~pm>~yHjtC5TU8Ufpn9nCvoe0~xvNc(mh1GxWy+@Fvnevt zK2^L~l~oMYIF5Rq=YNLvlql*V6~9w)BNab0v_Y+BLmL$5Rg=HwH?aNp1pC2zTl*tD z<9Htxw^wm|4Ln~1*H^`24e{8Nm@N1Dw;OCE#wxAGJ2h^DioqFll4^rm&)&75TVDsQ ze^8`na;!&{`aNI%A_-`jQJ# zK-(WwEZWcpwVsXJp!6!^^16W982Eije(vruYvg7u_A`GP?`s)(uHx9nv24S4Suf@? zt{ZJ5N5_=b;@B#VY>20;IIeLU)OuEHIH)E)ZvQ|!)C2i;_l8cz*p+-KGV(kn?!JJr zcV-nA*J9)R`}5Y`a%Qr*@HgT#j<+Eet~ddy+o0BPKplD={(*GL8buQNLZ{;N1{qcC z-Vnbxj^P_P>hBgaz8%wBF3zm4?bixdD12dvA*XHw_X3@N9qwNLK;kz5#SaXC?%fhS zhdxC{o~vsHE`Wg#kmSj^vz#&dxc+k8y@l*1)=-$}TWwH!Rm~;t1-hVGWQzU+=}146 zJ2D75#asAFM#`DAg8j_v>YjL+2!9`lyn^(i^G++WbBOSFb~JvI!gGc;C|-wwPoQ*? znoCNL`q##~e?WYk=#L5~?1-?vm5h|vAmi%HqFc*v4gB(p_!lDwqMS%@72yXABH{cx zC&5J?uI(-Ri1QT2GqgeRAygX-I!VnXu3;VL|Av1;{dc4;MM?E>8jnNCM~1e#*a>_)oPV-dfM;Fm6Lw zOXvdY{5-GWd+k1FhiYdXbLnJTcgon4GWO-%wxx_@BJLvZgZ-@AKSOi}=ZPFy#BVb^ z$-VI6hefMJcXXvZ3mPm}=hTtIwwYuX`#zp|2eW}2qsBq4f#AB|unoT_*bm-&;D7?h zhh|EW6YiAnH-7i3WL!=eS88(Vj(W-GBP;j~$Wr;V&t2Z{nJ4de&XhNCQ{~OJ$?}eW zf7rKBbVruU+g&qt57zb9ou67$x2I1AjZdQVs#?cE^}k^o{-BKiRk5?SSa)f9Ro#n- zk@9-`H2JV+4&|Cb`KHM0n2D0O*->6@94Rlthsv{%A@VecToivBd9<#l@VCmyN9imN zygSP8UTx)f@3y)}zMXY1f^9zETH5OK!Qn-9!Ocu{VT~EF_=nQ<7D&r^G~jf91RU#& zL%aIp(LuXxACHeMraL#KvRs){Pi`)1F896K$?vP$$^8|rFOgyJ>Hv0sTrxn$5xZsbXzJ~ zTtqJGB8hjzlXHYK_1`s~vP-k6+Z+toohWE;7CGB>q#*wwYP-yfq9;a^TWu6&j>{y9 zCyGdoAd}&y{o5q+eItXs zL%k{fy*wH)Z2<9VqR!i5$nimcOp>TuZ6?LVN0N`X4|VM7NG^d`9IPL?5%r(lpOOla zsH;a;YCW|rd2CB0rw&dOdtwrG-W*NY1=-~4;!6Je2a#KMSBm>!22m7|hpPv9cJm~k zm->*|NDCTVJeUaYh`JDY@9Iq{DJeu)XL15ShM%u51@6ltlTodx(>kn05K;F0Y)a|d zn_S&p$<@t;Tzy^1bR;@4MH{?B^)fmk^#Ec3c^7!k)B(U02+KpA0Usa`2myK`+d~TO zUUygEKeYnB1{cQkb!;E*c29O{cATw`CAf-j1i7Z&8%DX*gSyId^2qdYIiu4iQa>`2 z=g=_$_MRyollunb43_7R@q>D|>C%0|h{Tv6dA5t{)XFb5q1ynj3>$fNpvZRqfmQ>- zF*?h0>q%p$WOZ;J?%FZONuHx=)CjT|kwcl(R-XG0?d39LYR_Rw-obt3+1I_{GL>iZ zTbDJSQQ_8QyoO+Xbf6VcCC=l|fwYmfGQurB>!}7v1dsnUF7U#1fPW^^^|VMk@MZ>| zX7EV{FJ|ye2Jd3B|R@zWucnvdE}C_&tM%GGqZm1~KFZgJ&~j34>=c__S7r ze!-88+CyeA_$`BHGx$A2hB4$1L*6j>FN0q*WCBBGFyxF;d&oY9Tw%yGhP-6RCWdTb z$P$L^V#o!C9An50hP*Ut4|%EP2>Ha2nGCtckZBA#%aA3i4Dv~(kdwykBb*uXfgwW} z@_`|P7&4b3XBqNFdoS@Q!~7wCjoL#VYHRF(Ix<(RH)OqbFYiLu-$_d$*Nxgk_A%re zLw+)3Iz!$uWE4ZLGGrb@mNMiwLq0R)rcry@gOL4q1n4Bj?T@Wy=qGoE9q~=u|4Ziw zYx9e*e+Qp|$|x!jj+~XE<5|%ynz2%0f-2AM~-rkt@k)M-@@ z@=Nq1yCvA5&NDDGq)IXvi2WhG@4aVUqf2W1nbL2cVV zm|_#-DEbeDj~|sczQ8Kg!dq~=cCB=(NGGh8A6t$+9>_CO_4LXRYNT9Pp9IdVjB3}a+*JTKK1;= zbn^A_CHH50(S-52G-1>P>h-4rvY2c`UVGE2%`y+7B#bi-YcgXd1qBC^@1B0-x;c(4 z$Jmh1ek`iU6nXj40MzU9%5t)s>qcFkiK9-B1W?bvq*fZ0}-#36vCz+B@U0<@B=|Xdh=8|vi04kqTjxnRj-^Y(4!^0^lK0(t@ zW#e@P{D5Gf2M`PN0y2R9zzD3PpC6UaE~fw=D9O`My`~>ojAj*$ zi)stKU3B8|;&NqE5MD{~%wnZeD;+otWUSyj4sd7bT$ zWuA^(J4*h&M0mIOx9bJkx{YWJQLf~7A*v&Kn&`>rX)vrl)KK|8FBfcFV_Uen=ejj} zQrE6tHT0<=0a71_Z74 zH+xD~bLaNGtDosrF>Z8DanJ-WKgrK34@_z`XMEa2G4A(w?=gSDwCMw^C4U1^?Zb=v zM7ib9$Qbqb+*zBRqp6Z#PqcgK_RI%{_lax>^k1=}|Ld*hJT1}B1f&)0Tm5?<54oF}6ennrt zCC5C~pgF=D{tsS|QNKjrP&$j~NiCp}J`bMHkf{tg&*1wE*}{;`47tgWRSdb#kQEGh z$dE-0`JiDA(%HZgptzhN0~q>2Q+K+!3kR2l{#jG&R>hbQ*>{V#sfX%+u(RHdr6XK8Ak6kdIn^7}7K#1Ly(B z+6@DsiphFGA2OmJddDqVWQ~O`GXQ--Ut{P^${vEQq}fw#Q0A!R~WLDq1!O@DP>PVM`Y-N3>~e(J`h@<12XhG)dzGJqyC{sGV~aR?!(Xt z8M-J#hh*rM4E>Cuk1%uxhW^ITV;DLVL$6}!Q4HOOp&K&vD26V{&>M~Vht9^(gBW@w zL+|4rXC^cBC58^h(D@j84MSgK=%);QhoOfubW4Wb#L$@-dKg0wW9WYjz1XOK=rXs~ z2R0Y$lk;`fR4-1 zp%{7~L$6owTkT`no3fY1zJ`sg&acpgvkm>;sDJ2R4dbi&vgZWSMpB$r*c!Latn44X zohjuqhOP~Cb)){_yJ;v_{6<%|(Y??rJ_RXj2N?D*wz94b>;t3zq06(30iBp(2WV-- zy*vZ{fFIxk1o|=bbB4{q(2*H71w&6}*h~!D!Ki=u&Q)Fuy!;oHVLs|oeZm&LQ+xWS z>ix_1_D|X6{~mk%r`D`NKI+%$zcJP8OTVTb=81(#1oZxdO0hAUxrCN055fHUvXpX0 z-@=imJbE}C5L8Dovm!a=*UQVV#O0=Q{hPQrwfVlVR{}+CEh!j zXduy$ukI&a+nSu84Wq$>2b1+f_VnnQN6G)hFmhPrO?@sbq+SOnQg`?<%IB5S+((M3 zQ(Xi_e^fyC-*-Pv%Y|Vou^g!71e2xP)3Ib(ein$LQXbF6kV%RO(LCs}^TFichse**C$mf|^54~$99DS1Up<0yCrluZ znx2%Hlt_u6RZ`T6Tw1qw9nC48L!k$=$!3Kk^^A+7v@fe@^~%+>a>+_syl62!^Y}BA z{K-s;d}j=m7nW1ZAE#2_`y;92CVz6<9zz>8Y@qup@1v{%S!6oJoVsjIr1-OQDWZNT zSxtl|+7k2f0>o~HeVp=91qHt~k}SrwCiitQ)Ow~9&C8!hgT8x^Z0Etj(E;`P0uzZA z&RIx()B94tFDfbY^h9!58$mZiyW#vVaLEE`XHZzj*lYO`!PTf+Reup=SnF$ zE}F)S8bh&Bu@rqIhkAWjOl@bmli$(7Dz-T4$0y)#$e@f%m6Y_!TG$OZC%0vRikLh()x5Xw2x*a%i>KqMTXrRf!EH{+>3N@0v}t>1oUv+hOCg zn3MQ`+5=8NC%_f(1mHSRu}1Ofh;Jzzhyg{0>wKe}>lnYuq%n zSLJ^@eEIX*l87(z>vrrsT($G_ONR>&9li)$qK~Bgz_T?~XKJeIPcHv!Txne?uP!LN zcH(MTcMvw44e08YS)?xRJXy*%5ikv+qpyZ!Y{s3K|n*48`O|MIw+rDb- zy;oGZSJ1R?wEj2kx_RQ%4>uob6Xo${uhPf2UOQU%-LWHe-5&MY?kDZ7JGEM~c2Mr3 zJoDdWJytz)-OKBr_|u99eFKM9(nf_kGYi_{j|k?pxk2`a??Wu$A*Z&d#h^ z77!}spU_3By6NA&--4&=mTdg{!WX8NZaX@AL{h}(^s1Df1GRjl_<67K@7OI(UOex$ z>GgCmwMW5uoB=79`TYQ_3hVpbgokI@b^Pu}JPC`U(Nccj=~H!Sb#;ZcXkC5k?ZISakq*UJ?Z%BLbXYM611Wz4H$TezIZNkfOp&c!r5^BKA1VI} zZe)CwJ>xUo(@n`4Amz^-*uUS+?fv)PS8&7i`tY~f&7bVk|M#Ctxp#}Z69p*mYTDve zDdiSDTf81Yxl@N0FAEzvuud(HFU7y|1=-(lRf6mM+Bg6%-Y_6;d@(;yAQ3Q8cSM!o zYj>~T-U>h$nyqY-mVH-0rMv%<^4a>8kg*|`89E+ApJeDc3>}K0*D!QYhTg=`vl#j% zL+4`XS_~bQA!8YGm?1YctVQ~??p~j#Po)fi4#Lpq6upMyLqAq_HS`P3?~{*o0MHkJ zy-mG=DL^71Ho3%V?**XZO59ob*~HHy{xz{{#os12veXe_H4Y#%O%#V8R}6 zLF{?MXSs*JrBNRI8Y&iVSTDOtou+M27y6RX_|VT9_uUWuNNnG*@3Bpu#U~+tH^VwZ znmmtb@{GFBg^k9CUfj4JS$CcPrJ?_(bCLPW_Y8*PH=RHHVU5aL7$16@=AVJ7qx^2t zkN6|(0r7oU0;2(hWaS+yUrwU#Ui@@6x;*g<%DUMC;_nlh_0LjA#$Rtdf7lz^UJ^fJ z0#E?Ry^JA#9ob_=#LzJr_KvnMMr1jA-y==}`4j$s2aY*Mv0u(=pEm-a1+w3GEP96yT~b|u5k zYVdzHxBjqEG(UJW+RNJI0FeNmVG}WIVs(~b+cInlhMlSS0_-A&4Wq5O_y9p8#2v$) z(B_PH1lyNkM`=E}*2J)Tjph$qoMBHhY;}e`#jvLs_9w%BWY}>GTajVEGi)Y?eF~pw z2E&HK*cA-Bi(v~f>@J3l#;{2kwjINsW7ydY+nQm!GVDW!UCOZejmC%VtnD%3JE;J8 zox^euhV9I-$r*MZ!=7W<)(jh;VZSkKDu#{9u!$J>{*6wiEns%GVERW zgy%49YK>P5-@vwS6ypcpf19PI$}+ zK;)w24b-0D3u5?p7`Cx?=K3QQel-~oSt<7tEtT)A{RTCi?kH zDsop+@FMtr7(T2JG(P+XjmK*G{-u4>zClBS|6JdH({?yRjp#!?__&P5hu?@ zM)8!(n|hP`!*Gt{^PazNnL@#@8^=>_9C@4^p6N_ox2MpTFL*VMr*wuZR~Jud4WDxS zdoxr##p}&Jbanec6;H{&T&?0MZX3c?JjMKx)(!EL4$FL~@A*nCo>JexA)eyWB%Wer zXLT!{vO1ouX4+HoU$uD3`3ih4hL3a|oI}BNgQ(41#8ciHL=o>!Bd_0Ka;c{H zwhQk1*)Rk)YVj1C414n1kxA_y@wydHsq58ZJf-#0cDIkGyft3MQ{vyBqT(q|zw@Wg z+oKxAQ_LnUFl5!e1RmmQ(G?%+icZyiCZVhXuX^HKDYRD=6sAQDi>airm&m zlP!L`B=MBt*B?^xl-7=T>3#9iC*F#u4ETHr^*A|+T-SuFcuL#{MdVQFL9G(ZDEf3h z1s)zvt`F6q7rOr=)#U zuHq^76)x0vY1f8$ikUeA8i=Quc0_+I#Z$&(eRF|n7_Y!Yi>DkM^|RtB>F4G*8&5Gc zGbJ-C(9ldg#oEDI#Z&Cs*^za7RM5p!TD!I;OHWI(4nSTYmMpk6nFuq`#Zye9v47&Q zf8vq%Uw_@kAKlbbt=!jLTl8;h1qNR;c142>i-I3+tUgiY`F#Pd>uJ}HAHRM*a`{VF zuU);mEA4t@+v?Ic1z_UvwUu*RdfhPK9pUQ&C zpsunbDoImi`uZhW{m-Q6h_3%?Rgd)b)!0qyt3GbkKYsy{6J7n6wfbHfJ-Yr?Udbt~ z<7zs*P_li#+m8Ny!&4U-`PE zWtFJD9r_q1rJ{d777%m7P8vW$u~#sN;K4)n!q2wO)JD_TVb5*;k0A zK6|#WR$mQy`CTNR#%B)mJo@L{a{?yRWXQ zw(|&_X7}yB#JRI}9-=e4^{lTdxROu0`Q~4^aPh*bC@T5k-pqpP(!e)8&hGNespxg> z5_#s+`STYp7REf9d81^TuKw30S5~cxEGvne6&veiUi@b4y4oL>f4na9=8^m}Uwsh~ z5wRmGrCYaIkzahP(ewRF*fD#S|5&p)FE7A+S**v_q^e;vx2`|Cdso`Y6E_O3@7|YF zQIUA|`|Dc$sYUAA^7cXxk4*E-yzY6+N;k&lZLO<~-Y`|J!nBI@9u*6hrEB#&E-gyH zwIKPi^$ESr6MFmRJ!YPj_lG>k+^t(bUbk*t;D+453Aq&&-KJ^vZ`NQx7gl#nNGRIa z+j0Gqr+T-kdvZ~~yp4%@j&CO=y}igIac0b(UbeQn{*Qd?>grmsJZ5RpQ!xq22@C6< z?7c5x%b7(*OA@PZUMn~|H80Pj=6d9{$g5ia`P&X%ym+*%YD03ry5QuZ#a^=)3|r7K zs%U-hUTIe@U5=c!XwlS@C6~5;zDldFy{~t76?d6lx-mIPfYLfSm{gClarI*E`4Wd$CI9)(fQA3^xarfBAxEg z`d4RehZk-CBH}2AZM<>StIK1_Q|$T%7k^hK)wY+^URQN4YxQUB+_}?rchpfNyG~Zu z-&kEcAuB8DN4xqTXOy|F`exOYD_$p#d~@VT$xf~QKJ4UE`>Lblsxz;vJ9Wk}EB8#H zm)D+}Go>}9U>Z?g*a1~lhWj~Uk8E6`)7aJ5+`}Ay#BRoi?Am^=k|-m@Y=;ctS89E} z($&YY&)->_>w7$3s@AD8s@iE(|MIQ=FGS3^ero3hsZw`HRlH4oIriJOU#iv4yS~0L zJv$_bj7zbJ^JI5eJ=JRT{P?YU(&+DCz<^u6wUQ2&t@!>L9E z5AFnIF{7N=czg-c9dp9S)$HtXoU#s?YaDwOe+or?jF*m?;JwtH zU!Y^W8OLf<6G+~#iRaM&&%yJkFSLSY{S@T+^0ooYr`9l^cud1dqg=!gNTFu9{2Ac9(C|O=C@WbzYV-ujr--y zZvY3DF~7cq`8D9xD&~5`j_MaN@2}JW`8x)wIW*9ZIi1_Lh^@n{wHPYgLn=Nkan(d% z1|Z)^^e}+Lt|dNQ0!aK?;????wd6|-y9khP4kWHEbtDyZ2TB2{=cj`&Qh_%x4v;vI z+)G_a1>K0-^k{>5U{0X9f&S+}e_aJz_X7PA*OHjBe2>rv7y>K+QUHlj3(|Cu_|ytO zVwX}b&oZv0LiZd%>Pk#T4~gr`x(NM}r(Y{c1+oU?0g21Xy{wz8m2Pcp<7}B_>esF$wJ@0$$eQ^y-_EhUqqdK*=8fpz zw}34zo1xzc^(HspmzvM*=$CmTrrYeig?`Hx%5FnHw8-Y^f4PFKtPrc!uYo?5@o%^O z3tON;+TV`;xhOYpp{>Mj3uPg0ZTL0N7Yl;3rDC-XB`!Prr{lbr$(hvUB?EaViE9c3ek4E?Srb0c- z_d9I?8$iFWb8+9&{-1?1GoZPCf0BOipQiNVomhBc{X3ygJ)Chb{7z!-9RPWjGC30h z$&>Z>0ECyMnri&FEAHC^lK|n5@(%R%Wj<{HS%2wE>PbHWxtFq`z&(JhhkOg92fmf+ z;EDY&a-k{xuU4{Y0mh$(`qKfSc`6{he+e)F5PAf%t^(oH)d1?dz7WKtZam5kPvGyy zNFQT?GCTX+K)_Z9{eDE94((c?|FtSMGcz;pPu{nzpY$&@<9jgmU82w^`>6tm#Wzo< zrgOgwi};@UVd`1c!}|-x-^oGDge`_bHoBv(IUs!%02aD?L)ztjFwh&{OC;cXi7?#D zKGW4z=T~%#=a8qn`5OC-JpdTTuUZ^Q33MW0vz^dZjp z6yHUCSjLI(7izND7x`G@_%nH&b!jQPR0nEnYJ+^CF(1&=FYiImzhvCu#8!p2JQm+@ zg~&MJ$dmJd_t3!+>o59|5&etVyglYCG|GI1Zh=2A36Ol;%ilms{;-65xlW|8xPH$UetB2|Om_+y257_A- zXBKA%@j4!Ic?A#o=L$9-1Gy@6pl%1(mgzSYT|@MiBmnzXrLq@6hx)xZ&XL1H4}6<8 z8^6b$&4@cPEhct(IE<72I*;Q{P2=7lma^TPPD<~yUgE%MAI;~Kzm;(8@hRFF3_@S> zZshz%0m5fwedS$>J}2dq@!RJ2Cvw(jOL*WHOF8tV{#skm*FLyC)_-ZU>+iKOg#%t6 z&VdJj*GF;CfzcfN<`@qC{TO_+HjeEUc4F6c5gc=-fMedn-+|hVce{wV`?d_sshAO4 z<%B=aWf%OeS$IjuCw(~y&xx3C3g#u>N10@saMve$a<@GR?6pCV$liLaPh``ft=P20 zlm}d_;<)3Jxc3J|-2b!1-1(_6c3;_p5j)j%>}K{)w;kymcw{sOf!^RlV>#sTy})=5 z1$vyA!hZPvtlKLY9DaN%haMWokvOxo5@+-PaY#Ks^oO!yVDr)bH(rd>#{lK{h8eE(Jt!!xU3E1pjU=)!k^}F+w~so zQ0~SK_)WP(sT;Rh;KB)5>z=1)aM1pNoQ5-FUD#I12bbj`?EXkN)<5F5>u=T({73ks z8_-z?;a@Ys!}Hs6z~PY`@XiSCyrn0b&$H&xWBAtbjlmpxG*|syFp*Jy_$_<*$*Jml z%CI97IP{%yidV*fF9jVK!H6S+KJZxKyK?1i(h|d@+fA-^u27E4|fstKIASv;SMeIPmwQ zxXmJW_3a>H<=ATz*k)-5?s0N5cioYq_(||vWB4AN;Rw*xQFy7GU*U7YPen!wZ_Bab zo}j%a-hi_klV8GjMgDdtwkdSvZU-~jaw6m@_Lt)m0o?tK z0ql2hFq=(;?wvv07T;?I92&{4TcSDW@EGp+c#zTsY1nX3UK1IF? z-#OOStqI<1Ijs%*ygiV8UdO!N8N#+@_&aitZ*7-)anR8*+;wMf zt&i#G!wL{tCbVH~@wcDYVxSE>KNF(qKC*T)H>smT+qP{rTfZ6l&09f!8PrwxB2NbC z+RIw#<&EsCcw)DGG2HQKd>bu1JOIdo>^abfyVj?(_nZB>)p+PsF~qF~S#kIJer!7f z^YKKzi9i$D)LP4a5&c2-J>+dudfGaG{x_Rn|5jeDG+kKqVS$`sS!>ZBgkH%L9Y#{@ zC-pAm9Ez+H`Xd00?Yb+HJ@zHA$190iTlqE=b5Ql{Xu<$F84V=0mj(i z#jbl}*>NY%X(94P0P+q60|1;8m5(!|?y}T*fd;`VKd&Ag%vzw-O$i8dZUgoPilSX9;D3f>Jv<;ry*a`jc zcQv#Bo7JD?{K}d&)0fJV_oOegz&-X>t05NLZl^DsKWL-*Z6v=btwMj({jcvQ5oNMZ z_0I+=;$c6Je&Nmio9|2YZ@B)ZsAmtz{tgCY{|OzEZ$N{(AB8;gX7Z(8B7k);YJ;+0 zME~vfkI-mHoA3KkxhRfcpD6pxKcAukR=R6uJPugZ)iIXcSu6kbdkXe1ps%t;yn#*Yy8Q zLueFQ*>L|qkN8*ZY`#$c1Yg|05_sr0ij|5+p%w9?V-5RfH~xIi+f(@3sr7vA+)=*v z@uA-)gf`G9v@&Sc(=Vw!BTjk@-*xkE8bV_e+70J%_x|n*{C`>j{r5sGr3Yj&?tZ8B Pv%gQ%uUkv&s?Yx)B1DU_ diff --git a/res/pooltag.txt b/res/pooltag.txt new file mode 100644 index 0000000..f858c2b --- /dev/null +++ b/res/pooltag.txt @@ -0,0 +1,4386 @@ +// +// Copyright (C) Microsoft. All rights reserved. +// +rem +rem Pooltag.txt +rem +rem This file lists the tags used for pool allocations by kernel mode components +rem and drivers. +rem +rem The file has the following format: +rem - - +rem +rem Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage) +rem and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where +rem platform is amd64, i386, or arm). +rem + +@GMM - - (Intel video driver) Memory manager +@KCH - - (Intel video driver) Chipset specific service +@MP - - (Intel video driver) Miniport related memory +@SB - - (Intel video driver) Soft BIOS + +_ATI - - ATI video driver + +_LCD - monitor.sys - Monitor PDO name buffer + +8042 - i8042prt.sys - PS/2 keyboard and mouse + +AdSv - vmsrvc.sys - Virtual Machines Additions Service +ARPC - atmarpc.sys - ATM ARP Client +ATMU - atmuni.sys - ATM UNI Call Manager +Atom - - Atom Tables +Abos - - Abiosdsk +AcdM - - TDI AcdObjectInfoG +AcdN - - TDI AcdObjectInfoG +AcpA - acpi.sys - ACPI arbiter data +AcpB - acpi.sys - ACPI buffer data +AcpD - acpi.sys - ACPI device data +AcpE - acpi.sys - ACPI embedded controller data +AcpF - acpi.sys - ACPI interface data +Acpg - acpi.sys - ACPI GPE data +Acpi - acpi.sys - ACPI generic data +AcpI - acpi.sys - ACPI irp data +AcpL - acpi.sys - ACPI lock data +AcpM - acpi.sys - ACPI miscellaneous data +AcpO - acpi.sys - ACPI object data +AcpP - acpi.sys - ACPI power data +AcpR - acpi.sys - ACPI resource data +AcpS - acpi.sys - ACPI string data +Acpt - acpi.sys - ACPI table data +AcpT - acpi.sys - ACPI thermal data +AcpX - acpi.sys - ACPI translation data +Adap - - Adapter objects +Adbe - - Adobe's font driver +ADPT - acpipagr.sys - Processor Aggregator Driver +AECi - - filter object interface for MS acoustic echo canceller +Afd? - afd.sys - AFD objects +AfdA - afd.sys - Afd EA buffer +AfdB - afd.sys - Afd data buffer +AfdC - afd.sys - Afd connection structure +AfdD - afd.sys - Afd debug data +AfdE - afd.sys - Afd endpoint structure +AfdF - afd.sys - Afd TransmitFile info +AfdG - afd.sys - Afd group table +AfdI - afd.sys - Afd TDI data +AfdL - afd.sys - Afd local address buffer +AfdP - afd.sys - Afd poll info +AfdQ - afd.sys - Afd work queue item +AfdR - afd.sys - Afd remote address buffer +AfdS - afd.sys - Afd security info +AfdT - afd.sys - Afd transport info +AfdW - afd.sys - Afd work item +AfdX - afd.sys - Afd context buffer +Afda - afd.sys - Afd APC buffer (NT 3.51 only) +Afdc - afd.sys - Afd connect data buffer +Afdd - afd.sys - Afd disconnect data buffer +Afdf - afd.sys - Afd TransmitFile debug data +Afdh - afd.sys - Afd address list change buffer +Afdi - afd.sys - Afd "set inline mode" buffer +Afdl - afd.sys - Afd lookaside lists buffer +Afdp - afd.sys - Afd transport IRP buffer +Afdq - afd.sys - Afd routing query buffer +Afdr - afd.sys - Afd ERESOURCE buffer +Afdt - afd.sys - Afd transport address buffer +Ahca - ahcache.sys - Appcompat kernel cache pool tag + +AleD - tcpip.sys - ALE remote endpoint +Ala4 - tcpip.sys - ALE remote endpoint IPv4 address +Ala6 - tcpip.sys - ALE remote endpoint IPv6 address +Alei - tcpip.sys - ALE arrival/nexthop interface cache +AleU - tcpip.sys - ALE pend context +AleE - tcpip.sys - ALE endpoint context +AlLl - tcpip.sys - ALE remote endpoint LRU +AlCi - tcpip.sys - ALE credential info +AlSP - tcpip.sys - ALE secure socket policy +AlPU - tcpip.sys - ALE secure socket policy update +AlPi - tcpip.sys - ALE peer info +AlP4 - tcpip.sys - ALE peer IPv4 address +AlP6 - tcpip.sys - ALE peer IPv6 address +AlPT - tcpip.sys - ALE peer target +Alep - tcpip.sys - ALE process info +AleS - tcpip.sys - ALE token info +AleP - tcpip.sys - ALE process image path +AleK - tcpip.sys - ALE audit +AleA - tcpip.sys - ALE connection abort context +AlDN - tcpip.sys - ALE endpoint delete notify +AleW - tcpip.sys - ALE enum filter array +AleN - tcpip.sys - ALE notify context +AlSs - tcpip.sys - ALE socket security context +AlPF - tcpip.sys - ALE policy filters +AleL - tcpip.sys - ALE LRU +AleI - tcpip.sys - ALE token ID +AlP5 - tcpip.sys - ALE 5-tuple state +AlE5 - tcpip.sys - ALE 5-tuple temp entry + +Aric - tcpip.sys - ALE route inspection context +Adnc - tcpip.sys - ALE endpoint deactivation notification context +Acrc - tcpip.sys - ALE connect request inspection context +Acrl - tcpip.sys - ALE connect redirect layer data +Abrc - tcpip.sys - ALE bind request inspection context +Abrl - tcpip.sys - ALE bind redirect layer data +AlSm - tcpip.sys - ALE Secondary App Meta Data + +Afp - - SFM File server +AlCI - nt!alpc - ALPC communication info +AlEv - nt!alpc - ALPC eventlog queue +AlIn - nt!alpc - ALPC Internal allocation +AlHa - nt!alpc - ALPC port handle table +AlMs - nt!alpc - ALPC message +ALPC - nt!alpc - ALPC port objects +AlRe - nt!alpc - ALPC section region +AlRr - nt!Alpc - ALPC resource reserves +AlSc - nt!alpc - ALPC section +AlSe - nt!alpc - ALPC client security +AlVi - nt!alpc - ALPC view +ATmp - AppTag mount point +ATon - AppTag object name +ATub - AppTag user buffer +ATgb - AppTag guid buffer +ATac - AppTag ATR command buffer +ATdi - AppTag cliendata index buffer +ATdt - AppTag cliendata temp buffer +ATFb - AppTag file id buffer + +Aml* - - ACPI AMLI Pooltags +APIC - pnpapic.sys - I/O APIC Driver +ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG +ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG +ArbM - nt!arb - ARBITER_MISC_TAG +ArbR - nt!arb - ARBITER_RANGE_LIST_TAG +Arp? - - ATM ARP server objects, atmarps.sys +ArpA - - AtmArpS address +ArpB - - AtmArpS buffer space +ArpI - - AtmArpS Interface structure +ArpK - - AtmArpS ARP block +ArpM - - AtmArpS MARS structure +ArpR - - AtmArpS NDIS request +ArpS - - AtmArpS SAP structure +Asy1 - - ndis / ASYNC_IOCTX_TAG +Asy2 - - ndis / ASYNC_INFO_TAG +Asy3 - - ndis / ASYNC_ADAPTER_TAG +Asy4 - - ndis / ASYNC_FRAME_TAG +AtC - - IDE disk configuration +AtD - - atdisk.c +ATIX - - WDM mini drivers for ATI tuner, xbar, etc. +Atk - - Appletalk transport +AtmA - - Atoms +AtmT - - Atom tables +AtvE - cea_km.lib - Event broker aggregation library. +AuxL - - EXIFS Auxlist + +AzAp - HDAudio.sys - HD Audio Class Driver (Datastore: audio path) +AzAd - HDAudio.sys - HD Audio Class Driver (AzPcAudDev) +AzCd - HDAudio.sys - HD Audio Class Driver (CodecVendor) +AzCE - HDAudio.sys - HD Audio Class Driver (CEAAudioRender) +AzCm - HDAudio.sys - HD Audio Class Driver (AzCommon) +AzFg - HDAudio.sys - HD Audio Class Driver (Audio Function Group) +Azfg - HDAudio.sys - HD Audio Class Driver (datastore: function group) +AzJd - HDAudio.sys - HD Audio Class Driver (JackDetector) +AzMa - HDAudio.sys - HD Audio Class Driver (Main) +AzMi - HDAudio.sys - HD Audio Class Driver (micin, MixedCapture) +AzMu - HDAudio.sys - HD Audio Class Driver (MuxedCapture) +AzMx - HDAudio.sys - HD Audio Class Driver (AzMixerport) +AzLd - HDAudio.sys - HD Audio Class Driver (Datastore: logical device) +AzLi - HDAudio.sys - HD Audio Class Driver (CDIn,AUXIn, linein) +AzLg - HDAudio.sys - HD Audio Class Driver (debug) +AzLs - HDAudio.sys - HD Audio Class Driver (DLTest) +AzPd - HDAudio.sys - HD Audio Class Driver (AzDma) +AzPx - HDAudio.sys - HD Audio Class Driver (AzPower) +AzRr - HDAudio.sys - HD Audio Class Driver (RedirectedRender) +AzRR - HDAudio.sys - HD Audio Class Driver (SpdifEmbeddedRender, SpdifOut, Headphone, HBDAout) +AzSd - HDAudio.sys - HD Audio Class Driver (subdevicegraph) +AzSi - HDAudio.sys - HD Audio Class Driver (SpdifIn) +AzSt - HDAudio.sys - HD Audio Class Driver (AzWaveCyclicStream, HdaWaveRTstream) +AzTs - HDAudio.sys - HD Audio Class Driver (TestSet1000, TestSet1001) +AzUT - HDAudio.sys - HD Audio Class Driver (TestSet0004) +AzWd - HDAudio.sys - HD Audio Class Driver (AzWidget) +AzWp - HDAudio.sys - HD Audio Class Driver (AzWaveport, HdaWaveRTminiport) + +Bat? - - Battery Class drivers +BatC - - Composite battery driver +BatM - - Control method battery driver +BatS - - Smart battery driver +Batt - - Battery class driver +BCSP - bthbcsp.sys - Bluetooth BCSP minidriver +BCDK - nt!init - Kernel boot configuration data. +BDD - BasicDisplay.sys - Microsoft Basic Display Driver +BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c) +BlCc - blkcache.sys - Block Cache Driver +Bmfd - - Font related stuff +BT3C - bt3c.sys - Bluetooth 3COM minidriver +BT8x - - WDM mini drivers for Brooktree 848,829, etc. +BTHP - bthport.sys - Bluetooth port driver (generic) +BthS - bthport.sys - Bluetooth port driver (security) +BTME - bthenum.sys - Bluetooth enumerator +BTMO - bthmodem.sys - Bluetooth modem +BTPT - - Bluetooth transport protocol library +BTSR - bthser.sys - Bluetooth serial minidriver +BTUR - bthuart.sys - Bluetooth UART minidriver +WPAD - BasicRender.sys - Basic Render Adapter +WPDV - BasicRender.sys - Basic Render DX Device +WPCT - BasicRender.sys - Basic Render DX Context +WPAL - BasicRender.sys - Basic Render Allocation +WPAO - BasicRender.sys - Basic Render Opened Allocation +WPRC - BasicRender.sys - Basic Render Rectangles (for Present) +Bu* - - burneng.sys from adaptec + +BvHI - netiobvt.sys - BVT HT Items +BvHT - netiobvt.sys - BVT HT Tables + +Call - nt!ex - kernel callback object signature +call - - debugging call tables +CBRe - - CallbackRegistration +CBSI - cbsi.sys - Common Block Store +Cc - nt!cc - Cache Manager allocations (catch-all) +CcAs - nt!cc - Cache Manager Async cached read structure +CcBc - nt!cc - Cache Manager Bcb from pool +CcBm - nt!cc - Cache Manager Bitmap +CcBn - nt!cc - Cache Manager Bcb trim notification entry +CcBr - nt!cc - Cache Manager Bitmap range +CcBz - nt!cc - Cache Manager Bcb Zone +CcDw - nt!cc - Cache Manager Deferred Write +CcEv - nt!cc - Cache Manager Event +CcFn - nt!cc - Cache Manager File name for popups +CCFF - CCFFilter.sys - Cluster Client Failover Filter +CcMb - nt!cc - Cache Manager Mbcb +CcOb - nt!cc - Cache Manager Overlap Bcb +CcPB - nt!ccpf - Prefetcher trace buffer +CcPC - nt!ccpf - Prefetcher context +CcPD - nt!ccpf - Prefetcher trace dump +CcPF - nt!ccpf - Prefetcher file name +CcPI - nt!ccpf - Prefetcher intermediate table +CcPL - nt!ccpf - Prefetcher read list +CcPM - nt!ccpf - Prefetcher metadata +CcPS - nt!ccpf - Prefetcher scenario +CcPT - nt!ccpf - Prefetcher trace +CcPV - nt!ccpf - Prefetcher queried volumes +CcPW - nt!ccpf - Prefetcher workers +CcPa - nt!ccpf - Prefetcher async context +CcPc - nt!cc - Cache Manager Private Cache Map +CcPf - nt!ccpf - Prefetcher +CcPh - nt!ccpf - Prefetcher header preallocation +CcPn - nt!ccpf - Prefetcher name info +CcPp - nt!ccpf - Prefetcher instructions +CcPq - nt!ccpf - Prefetcher query buffer +CcPs - nt!ccpf - Prefetcher section table +CcPv - nt!ccpf - Prefetcher volume info +CcPw - nt!ccpf - Prefetcher enable worker +CcSc - nt!cc - Cache Manager Shared Cache Map +CcVa - nt!cc - Cache Manager Initial array of Vacbs +CcVl - nt!cc - Cache Manager Vacb Level structures (large streams) +CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream +CctX - - EXIFX FCB Commit CTX +CcWq - nt!cc - Cache Manager Work Queue Item +CcWK - nt!cc - Kernel Cache Manager lookaside list +CcWk - nt!cc - Kernel Cache Manager lookaside list +CcZe - nt!cc - Cache Manager Buffer of Zeros +CDmp - crashdmp.sys - Crashdump driver +CdA - - CdAudio filter driver +Cdcc - cdfs.sys - CDFS Ccb +Cddn - cdfs.sys - CDFS CdName in dirent +Cdee - cdfs.sys - CDFS Search expression for enumeration +Cdfd - cdfs.sys - CDFS Data Fcb +Cdfi - cdfs.sys - CDFS Index Fcb +Cdfl - cdfs.sys - CDFS Filelock +CdFn - cdfs.sys - CDFS Filename buffer +Cdfn - cdfs.sys - CDFS Nonpaged Fcb +Cdfs - cdfs.sys - CDFS General Allocation +Cdft - cdfs.sys - CDFS Fcb Table entry +Cdgs - cdfs.sys - CDFS Generated short name +Cdic - cdfs.sys - CDFS Irp Context +Cdil - cdfs.sys - CDFS Irp Context lite +Cdio - cdfs.sys - CDFS Io context for async reads +Cdma - cdfs.sys - CDFS Mcb array +Cdpe - cdfs.sys - CDFS Prefix Entry +CdPn - cdfs.sys - CDFS CdName in path entry +Cdpn - cdfs.sys - CDFS Prefix Entry name +Cdsp - cdfs.sys - CDFS Buffer for spanning path table +Cdtc - cdfs.sys - CDFS TOC +Cdun - cdfs.sys - CDFS Buffer for upcased name +Cdvd - cdfs.sys - CDFS Buffer for volume descriptor +Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem +CIcr - ci.dll - Code Integrity allocations for image integrity checking +CIsc - ci.dll - Code Integrity core dll +CIha - ci.dll - Code Integrity hashes +CKRT - - Cluster Kernel RTL library +CLb* - clusbflt.sys - Cluster block storage target driver +CLB* - clusbflt.sys - Cluster block storage target driver +CLd* - clusdflt.sys - Cluster disk filter driver +ClfA - clfs.sys - CLFS Log container lookaside list +ClfB - clfs.sys - CLFS Log base file lookaside list +ClfC - clfs.sys - CLFS Log physical FCB lookaside list +ClfD - clfs.sys - CLFS Log virtual FCB lookaside list +ClfE - clfs.sys - CLFS Log CCB lookaside list +ClfF - clfs.sys - CLFS Log flush element lookaside list +ClfG - clfs.sys - CLFS Log I/O Request lookaside list +ClfH - clfs.sys - CLFS Log I/O control block lookaside list +ClfI - clfs.sys - CLFS Log marshal buffer lookaside list +ClfJ - clfs.sys - CLFS Log MDL reference +ClfK - clfs.sys - CLFS Log read completion element +ClfL - clfs.sys - CLFS Log base file image (obsolete) +ClfN - clfs.sys - CLFS Log base file lock +ClfO - clfs.sys - CLFS Log zero page +ClfP - clfs.sys - CLFS Log request state +ClfS - clfs.sys - CLFS Log base file snapshot +Clfs - clfs.sys - CLFS General buffer, or owner page lookaside list +ClNt - netft.sys - NetFt +ClNw - netft.sys - NetFt work items +CM - nt!cm - Configuration Manager (registry) +CmcD - hal.dll - HAL CMC Driver Log +CmcK - hal.dll - HAL CMC Kernel Log +CmcT - hal.dll - HAL CMC temporary Log +CMCa - nt!cm - Configuration Manager Cache (registry) +CMDc - nt!cm - Configuration Manager Cache (registry) +CMkb - nt!cm - registry key control blocks +CMpb - nt!cm - registry post blocks +CMnb - nt!cm - registry notify blocks +CMpe - nt!cm - registry post events +CMpa - nt!cm - registry post apcs +CMsb - nt!cm - registry stash buffer +CmVn - nt!cm - captured value name +CMVw - nt!cm - registry mapped view of file +CMVa - nt!cm - value cache value tag +CMVI - nt!cm - value index cache tag +CMSc - nt!cm - security cache pooltag +CMSb - nt!cm - internal stash buffer pool tag +CMNb - nt!cm - Configuration Manager Name Tag +CMIn - nt!cm - Configuration Manager Index Hint Tag +CMDa - nt!cm - value data cache pool tag +CMAl - nt!cm - internal registry memory allocator pool tag +CMA1 - nt!cm - Configuration Manager Audit Tag 1 +CMA2 - nt!cm - Configuration Manager Audit Tag 2 +CMA3 - nt!cm - Configuration Manager Audit Tag 3 +CMA4 - nt!cm - Configuration Manager Audit Tag 4 +CMIx - nt!cm - Configuration Manager Intent Lock Tag +CMUw - nt!cm - Configuration Manager Unit of Work Tag +CMTr - nt!cm - Configuration Manager Transaction Tag +CMRm - nt!cm - Configuration Manager Resource Manager Tag +CM?? - nt!cm - Internal Configuration manager allocations +Cngb - ksecdd.sys - CNG kmode crypto pool tag +COMX - serial.sys - serial driver allocations +Cont - - Contiguous physical memory allocations for device drivers +CopW - - EXIFS CopyOnWrite +Covr - nt!cov - Code Coverage pool tag +CpeD - hal.dll - HAL CPE Driver Log +CpeK - hal.dll - HAL CMC Kernel Log +CpeT - hal.dll - HAL CPE temporary Log +CPnp - classpnp.sys - ClassPnP transfer packets +Crsp - ksecdd.sys - CredSSP kernel mode client allocations +CrtH - - EXIFS Create Header +Cryp - ksecdd.sys - Crypto allocations +CSdk - - Cluster Disk Filter driver +CSnt - - Cluster Network driver +CTE - - Common transport environment (ntos\inc\cxport.h, used by tdi) +Cvli - - EXIFS Cached Volume Info + +D2d - - Device Object to DosName rtns (ntos\rtl\dev2dos.c) +D3Dd - - DX D3D driver (embedded in a display driver like s3mvirge.dll) +D851 - - 8514a video driver +Dacl - - Temp allocations for object DACLs +DamK - dam.sys - Desktop Activity Moderator +Dati - - ati video driver +DbCb - nt!dbg - Debug Print Callbacks +DbLo - - Debug logging +dcam - - WDM mini driver for IEEE 1394 digital camera + +DcbA - msdcb.sys - DCB application priority +DcbC - msdcb.sys - DCB NMR provider context +DcbD - msdcb.sys - DCB NDIS_QOS_CONFIGURATION +DcbG - msdcb.sys - DCB string data +DcbI - msdcb.sys - DCB interface context +DcbL - msdcb.sys - DCB LLDP buffer +DcbP - msdcb.sys - DCB NDIS port information +DcbR - msdcb.sys - DCB store change record +DcbS - msdcb.sys - DCB security object +DcbU - msdcb.sys - DCB UQOS_POLICY_DESCRIPTOR +DcbX - msdcb.sys - DCB general + +Dcdd - cdd.dll - Canonical display driver +Dcl - - cirrus video driver +Ddk - - Default for driver allocated memory (user's of ntddk.h) +Devi - - Device objects + +DEag - devolume.sys - Drive extender disk set array: DEVolume!DEDiskSet * +DEbo - devolume.sys - Drive extender bus opener context: DEVolume!DEBusOpenerContext +DEbe - devolume.sys - Drive extender extends buffer +DEbg - devolume.sys - Drive extender bus opener context global: DEVolume!DEBusOpenerContextGlobal +DEbm - devolume.sys - Drive extender bitmap +DEbu - devolume.sys - Drive extender generic buffer +DEcl - devolume.sys - Drive extender delayed cleaner: DEVolume!DelayedCleaner +DEct - devolume.sys - Drive extender chunk table +DEda - devolume.sys - Drive extender disk array: DEVolume!DEDisk * +DEdb - devolume.sys - Drive extender disk directory information +DEdc - devolume.sys - Drive extender disk chunk: DEVolume!DiskChunk +DEdg - devolume.sys - Drive extender disk globals: DEVolume!DEDiskGlobals +DEdi - devolume.sys - Drive extender disk: DEVolume!DEDisk +DEdm - devolume.sys - Drive extender disk mini chunk: DEVolume!DiskMiniChunk +DEdn - devolume.sys - Drive extender disk identification info: DEVolume!DiskIdentificationInfo +DEdr - devolume.sys - Drive extender device relations +DEds - devolume.sys - Drive extender disk set: DEVolume!DEDiskSet +DEdt - devolume.sys - Drive extender disk message: DEVolume!DE_DISK_MESSAGE +DEdu - devolume.sys - Drive extender disk set message: DEVolume!DE_DISK_SET_MESSAGE +DEdv - devolume.sys - Drive extender driver object: DEVolume!DEDriver +DEea - devolume.sys - Drive extender expanding array: DEVolume!ExpandingAutoPointerArray +DEec - devolume.sys - Drive extender ECC Page: DEVolume!DeEccPage +DEfg - devolume.sys - Drive extender filter: DEVolume!DEFilter +DEga - devolume.sys - Drive extender guild array +DEic - devolume.sys - Drive extender filter instance context +DEip - devolume.sys - Drive extender IRP based logical to physical request: DEVolume!IrpBasedLogicalToPhysicalRequest +DEir - devolume.sys - Drive extender IRP based read request: DEVolume!IrpBasedReadRequest +DEiw - devolume.sys - Drive extender IRP based write request: DEVolume!IrpBasedWriteRequest +DEla - devolume.sys - Drive extender log mini chunk array +DElb - devolume.sys - Drive extender log buffer +DEli - devolume.sys - Drive extender disk set id record: DEVolume!DiskSetIdentificationRecord +DElm - devolume.sys - Drive extender log manager: DEVolume!LogManager +DElp - devolume.sys - Drive extender logical to physical request: DEVolume!LogicalToPhysicalRequest +DElr - devolume.sys - Drive extender log reader: DEVolume!LogReader +DElv - devolume.sys - Drive extender disk set volume id record: DEVolume!VolumeIdentificationRecord +DElw - devolume.sys - Drive extender log writer buffer: DEVolume!LogWriterBuffer +DEmc - devolume.sys - Drive extender volume chunk init mapping manager: DEVolume!VolumeChunkInitializationMappingManager +DEml - devolume.sys - Drive extender log mapping manager: DEVolume!LogMappingManager +DEms - devolume.sys - Drive extender superblock mapping manager: DEVolume!SuperBlockMappingManager +DEmv - devolume.sys - Drive extender volume mapping manager: DEVolume!VolumeMappingManager +DEog - devolume.sys - Drive extender old GUID array +DEpe - devolume.sys - Drive extender pingable event: DEVolume!PingableEvent +DEpg - devolume.sys - Drive extender pingable object globals: DEVolume!PingableObjectGlobals +DEpm - devolume.sys - Drive extender physical map: DEVolume!PhysicalMap +DEqm - devolume.sys - Drive extender queued message: DEVolume!QueuedMessage +DEra - devolume.sys - Drive extender disk event request +DErb - devolume.sys - Drive extender become dirty request: DEVolume!VolumeChunk::BecomeDirtyRequest +DErc - devolume.sys - Drive extender commit request: DEVolume!VolumeChunk::CommitRequest +DErd - devolume.sys - Drive extender decommit request: DEVolume!VolumeChunk::DecommitRequest +DEre - devolume.sys - Drive extender decommit all request: DEVolume!DiskSetVolume::DecommitAllRequest +DErg - devolume.sys - Drive extender registry: DEVolume!DERegistry +DErh - devolume.sys - Drive extender replicate chunk: DEVolume!ReplicateChunk +DErl - devolume.sys - Drive extender long and notify request: DEVolume!DiskSetVolume::LogAndNotifyRequest +DErm - devolume.sys - Drive extender range lock manager: DEVolume!RangeLockManager +DErn - devolume.sys - Drive extender new epoch request: DEVolume!DEDiskSet::NewEpochRequest +DEro - devolume.sys - Drive extender become out of date request: DEVolume!VolumeChunk::BecomeOutOfDateRequest +DErp - devolume.sys - Drive extender replicator: DEVolume!Replicator +DErr - devolume.sys - Drive extender read request: DEVolume!ReadRequest +DErs - devolume.sys - Drive extender delete or shutdown request: DEVolume!DiskSetVolume::DeleteOrShutdownRequest +DErt - devolume.sys - Drive extender start request: DEVolume!DEDiskSet::StartRequest +DEru - devolume.sys - Drive extender shutdown request: DEVolume!DEDiskSet::ShutdownRequest +DErv - devolume.sys - Drive extender repair volume request: DEVolume!DiskSetVolume::RepairVolumeDamageRequest +DErw - devolume.sys - Drive extender read write target: DEVolume!ReadWriteTarget +DErx - devolume.sys - Drive extender shutdown system request: DEVolume!DiskSetVolume::ShutdownRequest +DEry - devolume.sys - Drive extender start or create request: DEVolume!DiskSetVolume::StartOrCreateRequest +DErz - devolume.sys - Drive extender write super blocks request: DEVolume!DEDiskSet::WriteSuperBlocksRequest +DEsb - devolume.sys - Drive extender super block buffer +DEsd - devolume.sys - Drive extender disk set disk: DEVolume!DiskSetDisk +DEsg - devolume.sys - Drive extender disk set globals: DEVolume!DEDiskSetGlobals +DEsh - devolume.sys - Drive extender space holder operation: DEVolume!SpaceHolderOperation +DEte - devolume.sys - Drive extender data error message: DEVolume!DE_DATA_ERROR_MESSAGE +DEtr - devolume.sys - Drive extender trace message +DEtn - devolume.sys - Drive extender range lock test node +DEtx - devolume.sys - Drive extender range lock test +DEts - devolume.sys - Drive extender splay tree test +DEtw - devolume.sys - Drive extender trim worker pauser: DEVolume!AutoPauseTrimWorker +DEub - devolume.sys - Drive extender unaligned EccPage temp buffer: DEVolume!DeEccPage +DEus - devolume.sys - Drive extender unicode string +DEva - devolume.sys - Drive extender volume chunk array: DEVolume!AutoVolumeChunkPtr * +DEvc - devolume.sys - Drive extender volume chunk: DEVolume!VolumeChunk +DEvg - devolume.sys - Drive extender volume globals: DEVolume!DEVolumeGlobals +DEvh - devolume.sys - Drive extender volume device globals: DEVolume!DEVolumeDeviceGlobals +DEvm - devolume.sys - Drive extender volume message: DEVolume!DE_VOLUME_MESSAGE +DEvo - devolume.sys - Drive extender volume message: DEVolume!DEVolume +DEvs - devolume.sys - Drive extender disk set volume: DEVolume!DiskSetVolume +DEwi - devolume.sys - Drive extender work item: DEVolume!AutoWorkItem +DEze - devolume.sys - Drive extender cluster of zeros + +Dh 0 - - DirectDraw/3D default object +Dh 1 - - DirectDraw/3D DirectDraw object +Dh 2 - - DirectDraw/3D Surface object +Dh 3 - - DirectDraw/3D Direct3D context object +Dh 4 - - DirectDraw/3D VideoPort object +Dh 5 - - DirectDraw/3D MotionComp object + +Dfb - - framebuf video driver +DfC? - dfsc.sys - DFS Client allocations +DfCa - dfsc.sys - DFS Client PERUSERTABLE +DfCb - dfsc.sys - DFS Client REFCONTEXT +DfCc - dfsc.sys - DFS Client CONNECTION +DfCd - dfsc.sys - DFS Client CURRENTDC +DfCe - dfsc.sys - DFS Client CSCEA +DfCf - dfsc.sys - DFS Client FILENAME +DfCg - dfsc.sys - DFS Client PREFIXCACHE +DfCh - dfsc.sys - DFS Client HASH +DfCi - dfsc.sys - DFS Client INPUTBUFFER +DfCj - dfsc.sys - DFS Client REFERRALNAME +DfCj - dfsc.sys - DFS Client REWRITTENNAME +DfCl - dfsc.sys - DFS Client DCLIST +DfCm - dfsc.sys - DFS Client CMCONTEXT +DfCn - dfsc.sys - DFS Client DOMAINNAME +DfCp - dfsc.sys - DFS Client PATH +DfCq - dfsc.sys - DFS Client REGSTRING +DfCr - dfsc.sys - DFS Client REFERRAL +DfCs - dfsc.sys - DFS Client SHARENAME +DfCt - dfsc.sys - DFS Client TREECONNECT +DfCu - dfsc.sys - DFS Client USETABLE +DfCv - dfsc.sys - DFS Client SERVERNAME +DfCw - dfsc.sys - DFS Client TARGETINFO +DfCx - dfsc.sys - DFS Client CREDENTIALS +DfCy - dfsc.sys - DFS Client REMOTEENTRY +DfCz - dfsc.sys - DFS Client DOMAINREFERRAL +Dfs - - Distributed File System +dfsr - - RDBSS IRP allocation +Dfsm - - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre +dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption) +Dict - storport.sys - StorCreateDictionary storport!_STOR_DICTIONARY.Entries +Dire - - Directory objects +Dlck - - deadlock verifier (part of driver verifier) structures +Dlmp - - Video utility library for Vista display drivers +Dmga - - mga (matrox) video driver +DmH? - - DirectMusic hardware synthesizer +DmpS - dumpsvc.sys - Crashdump Service Driver +DmS? - - DirectMusic kernel software synthesizer +Dndt - - Device node +Dnod - - Device node structure +DOPE - - Device Object Power Extension (po component) +DpDc - FsDepends.sys - FsDepends Dependency Context Block +DpDl - FsDepends.sys - FsDepends Dependency List Block +DpPl - FsDepends.sys - FsDepends Parent Link Block +DPrf - - Disk performance filter driver +DPwr - nt!pnp - PnP power management +Dprt - dxgkrnl.sys - Video port for Vista display drivers +Dps5 - - NT5 PostScript printer driver +Dpsh - - Postcript driver heap memory +Dpsi - - psidisp video driver +Dpsm - - Postcript driver memory +Dqv - - qv (qvision) video driver +DpVc - FsDepends.sys - FsDepends Volume Context Block +DrDr - rdpdr.sys - Global object +DrEx - rdpdr.sys - Exchange object +DrIC - rdpdr.sys - I/O context object +Driv - - Driver objects +Drsd - - Rasdd Printer Driver Pool Tag. +Dtga - - tga video driver +Dump - - Bugcheck dump allocations +Dun5 - - NT5 Universal printer driver +DUQD - mpsdrv.sys - MPSDRV upcall user request +DV?? - - RDR2 DAV MiniRedir Tags +DVCx - - AsyncEngineContext, DAV MiniRedir +DVEx - - Exchange, DAV MiniRedir +DVFi - - FileInfo, DAV MiniRedir +DVFn - - FileName, DAV MiniRedir +DVRw - - ReadWrite, DAV MiniRedir +DVSc - - SrvCall, DAV MiniRedir +DVSh - - SharedHeap, DAV MiniRedir + +Dvga - - vga 16 color video driver +Dvg2 - - vga 256 color video driver +Dvg6 - - vga 64K color video driver +Dvgr - - vga for risc video driver +DW32 - - W32 video driver +Dwd - - wd90c24a video driver +Dwp9 - - weitekp9 video driver +Dxga - - XGA video driver + +DxgK - dxgkrnl.sys - Vista display driver support + +Efsm - - EFS driver +Efsc - - EFS driver + +Efst - - EXIFS FS Statistics + +Envr - - Environment strings + +EQAn - tcpip.sys - EQoS application name +EQCc - tcpip.sys - EQoS counters +EQHb - tcpip.sys - EQoS HKE binding +EQHp - tcpip.sys - EQoS HKE parameters +EQOw - tcpip.sys - EQoS policy owner +EQPn - tcpip.sys - EQoS policy net entry +EQPp - tcpip.sys - EQoS policy profile entry +EQPs - tcpip.sys - EQoS policy scratch data +EQPt - tcpip.sys - EQoS policy table +EQQu - tcpip.sys - EQoS flow unit +EQSc - tcpip.sys - EQoS pacer client +EQSe - tcpip.sys - EQoS QIM endpoint +EQSp - tcpip.sys - EQoS generic policy data +EQSt - tcpip.sys - EQoS policy trim scratch +EQSx - tcpip.sys - EQoS security object +EQSy - tcpip.sys - EQoS proxy data +EQUn - tcpip.sys - EQoS uQoS NPI client data +EQUr - tcpip.sys - EQoS URL string +EQUp - tcpip.sys - EQoS URL policy section +EQUQ - tcpip.sys - UQoS generic allocation + +Err - - Error strings + +EtwA - nt!etw - Etw APC +EtwG - nt!etw - Etw Guid +EtwD - nt!etw - Etw DataBlock +EtwS - nt!etw - Etw DataSource +EtwR - nt!etw - Etw Registration +EtwC - nt!etw - Etw Realtime Consumer +EtwB - nt!etw - Etw Buffer +EtwP - nt!etw - Etw Pool +EtwQ - nt!etw - Etw Queue +Etwb - nt!etw - Etw binary tracking +Etwq - nt!etw - Etw ReplyQueue +Etwr - nt!etw - Etw ReplyQueue Entry +EtwL - nt!etw - ETW_LOGGER_CONTEXT +Etwp - nt!etw - ETW per-processor block +EtwW - nt!etw - ETW work item +Etwm - nt!etw - ETW stack tracing bit-map +EtwF - nt!etw - ETW schematized filter + +Evel - - EFS file system filter driver lookaside list +Even - - Event objects +Evid - - Rtl Event ID's +ExWl - - Executive worker list entry + +Fat - fastfat.sys - Fat File System allocations +FatB - fastfat.sys - Fat allocation bitmaps +FatC - fastfat.sys - Fat Ccbs +FatD - fastfat.sys - Fat pool dirents +FatE - fastfat.sys - Fat EResources +FatF - fastfat.sys - Fat Fcbs +FatI - fastfat.sys - Fat IrpContexts +FatL - fastfat.sys - Fat FAT entry lookup buffer on verify +FatN - fastfat.sys - Fat Nonpaged Fcbs +FatO - fastfat.sys - Fat I/O buffer +FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees) +FatQ - fastfat.sys - Fat buffered user buffer +FatR - fastfat.sys - Fat repinned Bcb +FatS - fastfat.sys - Fat stashed Bpb +FatT - fastfat.sys - Fat directory allocation bitmaps +FatV - fastfat.sys - Fat Vcb stat bucket +Fatv - fastfat.sys - Fat events +FatW - fastfat.sys - Fat FAT windowing structure +FatX - fastfat.sys - Fat IO contexts +Fatb - fastfat.sys - Fat Bcb arrays +Fatd - fastfat.sys - Fat EA data +Fate - fastfat.sys - Fat EA set headers +Fatf - fastfat.sys - Fat deferred flush contexts +Fati - fastfat.sys - Fat IO run descriptor +Fatn - fastfat.sys - Fat filename buffer +Fatr - fastfat.sys - Fat verification-time rootdir snapshot +Fats - fastfat.sys - Fat verification-time boot sector +Fatv - fastfat.sys - Fat backpocket Vpb +Fatx - fastfat.sys - Fat delayed close contexts +FbCx - tcpip.sys - Inet feature fallback contexts + +Fcbl - - EXIFS FCBlock +fboX - - EXIFS FOBXVF List + +Feiv - netio.sys - WFP filter engine incoming values +Fecc - netio.sys - WFP filter engine classify context +Fecf - netio.sys - WFP filter engine callout context + +File - - File objects +FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path +FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter +FIcs - fileinfo.sys - FileInfo FS-filter Stream Context +FIcv - fileinfo.sys - FileInfo FS-filter Volume Context +FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context +FIou - fileinfo.sys - FileInfo FS-filter User Open Context +FIof - fileinfo.sys - FileInfo FS-filter File Object Context +FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context +FIvn - fileinfo.sys - FileInfo FS-filter Volume Name +FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties + +FlmC - tcpip.sys - Framing Layer Client Contexts +FlmP - tcpip.sys - Framing Layer Provider Contexts +Flng - tcpip.sys - Framing Layer Generic Buffers (Tunnel/Port change notifications, ACLs) +FlpC - tcpip.sys - Framing Layer Client Contexts +FlpI - tcpip.sys - Framing Layer Interfaces +FlpL - tcpip.sys - Framing Layer Client Interface Contexts +FlpM - tcpip.sys - Framing Layer Multicast Groups +FlpS - tcpip.sys - Framing Layer Serialized Requests +Fl6D - tcpip.sys - FL6t DataLink Addresses +Fl4D - tcpip.sys - FL4t DataLink Addresses +FlSB - tcpip.sys - Framing Layer Stack Block + +Flop - - floppy driver + +Flst - - EXIFS Freelist + +Fltt - nt!Vf - Log of Driver Verifier fault injection stack traces. + +FLex - - exclusive file lock +FLfl - - exported (non-private) file lock +FLli - - per-file lock information +FLln - - shared lock tree node +FLsh - - shared file lock +FLwl - - waiting lock + +FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w) +FMac - fltmgr.sys - ASCII String buffers +FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure +FMcb - fltmgr.sys - FLT_CCB structure +FMcn - fltmgr.sys - Non paged context extension structures +FMcp - fltmgr.sys - Client port wrapper structure +FMcr - fltmgr.sys - Context registration structures +FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure +FMdh - fltmgr.sys - Paged ECP context for targeted create reparse +FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers +FMea - fltmgr.sys - EA buffer for create +FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure +FMfi - fltmgr.sys - Fast IO dispatch table +FMfk - fltmgr.sys - Byte Range Lock structure +FMfl - fltmgr.sys - FLT_FILTER structure +FMfn - fltmgr.sys - NAME_CACHE_NODE structure +FMfr - fltmgr.sys - FLT_FRAME structure +FMfz - fltmgr.sys - FILE_LIST_CTRL structure +FMib - fltmgr.sys - Irp SYSTEM buffers +FMic - fltmgr.sys - IRP_CTRL structure +FMil - fltmgr.sys - IRP_CTRL completion node stack +FMin - fltmgr.sys - FLT_INSTANCE name +FMis - fltmgr.sys - FLT_INSTANCE structure +FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists +FMlp - fltmgr.sys - Paged stream list control entry structures +FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure +FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure +FMol - fltmgr.sys - OPLOCK_CONTEXT structure +FMos - fltmgr.sys - Operation status ctrl structure +FMpl - fltmgr.sys - Cache aware pushLock +FMpr - fltmgr.sys - FLT_PRCB structure +FMrl - fltmgr.sys - FLT_OBJECT rundown logs +FMrp - fltmgr.sys - Reparse point data buffer +FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure +FMrs - fltmgr.sys - Registry string +FMrw - fltmgr.sys - FLT_REGISTRY_WATCH_CONTEXT structure +FMsc - fltmgr.sys - SECTION_CONTEXT structure +FMsd - fltmgr.sys - Security descriptors +FMsl - fltmgr.sys - STREAM_LIST_CTRL structure +FMtb - fltmgr.sys - TXN_PARAMETER_BLOCK structure +FMtn - fltmgr.sys - Temporary file names +FMtp - fltmgr.sys - Non Paged TxVol context structures +FMtr - fltmgr.sys - Temporary Registry information +FMts - fltmgr.sys - Tree Stack +FMus - fltmgr.sys - Unicode string +FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure +FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure +FMvl - fltmgr.sys - Array of FLT_VERIFIER_OBJECT structures +FMvo - fltmgr.sys - FLT_VOLUME structure +FMwi - fltmgr.sys - Work item structures + +Fsb - netio.sys - Fixed-Size Block pool + +Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys) + +Fstb - - ntos\fstub +FstB - - ntos\fstub + +FsVg - fsvga.sys - International VGA support + +flnk - - font link tag used in ntgdi\gre + +fpct - wof.sys - Compressed file chunk table +fpcx - wof.sys - Compressed file IO context +fpdw - wof.sys - Compressed file decompression workspace +fpgn - wof.sys - Compressed file general +fppm - wof.sys - Compressed file IO parameters +fprd - wof.sys - Compressed file small read buffer +fpRD - wof.sys - Compressed file large read buffer +fpwi - wof.sys - Compressed file work item +fpxp - wof.sys - Compressed file xpress context + +FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w) +FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry +FSel - nt!fsrtl - File System Run Time Extra Create Parameter List +FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List +FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List +FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!) +FSmg - nt!fsrtl - File System Run Time +FSrd - nt!fsrtl - File System Run Time +FSrm - nt!fsrtl - File System Run Time +FSrn - nt!fsrtl - File System Run Time +FSrN - nt!fsrtl - File System Run Time +FSro - nt!fsrtl - File System Run Time +FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting +FSun - nt!fsrtl - File System Run Time +FOCX - nt!fsrtl - File System Run Time File Object Context structure + +FTrc - - Fault tolerance Slist tag. +FtC - - Fault tolerance driver +FtM - - Fault tolerance driver +FtS - - Fault tolerance driver +FtT - - Fault tolerance driver +FtU - - Fault tolerance driver +FtV - - Fault tolerance driver + +FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer +FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER + +FwSD - tcpip.sys - WFP security descriptor + +FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption) +FVE0 - fvevol.sys - General allocations +FVEc - fvevol.sys - Cryptographic allocations +FVEl - fvevol.sys - FVELIB allocations +FVEp - fvevol.sys - Write buffers +FVEr - fvevol.sys - Reserved mapping addresses +FVEv - fvevol.sys - Conversion allocations +FVEw - fvevol.sys - Worker threads +FVEx - fvevol.sys - Read/write control structures + +FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. +FxLg - wdf01000.sys - KMDF IFR log tag +FxL? - wdfldr.sys - KMDF Loader Pool allocation + +Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver. +Fwpn - fwpkclnt.sys - WFP NBL info +Fwpi - fwpkclnt.sys - WFP injector info +Fwpx - fwpkclnt.sys - WFP NBL tagged context +Fwpd - fwpkclnt.sys - WFP delayed injection context +Fwpc - fwpkclnt.sys - WFP injection call context + +G??? - - Gdi Objects +G - - Gdi Generic allocations +Gcac - - Gdi glyph cache +Gcap - - Gdi capture buffer +Gcsl - - Gdi string resource script names +Gdbr - - Gdi driver brush realization +Gdd - - Gdi ddraw PKEY_VALUE_FULL_INFORMATION +Gdda - - Gdi ddraw attach list +GddD - - Gdi ddraw dummy page +Gdde - - Gdi ddraw event +Gddf - - Gdi ddraw driver heaps +Gddp - - Gdi ddraw driver caps +Gddv - - Gdi ddraw driver video memory list +Gdxd - - Gdi ddraw VPE directdraw object +Gdxs - - Gdi ddraw VPE surface, videoport, capture object +Gdxx - - Gdi ddraw VPE DXAPI object +Gdev - - Gdi GDITAG_DEVMODE +GDev - - Gdi pdev +Gdrs - - Gdi GDITAG_DRVSUP +Gebr - - Gdi ENGBRUSH +gEdg - - Gdi gradient fill triangle +Gffv - - Gdi FONTFILEVIEW +gFil - - Gdi FILEVIEW +GFil - - Gdi engine descriptor list +Gfsb - - Gdi font sustitution list +Gfsm - - Gdi Fast mutex +Ggdv - - Gdi GDITAG_GDEVICE +Gglb - - Gdi temp buffer +Ggls - - Gdi glyphset +Ggb - - Gdi glyph bits +Ggbl - - Gdi look aside buffers +Ghmg - - Gdi handle manager objects +Gini - - Gdi fast mutex +Gldv - - Gdi Ldev +Glnk - - Gdi PFELINK +Gmap - - Gdi font map signature table +Gpff - - Gdi physical font file +Gpft - - Gdi font table +Gsem - - Gdi Semaphores +Gsp - - Gdi sprite +Gspr - - Gdi sprite grow range +Gtmp - - Gdi temporary allocations +Gtmw - - Gdi TMW_INTERNAL +Gxlt - - Gdi Xlate + +Gfcb - - EXIFS Grow FCB + + +Hal - hal.dll - Hardware Abstraction Layer +HalV - ntoskrnl.exe - Driver Verifier DMA checking +Hpfs - - Pinball (aka Hpfs) allocations +HisC - - histogram filter driver +Hist - - histogram filter driver +HidP - hidparse.sys - HID Parser +HidC - hidclass.sys - HID Class driver +HdCl - - HID Client Sample Driver +HpMM - pnpmem.sys - HotPlug Memory Driver + +HCID - bthport.sys - Bluetooth port driver HCI debug +HCIT - bthport.sys - Bluetooth port driver (HCI) + +HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST +HcEv - hcaport.sys - HCAPORT_TAG_EVENT +HcdI - hcaport.sys - HCAPORT_TAG_HWID +HcEn - hcaport.sys - HCAPORT_TAG_ENUM +HcMc - hcaport.sys - HCAPORT_TAG_MISC +HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS +HcBm - hcaport.sys - HCAPORT_TAG_BITMAP +HcOb - hcaport.sys - HCAPORT_TAG_OBJECT +HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE +HcPr - hcaport.sys - HCAPORT_TAG_PROTD +HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION +HcMa - hcaport.sys - HCAPORT_TAG_MAD +HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT +HcCm - hcaport.sys - HCAPORT_TAG_CM +HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT +HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK +Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO +Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE + +hSVD - mrxdav.sys - Shared Heap Tag + +HTab - - Hash Table pool + +HT01 - - GDI Halftone AddCachedDCI() for CurCDCIData +HT02 - - GDI Halftone GetCachedDCI() for Threshold +HT03 - - GDI Halftone FindCachedSMP() for CurCSMPData +HT04 - - GDI Halftone FindCachedSMP() for CurCSMPBmp +HT05 - - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI +HT06 - - GDI Halftone pDCIAdjClr() for DEVCLRADJ +HT07 - - GDI Halftone ComputeRGB555LUT() for RGBLUT +HT08 - - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ +HT09 - - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache +HT10 - - GDI Halftone CreateDyesColorMappingTable() for DevPrims +HT11 - - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable +HT12 - - GDI Halftone ThresholdsFromYData() for pYData +HT13 - - GDI Halftone ComputeHTCellRegress() for pThresholds +HT14 - - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine +HT15 - - GDI Halftone CalculateStretch() for PrimColorInfo + +Hvlm - nt!Hvl - Temporary MDL for the Hvl component. +HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component. + +IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager +CEP - wibcm.sys - CEP_INSTANCE_TAG +CMSH - wibcm.sys - WIBCM_SHARED_TAG +CMWK - wibcm.sys - WIBCM_WORK_TAG +CMWT - wibcm.sys - WIBCM_TIMER_TAG + +IBm* - wibms.sys - Windows Infiniband Management Server pool tags + +IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager +IbPS - wibpm.sys - WIBPM_SENT_TAG +IbPI - wibpm.sys - WIBPM_ITEM_TAG +IbPA - wibpm.sys - WIBPM_SAMPLE_TAG + +IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager +IbW1 - wibwmi.sys - WIBWMI1_TAG +IbW2 - wibwmi.sys - WIBWMI2_TAG + +Ic4c - tcpip.sys - ICMP IPv4 Control data +Ic4h - tcpip.sys - ICMP IPv4 Headers +Ic6c - tcpip.sys - ICMP IPv6 Control data +Ic6h - tcpip.sys - ICMP IPv6 Headers +IBbf - tcpip.sys - IP BVT Buffers +Ilom - tcpip.sys - IPsec LBFO offload map +Ilog - tcpip.sys - IPsec LBFO offload general +InAD - tcpip.sys - Inet Ancillary Data +InCo - tcpip.sys - Inet Compartment +InCS - tcpip.sys - Inet Compartment Set +IneI - tcpip.sys - Inet Inspects +InF0 - tcpip.sys - Inet Generic Fixed Size Block pool 0 +InF1 - tcpip.sys - Inet Generic Fixed Size Block pool 1 +InF2 - tcpip.sys - Inet Generic Fixed Size Block pool 2 +InIS - tcpip.sys - Inet Inspect Streams +InNA - - Inet Na Clients +InNP - tcpip.sys - Inet Nsi Providers +InPA - tcpip.sys - Inet Port Assignment Arrays +InPa - tcpip.sys - Inet Port Assignments +InPE - tcpip.sys - Inet Port Exclusions +InPP - tcpip.sys - Inet Port pool +InSB - tcpip.sys - Inet stack block +InSC - tcpip.sys - Inet Queued Send Contexts +InWP - tcpip.sys - Inet Wake Port Record +Ipas - tcpip.sys - IP Buffers for Address Sort +Ipcr - tcpip.sys - IP Cache-aware Reference Counters +IPbw - tcpip.sys - IP Path Bandwidth information +IPdc - tcpip.sys - IP Destination Cache +IPfg - tcpip.sys - IP Fragment Groups +IPfp - tcpip.sys - IP PreValidated Receives +IPif - tcpip.sys - IP Interfaces +IPlo - tcpip.sys - IP Loopback buffers +IPmf - tcpip.sys - IP Multicast Forwarding Entry pool +IPpo - tcpip.sys - IP Offload buffers +IPpa - tcpip.sys - IP Path information +IPro - tcpip.sys - IP Router Context +IPrq - tcpip.sys - IP Request Control data +IPss - tcpip.sys - IP Session State +IPsi - tcpip.sys - IP SubInterfaces +Ipng - tcpip.sys - IP Generic buffers (Address, Interface, Packetize, Route allocations) +IpOl - tcpip.sys - IP Offload Log data +Ippp - tcpip.sys - IP Prefix Policy information +IPre - tcpip.sys - IP Reassembly buffers +Iptt - tcpip.sys - IP Timer Tables +Iptc - tcpip.sys - IP Transaction Context information +Ipur - tcpip.sys - IP Unicast Routes +Ipwi - tcpip.sys - IP Work Item allocations +I4ai - tcpip.sys - IPv4 Local Address Identifiers +I4ba - tcpip.sys - IPv4 Local Broadcast Addresses +I4bf - tcpip.sys - IPv4 Generic Buffers (Source Address List allocations) +I4e - tcpip.sys - IPv4 Echo data +I4ma - tcpip.sys - IPv4 Local Multicast Addresses +I4nb - tcpip.sys - IPv4 Neighbors +I4rd - tcpip.sys - IPv4 Receive Datagrams Arguments +I4ua - tcpip.sys - IPv4 Local Unicast Addresses +I6ai - tcpip.sys - IPv6 Local Address Identifiers +I6aa - tcpip.sys - IPv6 Local Anycast Addresses +I6bf - tcpip.sys - IPv6 Generic Buffers (Source Address List allocations) +I6e - tcpip.sys - IPv6 Echo data +I6ma - tcpip.sys - IPv6 Local Multicast Addresses +I6nb - tcpip.sys - IPv6 Neighbors +I6rd - tcpip.sys - IPv6 Receive Datagrams Arguments +I6ua - tcpip.sys - IPv6 Local Unicast Addresses + +IPX - - Nwlnkipx transport +Icp - - I/O completion packets queue on a completion ports +IcpP - - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers +IdeP - - atapi IDE +IdeX - - PCI IDE +idle - - Power Manager idle handler +Ifs - - Default file system allocations (user's of ntifs.h) +Info - - general system information allocations +Io - nt!io - general IO allocations +IoBo - nt!io - Io boot disk information +IoCc - nt!io - Io completion context +IoDn - nt!io - Io device name info +IoEa - nt!io - Io extended attributes +IoEr - nt!io - Io error log packets +IoFc - nt!io - Io name transmogrify operation +IoFs - nt!io - Io shutdown packet +IoFu - nt!pnp - Io file utils +Ioin - - Io interrupts +IoKB - nt!io - Registry basic key block (temp allocation) +IoNm - nt!io - Io parsing names +IoOp - nt!io - I/O subsystem open packet +IoRb - nt!io - Io remote boot related +IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet +IoRN - nt!io - Registry key name (temp allocation) +IoSD - nt!io - Io system device buffer +IoSe - nt!io - Io security related +IoSh - nt!io - Io shutdown packet +IoSi - nt!io - Io Symbolic Links +IoSn - nt!io - Io Session Notifications +IoSt - nt!io - Io Stream Identifier Context +IoTi - nt!io - Io timers +IoTt - nt!vf - I/O verifier IRP tracking table +IoUs - nt!io - I/O SubSystem completion Context Allocation +Irp - - Io, IRP packets +Irp+ - nt!vf - I/O verifier allocated IRP packets +IrpB - nt!vf - I/O verifier direct I/O double buffer allocation +Irpd - nt!vf - I/O verifier deferred completion context +Irps - nt!vf - I/O verifier per-IRP session tracking data +Irpt - nt!vf - I/O verifier per-IRP tracking data +IrpC - nt!vf - I/O verifier stack contexts +Irpl - nt!io - system large IRP lookaside list +Irps - nt!io - system small IRP lookaside list +IrpX - nt!io - IRP Extension +Isap - - Pnp Isa bus extender +II?? - - IP in IP tunneling +IIrf - - Free memory +IIdt - - Data +IITn - - Tunnel +IIhd - - Header +IIpk - - Packet +IIsc - - Send Context +IIts - - Transfer Context +IIwc - - Work Context + +Im* - - Imapi.sys from adaptec + +INTC - - Intel video driver + +IPm? - - IP Multicasting +IPmg - - Group +IPms - - Source +IPmo - - Outgoing Interface +IPmm - - Message +IPmf - - Free memory (only in checked builds) + +Ip?? - ipsec.sys - IP Security (IPsec) +IpSI - ipsec.sys - initial allocations +IpAT - ipsec.sys - AH headers in transport mode +IpAU - ipsec.sys - AH headers in tunnel mode +IpET - ipsec.sys - ESP headers in transport mode +IpEU - ipsec.sys - ESP headers in tunnel mode +IpHT - ipsec.sys - HUGHES headers in transport mode +IpHU - ipsec.sys - HUGHES headers in tunnel mode +IpAX - ipsec.sys - key acquire contexts +IpFI - ipsec.sys - filter blocks +IpSA - ipsec.sys - security associations (SA) +IpKE - ipsec.sys - keys +IpTI - ipsec.sys - timers +IpSQ - ipsec.sys - stall queues +IpLA - ipsec.sys - lookaside lists +IpBP - ipsec.sys - buffer pools +IpSC - ipsec.sys - send complete context +IpEQ - ipsec.sys - event queue +IpHW - ipsec.sys - hardware accleration items +IpCO - ipsec.sys - IP compression + +ItoM - tcpip.sys - IPsec task offload interface +ItoD - tcpip.sys - IPsec task offload delete SA +ItoS - tcpip.sys - IPsec task offload add SA +ItoC - tcpip.sys - IPsec task offload context +ItoO - tcpip.sys - IPsec task offload paramters + +Itht - tcpip.sys - IPsec hashtable +ISLe - tcpip.sys - IPsec SA list entry +IsRc - tcpip.sys - IPsec rebalance context +Ikmb - tcpip.sys - IPsec key module blob +Ithp - tcpip.sys - IPsec throttle parameter +Ipfl - tcpip.sys - IPsec flow handle +Ipap - tcpip.sys - IPsec pend context +Inlc - tcpip.sys - IPsec NL complete context +Iprc - tcpip.sys - IPsec RPC context +Ipis - tcpip.sys - IPsec inbound sequence info +Itok - tcpip.sys - IPsec token +Iser - tcpip.sys - IPsec inbound sequence range +IKeO - tcpip.sys - IPsec key object +I4sa - tcpip.sys - IPsec SADB v4 +I4s6 - tcpip.sys - IPsec SADB v6 +IHaO - tcpip.sys - IPsec hash object +Ipnc - tcpip.sys - IPsec negotiation context +Icse - tcpip.sys - IPsec NS connection state +Itro - tcpip.sys - IPsec outbound session security context +Itri - tcpip.sys - IPsec inbound packet security context +Ituo - tcpip.sys - IPsec outbound tunnel session security context +Itui - tcpip.sys - IPsec inbound packet tunnel security context +Ipft - tcpip.sys - IPsec filter +Ipwi - tcpip.sys - IPsec work item + +Idqf - tcpip.sys - IPsec DoS Protection QoS flow +Idpc - tcpip.sys - IPsec DoS Protection pacer create +Idst - tcpip.sys - IPsec DoS Protection state entry +Ifws - tcpip.sys - IPsec forward state + +ImPl - ndisimplatform.sys - NDIS IM (LBFO) Platform + +IpFl - mpsdrv.sys - MPSDRV IP Flow + +IrD? - - IrDA TDI and RAS drivers + +IU?? - - IIS Utility Driver +IUDl - - Lookaside list allocations +IUcp - - completion port minipackets + +KAPC - nt!io - I/O SubSystem HardError APC +KbdC - kbdclass.sys - Keyboard Class Driver +KbdH - kbdhid.sys - Keyboard HID mapper Driver +KCfe - - Kernel COM factory entry +KDN_ - kdnic.sys - Network Kernel Debug Adapter +KDNT - kdnic.sys - Network Kernel Debug Adapter TCB +KDNR - kdnic.sys - Network Kernel Debug Adapter RCB +KDNr - kdnic.sys - Network Kernel Debug Adapter RECV-NBL +KDNF - kdnic.sys - Network Kernel Debug Adapter FRAME +Ke - - Kernel data structures +KeIC - - Kernel Interrupt Object Chain +Key - - Key objects +KMIX - - Kmixer (wdm audio) +KNMI - - Kernel NMI Callback object +KrbC - ksecdd.sys - Kerberos Client package +krpc - nt - NTOS midl_user_allocate +KSah - - Ks auxiliary stream headers +KSAI - - allocator instance +KSai - - default allocator instance header +KSbi - - event buffered item +KSCI - - clock instance +KSce - - create item entry +KSch - - create handler entry +KSci - - default clock instance header +KScp - - object creation parameters auxiliary copy +KSda - - default allocator +KSdc - - default clock +KSdh - - device header +Kse0 - ksecdd.sys - Security driver allocs for sec package 0 +Kse1 - ksecdd.sys - Security driver allocs for sec package 1 +Kse2 - ksecdd.sys - Security driver allocs for sec package 2 +Kse3 - ksecdd.sys - Security driver allocs for sec package 3 +Kse4 - ksecdd.sys - Security driver allocs for sec package 4 +Kse5 - ksecdd.sys - Security driver allocs for sec package 5 +Kse6 - ksecdd.sys - Security driver allocs for sec package 6 +Kse7 - ksecdd.sys - Security driver allocs for sec package 7 +Kse8 - ksecdd.sys - Security driver allocs for sec package 8 +Kse9 - ksecdd.sys - Security driver allocs for sec package 9 +Ksec - ksecdd.sys - Security device driver +KSed - - event dpc item +KSee - - event entry +KSed - - oneshot event deletion dpc +KSep - - irp system buffer event parameter +KseS - ksecdd.sys - Security driver allocs for LSA proper +KSew - - oneshot event deletion workitem +KseZ - ksecdd.sys - Security driver allocs for default sec package +KSqr - - QM quality report +KSer - - QM error report +KSfd - - filter cache data (MSKSSRV) +KsFI - - filter instance +KSns - - null security object +KSnv - - registry name value +KSoh - - object header +KSop - - object creation parameters +KSpc - - port driver instance FsContext +KSPI - - pin instance +KSpp - - irp system buffer property/method/event parameter +KSpt - - pin type list (MSKSSRV) +KSqf - - query information file buffer +KSsc - - port driver stream FsContext +KSsf - - set information file buffer +KSsh - - stream headers +KSsi - - software bus interface +KSsl - - symbolic link buffer (MSKSSRV) +KSsp - - serialized property set +KsoO - - WDM audio stuff +L2CA - bthport.sys - Bluetooth port driver (L2CAP) +L2T0 - - ndis\l2tp / MTAG_FREED +L2T1 - - ndis\l2tp / MTAG_ADAPTERCB +L2T2 - - ndis\l2tp / MTAG_TUNNELCB +L2T3 - - ndis\l2tp / MTAG_VCCB +L2T4 - - ndis\l2tp / MTAG_VCTABLE +L2T5 - - ndis\l2tp / MTAG_WORKITEM +L2T6 - - ndis\l2tp / MTAG_TIMERQ +L2T7 - - ndis\l2tp / MTAG_TIMERQITEM +L2T8 - - ndis\l2tp / MTAG_PACKETPOOL +L2T9 - - ndis\l2tp / MTAG_FBUFPOOL +L2Ta - - ndis\l2tp / MTAG_HBUFPOOL +L2Tb - - ndis\l2tp / MTAG_TDIXRDG +L2Tc - - ndis\l2tp / MTAG_TDIXSDG +L2Td - - ndis\l2tp / MTAG_CTRLRECD +L2Te - - ndis\l2tp / MTAG_CTRLSENT +L2Tf - - ndis\l2tp / MTAG_PAYLRECD +L2Tg - - ndis\l2tp / MTAG_PAYLSENT +L2Th - - ndis\l2tp / MTAG_INCALL +L2Ti - - ndis\l2tp / MTAG_UTIL +L2Tj - - ndis\l2tp / MTAG_ROUTEQUERY +L2Tk - - ndis\l2tp / MTAG_ROUTESET +L2Tl - - ndis\l2tp / MTAG_L2TPPARAMS +L2Tm - - ndis\l2tp / MTAG_TUNNELWORK +L2Tn - - ndis\l2tp / MTAG_TDIXROUTE +LANE - atmlane.sys - LAN Emulation Client for ATM +LB?? - - LM Datagram receiver allocations +LBan - - Server announcement +LBvb - - View buffer +LBma - - Master announce context +LBxp - - Transport +LBxn - - TransportName +LBxm - - Master name +LBtn - - Transport name +LBea - - Ea buffer +LBdi - - POOL_DOMAIN_INFO +LBds - - Send datagram context +LBci - - Connection info +LBmh - - Mailslot header +LBbl - - Backup List +LBsl - - Browser server list +LBbs - - Browser server +LBgb - - GetBackupList request +LBbr - - GetBackupList response +LBmb - - Mailslot Buffer +LBid - - Illegal datagram context +LBbn - - Name +LBnn - - Name name +LBic - - IRP context +LBwi - - Work item +LBel - - Election context +LBbb - - Become backup context +LBbr - - Become backup request +LBpn - - Paged Name +LBpt - - Paged transport +LBse - - Browser security + +Lbuf - - EXIFS Large Buffer + +Ldmp - nt!io - Live Dump Buffers. Note, these buffers will not be present in the resulting live dump file. + +LeGe - tcpip.sys - Legacy Registry Mapping Module Buffers + +LeoC - - Symantec/Norton AntiVirus filter driver +List - - kernel utilities list allocation +LCam - - WDM mini video capture driver for Logitech camera +Lfs - - Lfs allocations +LfsI - - Lfs allocations +LLDP - mslldp.sys - LLDP protocol driver allocations +LogA - clfsapimp.sys - CLFS Kernel API test driver +LpcZ - - LPC Zone +LpcM - - Local procedure call message blocks +Lr?? - - LM redirector allocations +Lr - - Generic allocations +Lrcx - - Context blocks of various types +Lrcl - - ConnectListEntries +Lrsl - - ServerListEntries +Lrse - - Security entry +Lrsc - - Search Control Blocks +Lrea - - EA related allocations +Lric - - Instance Control Blocks +Lrfc - - File Control Blocks +Lrfl - - Fcb Locks +Lrfp - - Fcb Paging locks +Lrcn - - Computer Name +Lrdn - - Domain Name +Lr?? - - Buffers used for FsControlFile APIs +Lrlc - - Lock Control Blocks +Lrlb - - Lock Control Block buffers +Lrnf - - Non paged FCB +Lrnt - - Non paged transport +Lrps - - Paged security entry +Lrte - - Transport event. +Lrxx - - Transceive context blocks +Lr!! - - Cancel request context blocks +Lrmt - - MPX table +Lrme - - MPX table entries +Lrsx - - Send contexts +Lraw - - Async write context +Lrwb - - Write behind buffer header +Lrbb - - Write behind buffer +Lrwq - - Work queue item +Lrac - - ACL for redirector +Lrds - - Security Descriptor for redirector +Lrsm - - SMB buffer +Lrds - - Duplicated ansi string +Lrdu - - Duplicated unicode string +Lxpt - - Transport +Lrtc - - Transport connection +Lrna - - Netbios Addresses +Lrca - - Temporary storage used in name canonicalization +Lr2x - - Transact SMB context +Lrpt - - Primary transport server list +Lrso - - Operating system name +Lref - - Reference history (debug only) +LS?? - - LM server allocations +LSac - srv.sys - SMB1 BlockTypeAdminCheck +LSas - srv.sys - SMB1 BlockTypeAdapterStatus +LSbf - srvnet.sys - SMB1 buffer descriptor or srvnet allocation +LScd - srv.sys - SMB1 comm device +LScn - srv.sys - SMB1 connection +LSdb - srv.sys - SMB1 data buffer +LSdc - srv.sys - SMB1 BlockTypeDirCache +LSdi - srv.sys - SMB1 BlockTypeDirectoryInfo +LSep - srv.sys - SMB1 endpoint +LSfn - srv.sys - SMB1 BlockTypeFSName +LSfR - srv2.sys - SMB2 rfssequence table and rfs64table +LShs - srv2.sys - SMB2 lease hash table +LSlb - srv2.sys - SRVLIB security descriptor/registry buffer +LSlf - srv.sys - SMB1 LFCB +LSlr - srv.sys - SMB1 BlockTypeLargeReadX +LSmf - srv.sys - SMB1 MFCB +LSmi - srv.sys - SMB1 BlockTypeMisc +LSnh - srv.sys - SMB1 nonpaged block header +LSni - srv.sys - SMB1 BlockTypeNameInfo +LSnn - srv2.sys - SMB2 netname +LSop - srv.sys - SMB1 oplock break wait +LSpc - srv.sys - SMB1 paged connection +LSpm - srv.sys - SMB1 paged MFCB +LSpr - srv.sys - SMB1 paged RFCB +LSrf - srv.sys - SMB1 RFCB +LSrp - srvnet.sys - srvnet RPC allocation +LSRp - srv2.sys - SRVLIB reparse point +LSsc - srv.sys - SMB1 search(core) +LSsd - srv.sys - SMB1 BlockTypeShareSecurityDescriptor +LSsf - srv.sys - SMB1 BlockTypeDfs +LSsh - srv.sys - SMB1 share +LSSL - srv2.sys - SMBLIB allocation +LSsp - srv.sys - SMB1 search(core complete) +LSsr - srv.sys - SMB1 search +LSss - srv.sys - SMB1 session +LStb - srv.sys - SMB1 table +LStc - srv.sys - SMB1 tree connect +LSti - srv.sys - SMB1 timer +LStr - srv.sys - SMB1 transaction +LSvi - srv.sys - SMB1 BlockTypeVolumeInformation +LSwi - srv.sys - SMB1 initial work context +LSwn - srv.sys - SMB1 normal work context +LSwq - srv.sys - SMB1 BlockTypeWorkQueue +LSwr - srv.sys - SMB1 raw work context +LSws - srv.sys - SMB1 BlockTypeWorkContextSpecial +LS2b - srv2.sys - SMB2 buffer +LS2c - srv2.sys - SMB2 connection +LS2e - srv2.sys - SMB2 endpoint +LS2f - srv2.sys - SMB2 file +LS2h - srv2.sys - SMB2 share +LS2i - srv2.sys - SMB2 client +LS2l - srv2.sys - SMB2 lease +LS2n - srv2.sys - SMB2 channel +LS2o - srv2.sys - SMB2 oplock break +LS2p - srv2.sys - SMB2 provider +LS2q - srv2.sys - SMB2 queue +LS2s - srv2.sys - SMB2 session +LS2t - srv2.sys - SMB2 treeconnect +LS2W - srv2.sys - SMB2 special workitem +LS2w - srv2.sys - SMB2 workitem +LS2x - srv2.sys - SMB2 security context +LS$S - srv2.sys - SMB2 ecp +LS2$ - srv2.sys - SMB2 misc. allocation +LS00 - srvnet.sys - SRVNET LookasideList level 0 allocation 256 Bytes +LS01 - srvnet.sys - SRVNET LookasideList level 1 allocation 512 Bytes +LS02 - srvnet.sys - SRVNET LookasideList level 2 allocation 1K Bytes +LS03 - srvnet.sys - SRVNET LookasideList level 3 allocation 2K Bytes +LS04 - srvnet.sys - SRVNET LookasideList level 4 allocation 4K Bytes +LS05 - srvnet.sys - SRVNET LookasideList level 5 allocation 8K Bytes +LS06 - srvnet.sys - SRVNET LookasideList level 6 allocation 16K Bytes +LS07 - srvnet.sys - SRVNET LookasideList level 7 allocation 32K Bytes +LS08 - srvnet.sys - SRVNET LookasideList level 8 allocation 64K Bytes +LS09 - srvnet.sys - SRVNET LookasideList level 9 allocation 128K Bytes +LS10 - srvnet.sys - SRVNET LookasideList level 10 allocation 192K Bytes +LS11 - srvnet.sys - SRVNET LookasideList level 11 allocation 256K Bytes +LS12 - srvnet.sys - SRVNET LookasideList level 12 allocation 320K Bytes +LS13 - srvnet.sys - SRVNET LookasideList level 13 allocation 384K Bytes +LS14 - srvnet.sys - SRVNET LookasideList level 14 allocation 448K Bytes +LS15 - srvnet.sys - SRVNET LookasideList level 15 allocation 512K Bytes +LS16 - srvnet.sys - SRVNET LookasideList level 16 allocation 576K Bytes +LS17 - srvnet.sys - SRVNET LookasideList level 17 allocation 640K Bytes +LS18 - srvnet.sys - SRVNET LookasideList level 18 allocation 704K Bytes +LS19 - srvnet.sys - SRVNET LookasideList level 19 allocation 768K Bytes +LS20 - srvnet.sys - SRVNET LookasideList level 20 allocation 832K Bytes +LSnd - - WDM mini sound driver for Logitech video camera +Luaf - luafv.sys - LUA File Virtualization +LXMK - - kernel mixer line driver (KMXL - looks like they got their tag backwards) + +MXF - - DirectMusic (MIDI Transform Filter) + +MapP - - PNP map +Mapr - - arc firmware registry routines + +McaC - hal.dll - HAL MCA corrected Log +McaD - hal.dll - HAL MCA Driver Log +McaK - hal.dll - HAL MCA Kernel Log +McaP - hal.dll - HAL MCA Log from previous boot +McaT - hal.dll - HAL MCA temporary Log + +Mdp - netio.sys - Memory Descriptor Lists + +MCAM - - WDM mini driver for Intel USB camera +MCDx - - OpenGL MCD server (mcdsrv32.dll) allocations +MCDd - - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll) +Mdl - - Io, Mdls +MdlP - - MDL per processor lookaside list pointers +Mem - nt!po - NT Power manager, POP_MEM_TAG +MePr - - In-memory print buffer +MiCf - nt!mm - Mm compressed Control Flow Guard valid target RVA list +mkup - mpsdrv.sys - MPSDRV upcall request +Mm - nt!mm - general Mm Allocations +MmAc - nt!mm - Mm access log buffers +MmBk - nt!mm - Mm banked sections +MmCa - nt!mm - Mm control areas for mapped files +MmCd - nt!mm - Mm fork clone descriptors +MmCh - nt!mm - Mm fork clone headers +MmCi - nt!mm - Mm control areas for images +MmCl - nt!mm - Mm fork clone prototype PTEs +MmCm - nt!mm - Calls made to MmAllocateContiguousMemory +MmCr - nt!mm - Mm fork clone roots +MmCt - nt!mm - Mm debug tracing +MmDb - nt!mm - NtMapViewOfSection service +MmDT - nt!mm - Mm debug +MmEx - nt!mm - Mm events +MmHi - nt!mm - Mm image entry - allocated per session +MmHn - nt!mm - Mm sessionwide address name string entry +MmHv - nt!mm - Mm sessionwide address entry +MmIn - nt!mm - Mm inpaged io structures +MmLd - nt!mm - Mm load module database +MmPd - nt!mm - Mm page table commitment bitmaps +MmPg - nt!mm - Mm page table pages at init time +MmRp - nt!mm - Mm repurpose logging +MmRw - nt!mm - Mm read write virtual memory buffers +MmSb - nt!mm - Mm subsections +MmSe - nt!mm - Mm secured VAD allocation +MmSg - nt!mm - Mm segments +MmSt - nt!mm - Mm section object prototype ptes +MmSy - nt!mm - Mm PTE and IO tracking logs +Mmdl - nt!mm - Mm Mdls for flushes +Mmpp - nt!mm - Mm prototype PTEs for pool +Mmpr - nt!mm - Mm physical VAD roots +MmVd - nt!mm - Mm virtual address descriptors for mapped views +MmVs - nt!mm - Mm virtual address descriptors short form (private views) +Mmxx - nt!mm - Mm temporary allocations +MmCx - nt!mm - info for dynamic section extension +MmDm - nt!mm - deferred MmUnlock entries +MmHt - nt!mm - session space PTE data +MmLn - nt!mm - temporary name buffer for driver loads +MmMl - nt!mm - physical memory range information +MmPa - nt!mm - pagefile space deletion slist entries +MmRl - nt!mm - temporary readlists for file prefetch +MmSP - nt!mm - SLIST entries for system PTE NB queues +MmSi - nt!mm - Control area security image stubs +MmSc - nt!mm - subsections used to map data files +MmSd - nt!mm - extended subsections used to map data files +MmSm - nt!mm - segments used to map data files +MmWe - nt!mm - Work entries for writing out modified filesystem pages. +MmWw - nt!mm - Write watch VAD info +Mmpv - nt!mm - Physical view VAD info +Mmww - nt!mm - Write watch bitmap VAD info +MmSW - nt!mm - Store write support +MmSw - nt!mm - Store write support when prefetching +MmCS - nt!mm - Pagefile CRC verification buffer +MmCp - nt!mm - Colored page counts for physical memory allocations +Mmdi - nt!mm - MDLs for physical memory allocations +MmDp - nt!mm - Lost delayed write context +MmFl - nt!mm - MDLs for large clusters for flushes +MmFr - nt!mm - ASLR fixup records +MmId - nt!mm - PFN identity buffer for setting PFN priorities +MmIh - nt!mm - Image header allocation for Se validation +MmIm - nt!mm - IO space MDL trackers +MmIo - nt!mm - IO space mapping trackers +Mmlk - nt!mm - ProbeAndLock MDL tracker +MmLl - nt!mm - Large page memory run allocation for finding large pages +MmNo - nt!mm - Inernal physical memory nodes +MmPh - nt!mm - Physical memory nodes for querying memory ranges +MmRe - nt!mm - ASLR relocation blocks +MmWs - nt!mm - PTE flush list for working set operations +MmWS - nt!mm - Working set swap support +MmZw - nt!mm - Work items for zeroing pages and pagefiles +MmSa - nt!mm - Subsection AVL tree allocations +MmVt - nt!mm - Verifier thunk allocations +MmLa - nt!mm - Memory list locks +MmTp - nt!mm - Store eviction thread params +MmPb - nt!mm - Paging file bitmaps + +Mn01 - monitor.sys - ACPI method evaluation output buffer +Mn02 - monitor.sys - Unused +Mn03 - monitor.sys - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any) +Mn04 - monitor.sys - Cached monitor ID WMI data block +Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block +Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block +Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block +Mn08 - monitor.sys - Cached monitor color characteristics WMI data block +Mn09 - monitor.sys - Cached supported monitor source modes WMI data block +Mn0A - monitor.sys - Registry subkey info buffer +Mn0B - monitor.sys - Registry value buffer +Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry) +Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block) +Mn0E - monitor.sys - Buffer for E-EDID v.1.x base block, if any, populated by miniport +Mn0F - monitor.sys - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport + +MNFf - msnfsflt.sys - NFS FS Filter, filename buffer +MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer +MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer +MNFs - msnfsflt.sys - NFS FS Filter, general string buffer +MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer +MNFC - msnfsflt.sys - NFS FS Filter, callback context +MNFF - msnfsflt.sys - NFS FS Filter, file context +MNFI - msnfsflt.sys - NFS FS Filter, instance context +MNFS - msnfsflt.sys - NFS FS Filter, stream context +MNFT - msnfsflt.sys - NFS FS Filter, thread array + +MQAA - mqac.sys - MSMQ driver, AVL allocations +MQAB - mqac.sys - MSMQ driver, CCursor allocations +MQAC - mqac.sys - MSMQ driver, generic allocations +MQAD - mqac.sys - MSMQ driver, CDistribution allocations +MQAG - mqac.sys - MSMQ driver, CGroup allocations +MQAH - mqac.sys - MSMQ driver, Heap allocations +MQAP - mqac.sys - MSMQ driver, CPacket allocations +MQAQ - mqac.sys - MSMQ driver, CQueue allocations +MQAT - mqac.sys - MSMQ driver, CTransaction allocations + +MRXx - - Client side caching for SMB + +REM Minstore (an ReFS component) allocations +MSag - refs.sys - Minstore unspecified AVL entries (too big for lookasides; filtered AVL) +MSah - refs.sys - Minstore allocator history +MSal - refs.sys - Minstore allocator block +MSav - refs.sys - Minstore AVL table +MSb+ - refs.sys - Minstor B+ table +MSca - refs.sys - Minstore read cache object +MScc - refs.sys - Minstore tx checksum context +MScd - refs.sys - Minstore read cache dirty page array +MSch - refs.sys - Minstore read cache hash table +MSci - refs.sys - Minstore metadata cache instance +MScl - refs.sys - Minstore read cache line +MScm - refs.sys - Minstore composite +MScn - refs.sys - Minstore container +MScp - refs.sys - Minstore cached pin +MScs - refs.sys - Minstore read cache sync set +MScu - refs.sys - Minstore cursor +MScw - refs.sys - Minstore read cache write range +MSdd - refs.sys - Minstore director row data +MSde - refs.sys - Minstore dirty table tracking +MSdg - refs.sys - Minstore debug +MSds - refs.sys - Minstore debug stack logs +Msdv - - WDM mini driver for IEEE 1394 DV Camera and VCR +MSeb - refs.sys - Minstore embedded factory (B+ and associated) +MSeg - nt!mm - segments used to support image files +MSfa - refs.sys - Minstore filtered AVL +MSha - refs.sys - Minstore hash table (incl. page tables) +MSho - refs.sys - Minstore hash table overflow (incl. page tables) +MSht - refs.sys - Minstore stack hash table +MSkb - refs.sys - Minstore keys buffer +MSkr - refs.sys - Minstore CmsKeyRules object +MSls - refs.sys - Minstore logged stack +MSPi - refs.sys - Minstore generic/untagged allocation +MSpa - refs.sys - Minstore hash table entries (incl. and primarily SmsPage) +MSrc - refs.sys - Minstore tx run cache +MSrb - refs.sys - Minstore redo block +MSre - refs.sys - Minstore AVL lite entries (incl. and primarily SmsRangeMapEntry) +MSrk - refs.sys - Minstore key rules +MSrm - refs.sys - Minstore range map +MSro - refs.sys - Minstore container rotation buffer +MSrp - refs.sys - Minstore read cache pages array +MSrr - refs.sys - Minstore AVL lite entries (incl. and primarily SmsRCRangeMapEntry) +MSrv - refs.sys - Minstore reserved buffers +MSst - refs.sys - Minstore stream object +MStb - refs.sys - Minstore table object +MStu - refs.sys - Minstore tree update filter +MStx - refs.sys - Minstore transaction +MSur - refs.sys - Minstore undo record +MSvc - refs.sys - Minstore volume context +MSvs - refs.sys - Minstore valid/invalid checksum debug buffers (debug only) +MSvu - refs.sys - Minstore volume/instance object + +MST? - - MSTEE (mstee.sys) +MSTa - - associated stream header +MSTc - - filer connection +MSTd - - data format +MSTf - - filter instance +MSTp - - pin instance +MSTs - - stream header + +MouC - mouclass.sys - Mouse Class Driver +MouH - mouhid.sys - Mouse HID mapper Driver +MsFc - - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these +MsFC - - Mailslot root CCB, A client control block for the top level mailslot directory +MsFd - - Mailslot data entry write buffer, This is writes buffered inside mailslots +MsFD - - Mailslot root DCB and its name buffer +MsFf - - Mailslot FCB, File control block, Service side block for each created mailslot. +MsFg - - Mailslot global resource +MsFn - - Mailslot temporary name buffer +MsFN - - Mailslot FCB name buffer, name for each created mailslot +MsFr - - Mailslot read buffer, buffer created for pended reads issued. +MsFt - - Mailslot query template, used for directory queries. +MsFw - - Mailslot work context block, blocks create when we need to timeout reads. + +MsvC - ksecdd.sys - Msv/Ntlm client package +Mup - mup.sys - Multiple UNC provider allocations, generic +MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation +MuDn - mup.sys - Device name +MuFc - mup.sys - File Context +MuFn - mup.sys - File name rewrite +MuIc - mup.sys - IRP Context +MuMc - mup.sys - Master context +MuQc - mup.sys - Query context +MuSi - mup.sys - Surrogate info +MuSf - mup.sys - Surrogate file info +MuSr - mup.sys - Surrogate IRP info +MuPe - mup.sys - Known prefix entry +MuPi - mup.sys - Provider info +MuUn - mup.sys - UNC provider + +Muta - - Mutant objects + +Nb01 - netbt.sys - NetBT hash table +Nb02 - netbt.sys - NetBT remote name address cache +Nb03 - netbt.sys - NetBT remote name address cache +Nb04 - netbt.sys - NetBT failed address list +Nb05 - netbt.sys - NetBT client element +Nb06 - netbt.sys - NetBT general buffer allocation +Nb07 - netbt.sys - NetBT datagram request tracker +Nb08 - netbt.sys - NetBT domain address list +Nb09 - netbt.sys - NetBT domain name +Nb10 - netbt.sys - NetBT domain address list +Nb11 - netbt.sys - NetBT lmhosts path +Nb12 - netbt.sys - NetBT lmhosts path +Nb13 - netbt.sys - NetBT lmhosts path +Nb14 - netbt.sys - NetBT lmhosts path +Nb16 - netbt.sys - NetBT timer entry +Nb17 - netbt.sys - NetBT registry path +Nb18 - netbt.sys - NetBT lmhosts file +Nb19 - netbt.sys - NetBT lmhosts data +Nb20 - netbt.sys - NetBT lmhosts path +Nb21 - netbt.sys - NetBT control object +Nb22 - netbt.sys - NetBT work item context +Nb23 - netbt.sys - NetBT lmhosts path +Nb25 - netbt.sys - NetBT device bindings +Nb26 - netbt.sys - NetBT device exports +Nb27 - netbt.sys - NetBT bind list cache +Nb28 - netbt.sys - NetBT name server addresses +Nb29 - netbt.sys - NetBT registry string +Nb30 - netbt.sys - NetBT registry string +Nb31 - netbt.sys - NetBT configuration entry +Nb33 - netbt.sys - NetBT registry data +Nb35 - netbt.sys - NetBT registry data +Nb36 - netbt.sys - NetBT string +Nb37 - netbt.sys - NetBT lmhosts path +Nb38 - netbt.sys - NetBT string +Nb39 - netbt.sys - NetBT file objects +NbL0 - netbt.sys - NetBT lower connection +NbL1 - netbt.sys - NetBT lower connection +NbL2 - netbt.sys - NetBT lower connection +NbL3 - netbt.sys - NetBT lower connection +NbL4 - netbt.sys - NetBT lower connection +NbTA - netbt.sys - NetBT internal address +Nba9 - netbt.sys - NetBT IP request buffer +Nbb0 - netbt.sys - NetBT IP request buffer +Nbt0 - netbt.sys - NetBT name address +Nbt1 - netbt.sys - NetBT name address +Nbt2 - netbt.sys - NetBT NetBIOS address +Nbt4 - netbt.sys - NetBT client list +Nbt5 - netbt.sys - NetBT client list +Nbt6 - netbt.sys - NetBT datagram +Nbt8 - netbt.sys - NetBT address list +Nbt9 - netbt.sys - NetBT temporary allocation +NbtA - netbt.sys - NetBT datagram +NbtC - netbt.sys - NetBT address element +NbtD - netbt.sys - NetBT connection +NbtF - netbt.sys - NetBT remote name +NbtG - netbt.sys - NetBT datagram +NbtH - netbt.sys - NetBT work item context +NbtI - netbt.sys - NetBT listen requests +NbtJ - netbt.sys - NetBT receive element +NbtK - netbt.sys - NetBT name address +NbtL - netbt.sys - NetBT datagram +NbtM - netbt.sys - NetBT address list +NbtN - netbt.sys - NetBT address list +NbtO - netbt.sys - NetBT adapter status +NbtP - netbt.sys - NetBT connection list +NbtQ - netbt.sys - NetBT name stats +NbtR - netbt.sys - NetBT name address +NbtS - netbt.sys - NetBT datagram +NbtV - netbt.sys - NetBT work item context +NbtX - netbt.sys - NetBT datagram +NbtY - netbt.sys - NetBT datagram +NbtZ - netbt.sys - NetBT datagram +Nbta - netbt.sys - NetBT DPC +Nbtb - netbt.sys - NetBT NetBIOS address +Nbtc - netbt.sys - NetBT address info +Nbte - netbt.sys - NetBT delayed connect +Nbtf - netbt.sys - NetBT DPC +Nbtg - netbt.sys - NetBT MDL buffer +Nbti - netbt.sys - NetBT device list +Nbtj - netbt.sys - NetBT EA buffer +Nbtm - netbt.sys - NetBT EA buffer +Nbtn - netbt.sys - NetBT device string +Nbtk - netbt.sys - NetBT transport address +Nbtt - netbt.sys - NetBT MDL buffer +Nbtu - netbt.sys - NetBT MDL buffer +Nbtv - netbt.sys - NetBT WINS allocation +Nbtw - netbt.sys - NetBT device linkage names +Nbuf - netio.sys - NetIO Memory Descriptor List allocations + +NBF - - general NBF allocations +NBFa - - NBF address object +NBFb - - NBF receive buffer +NBFc - - NBF connection object +NBFd - - NBF packet pool descriptor +NBFe - - NBF bind & export names +NBFf - - NBF address file object +NBFg - - NBF registry path name +NBFi - - NBF tdi connection info +NBFk - - NBF loopback buffer +NBFl - - NBF link object +NBFn - - NBF netbios name +NBFo - - NBF config data +NBFp - - NBF packet +NBFq - - NBF query buffer +NBFr - - NBF request +NBFs - - NBF provider stats +NBFt - - NBF connection table +NBFu - - NBF UI frame +NBFw - - NBF work item +NBI - - NwlnkNb transport +NBS - - general NetBIOS allocations +NBSa - - address block +NBSc - - connection block +NBSe - - EA buffer +NBSf - - FCB +NBSl - - LANA block +NBSn - - copy of user NCB +NBSr - - registry allocations +NBSx - - XNS NETONE address (connect block) +NBSy - - NetBIOS address (connect block) +NBSz - - NetBIOS address (listen block) +NBqh - - Non-blocking queue entries used to carry the real data in the queue. + +NCSt - - EXIFS NC + +ND - ndis.sys - general NDIS allocations +NDA - ndis.sys - NDIS PacketDirect tag prefix +NDAa - ndis.sys - NDIS_PD_ASSOCIATION +NDAb - ndis.sys - NDIS_PD_BLOCK +NDAc - ndis.sys - NDIS_PD_CLIENT +NDAe - ndis.sys - NDIS_PD_EC +NDAf - ndis.sys - NDIS_PD_FILTER +NDAg - ndis.sys - NDIS_PD_GLOBAL +NDAm - ndis.sys - NDIS_PD_MEM_BLOCK NDIS_PD_SGL_BLOCK +NDAn - ndis.sys - NDIS_PD_COUNTER +NDAo - ndis.sys - NDIS_PD_CONFIG +NDAq - ndis.sys - NDIS_PD_PLATFORM_QUEUE +NDAt - ndis.sys - NDIS_PD_QUEUE_TRACKER +NDDl - ndis.sys - NDIS_TAG_DBG_LOG +NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK +NDPX - ndis.sys - NDIS Proxy allocations +NDPa - ndis.sys - Apple Talk +NDPb - ndis.sys - NBF +NDPi - ndis.sys - NWLNKIPX +NDPn - ndis.sys - NWLNKNB +NDPp - ndis.sys - Packet Scheduler. +NDPs - ndis.sys - NWLNKSPX +NDPt - ndis.sys - TCPIP +NDPw - ndis.sys - WAN_PACKET_TAG +NDSD - ndis.sys - NDIS_SETUP_DEVICE_EXTENSION +NDTr - ndis.sys - NDIS_TAG_TRANSFER_DATA +NDam - ndis.sys - NdisAllocateMemory +NDan - ndis.sys - adapter name +NDar - ndis.sys - NDIS_TAG_ALLOCATED_RESOURCES +NDas - ndis.sys - NDIS_TAG_ALLOC_SHARED_MEM_ASYNC +NDbi - ndis.sys - NDIS_TAG_BUS_INTERFACE +NDca - ndis.sys - NDIS_TAG_NET_CFG_OPS_ACL +NDch - ndis.sys - NDIS_TAG_CONFIG_HANDLE +NDcm - ndis.sys - NDIS_TAG_CM +NDcn - ndis.sys - NDIS_TAG_CANCEL_DEVICE_NAME +NDco - ndis.sys - NDIS_TAG_CO +NDcs - ndis.sys - NDIS_TAG_NET_CFG_OPS_ID +NDcw - ndis.sys - NDIS_TAG_PCW - NDIS Performance Counters +NDd - ndis.sys - NDIS_TAG_DBG +NDda - ndis.sys - NDIS_TAG_NET_CFG_DACL +NDdb - ndis.sys - DMA block +NDdc - ndis.sys - NDIS_TAG_DCN - Data Center Networking +NDdi - ndis.sys - NDIS_TAG_IM_DEVICE_INSTANCE +NDdl - ndis.sys - NDIS_TAG_DBG_L +NDdp - ndis.sys - NDIS_TAG_DBG_P +NDds - ndis.sys - NDIS_TAG_DBG_S +NDdt - ndis.sys - NDIS_TAG_DFRD_TMR +NDel - ndis.sys - NDIS debugging event log +NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR +NDfb - ndis.sys - NDIS_TAG_LWFILTER_BLOCK +NDfd - ndis.sys - NDIS_TAG_FILE_DESCRIPTOR +NDfi - ndis.sys - NDIS_TAG_FILE_IMAGE +NDfm - ndis.sys - NDIS_TAG_FAKE_MAC +NDfn - ndis.sys - NDIS_TAG_FILE_NAME +NDfv - ndis.sys - NDIS_TAG_LWFILTER_DRIVER +NDif - ndis.sys - NDIS_TAG_IF +NDio - ndis.sys - NDIS_TAG_IOV - IO Virtualization +NDkr - ndis.sys - NDIS_TAG_NDK - Kernel Mode Network Direct (kRDMA) +NDlb - ndis.sys - lookahead buffer +NDlp - ndis.sys - NDIS_TAG_LOOP_PKT +NDmb - ndis.sys - MAC block +NDmo - ndis.sys - NDIS_TAG_M_OPEN_BLK +NDmr - ndis.sys - map register entry array +NDmt - ndis.sys - NDIS_TAG_MEDIA_TYPE_ARRAY +NDnc - ndis.sys - NDIS_TAG_NBL_CONTEXT +NDnd - ndis.sys - NDIS_TAG_POOL_NDIS +NDoa - ndis.sys - NDIS_TAG_OID_ARRAY +NDob - ndis.sys - open block +NDoc - ndis.sys - NDIS_TAG_OPEN_CONTEXT +NDof - ndis.sys - NDIS_TAG_OFFLOAD +NDop - ndis.sys - NDIS_TAG_PM_PROT_OFFLOAD +NDpb - ndis.sys - protocol block +NDpc - ndis.sys - NDIS_TAG_PROTOCOL_CONFIGURATION +NDpf - ndis.sys - NDIS_TAG_FILTER +NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN +NDpl - ndis.sys - NDIS_TAG_PERF_LOG_ID +NDpn - ndis.sys - NDIS_TAG_PARAMETER_NODE +NDpo - ndis.sys - NDIS_TAG_PORT +NDpp - ndis.sys - packet pool +NDpr - ndis.sys - NDIS_TAG_PERIODIC_RECEIVES +NDpw - ndis.sys - NDIS_TAG_WOL_PATTERN +NDqo - ndis.sys - NDIS_TAG_QUERY_OBJECT_WORKITEM +NDqs - ndis.sys - NDIS_TAG_QOS +NDqu - ndis.sys - NDIS_TAG_QUEUE +NDrc - ndis.sys - NDIS_TAG_RWL_REFCOUNT +NDrd - ndis.sys - NDIS_TAG_REG_READ_DATA_BUFFER +NDre - ndis.sys - NDIS_TAG_OID_REQUEST +NDrf - ndis.sys - NDIS_TAG_RECEIVE_FILTER +NDrl - ndis.sys - resource list +NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH +NDrq - ndis.sys - NDIS_TAG_Q_REQ +NDrs - ndis.sys - NDIS_TAG_RSS +NDrt - ndis.sys - NDIS_TAG_RST_NBL +NDrw - ndis.sys - NDIS_TAG_RWLOCK +NDrx - ndis.sys - NDIS debugging refcount +NDsd - ndis.sys - NDIS_TAG_NET_CFG_SEC_DESC +NDse - ndis.sys - NDIS_TAG_SECURITY +NDsg - ndis.sys - NDIS_TAG_DOUBLE_BUFFER_PKT +NDsh - ndis.sys - NDIS_TAG_SHARED_MEMORY +NDsi - ndis.sys - EISA slot information +NDsk - ndis.sys - NDIS debugging stacktrace +NDsm - ndis.sys - Cached shared memory descriptor +NDss - ndis.sys - NDIS_TAG_SS - Selective Suspend +NDst - ndis.sys - NDIS_TAG_STRING +NDtk - ndis.sys - NDIS_TAG_NBL_TRACKER - Lost packet diagnostics +NDvm - ndis.sys - NDIS_TAG_ALLOC_MEM_VERIFY_ON +NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO +NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID +NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST +NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM +NDwh - ndis.sys - NDIS_TAG_WRAPPER_HANDLE +NDwi - ndis.sys - NDIS_TAG_WORK_ITEM +NDwr - ndis.sys - NDIS_TAG_WMI_REQUEST +NDwx - ndis.sys - NDIS_TAG_WOL_XLATE +NDxc - ndis.sys - NDIS_TAG_POOL_XLATE + +Net - tcpip.sys - NetIO Generic Buffers (iBFT Table allocations) +NeWQ - tcpip.sys - NetIO WorkQueue Data + +NEEB - newt_ndis6.sys - NEWT Emulation Bench +NEFT - newt_ndis6.sys - NEWT Filter Object +NEIM - newt_ndis6.sys - NEWT IM Object +NEOD - newt_ndis6.sys - NEWT OID +NEPK - newt_ndis6.sys - NEWT Packet +NEWI - newt_ndis6.sys - NEWT Work Item + +Nb?? - - NetBT allocations +Nf?? - nfssvr.sys - NFS (Network File System) allocations +NfR? - nfsrdr.sys - NFS (Network File System) client re-director +Nls - - Nls strings +NlsK - nt!ex - Nls data +Nmdd - - NetMeeting display driver miniport 1 MB block + +Nhfs - tcpip.sys - NetIO Hash Function State Data + +NicT - mslbfoprovider.sys - Microsoft NDIS LBFO Provider (NIC Teaming) + +Navl - tcpip.sys - Network Layer AVL Tree allocations +NLbd - tcpip.sys - Network Layer Buffer Data +NLcc - tcpip.sys - Network Layer Client Contexts +NLpd - tcpip.sys - Network Layer Client Requests +NLcp - tcpip.sys - Network Layer Compartments +NLuh - - Network Layer Ul Handles +NLap - tcpip.sys - Network Layer Netio Helper Function allocations +NLNa - tcpip.sys - Network Layer Network Address Lists + +NMhf - netio.sys - Handle Factory pool +NMpt - - Generic AVL Tree allocations + +NMRb - tcpip.sys - Network Module Registrar Bindings +NMRc - tcpip.sys - Network Module Registrar Arrays +NMRf - tcpip.sys - Network Module Registrar Filters +NMRg - tcpip.sys - Network Module Registrar Generic Buffers +NMRm - tcpip.sys - Network Module Registrar Modules +NMRn - tcpip.sys - Network Module Registrar Network Protocol Identifiers + +Nnbl - netio.sys - NetIO NetBufferLists +Nnbf - netio.sys - NetIO NetBuffers +Nnnn - netio.sys - NetIO NetBuffers And NetBufferLists +Nph1 - netio.sys - NetIO Protocol Header1 Data +Nph2 - netio.sys - NetIO Protocol Header2 Data + +None - - call to ExAllocatePool + +NpEv - npfs.sys - Npfs events +Npf* - npfs.sys - Npfs Allocations +NpFc - npfs.sys - CCB, client control block +NpFC - npfs.sys - ROOT_DCB CCB +NpFD - npfs.sys - DCB, directory block +NpFg - npfs.sys - Global storage +NpFi - npfs.sys - NPFS client info buffer. +NpFn - npfs.sys - Name block +NpFq - npfs.sys - Query template buffer used for directory query +NpFr - npfs.sys - DATA_ENTRY records (read/write buffers) +NpFs - npfs.sys - Client security context +NpFw - npfs.sys - Write block +NpFW - npfs.sys - Write block + +Npta - - NPT Addresses +Nptx - - NPT Packets +Nptr - - NPT Receive Completes +Npts - - NPT Send sCompletes + +Nrsd - netio.sys - NRT security descriptor +Nrtr - netio.sys - NRT record +Nrtw - netio.sys - NRT worker + +NS?? - - Netware server allocations + +NSIk - nsi.dll - NSI RPC Tansactions +NSIr - nsi.dll - NSI Generic Buffers +NSpc - nsi.dll - NSI Proxy Contexts +NSpg - nsi.dll - NSI Proxy Generic Buffers + +REM NTFS Specific allocation tags +NtAR - ntfs.sys - Ntfs Async Cached Read allocation +Ntf0 - ntfs.sys - General pool allocation +Ntf9 - ntfs.sys - Large Temporary Buffer +NtfC - ntfs.sys - CCB +Ntfc - ntfs.sys - CCB_DATA +Ntfd - ntfs.sys - DEALLOCATED_CLUSTERS +NtfD - ntfs.sys - DEALLOCATED_RECORDS +NtfE - ntfs.sys - INDEX_CONTEXT +Ntff - ntfs.sys - FCB_DATA +NtfF - ntfs.sys - FCB_INDEX +NtfI - ntfs.sys - IO_CONTEXT +Ntfi - ntfs.sys - IRP_CONTEXT +NtfK - ntfs.sys - KEVENT +Ntfk - ntfs.sys - FILE_LOCK +Ntfl - ntfs.sys - LCB +NtfM - ntfs.sys - NTFS_MCB_ENTRY +Ntfm - ntfs.sys - NTFS_MCB_ARRAY +NtfN - ntfs.sys - NUKEM +Ntfn - ntfs.sys - SCB_NONPAGED +Ntfo - ntfs.sys - SCB_INDEX normalized named buffer +NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK +Ntfq - ntfs.sys - General Allocation with Quota +NtfR - ntfs.sys - READ_AHEAD_THREAD +Ntfr - ntfs.sys - ERESOURCE +NtfS - ntfs.sys - SCB_INDEX +Ntfs - ntfs.sys - SCB_DATA +NtfT - ntfs.sys - SCB_SNAPSHOT +Ntft - ntfs.sys - SCB (Prerestart) +Ntfu - ntfs.sys - NTFS_MARK_UNUSED_CONTEXT +NtfV - ntfs.sys - VPB +Ntfv - ntfs.sys - COMPRESSION_SYNC +Ntfw - ntfs.sys - Workspace +Ntfx - ntfs.sys - General Allocation +Ntf? - ntfs.sys - Unkown allocation +NtTc - ntfs.sys - FILE_LEVEL_TRIM_CONTEXT +NtTf - ntfs.sys - NTFS_DISK_FLUSH_CONTEXT NtfsDiskFlushContextLookasideList +NtTr - ntfs.sys - DEVICE_MANAGE_DATA_SET_ATTRIBUTES NtfsDeviceManageDataSetAttributesLookasideList +NtTo - ntfs.sys - DEVICE_MANAGE_DATA_SET_ATTRIBUTES NtfsFileOffloadLookasideList +NtTe - ntfs.sys - NTFS Telemetry + +REM NTFS tags based on source module +NtFa - ntfs.sys - AllocSup.c +NtFA - ntfs.sys - AttrSup.c +NtFB - ntfs.sys - BitmpSup.c +NtFC - ntfs.sys - Create.c +NtFD - ntfs.sys - DevioSup.c +NtFd - ntfs.sys - DirCtrl.c +NtFE - ntfs.sys - Ea.c +NtFF - ntfs.sys - FileInfo.c +NtFf - ntfs.sys - FsCtrl.c +NtFH - ntfs.sys - SelfHeal.c +NtFI - ntfs.sys - IndexSup.c +NtFL - ntfs.sys - LogSup.c +NtFM - ntfs.sys - McbSup.c +NtFm - ntfs.sys - Ntfs MFT View Ref Counter Arrays +NtFN - ntfs.sys - NtfsData.c +NtFO - ntfs.sys - ObjIdSup.c +NtFQ - ntfs.sys - QuotaSup.c +NtFR - ntfs.sys - RestrSup.c +NtFS - ntfs.sys - SecurSup.c +NtFs - ntfs.sys - StrucSup.c +NtFU - ntfs.sys - usnsup.c +NtFV - ntfs.sys - VerfySup.c +NtFv - ntfs.sys - ViewSup.c +NtFW - ntfs.sys - Write.c +NtF? - ntfs.sys - Unknown NTFS source module + +NulB - tlnull.sys - Null TDI Buffers +NulR - tlnull.sys - Null TDI Requests +NulS - tlnull.sys - Null TDI Sockets +NulE - tlnull.sys - Null Tl Endpoints +Null - tlnull.sys - Null TL Generics +NulI - tlnull.sys - Null TL Indications +Nulr - tlnull.sys - Null Tl Requests + +NV - - nVidia video driver +NvLA - - nVidia video driver +NvLa - - nVidia video driver +NvLC - - nVidia video driver +NvLc - - nVidia video driver +NvLD - - nVidia video driver +NvLd - - nVidia video driver +NvLE - - nVidia video driver +NvLH - - nVidia video driver +NvLm - - nVidia video driver +NvLP - - nVidia video driver +NvLp - - nVidia video driver +NvLR - - nVidia video driver +NvLr - - nVidia video driver +NvLS - - nVidia video driver +NvLs - - nVidia video driver +NvLT - - nVidia video driver + +Nwcs - - Client Services for NetWare +NwFw - - ntos\tdi\fwd + + +ObSq - nt!ob - object security descriptors (query) +ObCi - nt!ob - captured information for ObCreateObject +ObCI - nt!ob - object creation lookaside list +ObDi - nt!ob - object directory +ObHd - nt!ob - object handle count data base +ObNm - nt!ob - object names +ObNM - nt!ob - name buffer per processor lookaside pointers +ObRt - nt!ob - object reference stack tracing +ObZn - nt!ob - object zone +ObjT - nt!ob - object type objects +Obtb - nt!ob - object tables via EX handle.c +ObTR - nt!ob - object table ERESOURCEs +Obeb - nt!ob - object tables extra bit tables via EX handle.c +ObDm - nt!ob - object device map +ObSc - nt!ob - Object security descriptor cache block +ObSt - nt!ob - Object Manager temporary storage +ObWm - nt!ob - Object Manager wait blocks + +ODMg - dxgkrnl.sys - Output Duplication component + +OHCI - - Open Host Controller Interface for USB +ohci - - 1394 OHCI host controller driver + +OlmC - tcpip.sys - Offload Manager Connections +OlmI - tcpip.sys - Offload Manager Interfaces + +Ovfl - - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made + +OvfL - - EXIFS FCBOVF List + +PaeD - - PAE top level directory allocation blocks + +ParC - - Parallel class driver +ParL - - Parallel link driver +ParP - - Parallel port driver +ParV - - ParVdm driver for vdm<->parallel port communciation + +PciB - pci.sys - PnP pci bus enumerator + +Pccr - pacer.sys - PACER Filter Clone Requests +Pcfc - pacer.sys - PACER Filter Contexts +Pcfl - pacer.sys - PACER Flows +Pcge - pacer.sys - PACER Generic Buffers (DACL, SID allocations) +Pcle - pacer.sys - PACER Lines +Pclt - pacer.sys - PACER Line Tables +Pcna - pacer.sys - PACER Filter Network Addresses +Pcnt - pacer.sys - PACER NetBufferTimes +Pcop - pacer.sys - PACER Original Packet Contexts +Pcpc - pacer.sys - PACER Packet Contexts +Pcsb - pacer.sys - PACER Send Buffers +Pcta - pacer.sys - PACER Timer Units +Pctw - pacer.sys - PACER Timer Wheels +Pcwc - pacer.sys - PACER WAN NetworkBufferList CTXs + +PcCi - - WDM audio port class adapter device object stuff +PcCr - - WDM audio stuff +PcDi - - WDM audio stuff +PcDm - - DirectMusic MXF objects (WDM audio) +PcFM - - WDM audio FM synthesizer +PcFp - - WDM audio stuff +PcIc - - WDM audio stuff +PcIl - - WDM audio stuff +PcNw - - WDM audio stuff +PcPc - - WDM audio stuff +PcPr - - WDM audio stuff +PcSX - - WDM audio stuff +PcSl - - WDM audio stuff +PcSt - - WDM audio stuff +PcSx - - WDM audio stuff +PcUs - - WDM audio stuff + +Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures +Pcic - - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures +Pcdb - - Pcmcia bus enumerator, Databook controller specific structures + +PdcA - pdc.sys - PDC_ACTIVATION_TAG, ACTIVATOR_CLIENT_TAG +PdcC - pdc.sys - PDC_CLIENT_PORT_TAG +PdcE - pdc.sys - ACTIVATOR_EVENT_TAG +PdcI - pdc.sys - PDC_INCLUSION_LIST_TAG +PdcM - pdc.sys - PDC_MESSAGE_TAG +PdcN - pdc.sys - PDC_NOTIFICATION_TAG, NOTIFICATION_CLIENT_TAG +PdcP - pdc.sys - PDC_PORT_TAG +PdcR - pdc.sys - PDC_RESILIENCY_TAG, RESILIENCY_CLIENT_TAG +PdcS - pdc.sys - PDC_SUSPRES_TAG +PdcT - pdc.sys - PDC_TOKEN_TAG +PSwt - pdc.sys - PDC_PSWT_TAG +Pdcs - pdc.sys - PDC_SCENARIO_TAG + +SPMp - nt!po - Kernel Scenario Power Manager Policies. + +PepT - nt!PopPep - Default Power Engine Plugin + +Petw - pacer.sys - PACER ETW + +Pf?? - nt!pf - Pf Allocations +PfAL - nt!pf - Pf Application launch event data +PfAS - nt!pf - Pf Prefetch support array +PfDq - nt!pf - Pf Directory query buffers +PfED - nt!pf - Pf Generic event data +PfEL - nt!pf - Pf Event logging buffers +PfET - nt!pf - Pf Entry info tables +PfFH - nt!pf - Pf RpContext FileKeyHash buckets +PfFh - nt!pf - Pf Prefetch file handle cache array +PfFK - nt!pf - Pf RpContext FileKeyHashEntry +PfLB - nt!pf - Pf Log buffers +PfMP - nt!pf - Pf Prefetch metadata buffers +PfNL - nt!pf - Pf Name logging buffers +PfOB - nt!pf - Pf Oplock buffers +PfPB - nt!pf - Pf Pfn query buffers +PfRL - nt!pf - Pf Prefetch read list +PfRQ - nt!pf - Pf Prefetch request buffers +PfSA - nt!pf - Pf Prefetch support array +PfTD - nt!pf - Pf Trace Dump +PfTt - nt!pf - Pf Translation tables +PfVA - nt!pf - Pf VA prefetching buffers +PfVH - nt!pf - Pf Prefetch volume handles + +Pfcs - pacer.sys - PACER Flow Counter Sets +Pfhc - pacer.sys - PACER File Handle Contexts + +PFXM - nt!PoFx - Runtime Power Management Framework + +PcwC - nt!pcw - PCW Counter set +PcwR - nt!pcw - PCW provider Registration +PcwI - nt!pcw - PCW counter set Instance +PcwQ - nt!pcw - PCW Query item +PcwS - nt!pcw - PCW System call buffer +PcwT - nt!pcw - PCW Temporary (short-lived) buffer + +Pgm? - - Pgm (Pragmatic General Multicast) protocol: RMCast.sys + +Plcp - - Cache aware pushlock list (array of puchlock addresses) +Plcl - - Cache aware pushlock entry. One per processor + +PlMp - storport.sys - PortpReadDriverParameterEntry +PlRB - storport.sys - PortAllocateRegistryBuffer storport!_PORT_REGISTRY_INFO.Buffer + +PmpA - portmap.sys - Portmap address list +PmpC - portmap.sys - Portmap device context +PmpM - portmap.sys - Portmap mapping +PmpR - portmap.sys - Portmap RPCB + +PmAT - partmgr.sys - Partition Manager attributes table cache +PmDD - partmgr.sys - Partition Manager device descriptor +PmIB - partmgr.sys - Partition Manager buffer for IOCTL processing +PmME - partmgr.sys - Partition Manager migration entry +PmPE - partmgr.sys - Partition Manager partition entry +PmPT - partmgr.sys - Partition Manager partition table cache +PmRL - partmgr.sys - Partition Manager remove lock +PmRP - partmgr.sys - Partition Manager registry path +PmRR - partmgr.sys - Partition Manager removal relations +PmSD - partmgr.sys - Partition Manager snapshot data cache +PmTE - partmgr.sys - Partition Manager table entry +PmVE - partmgr.sys - Partition Manager volume entry + +PNCH - - Power Notify Channel +PNCL - - Power Notify channel list +PNDP - - Power Abort Dpc Routine +PNI - - Power Notify Instance + +PoEa - raspppoe.sys - MTAG_ADAPTER +PoEb - raspppoe.sys - MTAG_BINDING +PoEc - raspppoe.sys - MTAG_BUFFERPOOL +PoEd - raspppoe.sys - MTAG_PACKETPOOL +PoEe - raspppoe.sys - MTAG_PPPOEPACKET +PoEf - raspppoe.sys - MTAG_TAPIPROV +PoEg - raspppoe.sys - MTAG_LINE +PoEh - raspppoe.sys - MTAG_CALL +PoEi - raspppoe.sys - MTAG_HANDLETABLE +PoEj - raspppoe.sys - MTAG_HANDLECB +PoEk - raspppoe.sys - MTAG_TIMERQ +PoEl - raspppoe.sys - MTAG_FREED +PoEm - raspppoe.sys - MTAG_LLIST_WORKITEMS +PoEu - raspppoe.sys - MTAG_UTIL + +Pool - - Pool tables, etc. +PooL - - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures +Port - - Port objects + +PoSL - - Power shutdown event list + +PPMd - - Processor Drivers (Processor Power Management). +PPMi - nt!po - Kernel Processor Power Management Idle States. +PPMp - nt!po - Kernel Processor Power Management Perf States. +PPMw - nt!po - Kernel Processor Power Management WMI interface. + +Prof - - Profile objects + +POWI - nt!po - Power Work Item (executive worker thread work item entry) +PSwt - nt!po - Power switch structure +PSTA - nt!po - Po registered system state +PDss - nt!po - Po device system state +PRTM - nt!po - Power runtime management +PCol - nt!po - Thermal cooling requests and extensions + +PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer +PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer + +Prcr - processr.sys - Processr driver allocations + +Proc - nt!ps - Process objects +Ps - nt!ps - general ps allocations +Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread +PsAp - nt!ps - Process APC queued by user mode process +PsCa - nt!ps - APC queued at thread create time. +PsCr - nt!ps - Working set change record (temporary allocation) +PsEx - nt!ps - Process exit APC +PsFn - nt!ps - Captured image file name buffer (temporary allocation) +PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation) +PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista) +PsJa - nt!ps - Job access control state +Psjb - nt!ps - Job set array (temporary allocation) +PsLd - nt!ps - Process LDT information blocks +PsPb - nt!ps - Captured process parameter block (temporary allocation) +PsQb - nt!ps - Process quota block +PsRl - nt!ps - Captured memory reserve list (temporary allocation) +PsSb - nt!ps - Initial process parameter block (temporary allocation) +PsSd - nt!ps - Augmented thread security descriptor (temporary allocation) +PsTf - nt!ps - Job object token filter +Pstb - nt!ps - Process tables via EX handle.c +Psta - nt!ps - Power management system state +PsTp - nt!ps - Thread termination port block +PsWs - nt!ps - Process working set watch array + +PSE3 - pse36.sys - Physical Size Extension driver + +Pnp0 - nt!pnp - PNPMGR rebalance resource request table +Pnp1 - nt!pnp - PNPMGR IRP completion context +Pnp2 - nt!pnp - PNPMGR device action request +Pnp3 - nt!pnp - PNPMGR HW Profile +Pnp4 - nt!pnp - PNPMGR CM API +Pnp5 - nt!pnp - PNPMGR assign resources context +Pnp6 - nt!pnp - PNPMGR resource request +Pnp7 - nt!pnp - PNPMGR deferred notify entry +Pnp8 - nt!pnp - PNPMGR async target device change notify +Pnp9 - nt!pnp - PNPMGR HW profile notify +PnpA - nt!pnp - PNPMGR PnpRtl Operations +PnpC - nt!pnp - PNPMGR target device notify +PnpF - nt!pnp - PNPMGR eject data +PnpG - nt!pnp - PNPMGR generic +PnpH - nt!pnp - PNPMGR service name +PnpI - nt!pnp - PNPMGR instance path +PnpJ - nt!pnp - PNPMGR device event list +PnpK - nt!pnp - PNPMGR device event entry +PnpL - nt!pnp - PNPMGR device event workitem +PnpM - nt!pnp - PNPMGR veto buffer +PnpN - nt!pnp - PNPMGR PDO array +PnpO - nt!pnp - PNPMGR veto process +PnpP - nt!pnp - PNPMGR veto device object +PnpQ - nt!pnp - PNPMGR partition resource list +PnpR - nt!pnp - PNPMGR memory bitmap +PnpS - nt!pnp - PNPMGR dependent info +PnpT - nt!pnp - PNPMGR provider info +PnpU - nt!pnp - PNPMGR async set status control +PnpV - nt!pnp - PNPMGR notify entry loc +PnpW - nt!pnp - PNPMGR SwDevice +PnpX - nt!pnp - PNPMGR DevQuery +PnpY - nt!pnp - PNPMGR usermode device notifications +PnpZ - nt!pnp - PNPMGR data model +PnPb - nt!pnp - PnP BIOS resource manipulation +PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER +PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG +PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG +PpLg - nt!pnp - PnP last good. +PpUB - nt!pnp - PNP_USER_BLOCK_TAG +PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG +Ppcd - nt!pnp - PnP critical device database +Ppcr - nt!pnp - plug-and-play critical allocations +Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs +Ppde - nt!pnp - routines to perform device removal +Ppei - nt!pnp - Eisa related code +Ppen - nt!pnp - routines to perform device enumeration +Ppin - nt!pnp - plug-and-play initialization +Ppio - nt!pnp - plug-and-play IO system APIs + +PPMi - nt!po - Processor Power Manager Idle States +PPMp - nt!po - Processor Power Manager Perf States +PPMw - nt!po - Processor Power Manager WMI Interface + +Ppre - nt!pnp - resource allocation and translation +Pprl - nt!pnp - routines to manipulate relations list +Ppsu - nt!pnp - plug-and-play subroutines for the I/O system + +PPTP - - PPTP_MEMORYPOOL_TAG +PPT0 - - PPTP_TDIADDR_TAG +PPT1 - - PPTP_TDICONN_TAG +PPT2 - - PPTP_CONNINFO_TAG +PPT3 - - PPTP_ADDRINFO_TAG +PPT4 - - PPTP_TIMEOUT_TAG +PPT5 - - PPTP_TIMER_TAG +PPT6 - - PPTP_TDICOTS_TAG +PPT7 - - PPTP_WRKQUEUE_TAG +PPT8 - - PPTP_SEND_CTRLDATA_TAG +PPT9 - - PPTP_SEND_ACKDATA_TAG +PPTa - - PPTP_SEND_DGRAMDESC_TAG +PPTb - - PPTP_TDICLTS_TAG +PPTc - - PPTP_RECV_CTRLDESC_TAG +PPTd - - PPTP_RECV_CTRLDATA_TAG +PPTe - - PPTP_RECV_DGRAMDESC_TAG +PPTf - - PPTP_RECV_DGRAMDATA_TAG +PPTg - - PPTP_RECVDESC_TAG +PPTh - - PPTP_ENGINE_TAG +PPTi - - PPTP_RECVDATA_TAG + +PRF? - nt!wdi - Performance Allocations +PRFd - nt!wdi - Performance Diagnostics Structures + +PSC? - - Packet Scheduler (PSCHED) Tags + +PSC0 - - NDIS Request +PSC1 - - GPC Client Vc +PSC2 - - WanLink +PSC3 - - Miscellaneous allocations +PSC4 - - WMI +PSCa - - Adapter +PSCb - - CallParameters +PSCc - - PipeContext +PSCd - - FlowContext +PSCe - - ClassMapContext +PSCf - - Adapter Profile +PSCg - - Component + +PX1 - - ndis ProviderEventLookaside + +p2?? - perm2dll.dll - Permedia2 display driver +p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c +p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c +p2de - perm2dll.dll - Permedia2 display driver - debug.c +p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c +p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c +p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c +p2en - perm2dll.dll - Permedia2 display driver - enable.c +p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c +p2he - perm2dll.dll - Permedia2 display driver - heap.c +p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c +p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c +p2pa - perm2dll.dll - Permedia2 display driver - palette.c +p2pe - perm2dll.dll - Permedia2 display driver - permedia.c +p2tx - perm2dll.dll - Permedia2 display driver - textout.c + +P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D +P3G? - perm3dd.dll - Permedia3 display driver + +ppPT - pvhdparser.sys - Proxy Virtual Machine Storage VHD Parser Driver (parser) +ppRT - pvhdparser.sys - Proxy Virtual Machine Storage VHD Parser Driver (parser) + +PSHD - pshed.dll - PSHED +PSPi - pshed.dll - PSHED Plug-in + +Ppcs - pacer.sys - PACER Pipe Counter Sets +Pwff - pacer.sys - PACER WFP Filters +Pwmi - pacer.sys - PACER WMI notifications + +PX1 - ndproxy.sys - PX_EVENT_TAG +PX2 - ndproxy.sys - PX_VCTABLE_TAG +PX3 - ndproxy.sys - PX_ADAPTER_TAG +PX4 - ndproxy.sys - PX_CLSAP_TAG +PX5 - ndproxy.sys - PX_CMSAP_TAG +PX6 - ndproxy.sys - PX_PARTY_TAG +PX7 - ndproxy.sys - PX_COCALLPARAMS_TAG +PX8 - ndproxy.sys - PX_REQUEST_TAG +PX9 - ndproxy.sys - PX_PROVIDER_TAG +PXa - ndproxy.sys - PX_ENUMLINE_TAG +PXb - ndproxy.sys - PX_TAPILINE_TAG +PXc - ndproxy.sys - PX_ENUMADDR_TAG +PXd - ndproxy.sys - PX_TAPIADDR_TAG +PXe - ndproxy.sys - PX_TAPICALL_TAG +PXf - ndproxy.sys - PX_LINECALLINFO_TAG +PXg - ndproxy.sys - PX_CMAF_TAG +PXh - ndproxy.sys - PX_CLAF_TAG +PXi - ndproxy.sys - PX_VC_TAG +PXj - ndproxy.sys - PX_TRANSLATE_CALL_TAG +PXk - ndproxy.sys - PX_TRANSLATE_SAP_TAG +PXl - ndproxy.sys - PX_LINETABLE_TAG + +Qnam - - EXIFS Query Name + +Qp?? - - Generic Packet Classifier (MSGPC) +Qppn - - Queued Notifications +Qppi - - Pending Irp structures +Qpci - - CfInfo +Qpct - - Client blocks +Qppa - - Pattern blocks +Qphf - - HandleFactory +Qpph - - PathHash +Qprz - - Rhizome +Qppd - - GenPatternDb +Qpfd - - FragmentDb +Qpcf - - ClassificationFamily +Qpcd - - CfInfoData +Qpcb - - ClassificationBlock +Qppt - - Protocol +Qpdg - - Debug + +QuU2 - mpsdrv.sys - MPSDRV upcall response + +RAWb - nt!RAW - RAW file system buffer + +Ra12 - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.DataBuffer +RaAM - storport.sys - RaidAllocateAddressMapping storport!_MAPPED_ADDRESS +RaCD - storport.sys - RaUnitScsiGetDumpPointersIoctl +RaDf - storport.sys - RaidInitializeDeferredQueue storport!_RAID_DEFERRED_QUEUE.FreeList +RaDI - storport.sys - RaidUnitGetDeviceId +RaDR - storport.sys - RaidpBuildAdapterBusRelations storport!_DEVICE_RELATIONS +RaDS - storport.sys - StorCreateAnsiString storport!_STRING.Buffer +RaEt - storport.sys - RaidBusEnumeratorProcessBusUnit +RaHI - storport.sys - RaSaveDriverInitData storport!_HW_INITIALIZATION_DATA +RaME - storport.sys - RiAllocateMiniportDeviceExtension +RaPC - storport.sys - RaInitializeConfiguration storport!_PORT_CONFIGURATION_INFORMATION.AccessRanges +RaPD - storport.sys - RaidGetPortData storport!RaidpPortData +RaRL - storport.sys - RaidInitializeResourceList storport!_RAID_RESOURCE_LIST +RaRl - storport.sys - RaidBusEnumeratorAllocateReportLunsResources storport!_BUS_ENUM_RESOURCES.DataBuffer +RaRS - storport.sys - RaidUnitAllocateResources +RaSI - storport.sys - StorUnmapSenseInfo storport!_EXTENDED_REQUEST_BLOCK.Srb.SenseInfoBuffer +RaSN - storport.sys - RaidBusEnumeratorAllocateUnitResources storport!_BUS_ENUM_RESOURCES.SenseInfo +RaSr - storport.sys - RaidAllocateSrb storport!_SCSI_REQUEST_BLOCK +RaTM - storport.sys - RaInitializeTagList storport!_QUEUE_TAG_LIST.Buffer +RaTQ - storport.sys - RaUnitQueryDeviceTextIrp +RaUE - storport.sys - RaidUnitAllocateResources +RaWM - storport.sys - RaidAdapterWmiDeferredRoutine + +RaDA - tcpip.sys - Raw Socket Discretionary ACLs +RaEW - tcpip.sys - Raw Socket Endpoint Work Queue Contexts +RaJP - tcpip.sys - Raw Socket Join Path Contexts +RaMI - tcpip.sys - Raw Socket Message Indication Tags +RaPM - tcpip.sys - Raw Socket Partial Memory Descriptor List Tag +RaSM - tcpip.sys - Raw Socket Send Messages Requests +RaSL - tcpip.sys - Raw Socket Send Message Lists +RawE - tcpip.sys - Raw Socket Endpoints +RawN - tcpip.sys - Raw Socket Nsi + +RB?? - - RedBook Filter Driver, static allocations +RBEv - - RedBook - Thread Events +RBRl - - RedBook - Remove lock +RBRg - - RedBook - driverExtension->RegistryPath +RBSe - - RedBook - Serialization tracking for checked builds +RBWa - - RedBook - Wait block for system thread + +rb?? - - RedBook Filter Driver, dynamic allocations +rbBu - - RedBook - Buffer for read/stream +rbIr - - RedBook - Irp for read/stream +rbIp - - RedBook - Irp pointer block +rbMd - - RedBook - Mdl for read/stream +rbMp - - RedBook - Mdl pointer block +rbRc - - RedBook - Read completion context +rbRx - - RedBook - Read Xtra info +rbSc - - RedBook - Stream completion context +rbSx - - RedBook - Stream Xtra info +rbTo - - RedBook - Cached table of contents + +Rcp? - sacdrv.sys - SAC Driver (Headless) +RcpA - sacdrv.sys - Internal memory mgr alloc block +RcpI - sacdrv.sys - Internal memory mgr initial heap block +RcpS - sacdrv.sys - Security related block + +RDPD - rdpdr.sys - Device list object + +ReEv - - Resource Event +ReSe - - Resource Semaphore +ReTa - - Resource Extended Table +ReTr - - Per ETHREAD EXECUTIVE Resource tracking. + +REM ReFS Specific allocation tags +ReAR - refs.sys - Refs Async Cached Read allocation +Ref0 - refs.sys - General pool allocation +Ref9 - refs.sys - Large Temporary Buffer +RefC - refs.sys - CCB +Refc - refs.sys - CCB_DATA +Refd - refs.sys - DEALLOCATED_CLUSTERS +RefD - refs.sys - DEALLOCATED_RECORDS +RefE - refs.sys - INDEX_CONTEXT +Reff - refs.sys - FCB_DATA +RefF - refs.sys - FCB_INDEX +RefI - refs.sys - IO_CONTEXT +Refi - refs.sys - IRP_CONTEXT +RefK - refs.sys - KEVENT +Refk - refs.sys - FILE_LOCK +Refl - refs.sys - LCB +RefN - refs.sys - NUKEM +Refn - refs.sys - SCB_NONPAGED +Refo - refs.sys - SCB_INDEX normalized named buffer +Refq - refs.sys - General Allocation with Quota +RefR - refs.sys - READ_AHEAD_THREAD +Refr - refs.sys - ERESOURCE +RefS - refs.sys - SCB_INDEX +Refs - refs.sys - SCB_DATA +RefH - refs.sys - SCB_SNAPSHOT +Reft - refs.sys - SCB (Prerestart) +Refu - refs.sys - NTFS_MARK_UNUSED_CONTEXT +RefV - refs.sys - VPB +Refv - refs.sys - COMPRESSION_SYNC +Refw - refs.sys - Workspace +Refx - refs.sys - General Allocation +Ref? - refs.sys - Unkown allocation +ReTc - refs.sys - FILE_LEVEL_TRIM_CONTEXT +ReTm - refs.sys - DEVICE_MANAGE_DATA_SET_ATTRIBUTES RefsDeviceManageDataSetAttributesLookasideList +ReTo - refs.sys - DEVICE_MANAGE_DATA_SET_ATTRIBUTES RefsFileOffloadLookasideList +ReTe - refs.sys - ReFS Telemetry +Redf - refs.sys - REFS_DISK_FLUSH_CONTEXT allocations + +REM ReFS tags based on source module +ReFa - refs.sys - AllocSup.c +ReFA - refs.sys - AttrHelpers.c +ReFC - refs.sys - Create.c +ReFD - refs.sys - DevioSup.c +ReFd - refs.sys - DirCtrl.c +ReFE - refs.sys - Ea.c +ReFF - refs.sys - FileInfo.c +ReFf - refs.sys - FsCtrl.c +ReFH - refs.sys - SelfHeal.c +ReFN - refs.sys - NtfsData.c +ReFS - refs.sys - SecurSup.c +ReFs - refs.sys - StrucSup.c +ReFU - refs.sys - usnsup.c +ReFV - refs.sys - VerfySup.c +ReFv - refs.sys - ViewSup.c +ReFW - refs.sys - Write.c +ReF? - refs.sys - Unknown ReFS source module + +RefT - - Bluetooth reference tracking +Rf?? - - Bluetooth RFCOMM TDI driver +RfAD - rfcomm.sys - RFCOMM Address +RfBB - rfcomm.sys - RFCOMM BRB +RfBT - rfcomm.sys - RFCOMM (bthport) +RfCB - rfcomm.sys - RCOMMM +RfCH - rfcomm.sys - RFCOMM channel +RfCN - rfcomm.sys - RFCOMM connect +RfDA - rfcomm.sys - RFCOMM data +RfFR - rfcomm.sys - RFCOMM frame +RfRX - rfcomm.sys - RFCOMM receive +RfPP - rfcomm.sys - RFCOMM pnp +RfWR - rfcomm.sys - RFCOMM worker + +RhHi - tcpip.sys - Reference History Pool + +Rind - tcpip.sys - Raw Socket Receive Indications + +RKRW - mpsdrv.sys - MPSDRV work item +RTLF - mpsdrv.sys - MPSDRV filter + +RLin - - FsLib Range lock entry + +RmPt - netio.sys - Rtl Mapping Page Table Entries + +Rnm - rndismp.sys - RNDIS MP driver generic alloc +Rnms - rndismp.sys - RNDIS MP driver send frame +Rnmr - rndismp.sys - RNDIS MP driver receive frame +Rnmt - rndismp.sys - RNDIS MP driver timer + +RpcL - msrpc.sys - debugging log data - present on checked builds only +RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere +Rpcr - msrpc.sys - not currently used + +RRle - - RTL_RANGE_LIST_ENTRY_TAG +RRlm - - RTL_RANGE_LIST_MISC_TAG + +RtPi - - Temp allocation for product type key + +Rpcl - msrpc.sys - MSRpc memory logging - checked build only +Rpcm - msrpc.sys - MSRpc memory allocations +Rpcr - msrpc.sys - MSRpc resources +Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller + +RPrt - rstorprt.sys - Remote Storage Port Driver + +Rqrv - - Registry query buffer +RS?? - - Remote Storage +RSFS - - Recall Queue +RSFN - - File Name +RSSE - - Security info +RSWQ - - Work Queue +RSQI - - Queue info +RSLT - - Long term data +RSIO - - Ioctl Queue +RSFO - - File Obj queue +RSVO - - Validate Queue +RSER - - Error log data + +RtlT - nt!rtl - Temporary RTL allocation + +RWan - rawwan.sys - Raw WAN driver + +R300 - - ATI video driver +RX00 - - ATI video driver + +Rx?? - rdbss.sys - RDBSS allocations +RxSc - rdbss.sys - RDBSS SrvCall +RxNr - rdbss.sys - RDBSS NetRoot +RxVn - rdbss.sys - RDBSS VNetRoot +RxLv - rdbss.sys - RDBSS Logical View +RxFc - rdbss.sys - RDBSS FCB +RxSo - rdbss.sys - RDBSS SrvOpen +RxFx - rdbss.sys - RDBSS fobx +RxNf - rdbss.sys - RDBSS non paged FCB +RxWq - rdbss.sys - RDBSS work queue +RxBm - rdbss.sys - RDBSS buffering manager +RxCo - rdbss.sys - RDBSS construction context +RxMs - rdbss.sys - RDBSS miscellaneous +RxM1 - rdbss.sys - RDBSS VNetRoot name +RxM2 - rdbss.sys - RDBSS canonical name +RxM3 - rdbss.sys - RDBSS querypath name +RxM4 - rdbss.sys - RDBSS treeconnect name +RxM5 - rdbss.sys - RDBSS reparse buffer name +RxM9 - rdbss.sys - RDBSS cloned unicode string +RxIr - rdbss.sys - RDBSS RxContext +RxTl - rdbss.sys - RDBSS toplevel IRP +RxMx - rdbss.sys - RDBSS mini-rdr +RxNc - rdbss.sys - RDBSS name cache +RxSy - rdbss.sys - RDBSS symlink +RxCr - rdbss.sys - RDBSS credential +RxEc - rdbss.sys - RDBSS ECP + +RxCt - mrxsmb.sys - RXCE transport +RxCa - mrxsmb.sys - RXCE address +RxCc - mrxsmb.sys - RXCE connection +RxCv - mrxsmb.sys - RXCE VcEndpoint +RxCd - mrxsmb.sys - RXCE TDI + +S3 - - S3 video driver +SAad - srvnet.sys - SrvAdmin buffer +SBad - - bad block simulator - simbad.c + +sbp2 - - Sbp2 1394 storage port driver + +SC?? - - Smart card driver tags +SCLb - - Smart card driver library +SCB8 - - Bull CP8 Transac serial reader +SCB3 - - Bull SmarTlp PnP +SCS4 - - SCM Microsystems pcmcia reader +SCl0 - - Litronic 220 + +Sc?? - - Mass storage driver tags + +ScB? - classpnp.sys - ClassPnP misc allocations +ScB1 - classpnp.sys - Query registry parameters +ScB2 - classpnp.sys - Registry path +ScB4 - classpnp.sys - Storage descriptor header +ScB5 - classpnp.sys - FDO relations +ScC? - classpnp.sys - ClassPnP misc allocations +ScC1 - classpnp.sys - Registry path buffer +ScC2 - classpnp.sys - PDO relations +ScC6 - classpnp.sys - START_UNIT completion context +ScC7 - classpnp.sys - Sense info buffer +ScC8 - classpnp.sys - Registry value name +ScC9 - classpnp.sys - Device Control SRB + + + +ScC? - cdrom.sys - CdRom +ScCA - cdrom.sys - Autorun disable functionality +ScCa - cdrom.sys - Media change detection +ScSB - cdrom.sys - Scratch buffer (usually 64k) +ScCC - cdrom.sys - Ioctl GET_CONFIGURATION +ScCc - cdrom.sys - Context of completion routine +ScCD - cdrom.sys - Adaptor & Device descriptor buffer +ScCd - cdrom.sys - Disc information +ScCe - cdrom.sys - Request sync event +ScCF - cdrom.sys - Feature descriptor +ScCG - cdrom.sys - GESN buffer +ScCI - cdrom.sys - Sense info buffers +ScCi - cdrom.sys - Cached inquiry buffer +ScCM - cdrom.sys - Mode data buffer +SCCO - cdrom.sys - Set stream buffer +ScCo - cdrom.sys - Device Notification buffer +ScCp - cdrom.sys - Play active checks +ScCr - cdrom.sys - Registry string +ScCS - cdrom.sys - Srb allocation +ScCs - cdrom.sys - Assorted string data +ScCU - cdrom.sys - Update capacity path +ScCu - cdrom.sys - Read buffer for dvd key +ScCV - cdrom.sys - Read buffer for dvd/rpc2 check +ScCv - cdrom.sys - Read buffer for rpc2 check +ScCX - cdrom.sys - Security descriptor + +ScD? - - Disk +ScD - - generic tag +ScDa - - SMART +ScDA - - Info Exceptions +ScDC - - disable cache paths +ScDb - classpnp.sys - ClassPnP debug globals buffer +ScDc - - disk allocated completion c +ScDG - - disk geometry buffer +ScDg - - update disk geometry paths +ScDI - - sense info buffers +ScDp - - pnp ids +ScDM - - mode data buffer +ScDM - - mbr checksum code +ScDN - - disk name code +ScDP - - read capacity buffer +ScDp - - disk partition lists +ScDS - - srb allocation +ScDs - - start device paths +ScDU - - update capacity path +ScDW - - work-item context +ScMC - - medium changer allocations + +ScIO - classpnp.sys - ClassPnP device control +ScL? - classpnp.sys - Classpnp +ScLA - classpnp.sys - allocation to check for autorun disable +ScLF - classpnp.sys - File Object Extension +ScLc - classpnp.sys - Cache filters +ScLf - classpnp.sys - Fault prediction +ScLm - classpnp.sys - Mount +ScLM - classpnp.sys - Media Change Detection +ScLq - classpnp.sys - Release queue +ScLw - classpnp.sys - WMI +ScLW - classpnp.sys - Power + +ScNo - classpnp.sys - ClassPnP notification + +ScP? - - Scsiport +ScPa - - Hold registry data +ScPA - - Access Ranges +ScPb - - Get Bus Dat Holder +ScPB - - Queuetag BitMap +ScPc - - Fake common buffer +ScPC - - reset bus code +ScPd - - Pnp id strings +ScPD - - SRB_DATA allocations +ScPE - - Scatter gather lists +ScPG - - Global memory +ScPh - - HwDevice Ext +ScPi - - Sense Info +ScPI - - Init data chain +ScPl - - remove lock tracking +ScPL - - scatter gather lists +ScPm - - address mapping lists +ScPM - - scatter gather lists +ScPp - - device & adapter enable +ScpP - - scsi PortConfig copies +ScPq - - inquiry data +ScPQ - - request sense +ScPr - - resource list copy +ScPS - - registry allocations +ScPt - - legacy request rerouting +ScPT - - interface mapping +ScPu - - device relation structs +ScPv - - KEVENT +ScPV - - Device map allocations +ScPw - - Wmi Events +ScPW - - Wmi Requests +ScPx - - Report Luns +ScPY - - Report Targets +ScPZ - - Device name buffer + +ScR? - - Partition Manager +ScRi - - IOCTL buffer +ScRp - - Partition entry +ScRr - - Remove lock +ScRt - - Table entry +ScRv - - Dependant volume relations lists +ScRV - - Volume entry +ScRw - - Power mgmt private work item + +ScS2 - classpnp.sys - Sense interpretation data + +ScsC - - non-pnp SCSI CdRom +ScsD - - non-pnp SCSI Disk +ScsH - - non-pnp SCSI from class.h (class2) +ScsI - - non-pnp SCSI port internal +ScsL - - non-pnp SCSI class.c driver allocations +ScsP - - non-pnp SCSI port.c +Scs$ - - Tag for pnp class driver's SRB lookaside list + +ScUn - - Default Tag for pnp class driver allocations + +ScV? - - Dvd functionality in cdrom.sys +ScVk - - read buffer for DVD keys +ScVK - - write buffer for DVD keys +ScVS - - buffer for reads of DVD on-disk structures + +ScWs - classpnp.sys - Working set + +SdCc - - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES + +Sdba - - Application compatibility Sdb* allocations + +Sdp? - - Bluetooth SDP functionality in BTHPORT.sys +SdpC - bthport.sys - Bluetooth SDP client connection +SdpD - bthport.sys - Bluetooth SDP database +SdpI - bthport.sys - Bluetooth port driver (SDP) + +SD - smbdirect.sys - SMB Direct allocations +SDa - smbdirect.sys - SMB Direct socket objects +SDb - smbdirect.sys - SMB Direct adapter objects +SDc - smbdirect.sys - SMB Direct MR buffers +SDd - smbdirect.sys - SMB Direct connect event contexts +SDe - smbdirect.sys - SMB Direct large receive buffers +SDf - smbdirect.sys - SMB Direct LAM objects +SDg - smbdirect.sys - SMB Direct data transfer packet buffers +SDh - smbdirect.sys - SMB Direct FRMR objects +SDi - smbdirect.sys - SMB Direct buffer registrations +SDj - smbdirect.sys - SMB Direct SQ work requests +SDk - smbdirect.sys - SMB Direct operation + +Se - nt!se - General security allocations +SeAc - nt!se - Security ACL +SeAi - nt!se - Security Audit Work Item +SeAk - nt!se - Security Account Name +SeAo - nt!se - Security Attributes and Operations +SeAp - nt!se - Security Audit Parameter Record +SeAt - nt!se - Security Attributes +SeCL - nt!se - Security CONTEXT_TAG +SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links +SeDt - nt!se - Security Global Singleton attributes table +SeFS - nt!se - Security File System Notify Context +SeGa - nt!se - Granted Access allocations +SeHa - nt!se - Security Handle Array +SeHn - nt!se - AppContainer Handles +SeIf - nt!se - Security Image Filename +SeLa - nt!se - Security Learning Mode ACLs +SeLs - nt!se - Security Logon Session +SeLu - nt!se - Security LUID and Attributes array +SeLS - nt!se - Security Logon Session tracking array +SeLw - nt!se - Security LSA Work Item +SeOI - nt!se - Security Learning Mode Object Information +SeOn - nt!se - Security Captured Object Name information +SeON - nt!se - Security Learning Mode Object Name +SeOp - nt!se - Security Operation +SeOT - nt!se - Security Learning Mode Object Type +SeOt - nt!se - Captured object type array, used by access check +SePa - nt!se - Process audit image names and captured policy structures +SePh - nt!se - Dummy image page hash structure, used when CI is disabled +SePr - nt!se - Security Privilege Set +SeRO - nt!se - Learning Mode Root Object +SeSA - nt!se - Security CAPE Staged Access Array +SeSa - nt!se - Security SID and Attributes +SeSb - nt!se - Security Secure Boot +SeSc - nt!se - Captured Security Descriptor +SeSd - nt!se - Security Descriptor +SeSi - nt!se - Security SID +SeSp - nt!se - Scoped Policy +SeSs - nt!se - Shared Sids +SeSv - nt!se - Security SID values block +SeTa - nt!se - Security Temporary Array +SeTd - nt!se - Security Token dynamic part +SeTI - ksecdd.sys - Security TargetInfo +SeTl - nt!se - Security Token Lock +SeTn - nt!se - Security Captured Type Name information +SeUs - nt!se - Security Captured Unicode string + +Sect - - Section objects +Sema - - Semaphore objects +Senm - - Serenum (RS-232 serial bus enumerator) +SimB - - Simbad (bad sector simulation driver) allocations +SIfs - - Default tag for user's of ntsrv.h +sidg - - GDI spooler events +Sis - - Single Instance Store (dd\sis\filter) +SisB - - SIS per file object break event +SisC - - SIS common store file object +SisF - - SIS per file object +SisL - - SIS per link object +SisS - - SIS SCB +Setp - - SETUPDD SpMemAlloc calls + +SRdm - scsirdma.sys - Infiniband SRP driver + +StCc - netio.sys - WFP stream inspection call context +StDa - netio.sys - WFP stream inspection data +StFc - netio.sys - WFP stream filter conditions +StCx - netio.sys - WFP stream internal callout context +Stdq - netio.sys - WFP stream DPC queue + +SV?? - - Synthetic Video Driver + +SVXD - synvidxd.dll - WDDM Synthetic Video Display Driver +SVXM - synvidxm.sys - WDDM Synthetic Video Miniport Driver +SVid - synthvid.sys - LDDM Synthetic Video Miniport Driver + +SW?? - - Software Bus Enumerator +SWbi - - bus ID +SWbr - - bus reference +SWda - - POOLTAG_DEVICE_ASSOCIATION +SWdn - - device name +SWdr - - device reference +SWdr - - POOLTAG_DEVICE_DRIVER_REGISTRY +SWfd - - POOLTAG_DEVICE_FDOEXTENSION +SWid - - device ID +SWii - - instance ID +SWip - - POOLTAG_DEVICE_INTERFACEPATH +SWki - - key information +SWpd - - POOLTAG_DEVICE_PDOEXTENSION +SWre - - relations +SWrp - - reparse string +SWrs - - reference string + +Sm?? - mrxsmb.sys - SMB miniredirector allocations +SmCe - mrxsmb.sys - SMB connection object +SmXc - mrxsmb.sys - SMB exchange +SmBf - mrxsmb.sys - SMB exchange buffer +SmKy - mrxsmb.sys - SMB compounding key +SmMs - mrxsmb.sys - SMB miscellaneous +SmTp - mrxsmb.sys - SMB transport +SmVc - mrxsmb.sys - SMB VC endpoint +SmDg - mrxsmb.sys - SMB datagram endpoint +SmWi - mrxsmb.sys - SMB sequence window +SmFi - mrxsmb.sys - SMB file +SmTh - mrxsmb.sys - SMB thunk +SmSh - mrxsmb.sys - SMB shadow file (fast loopback) +SmTd - mrxsmb.sys - SMB TDI notify +SmDc - mrxsmb.sys - SMB directory cache + + +SmMm - mrxsmb.sys - SMB mm allocated structures. +SmAd - mrxsmb10.sys - SMB1 session setup/admin exchange +SmRw - mrxsmb10.sys - SMB1 read/write path +SmTr - mrxsmb10.sys - SMB1 transact exchange +SmRb - mrxsmb10.sys - SMB1 remote boot + +SmFc - mrxsmb10.sys - SMB1 fsctl structures (special build only) +SmDc - mrxsmb10.sys - SMB1 dir query buffer (special build only) +SmPi - mrxsmb10.sys - SMB1 pipeinfo buffer (special build only) +SmDO - mrxsmb10.sys - SMB1 deferred open context (special build only) +SmQP - mrxsmb10.sys - SMB1 params for directory query transact (special build only) + +SmVr - mrxsmb10.sys - SMB1 VNetroot (special build only) +SmSr - mrxsmb10.sys - SMB1 Server (special build only) +SmSe - mrxsmb10.sys - SMB1 Session (special build only) +SmNr - mrxsmb10.sys - SMB1 NetRoot (special build only) +SmMa - mrxsmb10.sys - SMB1 mid atlas (special build only) +SmMt - mrxsmb10.sys - SMB1 mailslot buffer (special build only) +SmEc - mrxsmb10.sys - SMB1 echo buffer (special build only) +SmKs - mrxsmb10.sys - SMB1 Kerberos blob (special build only) + +sm?? - nt!store or rdyboost.sys - ReadyBoost allocations +smCR - nt!store or rdyboost.sys - ReadyBoost encryption allocation +smMD - nt!store or rdyboost.sys - ReadyBoost store stats MDL +smWi - nt!store or rdyboost.sys - ReadyBoost various work items +smSt - nt!store or rdyboost.sys - ReadyBoost various store allocations +smBt - nt!store or rdyboost.sys - ReadyBoost various B+Tree allocations +smXt - nt!store or rdyboost.sys - ReadyBoost store extents array +smAr - nt!store or rdyboost.sys - ReadyBoost generic array allocation +smIt - nt!store or rdyboost.sys - ReadyBoost store ETA timers +smRg - nt!store or rdyboost.sys - ReadyBoost in-memory store region array +smET - nt!store or rdyboost.sys - ReadyBoost ETA check work item +smWd - nt!store or rdyboost.sys - ReadyBoost store contents rundown work item +smNp - nt!store or rdyboost.sys - ReadyBoost store node pool allocations +smDt - nt!store or rdyboost.sys - ReadyBoost store debug trace buffer +smDa - nt!store - ReadyBoost cache file DACL +smDS - nt!store - ReadyBoost cache file SID +smLb - nt!store - ReadyBoost virtual store manager log buffer +smCa - nt!store - ReadyBoost cache +smEK - nt!store - ReadyBoost encryption key +smEd - nt!store - ReadyBoost virtual store manager key descriptor allocation for logging +smAc - nt!store - ReadyBoost device arrival context +smFh - nt!store - ReadyBoost cache file header +smFp - nt!store - ReadyBoost virtual forward progress entry +smR? - nt!store - ReadyBoost virtual forward progress resources +smKG - nt!store - ReadyBoost encryption key registry path buffer +smms - nt!store - ReadyBoost virtual store memory monitor context +smCr - nt!store - ReadyBoost store region bitmap +smMd - rdyboost.sys - ReadyBoost MDL allocation +smMb - rdyboost.sys - ReadyBoost MDL buffer +smBP - rdyboost.sys - ReadyBoot boot plan buffer +smBD - rdyboost.sys - ReadyBoot decompressed boot plan buffer +smBX - rdyboost.sys - ReadyBoot boot plan decompression workspace buffer +smMR - rdyboost.sys - ReadyBoot multi-read ranges +smRW - rdyboost.sys - ReadyBoot read-after-write ranges +smPr - rdyboost.sys - ReadyBoot population ranges +smPi - rdyboost.sys - ReadyBoot population ranges index +smPl - rdyboost.sys - ReadyBoot pended IRP lists +smRT - rdyboost.sys - ReadyBoot thread params +smTi - rdyboost.sys - ReadyBoost debug IO trace buffer +smPc - rdyboost.sys - ReadyBoost persist log context +smPb - rdyboost.sys - ReadyBoost persist log buffer +smPm - rdyboost.sys - ReadyBoost persist partial MDL buffer +smBR - rdyboost.sys - ReadyBoost volume ranges array +smBr - rdyboost.sys - ReadyBoost volume range +smVc - rdyboost.sys - ReadyBoost read verification buffer +smHB - rdyboost.sys - ReadyBoost Hybrid Drive command buffer + +SPX - - Nwlnkspx transport +SQOS - - Security quality of service in IO + +Sr?? - sr.sys - System Restore file system filter driver +SrCo - sr.sys - SR's control object +SrSC - sr.sys - Stream contexts +SrDB - sr.sys - Debug information for lookup blob +SrDL - sr.sys - Device list +SrFE - sr.sys - File information buffer +SrFN - sr.sys - File name +SrHB - sr.sys - Hash bucket +SrHH - sr.sys - Hash header +SrHK - sr.sys - Hash key +SrLB - sr.sys - Log buffer +SrLC - sr.sys - Logging context +SrLE - sr.sys - Log entry +SrLT - sr.sys - Lookup blob +SrMP - sr.sys - Mount point information +SrOI - sr.sys - Overwrite information +SrPC - sr.sys - Persistant configuration information +SrRB - sr.sys - Rename buffer +SrRG - sr.sys - Logger context +SrRH - sr.sys - Reparse data size +SrRR - sr.sys - Registry information +SrSD - sr.sys - Security data information +SrST - sr.sys - Stream data information +SrTI - sr.sys - Directory delete information +SrWI - sr.sys - Work queue item + +SslC - ksecdd.sys - SSL kernel mode client allocations + +ST* - - New MMC compliant storage drivers + +Stac - - Stack Trace Database - i386 checked and built with NTNOFPO=1 only +StEl - storport.sys - PortpErrorInitRecords storport!_STORAGE_TRACE_CONTEXT_INTERNAL.ErrorLogRecords +Strg - - Dynamic Translated strings +Strm - - Streams and streams transports allocations +StTc - storport.sys - PortTraceInitTracing storport!_STORAGE_TRACE_CONTEXT_INTERNAL + +svx? - svhdxflt.sys - VHDX sharing among multiple Hyper-V guests +svxc - svhdxflt.sys - CDB (SCSI) operations +svxC - svhdxflt.sys - Create File processing +svxd - svhdxflt.sys - SVHDX communications port +svxe - svhdxflt.sys - Stored sense data errors +svxf - svhdxflt.sys - File contexts +svxI - svhdxflt.sys - Initiator lists +svxi - svhdxflt.sys - Instance context +svxl - svhdxflt.sys - Shared VHDX RTL +svxP - svhdxflt.sys - Persistent Reservation - Registrations +svxp - svhdxflt.sys - Persistent Reservation support for shared VHDX files +svxQ - svhdxflt.sys - Persistent Reservation - Device context +svxq - svhdxflt.sys - Persistent Reservation - Reservation Info +svxr - svhdxflt.sys - File read operations +svxs - svhdxflt.sys - Stream context +svxS - svhdxflt.sys - Stream handle context +svxt - svhdxflt.sys - Test Filter +svxv - svhdxflt.sys - VHDMP/SVHDX interaction +svxw - svhdxflt.sys - File write operations + +SwMi - - SWMidi KS filter (WDM Audio) +Symb - - Symbolic link objects +Symt - - Symbolic link target strings + +SYPK - syspart.lib - Kernel mode system partition detection allocations +SYSA - - Sysaudio (wdm audio) + +TAPI - - ntos\ndis\ndistapi + +TcAR - tcpip.sys - TCP Abort Requests +TcBW - tcpip.sys - TCP Bandwidth Allocations +TcCC - tcpip.sys - TCP Create And Connect Tcb Pool +TcCM - tcpip.sys - TCP Congestion Control Manager Contexts +TcCo - tcpip.sys - TCP Compartment +TcCR - tcpip.sys - TCP Connect Requests +TcCT - tcpip.sys - TCP Connection Tuples +TcDD - tcpip.sys - TCP Debug Delivery Buffers +TcDQ - tcpip.sys - TCP Delay Queues +TcDR - tcpip.sys - TCP Disconnect Requests +TcEW - tcpip.sys - TCP Endpoint Work Queue Contexts +TcFC - tcpip.sys - TCP Fastopen Cookies +TcFR - tcpip.sys - TCP FineRTT Buffers +TcHT - tcpip.sys - TCP Hash Tables +TcIn - tcpip.sys - TCP Inputs +TcLS - tcpip.sys - TCP Listener SockAddrs +TcLW - tcpip.sys - TCP Listener Work Queue Contexts +TcpA - tcpip.sys - TCP DMA buffers +TcpB - tcpip.sys - TCP Offload Blocks +TcDM - tcpip.sys - TCP Delayed Delivery Memory Descriptor Lists +TcDN - tcpip.sys - TCP Delayed Delivery Network Buffer Lists +TcPC - tcpip.sys - TCP Listener Pending Connections +TcpE - tcpip.sys - TCP Endpoints +TcpI - tcpip.sys - TCP ISN buffers +TcpL - tcpip.sys - TCP Listeners +TcpM - tcpip.sys - TCP Offload Miscellaneous buffers +TcpN - tcpip.sys - TCP Name Service Interfaces +TcOD - tcpip.sys - TCP Offload Devices +TcpO - tcpip.sys - TCP Offload Requests +TcpP - tcpip.sys - TCP Processor Arrays +TcPt - tcpip.sys - TCP Partitions +Tcpt - tcpip.sys - TCP Timers +TcRA - tcpip.sys - TCP Reassembly Data +TcRB - tcpip.sys - TCP Reassembly Buffers +TcRD - tcpip.sys - TCP Receive DPC Data +TcRe - tcpip.sys - TCP Recovery Buffers +TcRH - tcpip.sys - TCP Reassembly Headers +TcRK - tcpip.sys - TCP Rack Data +TcRL - tcpip.sys - TCP Create And Connect Tcb Rate Limit Pool +TcRR - tcpip.sys - TCP Receive Requests +TcRW - tcpip.sys - TCP Receive Window Tuning Blocks +TcSa - tcpip.sys - TCP Sack Data +TcSR - tcpip.sys - TCP Send Requests +TcST - tcpip.sys - TCP Syn TCBs +TcTW - tcpip.sys - TCP Time Wait TCBs +TcUD - tcpip.sys - TCP Urgent Delivery Buffers +TcWQ - tcpip.sys - TCP TCB Work Queue Contexts +TcWS - tcpip.sys - TCP Window Scaling Diagnostics + +TC?? - TCP - TCP/IP network protocol +TCh? - - TCP/IP header pools +TCPC - - TCP connection pool +TCPT - - TCB pool +TCPY - - SYN-TCB pool +TCPr - - TCP request pool + +TDIc - - TDI resource +TDId - - TDI resource +TDIe - - TDI resource +TDIf - - TDI resource +TDIg - - TDI resource +TDIk - - TDI resource +TDIu - - TDI resource +TDIv - - TDI resource + +Tdat - - NB Data + +TdxC - tdx.sys - TDX Connections +TdCI - tdx.sys - TDX Connection Information +Tdxc - tdx.sys - TDX Control Channels +Tdxo - tdx.sys - TDX Device Objects +Tdx - tdx.sys - TDX Generic Buffers (Address, Entity information, Interface change allocations) +TdxI - tdx.sys - TDX IO Control Buffers +TdxM - tdx.sys - TDX Message Indication Buffers +Tdxn - tdx.sys - TDX Net Addresses +TdxR - tdx.sys - TDX Received Data +Tdxp - tdx.sys - TDX Reserved Page Tables Entries +TdxB - tdx.sys - TDX Transport Layer Buffers +Tdxt - tdx.sys - TDX Transport Layer Clients +TdxP - tdx.sys - TDX Transport Layer Providers +Tdxm - tdx.sys - TDX Transport Layer TDI Mappings +TdxA - tdx.sys - TDX Transport Addresses +TdxT - tdx.sys - TDX Transport Provider Contexts + +Tedd - tcpip.sys - TCP/IP Event Data Descriptors + +thdd - - DirectDraw/3D handle manager table + +Thre - nt!ps - Thread objects +Time - nt!ke - Timer objects + +TmDn - nt!tm - Tm Dynamic Name +TmEn - nt!tm - Tm KENLISTMENT object +TmLo - nt!tm - Tm Log Entries +TmNo - nt!tm - Tm Notification +TmPa - nt!tm - Tm Propagate Argument +TmPb - nt!tm - Tm Propagation Buffer +TmPe - nt!tm - Tm Enlistment Pointers +TmPi - nt!tm - Tm Protocol Information +TmPo - nt!tm - Tm Propagation Output +TmPp - nt!tm - Tm Protocol Pointers +TmPr - nt!tm - Tm Protocol +TmPx - nt!tm - Tm Protocol Array +TmRi - nt!tm - Tm Recovery Information +TmRm - nt!tm - Tm KRESOURCEMANAGER object +TmRq - nt!tm - Tm Propagation Request +TmRr - nt!tm - Tm KTM_RESTART_RECORD +TmTm - nt!tm - Tm KTRANSACTIONMANAGER object +TmTx - nt!tm - Tm KTRANSACTION object + +Tnbl - - NB Lists +Tnbt - - NB Pool + +TNbl - tcpip.sys - TCP Send NetBufferLists + +Toke - nt!se - Token objects + +TOBJ - rdpdr.sys - Topology object + +TpWc - nt!ex - Threadpool minipacket context +TpWo - nt!ex - Threadpool worker factory objects + +TQoS - tcpip.sys - TL QoS Client Data + +Tran - - EXIFS Translate + +Trcd - netiobvt.sys - NB Control Data + +Tslc - tcpip.sys - WFP TL Shim Layer Cache +Tscf - netio.sys - WFP Filter Engine Cached Filter Block + +TSBV - - WDM mini driver for Toshiba 750 capture + +TSdd - rdpdd.sys - RDPDD - Hydra Display Driver +TSch - rdpwd.sys - RDPWD - Hydra char conversion +TSic - termdd.sys - Terminal Services - ICA_POOL_TAG +TSlc - rdpwd.sys - RDPWD - Hydra Licensing +TSmc - - PDMCS - Hydra MCS Protocol Driver +Tspk - ksecdd.sys - TS Package kernel mode client allocations +TSq - - Terminal Services - Queue - TSQ_TAG +TSrp - termdd.sys - Terminal Services - RP_ALLOC_TAG +TSwd - rdpwd.sys - RDPWD - Hydra Winstation Driver + +Ttnc - tcpip.sys - WFP tunnel nexthop context + +Tsmp - tcpip.sys - TCP Send Memory Descriptor Lists +TSNb - tcpip.sys - TCP Send NetBuffers +TTsp - tcpip.sys - TCP TCB Sends + +TtCo - - TTCP Connections +TtcC - - TTCP Controllers +TtcL - - TTCP Listeners +TtcM - - TTCP Mappings +TtcN - - TTCP NPIs +TtcW - - TTCP Work Items + +Ttfd - - TrueType Font driver +TTFC - - Font file cache + +Thrm - - Thermal zone structure +Tun4 - - Tunnel cache allocation for long file name +TunL - - Tunnel cache lookaside-allocated elements +TunP - - Tunnel cache oddsized pool-allocated elements +TunK - - Tunnel cache temporary key value + +TuSB - tunnel.sys - Tunnel stack block + +TWTa - tcpip.sys - Echo Request Timer Table +TWTs - netiobvt.sys - BVT TW Generic Buffers + +Txcl - ntfs.sys - TXF_CLR_RESERVATION_CHUNK +Txdl - ntfs.sys - TXF_DELETED_LINK +Txdr - ntfs.sys - TXF_DEFAULT_READER_SECTION +Txfc - ntfs.sys - TXF_FCB +Txfe - ntfs.sys - TXF_FCB_EXTENSION +Txfi - ntfs.sys - TXF_FCB_INFO +Txfl - ntfs.sys - TXF_FCB_CLEANUP +Txfo - ntfs.sys - TXF_FO +Txfq - ntfs.sys - Txf quota block +Txgd - ntfs.sys - TxfData global structure +Txis - ntfs.sys - TXF_ISO_SNAPSHOT +Txlf - ntfs.sys - TXF_FCB (large) +Txls - ntfs.sys - TXF_CANCEL_LSN +Txre - ntfs.sys - TXF_TOPS_RANGE_ENTRY +Txrm - ntfs.sys - TXF_RMCB +Txrn - ntfs.sys - TXF_NONPAGED_RMCB +Txsa - ntfs.sys - Txf sorted array item +Txsc - ntfs.sys - TXF_SCB +Txsp - ntfs.sys - TXF_SAVEPOINT +Txsp - ntfs.sys - TXF_SCB_PTR +Txtc - ntfs.sys - TXF_TRANS_CANCEL_LIST_ENTRY +Txte - ntfs.sys - TXF_RMCB_TABLE_ENTRY +Txtr - ntfs.sys - TXF_TRANS (Txf transaction context) +Txts - ntfs.sys - TXF_TRANS_SYNC +Txvc - ntfs.sys - TXF_VCB +Txvd - ntfs.sys - TXF_VSCB_TO_DEREF +Txvf - ntfs.sys - TXF_VSCB_FILE_SIZES +Txvl - ntfs.sys - TXF_VSCB + +Type - - Type objects + +U802 - usb8023.sys - RNDIS USB 8023 driver + +UCAM - - USB digital camera library + +Udf1 - udfs.sys - Udfs file set descriptor buffer +Udf2 - udfs.sys - Udfs volmume recognition sequence descriptor buffer +Udf3 - udfs.sys - Udfs volume descriptor sequence descriptor buffer +Udf4 - udfs.sys - Udfs logical volume integrity descriptor buffer +UdfB - udfs.sys - Udfs dynamic name buffer +UdfC - udfs.sys - Udfs CRC table +UdfD - udfs.sys - Udfs FID buffer for view spanning +UdfF - udfs.sys - Udfs nonpaged Fcb +UdfI - udfs.sys - Udfs IO context +UdfL - udfs.sys - Udfs IRP context lite (delayed close) +UdfN - udfs.sys - Udfs normalized full filename +UdfS - udfs.sys - Udfs short file name +UdfT - udfs.sys - Udfs generic table entry +Udfa - udfs.sys - Udfs AD buffer +Udfb - udfs.sys - Udfs IO buffer +Udfc - udfs.sys - Udfs IRP context +Udfd - udfs.sys - Udfs file Scb +Udfe - udfs.sys - Udfs enumeration match expression +Udff - udfs.sys - Udfs Fcb +Udfi - udfs.sys - Udfs directory Scb +Udfl - udfs.sys - Udfs Lcb +Udfn - udfs.sys - Udfs Nonpaged Scb +Udfp - udfs.sys - Udfs Pcb +Udfs - udfs.sys - Udfs Sparing Mcb +Udft - udfs.sys - Udfs CDROM TOC +Udfv - udfs.sys - Udfs Vpb +UdfV - udfs.sys - Udfs VMCB dirty sector bitmap +Udfx - udfs.sys - Udfs Ccb + +UdAE - tcpip.sys - UDP Activate Endpoints +UdCo - tcpip.sys - UDP Compartment +UdJP - tcpip.sys - UDP Join Path Contexts +UdEW - tcpip.sys - UDP Endpoint Work Queue Contexts +UdMI - tcpip.sys - UDP Message Indications +UDNb - tcpip.sys - UDP NetBuffers +UdpA - tcpip.sys - UDP Endpoints +UdpH - tcpip.sys - UDP Headers +UdPM - tcpip.sys - UDP Partial Memory Descriptor Lists +UdpN - tcpip.sys - UDP Name Service Interfaces +UdSM - tcpip.sys - UDP Send Messages Requests +UNbl - tcpip.sys - UDP NetBufferLists + +Udp - - Udp protocol (TCP/IP driver) +Ufsc - - User FULLSCREEN +UHCD - - Universal Host Controller (USB - Intel Controller) +UHUB - - Universal Serial Bus Hub + +Ul?? - http.sys - tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; +Uc?? - http.sys - i.e., the case of the leading "Ul" or "Uc" has been reversed. + +Ucac - http.sys - Auth Cache Pool +UcCO - http.sys - Client Connection +Ucmp - http.sys - Multipart String Buffer +Ucre - http.sys - Receive Response +Ucrp - http.sys - Response App Buffer +Ucrq - http.sys - Request Pool +UcSc - http.sys - Common Server Information +UcSN - http.sys - Server name +UcSP - http.sys - Process Server Information +UcSp - http.sys - Sspi Pool +UcST - http.sys - Server info table +Uctd - http.sys - Response Tdi Buffer +Ucte - http.sys - Entity Pool +Ucto - http.sys - Tdi Objects Pool +UlAB - http.sys - Auxiliary Buffer +UlAO - http.sys - App Pool Object +UlAP - http.sys - App Pool Process +UlBL - http.sys - Binary Log File Entry +UlBO - http.sys - Outstanding i/o +UlCC - http.sys - Control Channel +UlCE - http.sys - Config Group Tree Entry +UlCH - http.sys - Config Group Tree Header +UlCI - http.sys - Config Group URL Info +UlCJ - http.sys - Config Group Object Pool +UlCK - http.sys - Chunk Tracker +UlCL - http.sys - Config Group LogDir +UlCl - http.sys - Connection RefTraceLog +UlCO - http.sys - Connection +UlCT - http.sys - Config Group Timestamp +UlCY - http.sys - Connection Count Entry +UlDB - http.sys - Debug +UlDC - http.sys - Data Chunks array +UlDO - http.sys - Disconnect Object +UlDR - http.sys - Deferred Remove Item +UlDT - http.sys - Debug Thread Pool +UlEP - http.sys - Endpoint +UlFA - http.sys - Force Abort Work Item +UlFC - http.sys - File Cache Entry +Ulfc - http.sys - Uri Filter Context +UlFD - http.sys - Noncached File Data +UlFP - http.sys - Filter Process +UlFR - http.sys - Dummy Filter Receive Buffer +UlFT - http.sys - Filter Channel +UlFU - http.sys - Full Tracker +UlFW - http.sys - Filter Write Tracker +UlHC - http.sys - Http Connection +UlHc - http.sys - Http Connection RefTraceLog +UlHL - http.sys - Internal Request RefTraceLog +UlHR - http.sys - Internal Request +UlHT - http.sys - Hash Table +UlHV - http.sys - Header Value +UlIC - http.sys - Irp Context +UlID - http.sys - Conn ID Table +UlIR - http.sys - Internal Response +UlLD - http.sys - Log Field +UlLF - http.sys - Log File Entry +UlLG - http.sys - Log Generic +UlLH - http.sys - Log File Handle +UlLL - http.sys - Log File Buffer +UlLS - http.sys - Ansi Log Data Buffer +UlLT - http.sys - Binary Log Data Buffer +UlNO - http.sys - NSGO Pool +UlNP - http.sys - Non-Paged Data +UlOE - http.sys - Endpoint OwnerRefTraceLog PoolTag +UlOR - http.sys - Owner RefTrace Signature +UlOT - http.sys - Opaque ID Table +UlPB - http.sys - APool Proc Binding +UlPL - http.sys - Pipeline +UlQF - http.sys - TCI Filter +UlQG - http.sys - TCI Generic +UlQI - http.sys - TCI Interface +UlQL - http.sys - TCI Flow +UlQT - http.sys - TCI Tracker +UlQW - http.sys - TCI WMI +UlRB - http.sys - Receive Buffer +UlRD - http.sys - Registry Data +UlRE - http.sys - Request Body Buffer +UlRP - http.sys - Request Buffer +UlRR - http.sys - Request Buffer References +UlRS - http.sys - Non-Paged Resource +UlRT - http.sys - RefTraceLog PoolTag +UlSC - http.sys - SSL Cert Data +UlSD - http.sys - Security Data +UlSl - http.sys - StringLog Buffer PoolTag +UlSL - http.sys - StringLog PoolTag +UlSO - http.sys - Site Counter Entry +UlSS - http.sys - Simple Status Item +UlTA - http.sys - Address Pool +UlTD - http.sys - UL_TRANSPORT_ADDRESS +UlTT - http.sys - Thread Tracker +UlUB - http.sys - URL Buffer +UlUC - http.sys - Uri Cache Entry +UlUH - http.sys - HTTP Unknown Header +UlUL - http.sys - URL +UlUM - http.sys - URL Map +UlVH - http.sys - Virtual Host +UlWC - http.sys - Work Context +UlWI - http.sys - Work Item + +UndP - - EXIFS Underlying Path + +UMD? - WUDFRd.sys - UMDF pool allocation +USBB - bthusb.sys - Bluetooth USB minidriver +USBD - - Universal Serial Bus Class Driver +UsbS - usbser.sys - USB Serial Driver + +V2ic - vhdmp.sys - VHD2 external I/O allocation +V2io - vhdmp.sys - VHD2 internal I/O allocation +V2lg - vhdmp.sys - VHD2 core large allocation +V2rv - vhdmp.sys - VHD2 reserved VA mapping +V2sm - vhdmp.sys - VHD2 core allocation +V2sr - vhdmp.sys - VHD2 SRB range allocation +V2wi - vhdmp.sys - VHD2 work item +V2?? - vhdmp.sys - VHD2 pool allocation + +Vad - nt!mm - Mm virtual address descriptors +VadF - nt!mm - VADs created by a FreeVM splitting +Vadl - nt!mm - Mm virtual address descriptors (long) +VadS - nt!mm - Mm virtual address descriptors (short) + +Vbus - vmbus.sys - Virtual Machine Bus Driver +VbuW - vmbus.sys - Virtual Machine Bus Driver (WDF) +Vbxp - vmbus.sys - Virtual Machine Bus Driver (cross partition) + +VcCh - rdpdr.sys - Dynamic Virtual channel object +VcFl - rdpdr.sys - Dynamic Virtual file object +VcMn - rdpdr.sys - Dynamic Virtual manager object +VcSn - rdpdr.sys - Dynamic Virtual session object + +VDM - nt!vdm - ntos\vdm + +VdDr - Vid.sys - Virtual Machine Virtualization Infrastructure Driver +VdMm - Vid.sys - Virtual Machine Virtualization Infrastructure Driver (VSMM service) +VdWd - Vid.sys - Virtual Machine Virtualization Infrastructure Driver (WDF) + +vDMc - dmvsc.sys - Virtual Machine Dynamic Memory VSC Driver +vDMW - dmvsc.sys - Virtual Machine Dynamic Memory VSC Driver (WDF) + +Vflt - vmstorfl.sys - Virtual Machine Storage Filter Driver +VflW - vmstorfl.sys - Virtual Machine Storage Filter Driver (WDF) + +VdPN - dxgkrnl.sys - Video display mode management +Vepp - nt!Vf - Verifier Pool Tracking information +VfAT - nt!Vf - Verifier AVL trees +VfIT - nt!Vf - Verifier Import Address Table information +VfPT - nt!Vf - Verifier Allocate/Free Pool stack traces +VfUs - nt!Vf - Memory allocated by a call to IoSetCompletionRoutineEx. +Vfwi - nt!Vf - IO_WORKITEM allocated by I/O verifier version of IoAllocateWorkItem +VMdl - nt!Vf - MDL allocated by I/O verifier version of IoAllocateMdl +VNod - nt!Vf - Deadlock Verifier nodes +VRes - nt!Vf - Deadlock Verifier resources +VStr - nt!Vf - String buffer allocated by the Driver Verifier version of Rtl String APIs + +VHDa - vhdmp.sys - VHD generic allocator +VHDA - vhdmp.sys - VHD generic allocator pool +VHDb - vhdmp.sys - VHD Block Allocation Table +VHDf - vhdmp.sys - VHD file entry +VHDh - vhdmp.sys - VHD header +VHDi - vhdmp.sys - VHD IO Range +VHDI - vhdmp.sys - VHD IO Range pool +VHDl - vhdmp.sys - VHD LUN +VHDm - vhdmp.sys - VHD bitmap +VHDn - vhdmp.sys - VHD filename +VHDo - vhdmp.sys - VHD footer +VHDp - vhdmp.sys - VHD filepath +VHDr - vhdmp.sys - VHD read buffer +VHDs - vhdmp.sys - VHD sector map +VHDS - vhdmp.sys - VHD symbolic link +VHDt - vhdmp.sys - VHD tracking information +VHDw - vhdmp.sys - VHD work item +VHDy - vhdmp.sys - VHD dynamic header +VHD? - vhdmp.sys - VHD allocation + +VHde - vmusbhub.sys - Virtual Machine USB Hub Driver (descriptor) +VHif - vmusbhub.sys - Virtual Machine USB Hub Driver (interface) +VHps - vmusbhub.sys - Virtual Machine USB Hub Driver (Pnp string) +VHrc - vmusbhub.sys - Virtual Machine USB Hub Driver (request context) +VHtx - vmusbhub.sys - Virtual Machine USB Hub Driver (text) +VHub - vmusbhub.sys - Virtual Machine USB Hub Driver (Bus) +VHur - vmusbhub.sys - Virtual Machine USB Hub Driver (URB) +VHuW - vmusbhub.sys - Virtual Machine USB Hub Driver (WDF) + +VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION) +VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport + +ViMm - dxgkrnl.sys - Video memory manager +virt - vmm.sys - Virtual Machine Manager (VPC/VS) +ViSh - dxgkrnl.sys - Video scheduler + +Vk?? - vmbkmcl.sys - Hyper-V VMBus KMCL driver +Vkin - vmbkmcl.sys - Hyper-V VMBus KMCL driver (incoming packets) +Vkou - vmbkmcl.sys - Hyper-V VMBus KMCL driver (outgoing packets) + +VM?? - volmgr.sys - Volume Manager +VM - volmgr.sys - General allocations + +Vm?? - volmgrx.sys - Volume Manager Extension +Vm - volmgrx.sys - General allocations +VmBl - volmgrx.sys - Raw configuration blocks +VmBu - volmgrx.sys - I/O buffers +VmCc - volmgrx.sys - Configuration copies +VmCo - volmgrx.sys - Configurations +VmCp - volmgrx.sys - Copies +VmCr - volmgrx.sys - Completion routine contexts +VmDc - volmgrx.sys - Device changes +VmDd - volmgrx.sys - Disk devices +VmDh - volmgrx.sys - Disk headers +VmLa - volmgrx.sys - Drive layouts +VmLb - volmgrx.sys - Log blocks +VmLc - volmgrx.sys - Log copies +VmLo - volmgrx.sys - Logs +VmLr - volmgrx.sys - Log raw content +VmMm - volmgrx.sys - Mirror emergency mappings +VmNe - volmgrx.sys - Notification entries +VmOb - volmgrx.sys - I/O objects +VmP0 - volmgrx.sys - Packets +VmP1 - volmgrx.sys - Small packets +VmP2 - volmgrx.sys - Large packets +VmP3 - volmgrx.sys - Huge packets +VmPa - volmgrx.sys - Packs +VmPd - volmgrx.sys - Physical disks +VmPs - volmgrx.sys - Arrays of packets +VmRb - volmgrx.sys - Raw record buffers +VmRc - volmgrx.sys - Raw configurations +VmRe - volmgrx.sys - Records +VmRi - volmgrx.sys - Record information +VmRm - volmgrx.sys - RAID-5 emergency mappings +VmRr - volmgrx.sys - Raw records +VmTa - volmgrx.sys - I/O tasks +VmTc - volmgrx.sys - Table of contents +VmTe - volmgrx.sys - Table of contents entries +VmTx - volmgrx.sys - Transactions +VmUe - volmgrx.sys - User entries +VmVd - volmgrx.sys - Volume devices +VmWi - volmgrx.sys - Work items + +VmbK - kmcl.lib - Virtual Machine Bus Kernel Mode Client Library + +VmCh - ChimneyLib.lib - Virtual Machine Network Chimney Library + +VmFP - vfpext.sys - Virtual Filtering Platform driver + +VMhd - vmbushid.sys - Virtual Machine Input VSC Driver +VMIN - vwifimp.sys - Virtual Wi-Fi miniport + +Vmsc - storchannel.lib - Virtual Machine Storage VSC Channel Library + +VNC - netvsc50.sys/netvsc60.sys - Virtual Machine Network VSC Driver +VNCm - netvsc50.sys/netvsc60.sys - Virtual Machine Network VSC Driver (RNDIS miniport driver library, message or object) +VNCn - netvsc50.sys/netvsc60.sys - Virtual Machine Network VSC Driver (NBL) +VNCr - netvsc50.sys/netvsc60.sys - Virtual Machine Network VSC Driver (RNDIS message context signature) +VNCW - netvsc50.sys/netvsc60.sys - Virtual Machine Network VSC Driver (WDF) + +VoS? - volsnap.sys - VolSnap (Volume Snapshot Driver) +VoSa - volsnap.sys - Application information allocations +VoSb - volsnap.sys - Buffer allocations +VoSc - volsnap.sys - Snapshot context allocations +VoSd - volsnap.sys - Diff area volume allocations +VoSf - volsnap.sys - Diff area file allocations +VoSh - volsnap.sys - Bit history allocations +VoSi - volsnap.sys - Io status block allocations +VoSm - volsnap.sys - Bitmap allocations +VoSo - volsnap.sys - Old heap entry allocations +VoSp - volsnap.sys - Pnp id allocations +VoSr - volsnap.sys - Device relations allocations +VoSs - volsnap.sys - Short term allocations +VoSt - volsnap.sys - Temp table allocations +VoSw - volsnap.sys - Work queue allocations +VoSx - volsnap.sys - Dispatch context allocations + +Vpb - - Io, vpb's + +VPrs - passthruparser.sys - Virtual Machine Storage Passthrough Parser Driver + +Vprt - videoprt.sys - Video port for legacy (pre-Vista) display drivers + +VraP - - parallel class driver +Vtfd - - Font file/context + +Vrdc - netvsc60.sys - Virtual Machine Network VSC Driver (NDIS 6, RNDIS miniport driver library, chimney neighbor or path context) +Vrdt - netvsc60.sys - Virtual Machine Network VSC Driver (NDIS 6, RNDIS miniport driver library, chimney TCP context) +Vrdi - netvsc60.sys - Virtual Machine Network VSC Driver (NDIS 6, RNDIS miniport driver library, chimney initiate offload) + +VSAB - utils.lib - Virtual Machine Storage VSP Utility Library + +VsAT - vmswitch.sys - Virtual Machine Network Switch Driver (address table) +VsC4 - vmswitch.sys - Virtual Machine Network Switch Driver (chimney path4 context) +VsC6 - vmswitch.sys - Virtual Machine Network Switch Driver (chimney path6 context) +VsCH - vmswitch.sys - Virtual Machine Network Switch Driver (chimney handle) +VsCN - vmswitch.sys - Virtual Machine Network Switch Driver (chimney neighbor context) +VsCP - vmswitch.sys - Virtual Machine Network Switch Driver (chimney NBL context) +VsCs - vmswitch.sys - Virtual Machine Network Switch Driver (configuration store) +VsCT - vmswitch.sys - Virtual Machine Network Switch Driver (chimney TCP context) +VsDI - vmswitch.sys - Virtual Machine Network Switch Driver (direct I/O NIC) +VsNb - vmswitch.sys - Virtual Machine Network Switch Driver (NBL) +VsOb - vmswitch.sys - Virtual Machine Network Switch Driver (object allocation) +VsRD - vmswitch.sys - Virtual Machine Network Switch Driver (RNDIS device) +VsRm - vmswitch.sys - Virtual Machine Network Switch Driver (routing) +VsRT - vmswitch.sys - Virtual Machine Network Switch Driver (routing table) +VssB - vmswitch.sys - Virtual Machine Network Switch Driver (balance) +VssM - vmswitch.sys - Virtual Machine Network Switch Driver (miniport NIC) +VssP - vmswitch.sys - Virtual Machine Network Switch Driver (protocol NIC) +VsSw - vmswitch.sys - Virtual Machine Network Switch Driver +VsSW - vmswitch.sys - Virtual Machine Network Switch Driver (WDF) +VsVN - vmswitch.sys - Virtual Machine Network Switch Driver (VM NIC) +Vsvq - vmswitch.sys - Virtual Machine Network Switch Driver (VMQ) + +VSt - storvsp.sys - Virtual Machine Storage VSP Driver +VSta - storvsp.sys - Virtual Machine Storage VSP Driver (adapter) +VStb - storvsp.sys - Virtual Machine Storage VSP Driver (balance) +VStd - storvsp.sys - Virtual Machine Storage VSP Driver (device) +VStp - storvsp.sys - Virtual Machine Storage VSP Driver (parser) +VStu - storvsp.sys - Virtual Machine Storage VSP Driver (authentication) +VStW - storvsp.sys - Virtual Machine Storage VSP Driver (WDF) + +VSVL - VMBusVideoM.sys - Virtual Machine Synthetic Video Display Driver + +vS3W - vms3cap.sys - Virtual Machine Emulated S3 Device Cap Driver (WDF) + +vTDR - dxgkrnl.sys - Video timeout detection/recovery + +VubH - vmusbbus.sys - Virtual Machine USB Bus Driver +VubW - vmusbbus.sys - Virtual Machine USB Bus Driver (WDF) + +VuCH - vuc.sys - Virtual Machine USB Connector Driver (connector handle) +VuCP - vuc.sys - Virtual Machine USB Connector Driver (virtual hub ports) +VuCU - vuc.sys - Virtual Machine USB Connector Driver (connector URB) +VuCW - vuc.sys - Virtual Machine USB Connector Driver (WDF) + +VusW - vmusbstub.sys - Virtual Machine USB Stub Driver (WDF) + +VVpc - vhdparser.sys - Virtual Machine Storage VHD Parser Driver (context) +VVpp - vhdparser.sys - Virtual Machine Storage VHD Parser Driver (parser) + +VWFB - vwifibus.sys - Virtual Wi-Fi Bus Driver +VWFF - vwififlt.sys - Virtual Wi-Fi Filter Driver (object allocation) +VWnd - vwififlt.sys - Virtual Wi-Fi Filter Driver (requests) + +Wait - nt!io - WaitCompletion Packets + +Wan? - - NdisWan Tags (PPP Framing module for Remote Access) +WanA - - BundleCB +WanB - - ProtocolCB/LinkCB +WanC - - DataDesc +WanD - - WanRequest +WanE - - LoopbackDesc +WanG - - MiniportCB +WanH - - OpenCB +WanI - - IoPacket +WanJ - - LineUpInfo +WanK - - Unicode String Buffer +WanL - - Protocol Table +WanM - - Connection Table +WanN - - NdisPacketPool Desc +WanQ - - DataBuffer +WanR - - WanPacket +WanS - - AfCB/SapCB/VcCB +WanT - - Transform Driver +WanV - - RC4 Encryption Context +WanW - - SHA Encryption +WanX - - Send Compression Context +WanY - - Recv Compression Context +WanZ - - Protocol Specific Info + +Wdm - - WDM +WDMA - - WDM Audio + +Wdog - watchdog.sys - Watchdog object/context allocation + +Wfp? - netio.sys - Windows Filtering Platform Tags +WfpF - netio.sys - WFP filters +WfpM - netio.sys - WFP filter match buffers +WfpI - netio.sys - WFP index +WfpH - netio.sys - WFP hash +WfpR - netio.sys - WFP RPC +WfpC - netio.sys - WFP callouts +WfpS - netio.sys - WFP startup +WfpL - netio.sys - WFP fast cache +WfpE - netio.sys - WFP extension +Wfpn - netio.sys - WFP NBL info container + +WfTi - - WFP timer +WfSt - - WFP string + +werk - - WER kernel mode reporting allocation +WKSM - werkernel.sys - WER kernel mode reporting allocation of WERSVC message + +WimF - wimfsf.sys - WIM Boot Filter + +Wl2l - wfplwfs.sys - WFP L2 LWF context +Wl2g - wfplwfs.sys - WFP L2 generic block +Wl2c - wfplwfs.sys - WFP L2 classify cache +Wl2f - wfplwfs.sys - WFP L2 flow +Wl2n - wfplwfs.sys - WFP L2 NBL context + +WlBs - writelog.sys - Writelog block store +WlFc - writelog.sys - Writelog fsd context +WlGc - writelog.sys - Writelog global context +WlIb - writelog.sys - Writelog I/O buffer +WlLb - writelog.sys - Writelog library buffer +WlCb - writelog.sys - Writelog checkpoint buffer +WlPw - writelog.sys - Writelog planned write +WlMh - writelog.sys - Writelog marker header +WlMp - writelog.sys - Writelog marker payload +WlDt - writelog.sys - Writelog drain target + +Wmii - - Wmi InstId chunks +Wmij - - Wmi GuidMaps +Wmim - - Wmi KM to UM Notification Buffers +Wmin - - Wmi Notification Slot Chunks +Wmip - - Wmi General purpose allocation +Wmiq - - Wmi NBQ Blocks +Wmis - - Wmi SysId allocations +Wmit - - Wmi Trace +Wmiw - - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL +Wmiz - - Wmi MCA Insertions debug code + +WmiA - - Wmi ACPI mapper +WmiC - - Wmi Create Pump Thread Work Item +WmiD - - Wmi Registration DataSouce +WmiG - - Allocation of WMIGUID +WmiI - - Wmi Instance Names +WmiL - - WmiLIb +WmiN - - Wmi Notification Notification Packet +WmiR - - Wmi Registration info blocks + +WmDS - - Wmi DataSource chunks +WmGE - - Wmi GuidEntry chunks +WmIS - - Wmi InstanceSet chunks +WmMR - - Wmi MofResouce chunks + +WMca - - WMI MCA Handling + +Wnf - nt!wnf - Windows Notification Facility + +WofD - wof.sys - Wof directory buffer +WofF - wof.sys - Wof file context +Woff - wof.sys - Wof extended file context +WofG - wof.sys - Wof general allocation +WofH - wof.sys - Wof handle context +WofI - wof.sys - Wof inflate buffer +WofS - wof.sys - Wof stream context +Woft - wof.sys - Wof transaction context +WofV - wof.sys - Wof volume context + +wpcf - wof.sys - Wim config file +wpci - wof.sys - Wim integrity +wpct - wof.sys - Wim chunk table +wpcx - wof.sys - Wim IO context +wpdw - wof.sys - Wim decompression workspace +wpgn - wof.sys - Wim general +wppm - wof.sys - Wim IO parameters +wprd - wof.sys - Wim small read buffer +wpRD - wof.sys - Wim large read buffer +wprt - wof.sys - Wim resource table +wpvo - wof.sys - Wim volume overlay +wpwf - wof.sys - Wim file +wpwi - wof.sys - Wim work item +wpxp - wof.sys - Wim xpress context + +Wrp? - - WanArp Tags (ARP module for Remote Access) + +Wrpa - - WAN_ADAPTER_TAG +Wrpi - - WAN_INTERFACE_TAG +Wrpr - - WAN_REQUEST_TAG +Wrps - - WAN_STRING_TAG +Wrpc - - WAN_CONN_TAG +Wrpw - - WAN_PACKET_TAG +Wrpf - - FREE_TAG (checked builds only) +Wrpd - - WAN_DATA_TAG +Wrph - - WAN_HEADER_TAG +Wrpn - - WAN_NOTIFICATION_TAG + +WSCD - WFPSamplerCalloutDriver.sys - WFPSampler Callout Driver + +WSKs - afd.sys - WSK socket + +WSNP - WFPSamplerCalloutDriver.sys - WFPSampler Callout Driver NDIS Pool + +WvCy - - WDM Audio WaveCyc port +WvPc - - WDM Audio WavePCI port + +xCVD - mrxdav.sys - AsyncEngineContext Tag + +XDR? - rpcxdr.sys - NFS (Network File System) XDR driver + +xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector + +XWan - - ndis\usrwan allocations + +Xtra - - EXIFS Extra Create + +ZsaB - - EXIFS ZeroBlock +Adbe - win32k.sys - GDITAG_ATM_FONT +Bmfd - win32k.sys - GDITAG_BMP_FONT +Dfsm - win32k.sys - GDITAG_ENG_EVENT +DwmL - win32k!HwndLookupAllocTableData - GDITAG_DWM_HWND_LOOKUP +DWMt - win32k.sys - GDITAG_DWM_SENDTOUCHCONTACTS +DWMv - win32k.sys - GDITAG_DWM_VALIDATION +Dxdd - win32k!DxLddmSharedPrimaryLockNotification - GDITAG_LOCKED_PRIMARY +Gadb - win32k!XDCOBJ::bAddColorTransform - GDITAG_DC_COLOR_TRANSFORM +Gadd - win32k.sys - GDITAG_DC_FONT +Galp - win32k!AlphaScanLineBlend - GDITAG_ALPHABLEND +Gapc - win32kfull!UmfdQueueTryUnzombifyPffApc - GDITAG_UNZOMBIFY_APC +Gbaf - win32k.sys - GDITAG_BRUSH_FREELIST +Gbdl - win32k!BRUSH::bAddIcmDIB - GDITAG_ICM_DIB_LIST +Gcac - win32k.sys - GDITAG_FONTCACHE +Gcsl - win32k!InitializeScripts - GDITAG_SCRIPTS +Gcwc - win32k!ConvertToAndFromWideChar - GDITAG_CHAR_TO_WIDE_CHAR +Gdbr - win32k!BRUSHOBJ_pvAllocRbrush - GDITAG_RBRUSH +Gdcf - win32k.sys - GDITAG_DC_FREELIST +GDcs - win32k!GreDwmStartup - GDITAG_DWMSTATE +Gdev - win32k.sys - GDITAG_DEVMODE +GDev - win32k.sys - GDITAG_PDEV +Gdfm - win32k!DoFontManagement - GDITAG_HGLYPH_ARRAY +Gdrs - win32k.sys - GDITAG_DRVSUP +Gdrv - win32k!EngCreateClip - GDITAG_CLIPOBJ +Gdtd - win32k!GreAcquireSemaphoreAndValidate - GDITAG_SEMAPHORE_VALIDATE +Gdwd - win32k.sys - GDITAG_WATCHDOG +Gebr - win32k!EngRealizeBrush - GDITAG_ENGBRUSH +Gedd - win32k.sys - GDITAG_ENUM_DISPLAY_DEVICES +Gedg - win32k!bFill - GDITAG_EDGE +gEdg - win32k!bTriangleMesh - GDITAG_TRIANGLEDATA +Geto - win32k.sys - GDITAG_TEXTOUT +Gfda - win32k!UmfdAllocation::Create - GDITAG_UMFD_ALLOCATION +Gfdf - win32k!InitializeDefaultFamilyFonts - GDITAG_FONT_DEFAULT_FAMILY +Gffv - win32k.sys - GDITAG_FONTFILEVIEW +Gfid - win32k.sys - GDITAG_UNIVERSAL_FONT_ID +GFil - win32k.sys - GDITAG_FILEPATH +Gfil - win32k.sys - GDITAG_MAPFILE +GFld - win32k.sys - GDITAG_FLOODFILL +Gfnt - win32k!RFONTOBJ::bRealizeFont - GDITAG_RFONT +Gfsb - win32k.sys - GDITAG_FONT_SUB +Gfsf - win32k!bInitStockFontsInternal - GDITAG_FONT_STOCKFONT +Gfsm - win32k!GreCreateFastMutex - GDITAG_FAST_MUTEX +Gful - win32k.sys - GDITAG_FULLSCREEN +Gfvi - win32k!bUnloadAllButPermanentFonts - GDITAG_FONTVICTIM +Ggb - win32k!RFONTOBJ::pgbCheckGlyphCache - GDITAG_GLYPHBLOCK +Ggdv - win32k.sys - GDITAG_GDEVICE +Ggls - win32k.sys - GDITAG_GLYPHSET +Ggly - win32k.sys - GDITAG_HGLYPH +Gh?: - win32k.sys - GDITAG_HMGR_LFONT_TYPE +Gh?; - win32k.sys - GDITAG_HMGR_RFONT_TYPE +Gh?@ - win32k.sys - GDITAG_HMGR_BRUSH_TYPE +Gh?> - win32k.sys - GDITAG_HMGR_ICMCXF_TYPE +Gh?0 - win32k.sys - GDITAG_HMGR_DEF_TYPE +Gh?1 - win32k.sys - GDITAG_HMGR_DC_TYPE +Gh?4 - win32k.sys - GDITAG_HMGR_RGN_TYPE +Gh?5 - win32k.sys - GDITAG_HMGR_SURF_TYPE +Gh?6 - win32k.sys - GDITAG_HMGR_CLIENTOBJ_TYPE +Gh?7 - win32k.sys - GDITAG_HMGR_PATH_TYPE +Gh?8 - win32k.sys - GDITAG_HMGR_PAL_TYPE +Gh?9 - win32k.sys - GDITAG_HMGR_ICMLCS_TYPE +Gh?A - win32k.sys - GDITAG_HMGR_UMPD_TYPE +Gh?B - win32k.sys - GDITAG_HMGR_HLSURF_TYPE +Gh?E - win32k.sys - GDITAG_HMGR_META_TYPE +Gh?L - win32k.sys - GDITAG_HMGR_DRVOBJ_TYPE +Gh?? - win32k.sys - GDITAG_HMGR_SPRITE_TYPE +Gh00 - win32k.sys - GDITAG_HMGR_START +Ghab - win32k!FHOBJ::bAddPFELink - GDITAG_PFE_HASHBUCKET +Ghas - win32k!FHMEMOBJ::FHMEMOBJ - GDITAG_PFE_HASHTABLE +Ghml - win32k.sys - GDITAG_HMGR_LOCK +Ghtc - win32k!bSetHTSrcSurfInfo - GDITAG_HALFTONE_COLORTRIAD +Ghtm - win32k.sys - GDITAG_HMGR_TEMP +Gi2c - win32k.sys - GDITAG_DDCCI +Gicm - win32k.sys - GDITAG_ICM +Giga - win32k.sys - GDITAG_PRIVATEGAMMA +Giog - win32k.sys - GDITAG_COMPOSEDGAMMA +Gkbm - win32k.sys - GDITAG_KMODE_BITMAP +Gla: - win32k.sys - GDITAG_HMGR_LOOKASIDE_LFONT_TYPE +Gla; - win32k.sys - GDITAG_HMGR_LOOKASIDE_RFONT_TYPE +Gla@ - win32k.sys - GDITAG_HMGR_LOOKASIDE_BRUSH_TYPE +Gla0 - win32k.sys - GDITAG_HMGR_LOOKASIDE_START +Gla1 - win32k.sys - GDITAG_HMGR_LOOKASIDE_DC_TYPE +Gla4 - win32k.sys - GDITAG_HMGR_LOOKASIDE_RGN_TYPE +Gla5 - win32k.sys - GDITAG_HMGR_LOOKASIDE_SURF_TYPE +Gla8 - win32k.sys - GDITAG_HMGR_LOOKASIDE_PAL_TYPE +Gldv - win32k.sys - GDITAG_LDEV +Glid - win32k!GetLanguageID - GDITAG_LOCALEINFO +Glnk - win32k!FHOBJ::bAddPFELink - GDITAG_PFE_LINK +Gmap - win32k!InitializeFontSignatures - GDITAG_FONT_MAPPER +Gmso - win32k!MULTISORTBLTORDER::MULTISORTBLTORDER - GDITAG_DISPURF_SORT +Gmul - win32k!MULTIFONT::MULTIFONT - GDITAG_MULTIFONT +Gnls - win32k.sys - GDITAG_NLS +Gogl - win32k!iOpenGLExtEscape - GDITAG_OPENGL +GOPM - win32k.sys - GDITAG_OPM +GPal - win32k.sys - GDITAG_PALETTE +Gpan - win32k.sys - GDITAG_PANNING_PDEV +Gpat - win32k.sys - GDITAG_PATHOBJ +Gpfe - win32k!PFFMEMOBJ::bAllocPFEData - GDITAG_PFF_INDEXES +Gpff - win32k.sys - GDITAG_PFF +Gpft - win32k!pAllocateAndInitializePFT - GDITAG_PFT +Gpgb - win32k!EngPlgBlt - GDITAG_PLGBLT_DATA +Gpid - win32k!NtGdiSetPUMPDOBJ - GDITAG_PRINTCLIENTID +Gppo - win32k!XCLIPOBJ::ppoGetPath - GDITAG_CLIP_PATHOBJ +Gppt - win32k!PROXYPORT::PROXYPORT - GDITAG_PROXYPORT +Gpre - win32k!pSpCreatePresent - GDITAG_PRESENT +Gqnk - win32k!bComputeQuickLookup - GDITAG_LFONT_QUICKLOOKUP +Grgb - win32k.sys - GDITAG_PALETTE_RGB_XLATE +Grgn - win32k.sys - GDITAG_REGION +Gsem - win32k.sys - GDITAG_SEMAPHORE +Gsp - win32k!pSpCreateSprite - GDITAG_SPRITE +Gspm - win32k.sys - GDITAG_METASPRITE +Gspr - win32k.sys - GDITAG_SPRITESCAN +Gsta - win32k.sys - GDITAG_STACKTRACE +Gsth - win32k.sys - GDITAG_STRETCHBLT +Gsty - win32k!GreExtCreatePen - GDITAG_PENSTYLE +Gsux - win32k.sys - GDITAG_SFM +Gtmp - win32k.sys - GDITAG_TEMP +GTmp - win32k!AllocFreeTmpBuffer - GDITAG_TEMP_THREADLOCK +Gtmw - win32k!vIFIMetricsToTextMetricW - GDITAG_TEXTMETRICS +Gtvp - win32k!PFFOBJ::bAddPvtData - GDITAG_PFF_DATA +Gtvt - win32k!bTriangleMesh - GDITAG_TRIANGLE_MESH +Gtxt - win32k.sys - GDITAG_TEXT +Gubm - win32k.sys - GDITAG_UMODE_BITMAP +GUma - win32k!GDIEngUserMemAllocNodeAlloc - GDITAG_ENG_USER_MEM_ALLOC_TABLE +Gump - win32k.sys - GDITAG_UMPD +Gvds - win32k!MulEnablePDEV - GDITAG_HDEV +GVdv - win32k.sys - GDITAG_VDEV +GVms - win32k!MulSaveScreenBits - GDITAG_MULTISAVEBITS +GVsf - win32k!MulCreateDeviceBitmap - GDITAG_MDSURF +Gwnd - win32k.sys - GDITAG_WNDOBJ +Gxlt - win32k.sys - GDITAG_PXLATE +Gxpd - win32k!XUMPDOBJ::XUMPDOBJ - GDITAG_UMPDOBJ +knlf - win32k.sys - GDITAG_FONT_LINK +PASf - win32k.sys - GDITAG_PANNING_SURFACE +PSlo - win32k.sys - GDITAG_PANNING_SHADOWLOCK +Ssrl - win32k.sys - GDITAG_SINGLEREADERLOCK +TTFC - win32k.sys - GDITAG_TT_FONT_CACHE +Ttfd - win32k.sys - GDITAG_TT_FONT +Vtfd - win32k.sys - GDITAG_VF_FONT +W32l - win32k!W32PIDLOCK::vInit - GDITAG_W32PIDLOCK +SFMb - win32k!SfmTokenArray::EnsureTokenBufferSize - GDITAG_TOKENARRAY +Gnff - win32k.sys - GDITAG_NETWORKED_FONT_FILE_TABLE +Gtff - win32k.sys - GDITAG_TRUSTED_FONT_FILE_TABLE +Gala - win32k.sys - GDITAG_ADAPTER_LUID_ARRAY +FDpd - win32k.sys - GDITAG_UMFD_PDEV +FDev - win32k.sys - GDITAG_UMFD_EVENT +FDUm - win32k.sys - GDITAG_UMFD_UM_BUFFER +FDtl - win32k.sys - GDITAG_UMFD_TLS +FDrq - win32k.sys - GDITAG_UMFD_REQUEST +GFdk - win32k.sys - GDITAG_UMFD_KERNEL_ALLOCATION +UHFF - win32k.sys - GDITAG_UMFD_HFF +FDat - win32k.sys - GDITAG_UMFD_GLYPHATTRS +GMFF - win32k.sys - GDITAG_FONT_MAPPER_FAMILY_FALLBACK +GFIC - win32k.sys - GDITAG_FONT_INTENSITY_CORRECTION +Ghmc - win32k!GdiHandleManager::Create - GDITAG_HANDLE_MANAGER +Getc - win32k!GdiHandleEntryTable::_Create - GDITAG_HANDLE_ENTRY_TABLE +Gelt - win32k!EntryDataLookupTable::Create - GDITAG_ENTRY_DATA_LOOKUP_TABLE +Gelc - win32k!EntryDataLookupTable::Initialize - GDITAG_ENTRY_DATA_LOOKUP_TABLE_COLUMN +Ucal - win32k!DriverEntry - USERTAG_SERVICE_TABLE +Umam - win32k!UpdateDesktopThresholds - USERTAG_MONITOR_MARGIN +Uman - win32k!NtUserSetManipulationInputTarget - USERTAG_DWM_MANIPULATION +Urdr - win32k!SetRedirectionBitmap - USERTAG_REDIRECT +Usac - win32k!_CreateAcceleratorTable - USERTAG_ACCEL +Usai - win32k!zzzAttachThreadInput - USERTAG_ATTACHINFO +Usal - win32k!InitSwitchWndInfo - USERTAG_ALTTAB +Usbg - win32k!xxxLogClipData - USERTAG_DEBUG +Usbm - win32k!SetGestureConfigSettings - USERTAG_BITMASK +Usbr - win32k!NtUserShutdownBlockReasonCreate - USERTAG_BLOCKREASON +Usca - win32k!NtUserSetCalibrationData - USERTAG_CALIBRATIONDATA +Uscb - win32k!_ConvertMemHandle - USERTAG_CLIPBOARD +Uscc - win32k!AllocCallbackMessage - USERTAG_CALLBACK +Uscd - win32k!SetWindowCompositionInfo - USERTAG_COMPOSITIONPROP +UsCd - win32k!xxxUserChangeDisplaySettings - USERTAG_CDS +Usce - win32k!RetrieveLinkCollection - USERTAG_COLLINK +Usci - win32k!InitSystemThread - USERTAG_CLIENTTHREADINFO +UscI - win32k!CitStart - USERTAG_COMPAT_IMPACT +Uscl - win32k!ClassAlloc - USERTAG_CLASS +Uscm - win32k!InitScancodeMap - USERTAG_SCANCODEMAP +Uscp - win32k!CreateDIBPalette - USERTAG_CLIPBOARDPALETTE +Uscr - win32k!NtUserSetSysColors - USERTAG_COLORS +Usct - win32k!CkptRestore - USERTAG_CHECKPT +Uscu - win32k!_CreateEmptyCursorObject - USERTAG_CURSOR +Uscv - win32k!NtUserSetSysColors - USERTAG_COLORVALUES +Uscw - win32k!CacheAxisChildIndex - USERTAG_CONTACTRELATIVE +UsDI - win32k!CreateDeviceInfo - USERTAG_DEVICEINFO +UsDc - win32k!NtUserDisplayConfigSetDeviceInfo - USERTAG_DISPLAYCONFIG +UsDt - win32k!NtUserCtxDisplayIOCtl - USERTAG_DISPLAYIOCTL +Usd1 - win32k!FreeListAdd - USERTAG_DDE1 +Usd2 - win32k!_DdeSetQualityOfService - USERTAG_DDE2 +Usd4 - win32k!AddPublicObject - USERTAG_DDE4 +Usd5 - win32k!xxxCsEvent - USERTAG_DDE5 +Usd6 - win32k!xxxCsEvent - USERTAG_DDE6 +Usd7 - win32k!xxxCsEvent - USERTAG_DDE7 +Usd8 - win32k!xxxMessageEvent - USERTAG_DDE8 +Usd9 - win32k!xxxCsDdeInitialize - USERTAG_DDE9 +UsdA - win32k!NewConversation - USERTAG_DDEa +UsdB - win32k!Createpxs - USERTAG_DDEb +Usdc - win32k!CreateCacheDC - USERTAG_DCE +UsdD - win32k!NtUserfnDDEINIT - USERTAG_DDEd +UsdE - win32k!xxxClientCopyDDEIn1 - USERTAG_DDE +Usdi - win32k!CreateMonitor - USERTAG_DISPLAYINFO +Usdm - win32k!CreateDCompositionHwndTargetInfo - USERTAG_DCOMPHWNDTARGETINFO +Usdp - win32k!NtUserDelegateCapturePointers - USERTAG_DELEGATEPOINTERSTRUCT +Usds - win32k!xxxDragObject - USERTAG_DRAGDROP +Usdv - win32k!NtUserfnINDEVICECHANGE - USERTAG_DEVICECHANGE +Usdw - win32k!GetProductString - USERTAG_DEVICENAME +UsEC - win32k!AddWEFCOMPInvalidateSListEntry - USERTAG_WSEXCOMPINVALID +Used - win32k!AddOrUpdateListener - USERTAG_EDGY +User - win32k!InitCreateUserCrit - USERTAG_ERESOURCE +Usex - win32k!IsDeviceExcluded - USERTAG_EXCLUDEDLIST +Usfi - win32k!CreatePointerDeviceInfo - USERTAG_FEATUREIOCTL +Usft - win32k!CreateValidTouchInputInfo - USERTAG_FORWARDTOUCHMESSAGE +Usgc - win32k!_StoreGestureConfig - USERTAG_GESTURECONFIG +Usgd - win32k!SetGestureConfigSettings - USERTAG_GESTUREDATA +Usgh - win32k!NtUserUserHandleGrantAccess - USERTAG_GRANTEDHANDLES +Usgi - win32k!NtUserSendGestureInput - USERTAG_GESTUREINFO +Usgt - win32k!AddGhost - USERTAG_GHOST +Usha - win32k!AllocateHidData - USERTAG_HIDDATA +Ushc - win32k!AllocateHidConfigDesc - USERTAG_HIDCONFIG +UshD - Win32k!AllocateHidDesc - USERTAG_HIDDESC +Ushf - win32k!AllocateHidConfigDesc - USERTAG_HIDFEATURE +Ushh - win32k!HidGetCaps - USERTAG_HID +Ushi - win32k!AllocateHidDesc - USERTAG_HIDINPUT +Ushk - win32k!_RegisterHotKey - USERTAG_HOTKEY +Ushl - win32k!INLPHLPSTRUCT - USERTAG_HELP +Ushp - win32k!GetDeviceParent - USERTAG_HIDPARENT +UshP - win32k!HidCreateDeviceInfo - USERTAG_HIDPREPARSED +Ushr - win32k!AllocateAndLinkHidPageOnlyRequest - USERTAG_HIDPAGEREQUEST +UshR - win32k!AllocateHidProcessRequest - USERTAG_HIDPROCREQUEST +Usht - win32k!AllocateProcessHidTable - USERTAG_HIDTABLE +UshT - win32k!AllocateAndLinkHidTLCInfo - USERTAG_HIDTLC +Usih - win32k!SetImeHotKey - USERTAG_IMEHOTKEY +Usim - win32k!CreateInputContext - USERTAG_IME +Usip - win32k!CreateNode - USERTAG_INPUTPOINTERNODE +Usiq - win23k!CInputQueueProp - USERTAG_COMPOSITIONINPUTQUEUE +Usit - win32k!InjectTouchInput - USERTAG_INJECT_TOUCH +Usim - win32k!InjectMouseInput - USERTAG_INJECT_MOUSE +Usik - win32k!InjectKeyboardInput - USERTAG_INJECT_KEYBOARD +Usix - win32k!AllocInputTransformEntry - USERTAG_INPUT_TRANSFORM +Usjb - win32k!CreateW32Job - USERTAG_W32JOB +Usjx - win32k!JobCalloutAddProcess - USERTAG_W32JOBEXTRA +UsKe - win32k!CreateKernelEvent - USERTAG_KEVENT +UsKf - win32k!InitCreateUserCrit - USERTAG_FASTMUTEX +UsKm - win32k!DriverEntry - USERTAG_KMUTEX +UsKs - win32k!CreateKernelSemaphore - USERTAG_KSEMAPHORE +UsKt - win32k!RemoteConnect - USERTAG_KTIMER +UsKw - win32k!xxxDesktopThread - USERTAG_KWAITBLOCK +UsKv - win32k!ReadTabletButtonConfig - USERTAG_KEYVALUEINFORMATION +Uskb - win32k!xxxLoadKeyboardLayoutEx - USERTAG_KBDLAYOUT +Uskd - win32k!xxxCreateDesktopEx2 - USERTAG_KERNELDESKTOPINFO +Ukdp - win32k!Win32UserInitialize - USERTAG_KERNELDISPLAYINFO +Uske - win32k!GetKbdExId - USERTAG_KBDEXID +Uskf - win32k!LoadKeyboardLayoutFile - USERTAG_KBDFILE +Usks - win32k!PostUpdateKeyStateEvent - USERTAG_KBDSTATE +Uskt - win32k!ReadLayoutFile - USERTAG_KBDTABLE +Usla - win32k!InitLockRecordLookaside - USERTAG_LOOKASIDE +Usld - win32k!GrowLogIfNecessary - USERTAG_LOGDESKTOP +Uslr - win32k!InitLockRecordLookaside - USERTAG_LOCKRECORD +UsMP - win32k!GeneratePointerMessageFromMouse - USERTAG_MOUSEINPOINTER +usmd - win32k!xxxSetModernAppWindow - USERTAG_MODERNDESKTOPAPP +Usmg - win32k!Magxxx - USERTAG_MAGNIFICATION +Usmi - win32k!MirrorRegion - USERTAG_MIRROR +Usml - win32k!MsgLookupTableAlloc - USERTAG_MESSAGE_FILTER +Usmo - win32k!_EnableIAMAccess - USERTAG_MOSH +Usmp - win32k!AllocMousePromotionEntry - USERTAG_MOUSEPROMOTIONENTRY +Usmr - win32k!SnapshotMonitorRects - USERTAG_MONITORRECTS +Usms - win32k!xxxMoveSize - USERTAG_MOVESIZE +Usmt - win32k!xxxMNAllocMenuState - USERTAG_MENUSTATE +Usmx - win32k!InitializeMonitorDpiRectsAndTransforms - USERTAG_MATRIX +Usna - win32k!UserPostNKAPC - USERTAG_NKAPC +Usny - win32k!CreateNotify - USERTAG_NOTIFY +Uspa - win32k!AllocPointerMsgParamsList - USERTAG_POINTERMSGPARAMS +Uspb - win32k!fnPOWERBROADCAST - USERTAG_POWERBROADCAST +Uspd - win32k!PointerList::AddMsgData - USERTAG_POINTERINPUTMSGDATA +Uspc - win32k!CreatePointerDeviceInfo - USERTAG_POINTERDEVICE +UspC - win32k!AssignPointerCaptureData - USERTAG_POINTERCAPTUREDATA +Uspe - win32k!AllocPointerInfoNodeList - USERTAG_POINTERINPUTEVENT +Uspf - win32k!CommitHoldingFrame - USERTAG_POINTERINPUTFRAME +Uspg - win32k!GeneratePointerMessage - USERTAG_POINTERINPUTMSG +Uspi - win32k!MapDesktop - USERTAG_PROCESSINFO +Uspk - win32k!GetProductString - USERTAG_PRODUCTSTRING +Uspl - win32k!xxxPollAndWaitForSingleObject - USERTAG_POLLEVENT +UsPM - win32k!InitPostMortemLogging - USERTAG_POSTMORTEM_LOGGING +Uspm - win32k!MNAllocPopup - USERTAG_POPUPMENU +Uspn - win32k!CreateProfileUserName - USERTAG_PROFILEUSERNAME +Uspo - win32k!QueuePowerRequest - USERTAG_POWER +Uspp - win32k!AllocateAndLinkHidTLCInfo - USERTAG_PNP +Uspq - win32k!CreatePointerDeviceInfo - USERTAG_PARALLELPROP +UspQ - win32k!AllocPointerQFrameList - USERTAG_POINTERQFRAME +Uspr - win32k!GetPrivateProfileStruct - USERTAG_PROFILE +Usps - win32k!InitPlaySound - USERTAG_PLAYSOUND +Uspt - win32k!AllocThreadPointerData - USERTAG_POINTERTHREADDATA +Uspv - win32k!ContactVisualization - USERTAG_POINTERVISUALIZATION +Uspw - win32k!CDynamicArray::Add - USERTAG_DYNAMICARRAY +Uspx - win32k!GetCustomFlickPath - USERTAG_PTRCFG +USqm - win32k!_WinSqmAllocate - USERTAG_SQM +Usql - win32k!EnsureQMsgLog - USERTAG_QMSGLOG +Usqm - win32k!InitQEntryLookaside - USERTAG_QMSG +Usqq - win32k!InitQMiPTrace - USERTAG_QMIPTRACE +Usqu - win32k!InitQEntryLookaside - USERTAG_Q +Usrd - win32k!StoreRawDataBlock - USERTAG_POINTERRAWDATA +Usri - win32k!NtUserRegisterRawInputDevices - USERTAG_RAWINPUTDEVICE +Usrt - win32k!xxxDrawMenuItemText - USERTAG_RTL +Ussa - win32k!xxxBroadcastMessage - USERTAG_SMS_ASYNC +Ussb - win32k!CreateSpb - USERTAG_SPB +Ussc - win32k!xxxInterSendMsgEx - USERTAG_SMS_CAPTURE +Ussd - win32k!xxxAddShadow - USERTAG_SHADOW +Usse - win32k!SetDisconnectDesktopSecurity - USERTAG_SECURITY +Ussi - win32k!NtUserSendInput - USERTAG_SENDINPUT +Ussj - win32k!NtUserSendTouchInput - USERTAG_SENDTOUCHINPUT +Ussm - win32k!InitSMSLookaside - USERTAG_SMS +Usss - win32k!xxxBroadcastMessage - USERTAG_SMS_STRING +Usst - win32k!xxxSBTrackInit - USERTAG_SCROLLTRACK +Ussw - win32k!_BeginDeferWindowPos - USERTAG_SWP +Ussh - win32k!zzzSetWindowsHookEx - USERTAG_HOOK +Uscd - win32k!GetCPD - USERTAG_CPD +Ussw - win32k!xxxDesktopRecalc - USERTAG_ADR +Ussy - win32k!xxxDesktopThread - USERTAG_SYSTEM +UsTI - win32k!NtUserQueryInformationThread - USERTAG_THREADINFORMATION +Usta - win32k!AssociateShellFrameAppThreads - USERTAG_THREADASSOCIATION +Ustd - win32k!TrackAddDesktop - USERTAG_TRACKDESKTOP +Usti - win32k!AllocateW32Thread - USERTAG_THREADINFO +Ustn - win32k!AllocateW32Thread - USERTAG_THREADINFONP +Ustk - win32k!HeavyAllocPool - USERTAG_STACK +Ustm - win32k!InternalSetTimer - USERTAG_TIMER +Usto - win32k!xxxConnectService - USERTAG_TOKEN +Ustp - win32k!FindOrCreateHoldingFrameForDevice - USERTAG_TOUCHPADSTATE +Usts - win32k!_Win32CreateSection - USERTAG_SECTION +Ustx - win32k!NtUserDrawCaptionTemp - USERTAG_TEXT +Usty - win32k!NtUserResolveDesktopForWOW - USERTAG_TEXT2 +Ustz - win32k!AllocTouchInputInfo - USERTAG_TOUCHINPUTINFO +Usua - win32k!TabletButtonHandler - USERTAG_TABLETBUTTONUSAGE +Usub - win32k!NtUserToUnicodeEx - USERTAG_UNICODEBUFFER +Usus - win32k!MsgSQMGetMsgList - USERTAG_UIPI_SQM +Usvc - win32k!_GetPointerDeviceProperties - USERTAG_VALUECAP +Usvi - win32k!ResizeVisExcludeMemory - USERTAG_VISRGN +Usvl - win32k!VWPLAdd - USERTAG_VWPL +UsWE - win32k!ReportHungExplorerToWer - USERTAG_WER +UsWP - win32k!SetGlobalWallpaperSettings - USERTAG_WALLPAPER +Uswc - win32k!SetSwapChainProp - USERTAG_SWAPCHAIN +Uswd - win32k!xxxCreateWindowEx - USERTAG_WINDOW +Uswe - win32k!_SetWinEventHook - USERTAG_WINEVENT +Uswi - win32k!RemoteShadowStart - USERTAG_WIREDATA +Uswl - win32k!BuildHwndList - USERTAG_WINDOWLIST +Uswo - win32k!zzzInitTask - USERTAG_WOWTDB +Uswp - win32k!xxxRegisterUserHungAppHandlers - USERTAG_WOWPROCESSINFO +Uswr - win32k!CoreWindowProp - USERTAG_COREWINDOWPROP +Uswt - win32k!xxxUserNotifyProcessCreate - USERTAG_WOWTHREADINFO +Usrr - win32k!TouchTargetingRankForRegion - USERTAG_RANKFORRGN +Uslt - win32k!InitializeWin32PoolTracking - USERTAG_LEAKEDTAG +UsI0 - win32k!NSInstrumentation::CBackTraceStorageUnit::Create - USERTAG_BACKTRACE_STORAGE_UNIT +UsI1 - win32k!NSInstrumentation::CBackTraceBucket::Create - USERTAG_BACKTRACE_BUCKET +UsI2 - win32k!NSInstrumentation::CBackTraceBucket::CreateContext - USERTAG_BACKTRACE_BUCKET_CONTEXT +UsI3 - win32k!NSInstrumentation::CBackTraceStoreEx::Create - USERTAG_BACKTRACE_STORE +UsI4 - win32k!NSInstrumentation::CBloomFilter::Create - USERTAG_BLOOMFILTER +UsI5 - win32k!NSInstrumentation::CPlatformSignal::Create - USERTAG_INSTRUMENTATION_EVENT +UsI6 - win32k!NSInstrumentation::CLeakTrackingAllocator::Create - USERTAG_LEAK_TRACKING_ALLOCATOR +UsI7 - win32k!NSInstrumentation::CPrioritizedWriterLock::Create - USERTAG_PRIORITIZED_WRITER_LOCK +UsI8 - win32k!NSInstrumentation::CPointerHashTable::Create - USERTAG_POINTER_HASH_TABLE +UsI9 - win32k!NSInstrumentation::CReferenceTracker::Create - USERTAG_REFERENCE_TRACKER +UsIa - win32k!NSInstrumentation::CReferenceTracker::CReferenceCountedType::Create - USERTAG_REFERENCE_COUNTED_TYPE_HANDLE +UsIb - win32k!NSInstrumentation::CReferenceTracker::CReferenceCountedType::BeginTrack - USERTAG_REFERENCE_COUNTED_OBJECT_HANDLE +UsIc - win32k!NSInstrumentation::CSortedVector::Create - USERTAG_SORTED_VECTOR +UsId - win32k!NSInstrumentation::CSharedStorage::InitializeCommon - USERTAG_SHARED_STORAGE +Udpi - win32k!CreateSystemFontsForDpi - USERTAG_DPIMETRICS +Ubwd - win32kbase!NtMITMinuserWindowCreated - USERTAG_BASE_WINDOW +Ubwp - win32kmin!CreateProp - USERTAG_BASE_WINDOW_PROPLIST +Ubws - win32kmin!xxxMinSendPointerMessageWorker - USERTAG_BASE_WINDOW_SENTLIST +Ubii - win32kbase!NtMITBindInputTypeToMonitors - USERTAG_BASE_INPUT_ISOLATION +Urtm - win32kfull!InitRotationManager - USERTAG_ROTMGR +Usws - win32kfull!xxxCreateWindowEx - USERTAG_WND_SERVER_EXTRA_BYTES +DCab - win32kbase!DirectComposition::CAnimationBinding::_allocate - DCOMPOSITIONTAG_ANIMATIONBINDING +DCac - win32kbase!DirectComposition::CApplicationChannel::_allocate - DCOMPOSITIONTAG_APPLICATIONCHANNEL +DCae - win32kbase!DirectComposition::CAnimationMarshaler::SetBufferProperty - DCOMPOSITIONTAG_ANIMATIONTIMEEVENTDATA +DCag - win32kbase!DirectComposition::CAnimationMarshaler::SetBufferProperty - DCOMPOSITIONTAG_ANIMATIONSCENARIOGUID +DCal - win32kbase!DirectComposition::CAnimationTimeList::_allocate - DCOMPOSITIONTAG_ANIMATIONTIMELIST +DCam - win32kbase!DirectComposition::CCompositionAmbientLight::_allocate - DCOMPOSITIONTAG_AMBIENTLIGHTMARSHALER +DCan - win32kbase!DirectComposition::CAnimationMarshaler::_allocate - DCOMPOSITIONTAG_ANIMATIONMARSHALER +DCat - win32kbase!DirectComposition::CAnimationTriggerMarshaler::_allocate - DCOMPOSITIONTAG_ANIMATIONTRIGGERMARSHALER +DCau - win32kbase!DirectComposition::CSharedReadAnimationTriggerMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADANIMATIONTRIGGERMARSHALER +DCav - win32kbase!DirectComposition::CSharedWriteAnimationTriggerMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEANIMATIONTRIGGERMARSHALER +DCax - win32kbase!DirectComposition::CAnalogExclusiveViewMarshaler::_allocate - DCOMPOSITIONTAG_ANALOGEXCLUSIVEVIEWMARSHALER +DCay - win32kbase!DirectComposition::CAnalogTextureTargetMarshaler::_allocate - DCOMPOSITIONTAG_ANALOGTEXTURETARGETMARSHALER +DCaz - win32kbase!DirectComposition::CAnalogCompositorMarshaler::_allocate - DCOMPOSITIONTAG_ANALOGCOMPOSITORMARSHALER +DCba - win32kbase!DirectComposition::CBatch::_allocate - DCOMPOSITIONTAG_BATCH +DCbc - win32kbase!DirectComposition::CChannel::_allocate - DCOMPOSITIONTAG_CHANNEL +DCbf - win32kbase!DirectComposition::Memory::Allocate - DCOMPOSITIONTAG_BUFFER +DCbl - win32kbase!DirectComposition::CBackChannelMarshaler::_allocate - DCOMPOSITIONTAG_BACKCHANNELMARSHALER +DCbr - win32kbase!DirectComposition::CBatch::CSystemResourceReference::_allocate - DCOMPOSITIONTAG_BATCH_RESOURCEREF +DCbs - win32kbase!DirectComposition::CBatchSharedMemoryPool::_allocate - DCOMPOSITIONTAG_BATCH_SHARED_MEMORY_POOL +DCc2 - win32kbase!DirectComposition::CComponentTransform2DMarshaler::_allocate - DCOMPOSITIONTAG_COMPONENTTRANSFORM2DMARSHALER +DCca - win32kbase!DirectComposition::CConditionalExpressionMarshaler::_allocate - DCOMPOSITIONTAG_CONDITIONALEXPRESSIONMARSHALER +DCcb - win32kbase!DirectComposition::CCompositionSurfaceBitmapMarshaler::_allocate - DCOMPOSITIONTAG_HCOMPBITMAPMARSHALER +DCcc - win32kbase!DirectComposition::CConnection::_allocate - DCOMPOSITIONTAG_CONNECTION +DCcd - win32kbase!DirectComposition::CCompositionCapabilitiesMarshaler::_allocate - DCOMPOSITIONTAG_COMPOSITIONCAPABILITIES +DCce - win32kbase!DirectComposition::CCompositionFrame::TokenTableEntry::Allocate - DCOMPOSITIONTAG_COMPOSITIONFRAMETOKENTABLEENTRY +DCcf - win32kbase!DirectComposition::CCompositionFrame::Create - DCOMPOSITIONTAG_COMPOSITIONFRAME +DCcg - win32kbase!DirectComposition::CClipGroupMarshaler::_allocate - DCOMPOSITIONTAG_CLIPGROUPMARSHALER +DCch - win32kbase!DirectComposition::CChannelHandleTable::_allocate - DCOMPOSITIONTAG_CHANNELHANDLETABLE +DCcl - win32kbase!DirectComposition::CCompositionLight::_allocate - DCOMPOSITIONTAG_LIGHTMARSHALER +DCco - win32kbase!DirectComposition::CComponentTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_COMPONENTTRANSFORM3DMARSHALER +DCcp - win32kbase!DirectComposition::CPushLockCriticalSection::_allocate - DCOMPOSITIONTAG_PUSHLOCKCRITICALSECTION +DCcs - win32kbase!DirectComposition::CCriticalSection::_allocate - DCOMPOSITIONTAG_CRITICALSECTION +DCct - win32kbase!DirectComposition::CApplicationChannel::AllocateTableEntry - DCOMPOSITIONTAG_CHANNELTABLE +DCcv - win32kbase!DirectComposition::CrossChannelVisualData::_allocate - DCOMPOSITIONTAG_CROSSCHANNELVISUALDATA +DCda - win32kbase!DirectComposition::CDCompDynamicArray::_allocate - DCOMPOSITIONTAG_DYNAMICARRAY +DCdb - win32kbase!DirectComposition::CDCompDynamicArrayBase::_allocate - DCOMPOSITIONTAG_DYNAMICARRAYBASE +DCdc - win32kbase!DirectComposition::CDwmChannel::_allocate - DCOMPOSITIONTAG_DWMCHANNEL +DCde - win32kbase!DirectComposition::CDesktopTargetMarshaler::_allocate - DCOMPOSITIONTAG_DESKTOPTARGETMARSHALER +DCdf - win32kbase!DirectComposition::CSharedReadDesktopTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADDESKTOPTARGETMARSHALER +DCdg - win32kbase!DirectComposition::CSharedWriteDesktopTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEDESKTOPTARGETMARSHALER +DCdh - win32kbase!DirectComposition::CDesktopTargetMarshaler::_allocate - DCOMPOSITIONTAG_DESKTOPTARGETMARSHALERMONITORS +DCdi - win32kbase!DirectComposition::CSharedReadDcompTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADDCOMPTARGETMARSHALER +DCdj - win32kbase!DirectComposition::CSharedWriteDcompTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEDCOMPTARGETMARSHALER +DCdk - win32kbase!DirectComposition::CDcompTargetGroupMarshaler::_allocate - DCOMPOSITIONTAG_DCOMPTARGETGROUPMARSHALER +DCdl - win32kbase!DirectComposition::CCompositionDistantLight::_allocate - DCOMPOSITIONTAG_DISTANTLIGHTMARSHALER +DCdm - win32kbase!DirectComposition::CRemotingRenderTargetMarshaler::_allocate - DCOMPOSITIONTAG_REMOTINGRENDERTARGETMARSHALER +DCdn - win32kbase!DirectComposition::CBaseExpressionMarshaler::SetBufferProperty - DCOMPOSITIONTAG_DEBUGINFO +DCdn - win32kbase!DirectComposition::CSharedReadRemotingRenderTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADREMOTINGRENDERTARGETMARSHALER +DCdo - win32kbase!DirectComposition::CSharedWriteRemotingRenderTargetMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEREMOTINGRENDERTARGETMARSHALER +DCds - win32kbase!DirectComposition::CDropShadowMarshaler::_allocate - DCOMPOSITIONTAG_DROPSHADOWMARSHALER +DCef - win32kbase!DirectComposition::CCompiledEffect::_allocate - DCOMPOSITIONTAG_COMPILEDEFFECTMARSHALER +DCeg - win32kbase!DirectComposition::CEffectGroupMarshaler::_allocate - DCOMPOSITIONTAG_EFFECTGROUPMARSHALER +DCem - win32kbase!DirectComposition::CBaseExpressionMarshaler::SetBufferProperty - DCOMPOSITIONTAG_EXPRESSIONTARGETMASK +DCep - win32kbase!DirectComposition::CCompiledEffectPropertyBag::_allocate - DCOMPOSITIONTAG_COMPILEDEFFECTPROPERTYBAGMARSHALER +DCet - win32kbase!DirectComposition::CCompiledEffectTemplate::_allocate - DCOMPOSITIONTAG_COMPILEDEFFECTTEMPLATEMARSHALER +DCev - win32kbase!DirectComposition::CEvent::_allocate - DCOMPOSITIONTAG_EVENT +DCex - win32kbase!DirectComposition::CExpressionMarshaler::_allocate - DCOMPOSITIONTAG_EXPRESSIONMARSHALER +DCfb - win32kbase!DirectComposition::CTableTransferEffectMarshaler::SetBufferProperty - DCOMPOSITIONTAG_FILTEREFFECTBUFFER +DCfe - win32kbase!DirectComposition::CFilterEffectMarshaler::_allocate - DCOMPOSITIONTAG_FILTEREFFECTMARSHALER +DCff - win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_FILTERINPUTFLAGS +DCfi - win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_FILTERINPUTS +DCfj - win32kbase!DirectComposition::CFilterEffectMarshaler::Initialize - DCOMPOSITIONTAG_SUBRECTINPUTFLAGS +DCg3 - win32kbase!DirectComposition::CTransform3DGroupMarshaler::_allocate - DCOMPOSITIONTAG_TRANSFORM3DGROUPMARSHALER +DCgb - win32kbase!DirectComposition::CGdiBitmapMarshaler::_allocate - DCOMPOSITIONTAG_GDIBITMAPMARSHALER +DCge - win32kbase!DirectComposition::CGaussianBlurEffectMarshaler::_allocate - DCOMPOSITIONTAG_GAUSSIANBLUREFFECTMARSHALER +DCgi - win32kbase!DirectComposition::CGenericInkMarshaler::_allocate - DCOMPOSITIONTAG_GENERICINKMARSHALER +DChb - win32kbase!DirectComposition::CHwndBitmapMarshaler::_allocate - DCOMPOSITIONTAG_HWNDBITMAPMARSHALER +DChd - win32kbase!DirectComposition::CHolographicDisplayMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICDISPLAYMARSHALER +DChe - win32kbase!DirectComposition::CHolographicExclusiveViewMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICEXCLUSIVEVIEWMARSHALER +DChi - win32kbase!DirectComposition::CHolographicInteropTextureMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICINTEROPTEXTUREMARSHALER +DChm - win32kbase!DirectComposition::CHolographicExclusiveModeMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICEXCLUSIVEMODEMARSHALER +DChp - win32kbase!DirectComposition::CHoverPointerSourceMarshaler::_allocate - DCOMPOSITIONTAG_HOVERPOINTERSOURCEMARSHALER +DChr - win32kbase!DirectComposition::CSharedReadHolographicInteropTextureMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADHOLOGRAPHICINTEROPTEXTUREMARSHALER +DChs - win32kbase!DirectComposition::CSharedHolographicInteropTextureMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDHOLOGRAPHICINTEROPTEXTUREMARSHALER +DCht - win32kbase!DirectComposition::CHwndTargetMarshaler::_allocate - DCOMPOSITIONTAG_HWNDTARGETMARSHALER +DChv - win32kbase!DirectComposition::CHostVisualMarshaler::_allocate - DCOMPOSITIONTAG_HOSTVISUALMARSHALER +DChw - win32kbase!DirectComposition::CHolographicViewerContentMarshaler::_allocate - DCOMPOSITIONTAG_HOLOGRAPHICVIEWERCONTENTMARSHALER +DCia - win32kbase!DirectComposition::CInjectionAnimationMarshaler::_allocate - DCOMPOSITIONTAG_INJECTIONANIMATIONMARSHALER +DCic - win32kbase!DirectComposition::CInteractionConfigurationGroup::_allocate - DCOMPOSITIONTAG_INTERACTIONCONFIGURATIONGROUP +DCik - win32kbase!DirectComposition::CInkMarshaler::_allocate - DCOMPOSITIONTAG_INKMARSHALER +DCio - win32kbase!DirectComposition::CInteractionMarshaler::_allocate - DCOMPOSITIONTAG_INTERACTIONMARSHALER +DCir - win32kbase!DirectComposition::CInteractionTrackerMarshaler::_allocate - DCOMPOSITIONTAG_INTERACTIONTRACKERMARSHALER +DCit - win32kbase!DirectComposition::CInteractionMarshaler::EnsureTouchConfigurationList - DCOMPOSITIONTAG_INTERACTIONTOUCHCONFIGURATION +DCjb - win32kbase!DirectComposition::CBackdropBrushMarshaler::_allocate - DCOMPOSITIONTAG_BACKDROPBRUSHMARSHALER +DCjc - win32kbase!DirectComposition::CColorBrushMarshaler::_allocate - DCOMPOSITIONTAG_COLORBRUSHMARSHALER +DCje - win32kbase!DirectComposition::CEffectBrushMarshaler::_allocate - DCOMPOSITIONTAG_EFFECTBRUSHMARSHALER +DCjl - win32kbase!DirectComposition::CLinearGradientBrushMarshaler::_allocate - DCOMPOSITIONTAG_LINEARGRADIENTBRUSHMARSHALER +DCjm - win32kbase!DirectComposition::CMaskBrushMarshaler::_allocate - DCOMPOSITIONTAG_MASKBRUSHMARSHALER +DCjn - win32kbase!DirectComposition::CNineGridBrushMarshaler::_allocate - DCOMPOSITIONTAG_NINEGRIDBRUSHMARSHALER +DCjs - win32kbase!DirectComposition::CSurfaceBrushMarshaler::_allocate - DCOMPOSITIONTAG_SURFACEBRUSHMARSHALER +DCjw - win32kbase!DirectComposition::CWindowBackdropBrushMarshaler::_allocate - DCOMPOSITIONTAG_WINDOWBACKDROPBRUSHMARSHALER +DCkf - win32kbase!DirectComposition::CKeyframeAnimationMarshaler::_allocate - DCOMPOSITIONTAG_KEYFRAMEANIMATIONMARSHALER +DCkt - win32kbase!DirectComposition::CSkewTransformMarshaler::_allocate - DCOMPOSITIONTAG_SKEWTRANSFORMMARSHALER +DClc - win32kbase!DirectComposition::CVisualMarshaler::_allocate - DCOMPOSITIONTAG_LAYOUTCONSTRAINTINFO +DCls - win32kbase!DirectComposition::CVisualSurfaceMarshaler::_allocate - DCOMPOSITIONTAG_VISUALSURFACEMARSHALER +DClt - win32kbase!DirectComposition::CLinearObjectTableBase::_allocate - DCOMPOSITIONTAG_LINEAROBJECTTABLEDATA +DClv - win32kbase!DirectComposition::CLayerVisualMarshaler::_allocate - DCOMPOSITIONTAG_LAYERVISUALMARSHALER +DCm3 - win32kbase!DirectComposition::CMatrixTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_MATRIXTRANSFORM3DMARSHALER +DCm4 - win32kbase!DirectComposition::CSharedMatrixTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDMATRIXTRANSFORM3DMARSHALER +DCma - win32kbase!DirectComposition::CManipulationTransformMarshaler::_allocate - DCOMPOSITIONTAG_MANIPULATIONTRANSFORMMARSHALER +DCmb - win32kbase!DirectComposition::CSharedManipulationTransformMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDMANIPULATIONTRANSFORMMARSHALER +DCmh - win32kbase!DirectComposition::CMessageHandleInfo::_allocate - DCOMPOSITIONTAG_MESSAGEHANDLEINFO +DCmi - win32kbase!DirectComposition::CManipulationMarshaler::_allocate - DCOMPOSITIONTAG_MANIPULATIONMARSHALER +DCmt - win32kbase!DirectComposition::CMatrixTransformMarshaler::_allocate - DCOMPOSITIONTAG_MATRIXTRANSFORMMARSHALER +DCmu - win32kbase!DirectComposition::CSharedReadTransformMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADTRANSFORMMARSHALER +DCmv - win32kbase!DirectComposition::CSharedMatrixTransformMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDMATRIXTRANSFORMMARSHALER +DCnb - win32kbase!DirectComposition::CDeletedNotificationList::EnsureTagAllocation - DCOMPOSITIONTAG_DELETEDNOTIFICATIONLISTBUFFER +DCnl - win32kbase!DirectComposition::CDeletedNotificationList::_allocate - DCOMPOSITIONTAG_DELETEDNOTIFICATIONLIST +DCpb - win32kbase!DirectComposition::CPropertyBagMarshaler::_allocate - DCOMPOSITIONTAG_PROPERTYBAGMARSHALER +DCpc - win32kbase!DirectComposition::CPrimitveColorMarshaler::_allocate - DCOMPOSITIONTAG_PRIMITIVECOLORMARSHALER +DCpd - win32kbase!DirectComposition::CProcessData::_allocate - DCOMPOSITIONTAG_PROCESSDATA +DCpe - win32kbase!DirectComposition::CSharedReadPrimitiveColorMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADPRIMITIVECOLORMARSHALER +DCpf - win32kbase!DirectComposition::CSharedWritePrimitiveColorMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITEPRIMITIVECOLORMARSHALER +DCpg - win32kbase!DirectComposition::CPrimitiveGroupMarshaler::_allocate - DCOMPOSITIONTAG_PRIMITIVEGROUPMARSHALER +DCpk - win32kbase!DirectComposition::CPencilMarshaler::_allocate - DCOMPOSITIONTAG_PENCILMARSHALER +DCpo - win32kbase!DirectComposition::CCompositionPointLight::_allocate - DCOMPOSITIONTAG_POINTLIGHTMARSHALER +DCpr - win32kbase!DirectComposition::CPrimitiveMarshaler::_allocate - DCOMPOSITIONTAG_PRIMITIVEMARSHALER +DCpx - win32kbase!DirectComposition::CPropertyBagMarshaler::SetBufferProperty - DCOMPOSITIONTAG_PROPERTYBAGBUFFER +DCr3 - win32kbase!DirectComposition::CRotateTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_ROTATETRANSFORM3DMARSHALER +DCrc - win32kbase!DirectComposition::CRectangleClipMarshaler::_allocate - DCOMPOSITIONTAG_RECTANGLECLIPMARSHALER +DCro - win32kbase!DirectComposition::CRotateTransformMarshaler::_allocate - DCOMPOSITIONTAG_ROTATETRANSFORMMARSHALER +DCrt - win32kbase!DirectComposition::CResourceTable::_allocate - DCOMPOSITIONTAG_RESOURCETABLE +DCs3 - win32kbase!DirectComposition::CScaleTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_SCALETRANSFORM3DMARSHALER +DCsa - win32kbase!DirectComposition::CSnapshotMarshaler::_allocate - DCOMPOSITIONTAG_SNAPSHOTMARSHALER +DCsc - win32kbase!DirectComposition::CSystemChannel::_allocate - DCOMPOSITIONTAG_SYSTEMCHANNEL +DCsd - win32kbase!DirectComposition::CStructDynamicArray::_allocate - DCOMPOSITIONTAG_STRUCTDYNAMICARRAY +DCse - win32kbase!DirectComposition::CSynchronizationManager::_allocate - DCOMPOSITIONTAG_SYNCHRONIZATIONENTRY +DCsi - win32kbase!DirectComposition::CSharedInteractionMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDINTERACTIONMARSHALER +DCsj - win32kbase!DirectComposition::CSharedReadInteractionMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADINTERACTIONMARSHALER +DCsl - win32kbase!DirectComposition::CScalarMarshaler::_allocate - DCOMPOSITIONTAG_SCALARMARSHALER +DCsm - win32kbase!DirectComposition::CSharedReadScalarMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDREADSCALARMARSHALER +DCsn - win32kbase!DirectComposition::CSharedWriteScalarMarshaler::_allocate - DCOMPOSITIONTAG_SHAREDWRITESCALARMARSHALER +DCso - win32kbase!DirectComposition::CSemaphore::_allocate - DCOMPOSITIONTAG_SEMAPHORE +DCsp - win32kbase!DirectComposition::CCompositionSpotLight::_allocate - DCOMPOSITIONTAG_SPOTLIGHTMARSHALER +DCss - win32kbase!DirectComposition::CSharedSectionMarshaler - DCOMPOSITIONTAG_SHAREDSECTIONMARSHALER +DCst - win32kbase!DirectComposition::CScaleTransformMarshaler::_allocate - DCOMPOSITIONTAG_SCALETRANSFORMMARSHALER +DCsv - win32kbase!DirectComposition::CSpriteVisualMarshaler::_allocate - DCOMPOSITIONTAG_SPRITEVISUALMARSHALER +DCsw - win32kbase!DirectComposition::CCompositionSurfaceWrapperMarshaler::_allocate - DCOMPOSITIONTAG_SURFACEWRAPPERMARSHALER +DCt3 - win32kbase!DirectComposition::CTranslateTransform3DMarshaler::_allocate - DCOMPOSITIONTAG_TRANSLATETRANSFORM3DMARSHALER +DCtc - win32kbase!DirectComposition::CTileClumpMarshaler::_allocate - DCOMPOSITIONTAG_TILECLUMPMARSHALER +DCtg - win32kbase!DirectComposition::CTransformGroupMarshaler::_allocate - DCOMPOSITIONTAG_TRANSFORMGROUPMARSHALER +DCto - win32kbase!DirectComposition::CTelemetryInfo::_allocate - DCOMPOSITIONTAG_TELEMETRYINFO +DCts - win32kbase!DirectComposition::_allocate - DCOMPOSITIONTAG_TELEMETRYSTRING +DCtt - win32kbase!DirectComposition::CTranslateTransformMarshaler::_allocate - DCOMPOSITIONTAG_TRANSLATETRANSFORMMARSHALER +DCtv - win32kbase!DirectComposition::CTargetVisualMarshaler::_allocate - DCOMPOSITIONTAG_TARGETVISUALMARSHALER +DCvc - win32kbase!DirectComposition::CVisualMarshaler::AllocateChildrenArray - DCOMPOSITIONTAG_VISUALMARSHALERCHILDREN +DCvi - win32kbase!DirectComposition::CVisualMarshaler::_allocate - DCOMPOSITIONTAG_VISUALMARSHALER +DCvr - win32kbase!DirectComposition::CVisualCaptureMarshaler::_allocate - DCOMPOSITIONTAG_VISUALCAPTUREMARSHALER +DCvs - win32kbase!DirectComposition::CVirtualSurfaceMarshaler::_allocate - DCOMPOSITIONTAG_VIRTUALSURFACEMARSHALER +DCwr - win32kbase!DirectComposition::CWeakReferenceBase::_allocate - DCOMPOSITIONTAG_WEAKREFERENCE +DCwt - win32kbase!DirectComposition::CApplicationChannel::GetWeakReferenceBase - DCOMPOSITIONTAG_WEAKREFERENCETABLEENTRY +DCxc - win32kbase!DirectComposition::CCrossChannelChildVisualMarshaler::_allocate - DCOMPOSITIONTAG_CROSSCHANNELCHILDVISUALMARSHALER +DCxp - win32kbase!DirectComposition::CCrossChannelParentVisualMarshaler::_allocate - DCOMPOSITIONTAG_CROSSCHANNELPARENTVISUALMARSHALER +DCys - win32kbase!DirectComposition::CYCbCrSurfaceMarshaler::_allocate - DCOMPOSITIONTAG_YCBCRSURFACEMARSHALER +CSMb - win32k!CCompositionBuffer::Create - COMPOSITIONSURFACEMANAGER_BUFFER +CSMr - win32k!CBufferRealization::Create - COMPOSITIONSURFACEMANAGER_REALIZATION +TMcb - win32k!CCompositionToken::Initialize - TOKENMANAGER_COMPOSITIONTOKENBUFFER +TMlt - win32k!CTokenManager::EnsureLegacyTokenBuffer - TOKENMANAGER_LEGACYTOKENBUFFER +TMsg - win32k!CreateSessionTokenManager - TOKENMANAGER_SESSIONGLOBAL +TMtb - win32k!CLegacyTokenBuffer::TokenBlock::Create - TOKENMANAGER_TOKENBLOCK +TMte - win32k!CTokenManager::TokenQueueTableEntry::Allocate - TOKENMANAGER_TOKENQUEUETABLEENTRY +TMto - win32k!CToken::Create - TOKENMANAGER_TOKENOBJECT +TMtq - win32k!CTokenQueue::Create - TOKENMANAGER_TOKENQUEUE +IMhq - win32k!CInputQueue::Create - INPUTMANAGER_INPUTQUEUE +IMsg - win32k!CInputManager::Create - INPUTMANAGER_SESSIONGLOBAL + \ No newline at end of file diff --git a/resource.h b/resource.h index 9973fc0..afb4e97 100644 --- a/resource.h +++ b/resource.h @@ -9,6 +9,7 @@ #define IDR_PoolMonExTYPE 130 #define IDI_NONPAGED 310 #define IDI_PAGED 311 +#define IDR_POOLTAG 314 #define IDC_REFRESH 1000 #define ID_FILE_SAVE32771 32771 #define ID_VIEW_REFRESH 32772 @@ -24,8 +25,8 @@ // #ifdef APSTUDIO_INVOKED #ifndef APSTUDIO_READONLY_SYMBOLS -#define _APS_NEXT_RESOURCE_VALUE 314 -#define _APS_NEXT_COMMAND_VALUE 32784 +#define _APS_NEXT_RESOURCE_VALUE 315 +#define _APS_NEXT_COMMAND_VALUE 32786 #define _APS_NEXT_CONTROL_VALUE 1003 #define _APS_NEXT_SYMED_VALUE 310 #endif diff --git a/stdafx.h b/stdafx.h index 88a776a..c1e94c7 100644 --- a/stdafx.h +++ b/stdafx.h @@ -34,6 +34,7 @@ #endif // _AFX_NO_AFXCMN_SUPPORT #include // MFC support for ribbons and control bars +#include #ifdef _UNICODE