8042 - i8042prt.sys - PS/2 kb and mouse @GMM - - (Intel video driver) Memory manager @KCH - - (Intel video driver) Chipset specific service @MP - - (Intel video driver) Miniport related memory @SB - - (Intel video driver) Soft BIOS Abos - - Abiosdsk AcdM - - TDI AcdObjectInfoG AcdN - - TDI AcdObjectInfoG Acp* - acpi.sys - ACPI Pooltags ACPI - acpi.sys - ACPI Adap - - Adapter objects Adbe - - Adobe's font driver AdSv - vmsrvc.sys - Virtual Machines Additions Service AECi - - filter object interface for MS acoustic echo canceller Afd? - afd.sys - AFD objects AfdA - afd.sys - Afd EA buffer Afda - afd.sys - Afd APC buffer (NT 3.51 only) AfdB - afd.sys - Afd data buffer AfdC - afd.sys - Afd connection structure Afdc - afd.sys - Afd connect data buffer AfdD - afd.sys - Afd debug data Afdd - afd.sys - Afd disconnect data buffer AfdE - afd.sys - Afd endpoint structure AfdF - afd.sys - Afd TransmitFile info Afdf - afd.sys - Afd TransmitFile debug data AfdG - afd.sys - Afd group table Afdh - afd.sys - Afd address list change buffer AfdI - afd.sys - Afd TDI data Afdi - afd.sys - Afd "set inline mode" buffer AfdL - afd.sys - Afd local address buffer Afdl - afd.sys - Afd lookaside lists buffer AfdP - afd.sys - Afd poll info Afdp - afd.sys - Afd transport IRP buffer AfdQ - afd.sys - Afd work queue item Afdq - afd.sys - Afd routing query buffer AfdR - afd.sys - Afd remote address buffer Afdr - afd.sys - Afd ERESOURCE buffer AfdS - afd.sys - Afd security info AfdT - afd.sys - Afd transport info Afdt - afd.sys - Afd transport address buffer AfdW - afd.sys - Afd work item AfdX - afd.sys - Afd context buffer AFMM - afw.sys, afwcore.sys - Agnitum Outpost Firewall Drivers Afp - - SFM File server AlCI - nt!alpc - ALPC communication info AlEv - nt!alpc - ALPC eventlog queue AlHa - nt!alpc - ALPC port handle table AlIn - nt!alpc - ALPC Internal allocation AlMs - nt!alpc - ALPC message ALPC - nt!alpc - ALPC port objects AlRe - nt!alpc - ALPC section region AlRr - nt!Alpc - ALPC resource reserves AlSc - nt!alpc - ALPC section AlSe - nt!alpc - ALPC client security AlVi - nt!alpc - ALPC view Aml* - - ACPI AMLI Pooltags AoE* - aoebus.sys - ATA over Ethernet driver APIC - pnpapic.sys - I/O APIC Driver ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG ArbM - nt!arb - ARBITER_MISC_TAG ArbR - nt!arb - ARBITER_RANGE_LIST_TAG Arp? - - ATM ARP server objects, atmarps.sys ArpA - - AtmArpS address ArpB - - AtmArpS buffer space ARPC - atmarpc.sys - ATM ARP Client ArpI - - AtmArpS Interface structure ArpK - - AtmArpS ARP block ArpM - - AtmArpS MARS structure ArpR - - AtmArpS NDIS request ArpS - - AtmArpS SAP structure Asy1 - - ndis / ASYNC_IOCTX_TAG Asy2 - - ndis / ASYNC_INFO_TAG Asy3 - - ndis / ASYNC_ADAPTER_TAG Asy4 - - ndis / ASYNC_FRAME_TAG ATac - AppTag ATR command buffer - AtC - - IDE disk configuration AtD - - atdisk.c ATdi - AppTag cliendata index buffer - ATdt - AppTag cliendata temp buffer - ATFb - AppTag file id buffer - ATgb - AppTag guid buffer - ATIX - - WDM mini drivers for ATI tuner, xbar, etc. Atk - - Appletalk transport AtmA - - Atoms ATmp - AppTag mount point - AtmT - - Atom tables ATMU - atmuni.sys - ATM UNI Call Manager Atom - - Atom Tables ATon - AppTag object name - ATub - AppTag user buffer - AudC - wdmaud.sys - MMSYSTEM Wave/Midi API mapper AudL - wdmaud.sys - MMSYSTEM Wave/Midi API mapper AuxL - - EXIFS Auxlist Bat? - - Battery Class drivers BatC - - Composite battery driver BatM - - Control method battery driver BatS - - Smart battery driver Batt - - Battery class driver BCDK - nt!init - Kernel boot configuration data. BCSP - bthbcsp.sys - Bluetooth BCSP minidriver BIG - nt!mm - Large session pool allocations (ntosexpool.c) BlCc - blkcache.sys - Block Cache Driver Bmfd - - Font related stuff BT3C - bt3c.sys - Bluetooth 3COM minidriver BT8x - - WDM mini drivers for Brooktree 848,829, etc. BTHP - bthport.sys - Bluetooth port driver (generic) BthS - bthport.sys - Bluetooth port driver (security) BTME - bthenum.sys - Bluetooth enumerator BTMO - bthmodem.sys - Bluetooth modem BTPT - - Bluetooth transport protocol library BTSR - bthser.sys - Bluetooth serial minidriver BTUR - bthuart.sys - Bluetooth UART minidriver Bu* - - burneng.sys from adaptec Call - nt!ex - kernel callback object signature call - - debugging call tables Cbrb - nt!ExAllocateCallBack - Callback registration block (PEX_CALLBACK_FUNCTION, ptr to \\'CMcb\\' structure) CBRe - - CallbackRegistration Cc - nt!cc - Cache Manager allocations (catch CcBc - nt!cc - Cache Manager Bcb from pool CcBm - nt!cc - Cache Manager Bitmap CcBn - nt!cc - Cache Manager Bcb trim notification entry CcBr - nt!cc - Cache Manager Bitmap range CcBz - nt!cc - Cache Manager Bcb Zone CcDw - nt!cc - Cache Manager Deferred Write CcEv - nt!cc - Cache Manager Event CcFn - nt!cc - Cache Manager File name for popups CcMb - nt!cc - Cache Manager Mbcb CcOb - nt!cc - Cache Manager Overlap Bcb CcPB - nt!ccpf - Prefetcher trace buffer CcPC - nt!ccpf - Prefetcher context CcPc - nt!cc - Cache Manager Private Cache Map CcPD - nt!ccpf - Prefetcher trace dump CcPF - nt!ccpf - Prefetcher file name CcPf - nt!ccpf - Prefetcher CcPh - nt!ccpf - Prefetcher header preallocation CcPI - nt!ccpf - Prefetcher intermediate table CcPL - nt!ccpf - Prefetcher read list CcPM - nt!ccpf - Prefetcher metadata CcPp - nt!ccpf - Prefetcher instructions CcPq - nt!ccpf - Prefetcher query buffer CcPS - nt!ccpf - Prefetcher scenario CcPs - nt!ccpf - Prefetcher section table CcPT - nt!ccpf - Prefetcher trace CcPv - nt!ccpf - Prefetcher volume info CcPw - nt!ccpf - Prefetcher boot worker CcSc - nt!cc - Cache Manager Shared Cache Map - ok CctX - - EXIFX FCB Commit CTX CcVa - nt!cc - Cache Manager Initial array of Vacbs CcVl - nt!cc - Cache Manager Vacb Level structures (large streams) CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream CcWK - nt!cc - Kernel Cache Manager lookaside list CcWk - nt!cc - Kernel Cache Manager lookaside list CcWq - nt!cc - Cache Manager Work Queue Item CcZe - nt!cc - Cache Manager Buffer of Zeros CdA - - CdAudio filter driver Cdcc - cdfs.sys - CDFS Ccb Cddn - cdfs.sys - CDFS CdName in dirent Cdee - cdfs.sys - CDFS Search expression for enumeration Cdfd - cdfs.sys - CDFS Data Fcb Cdfi - cdfs.sys - CDFS Index Fcb Cdfl - cdfs.sys - CDFS Filelock CdFn - cdfs.sys - CDFS Filename buffer Cdfn - cdfs.sys - CDFS Nonpaged Fcb Cdfs - cdfs.sys - CDFS General Allocation Cdft - cdfs.sys - CDFS Fcb Table entry Cdgs - cdfs.sys - CDFS Generated short name Cdic - cdfs.sys - CDFS Irp Context Cdil - cdfs.sys - CDFS Irp Context lite Cdio - cdfs.sys - CDFS Io context for async reads Cdma - cdfs.sys - CDFS Mcb array Cdpe - cdfs.sys - CDFS Prefix Entry CdPn - cdfs.sys - CDFS CdName in path entry Cdpn - cdfs.sys - CDFS Prefix Entry name CdRw - dwcdrw.sys - (Dvd Write Now) cdrw driver\\'s default tag Cdsp - cdfs.sys - CDFS Buffer for spanning path table Cdtc - cdfs.sys - CDFS TOC Cdun - cdfs.sys - CDFS Buffer for upcased name Cdvd - cdfs.sys - CDFS Buffer for volume descriptor Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem CEP - wibcm.sys - CEP_INSTANCE_TAG cfsp - cfosspeed.sys - cFosSpeed Driver CIcr - ci.dll - Code Integrity allocations for image integrity checking CIha - ci.dll - Code Integrity hashes CIsc - ci.dll - Code Integrity core dll ClfA - clfs.sys - CLFS_CONTAINER_TAG ClfB - clfs.sys - CLFS_BASEFILE_TAG ClfC - clfs.sys - CLFS_LOGFCBPHYSICAL_TAG ClfD - clfs.sys - CLFS_LOGFCBVIRTUAL_TAG ClfE - clfs.sys - CLFS_LOGCCB_TAG ClfF - clfs.sys - CLFS_FLUSHELT_TAG ClfG - clfs.sys - CLFS_REQUEST_TAG ClfH - clfs.sys - CLFS_IOCB_TAG ClfI - clfs.sys - CLFS_MARSHALBUFFER_TAG Clfs - clfs.sys - CLFS_TAG CM - nt!cm - Configuration Manager (registry) CM?? - nt!cm - Internal Configuration manager allocations CMAl - nt!cm - internal registry memory allocator pool tag CMCa - nt!cm - Configuration Manager Cache (registry) CMcb - nt!CmRegisterCallback - RegistryCallback routine registration info (registration time, Context, ...) CmcD - hal.dll - HAL CMC Driver Log CmcK - hal.dll - HAL CMC Kernel Log CmcT - hal.dll - HAL CMC temporary Log CMDa - nt!cm - value data cache pool tag CMDc - nt!cm - Configuration Manager Cache (registry) CMIn - nt!cm - index hint pool tag CMkb - nt!cm - registry key control blocks CMNb - nt!cm - notification block pool tag CMnb - nt!cm - registry notify blocks CMpa - nt!cm - registry post apcs CMpb - nt!cm - registry post blocks CMpe - nt!cm - registry post events CMSb - nt!cm - internal stash buffer pool tag CMsb - nt!cm - registry stash buffer CMSc - nt!cm - security cache pooltag CMSH - wibcm.sys - WIBCM_SHARED_TAG CMVa - nt!cm - value cache value tag CMVI - nt!cm - value index cache tag CmVn - nt!cm - captured value name CMVw - nt!cm - registry mapped view of file CMWK - wibcm.sys - WIBCM_WORK_TAG CMWT - wibcm.sys - WIBCM_TIMER_TAG Cngb - ksecdd.sys - CNG kmode crypto pool tag COMX - serial.sys - serial driver allocations COMX - vspd.sys - Virtual Serial Port driver Cont - - Contiguous physical memory allocations for device drivers CopW - - EXIFS CopyOnWrite Covr - nt!cov - Code Coverage pool tag CpeD - hal.dll - HAL CPE Driver Log CpeK - hal.dll - HAL CMC Kernel Log CpeT - hal.dll - HAL CPE temporary Log CPnp - classpnp.sys - ClassPnP transfer packets Crsp - ksecdd.sys - CredSSP kernel mode client allocations CrtH - - EXIFS Create Header Cryp - ksecdd.sys - Crypto allocations CSdk - - Cluster Disk Filter driver CSnt - - Cluster Network driver CTE - - Common transport environment (ntosinccxport.h, used by tdi) Cvli - - EXIFS Cached Volume Info D2d - - Device Object to DosName rtns (ntos tldev2dos.c) D3Dd - - DX D3D driver (embedded in a display driver like s3mvirge.dll) D851 - - 8514a video driver Dacl - - Temp allocations for object DACLs Dati - - ati video driver DbLo - - Debug logging dcam - - WDM mini driver for IEEE 1394 digital camera Dcdd - cdd.dll - Canonical display driver Dcl - - cirrus video driver Ddk - - Default for driver allocated memory (user's of ntddk.h) Devi - - Device objects Dfb - - framebuf video driver DfC? - dfsc.sys - DFS Client allocations DfCa - dfsc.sys - DFS Client PERUSERTABLE DfCb - dfsc.sys - DFS Client REFCONTEXT DfCc - dfsc.sys - DFS Client CONNECTION DfCd - dfsc.sys - DFS Client CURRENTDC DfCe - dfsc.sys - DFS Client CSCEA DfCf - dfsc.sys - DFS Client FILENAME DfCg - dfsc.sys - DFS Client PREFIXCACHE DfCh - dfsc.sys - DFS Client HASH DfCi - dfsc.sys - DFS Client INPUTBUFFER DfCj - dfsc.sys - DFS Client REWRITTENNAME DfCl - dfsc.sys - DFS Client DCLIST DfCm - dfsc.sys - DFS Client CMCONTEXT DfCn - dfsc.sys - DFS Client DOMAINNAME DfCp - dfsc.sys - DFS Client PATH DfCq - dfsc.sys - DFS Client REGSTRING DfCr - dfsc.sys - DFS Client REFERRAL DfCs - dfsc.sys - DFS Client SHARENAME DfCt - dfsc.sys - DFS Client TREECONNECT DfCu - dfsc.sys - DFS Client USETABLE DfCv - dfsc.sys - DFS Client SERVERNAME DfCw - dfsc.sys - DFS Client TARGETINFO DfCx - dfsc.sys - DFS Client CREDENTIALS DfCy - dfsc.sys - DFS Client REMOTEENTRY DfCz - dfsc.sys - DFS Client DOMAINREFERRAL Dfs - - Distributed File System Dfsm - - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdigre dfsr - - RDBSS IRP allocation dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption) Dh 0 - - DirectDraw/3D default object Dh 1 - - DirectDraw/3D DirectDraw object Dh 2 - - DirectDraw/3D Surface object Dh 3 - - DirectDraw/3D Direct3D context object Dh 4 - - DirectDraw/3D VideoPort object Dh 5 - - DirectDraw/3D MotionComp object Dire - - Directory objects Dlck - - deadlock verifier (part of driver verifier) structures Dlmp - - Video utility library for Vista display drivers Dmga - - mga (matrox) video driver DmH? - - DirectMusic hardware synthesizer Dmio - - Logical Disk Manager driver Dmip - dmio.sys - Logical Disk Manager driver Dmiq - dmio.sys - Logical Disk Manager driver Dmld - - Logical Disk Manager loader DmpS - dumpsvc.sys - Crashdump Service Driver DmS? - - DirectMusic kernel software synthesizer Dmst - - Logical Disk Manager driver static initialization Dndt - - Device node Dnod - - Device node structure DOPE - - Device Object Power Extension (po component) DPHk - DbgPrnHk.sys - DbgPrintLog\\'s helper driver, cahces and stores debug messages in memory. DPrf - - Disk performance filter driver Dprt - dxgkrnl.sys - Video port for Vista display drivers Dps5 - - NT5 PostScript printer driver Dpsh - - Postcript driver heap memory Dpsi - - psidisp video driver Dpsm - - Postcript driver memory DPwr - nt!pnp - PnP power management Dqv - - qv (qvision) video driver Driv - - Driver objects Drsd - - Rasdd Printer Driver Pool Tag. Dtga - - tga video driver Dump - - Bugcheck dump allocations Dun5 - - NT5 Universal printer driver DUQD - mpsdrv.sys - MPSDRV upcall user request DV?? - - RDR2 DAV MiniRedir Tags DVCx - - AsyncEngineContext, DAV MiniRedir DVEx - - Exchange, DAV MiniRedir DVFi - - FileInfo, DAV MiniRedir DVFn - - FileName, DAV MiniRedir Dvg2 - - vga 256 color video driver Dvg6 - - vga 64K color video driver Dvga - - vga 16 color video driver Dvgr - - vga for risc video driver DVRw - - ReadWrite, DAV MiniRedir DVSc - - SrvCall, DAV MiniRedir DVSh - - SharedHeap, DAV MiniRedir DW32 - - W32 video driver Dwd - - wd90c24a video driver DWNb - dwudf.sys - (DVD Write Now) I/O buffers and data verification request block DWNf - dwudf.sys - (DVD Write Now) default allocation without internal bounds checker dwnF - dwudf.sys - (DVD Write Now) default tag DWNm - dwudf.sys - (DVD Write Now) pending verification bitmap DWNm - dwudf.sys - (DVD Write Now) default allocation tag when built-in memory manager is enabled dwnS - dwudf.sys - (DVD Write Now) \\'system\\' memory allocation DWNz - dwudf.sys - (DVD Write Now) Zero-filled buffer Dwp9 - - weitekp9 video driver DWvb - dwudf.sys - (DVD Write Now) stored data verification block Dxga - - XGA video driver DxgK - dxgkrnl.sys - Vista display driver support Efsc - - EFS driver Efsm - - EFS driver Efst - - EXIFS FS Statistics Enli - nt!tm - KTM Transaction Enlistment Envr - - Environment strings Err - - Error strings EtwA - nt!etw - Etw APC EtwB - nt!etw - Etw Buffer EtwC - nt!etw - Etw Realtime Consumer EtwD - nt!etw - Etw DataBlock EtwG - nt!etw - Etw Guid EtwL - nt!etw - ETW_LOGGER_CONTEXT EtwP - nt!etw - Etw Pool Etwp - nt!etw - ETW per EtwQ - nt!etw - Etw Queue Etwq - nt!etw - Etw ReplyQueue EtwR - nt!etw - Etw Registration Etwr - nt!etw - Etw ReplyQueue Entry EtwS - nt!etw - Etw DataSource Evel - - EFS file system filter driver lookaside list Even - - Event objects Evid - - Rtl Event ID's ExWl - - Executive worker list entry Fat - fastfat.sys - Fat File System allocations FatB - fastfat.sys - Fat allocation bitmaps Fatb - fastfat.sys - Fat Bcb arrays FatC - fastfat.sys - Fat Ccbs FatD - fastfat.sys - Fat pool dirents Fatd - fastfat.sys - Fat EA data FatE - fastfat.sys - Fat EResources Fate - fastfat.sys - Fat EA set headers FatF - fastfat.sys - Fat Fcbs Fatf - fastfat.sys - Fat deferred flush contexts FatI - fastfat.sys - Fat IrpContexts Fati - fastfat.sys - Fat IO run descriptor FatL - fastfat.sys - Fat FAT entry lookup buffer on verify FatN - fastfat.sys - Fat Nonpaged Fcbs Fatn - fastfat.sys - Fat filename buffer FatO - fastfat.sys - Fat I/O buffer FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees) FatQ - fastfat.sys - Fat buffered user buffer FatR - fastfat.sys - Fat repinned Bcb Fatr - fastfat.sys - Fat verification FatS - fastfat.sys - Fat stashed Bpb Fats - fastfat.sys - Fat verification FatT - fastfat.sys - Fat directory allocation bitmaps FatV - fastfat.sys - Fat Vcb stat bucket Fatv - fastfat.sys - Fat backpocket Vpb FatW - fastfat.sys - Fat FAT windowing structure FatX - fastfat.sys - Fat IO contexts Fatx - fastfat.sys - Fat delayed close contexts fboX - - EXIFS FOBXVF List Fcbl - - EXIFS FCBlock FhCI - substvol.sys - (AllenPort Virtual Volume) file handle cache item FIcn - fileinfo.sys - FileInfo FS FIcp - fileinfo.sys - FileInfo FS FIcs - fileinfo.sys - FileInfo FS FIcv - fileinfo.sys - FileInfo FS File - - File objects FIOc - fileinfo.sys - FileInfo FS FIof - fileinfo.sys - FileInfo FS FIou - fileinfo.sys - FileInfo FS FIPc - fileinfo.sys - FileInfo FS FIvn - fileinfo.sys - FileInfo FS FIvp - fileinfo.sys - FileInfo FS FLex - - exclusive file lock FLfl - - exported (non FLli - - per FLln - - shared lock tree node flnk - - font link tag used in ntgdigre Flop - - floppy driver Flop - flopx.sys - Alter\\'s Floppy driver with non-standard format support (e.g. 1,76Mb) FLsh - - shared file lock Flst - - EXIFS Freelist FLwl - - waiting lock FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w) FMac - fltmgr.sys - ASCII String buffers FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure FMcb - fltmgr.sys - FLT_CCB structure FMcr - fltmgr.sys - Context registration structures FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers FMea - fltmgr.sys - EA buffer for create FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure FMfi - fltmgr.sys - Fast IO dispatch table FMfk - fltmgr.sys - Byte Range Lock structure FMfl - fltmgr.sys - FLT_FILTER structure FMfn - fltmgr.sys - NAME_CACHE_NODE structure FMfr - fltmgr.sys - FLT_FRAME structure FMfz - fltmgr.sys - FILE_LIST_CTRL structure FMib - fltmgr.sys - Irp SYSTEM buffers FMic - fltmgr.sys - IRP_CTRL completion node stack FMil - fltmgr.sys - IRP_CTRL completion node stack FMin - fltmgr.sys - FLT_INSTANCE name FMis - fltmgr.sys - FLT_INSTANCE structure FMla - fltmgr.sys - Per FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure FMol - fltmgr.sys - OPLOCK_CONTEXT structure FMos - fltmgr.sys - Operation status ctrl structure FMpl - fltmgr.sys - Cache aware pushLock FMpr - fltmgr.sys - FLT_PRCB structure FMrl - fltmgr.sys - FLT_OBJECT rundown logs FMrp - fltmgr.sys - Reparse point data buffer FMrr - fltmgr.sys - Per FMsd - fltmgr.sys - Security descriptors FMsl - fltmgr.sys - STREAM_LIST_CTRL structure FMtn - fltmgr.sys - Temporary file names FMtr - fltmgr.sys - Temporary Registry information FMts - fltmgr.sys - Tree Stack FMus - fltmgr.sys - Unicode string FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure FMvo - fltmgr.sys - FLT_VOLUME structure FMwi - fltmgr.sys - Work item structures FOCX - nt!fsrtl - File System Run Time File Object Context structure FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w) FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry FSel - nt!fsrtl - File System Run Time Extra Create Parameter List FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List FSmg - nt!fsrtl - File System Run Time Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys) FSrd - nt!fsrtl - File System Run Time FSrm - nt!fsrtl - File System Run Time FSrN - nt!fsrtl - File System Run Time FSrn - nt!fsrtl - File System Run Time FSro - nt!fsrtl - File System Run Time FSrs - nt!fsrtl - File System Run Time Work Item for low FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!) FstB - - ntosfstub Fstb - - ntosfstub FSun - nt!fsrtl - File System Run Time FsVg - fsvga.sys - International VGA support FtC - - Fault tolerance driver FtM - - Fault tolerance driver FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer FTrc - - Fault tolerance Slist tag. FtS - - Fault tolerance driver FtT - - Fault tolerance driver FtU - - Fault tolerance driver FtV - - Fault tolerance driver FVE0 - fvevol.sys - General allocations FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption) FVEc - fvevol.sys - Cryptographic allocations FVEl - fvevol.sys - FVELIB allocations FVEp - fvevol.sys - Write buffers FVEr - fvevol.sys - Reserved mapping addresses FVEv - fvevol.sys - Conversion allocations FVEw - fvevol.sys - Worker threads FVEx - fvevol.sys - Read/write control structures FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver. FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. FxL? - wdfldr.sys - KMDF Loader Pool allocation FxLg - wdf01000.sys - KMDF IFR log tag G - - Gdi Generic allocations G??? - - Gdi Objects Gcac - - Gdi glyph cache Gcap - - Gdi capture buffer Gcsl - - Gdi string resource script names Gdbr - - Gdi driver brush realization Gdd - - Gdi ddraw PKEY_VALUE_FULL_INFORMATION Gdda - - Gdi ddraw attach list GddD - - Gdi ddraw dummy page Gdde - - Gdi ddraw event Gddf - - Gdi ddraw driver heaps Gddp - - Gdi ddraw driver caps Gddv - - Gdi ddraw driver video memory list GDev - - Gdi pdev Gdev - - Gdi GDITAG_DEVMODE Gdrs - - Gdi GDITAG_DRVSUP Gdwd - win32k.sys - Gdi watchdog support objects Gdxd - - Gdi ddraw VPE directdraw object Gdxs - - Gdi ddraw VPE surface, videoport, capture object Gdxx - - Gdi ddraw VPE DXAPI object Gebr - - Gdi ENGBRUSH gEdg - - Gdi gradient fill triangle Gfcb - - EXIFS Grow FCB Gffv - - Gdi FONTFILEVIEW GFil - - Gdi engine descriptor list gFil - - Gdi FILEVIEW Gfsb - - Gdi font sustitution list Gfsm - - Gdi Fast mutex Ggb - - Gdi glyph bits Ggbl - - Gdi look aside buffers Ggdv - - Gdi GDITAG_GDEVICE Gglb - - Gdi temp buffer Ggls - - Gdi glyphset Gh ? - win32k.sys - Gdi Handle manager specific object types: defined in w32\ntgdiinc\ntgdistr.h Ghmg - - Gdi handle manager objects Gini - - Gdi fast mutex Gla? - win32k.sys - Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdiinc\ntgdistr.h Gldv - - Gdi Ldev Glnk - - Gdi PFELINK Gmap - - Gdi font map signature table Gpff - - Gdi physical font file Gpft - - Gdi font table Gsem - - Gdi Semaphores Gsp - - Gdi sprite Gspr - - Gdi sprite grow range Gtmp - - Gdi temporary allocations Gtmw - - Gdi TMW_INTERNAL Gxlt - - Gdi Xlate Hal - hal.dll - Hardware Abstraction Layer HalV - ntoskrnl.exe - Driver Verifier DMA checking HcBm - hcaport.sys - HCAPORT_TAG_BITMAP HcCm - hcaport.sys - HCAPORT_TAG_CM HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE HcdI - hcaport.sys - HCAPORT_TAG_HWID HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS HcEn - hcaport.sys - HCAPORT_TAG_ENUM HcEv - hcaport.sys - HCAPORT_TAG_EVENT HCID - bthport.sys - Bluetooth port driver HCI debug HCIT - bthport.sys - Bluetooth port driver (HCI) HcMa - hcaport.sys - HCAPORT_TAG_MAD HcMc - hcaport.sys - HCAPORT_TAG_MISC HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK HcOb - hcaport.sys - HCAPORT_TAG_OBJECT HcPr - hcaport.sys - HCAPORT_TAG_PROTD HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT HdCl - - HID Client Sample Driver HidC - - HID Class HidP - - HID Parser Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE HisC - - histogram filter driver Hist - - histogram filter driver Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO Hpfs - - Pinball (aka Hpfs) allocations HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION HpMM - pnpmem.sys - HotPlug Memory Driver hSVD - mrxdav.sys - Shared Heap Tag HT01 - - GDI Halftone AddCachedDCI() for CurCDCIData HT02 - - GDI Halftone GetCachedDCI() for Threshold HT03 - - GDI Halftone FindCachedSMP() for CurCSMPData HT04 - - GDI Halftone FindCachedSMP() for CurCSMPBmp HT05 - - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI HT06 - - GDI Halftone pDCIAdjClr() for DEVCLRADJ HT07 - - GDI Halftone ComputeRGB555LUT() for RGBLUT HT08 - - GDI Halftone ColorTriadSrcToDev() for RGB HT09 - - GDI Halftone ColorTriadSrcToDev() for CRTX HT10 - - GDI Halftone CreateDyesColorMappingTable() for DevPrims HT11 - - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable HT12 - - GDI Halftone ThresholdsFromYData() for pYData HT13 - - GDI Halftone ComputeHTCellRegress() for pThresholds HT14 - - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine HT15 - - GDI Halftone CalculateStretch() for PrimColorInfo Hvlm - nt!Hvl - Temporary MDL for the Hvl component. HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component. IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager IBm* - wibms.sys - Windows Infiniband Management Server pool tags IbPA - wibpm.sys - WIBPM_SAMPLE_TAG IbPI - wibpm.sys - WIBPM_ITEM_TAG IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager IbPS - wibpm.sys - WIBPM_SENT_TAG IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager IbW1 - wibwmi.sys - WIBWMI1_TAG IbW2 - wibwmi.sys - WIBWMI2_TAG Icp - - I/O completion packets queue on a completion ports IcpP - - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers ICSo - substvol.sys - (AllenPort Virtual Volume) SectionObject cache IdeP - - atapi IDE IdeX - - PCI IDE idle - - Power Manager idle handler Ifs - - Default file system allocations (user's of ntifs.h) II?? - - IP in IP tunneling IIdt - - Data IIhd - - Header IIpk - - Packet IIrf - - Free memory IIsc - - Send Context IITn - - Tunnel IIts - - Transfer Context IIwc - - Work Context Im* - - Imapi.sys from adaptec Info - - general system information allocations INTC - - Intel video driver INty - substvol.sys - (AllenPort Virtual Volume) file notification item Io - nt!io - general IO allocations IoCc - nt!io - Io completion context IoEa - nt!io - Io extended attributes IoEr - nt!io - Io error log packets IoFc - nt!io - Io name transmogrify operation IOfl - substvol.sys - (AllenPort Virtual Volume) offline file descriptor IoFs - nt!io - Io shutdown packet IoFu - nt!pnp - Io file utils Ioin - - Io interrupts IoKB - - Registry basic key block (temp allocation) IoNm - nt!io - Io parsing names IoOp - nt!io - I/O subsystem open packet IoRb - nt!io - Io remote boot related IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet IoRN - nt!io - Registry key name (temp allocation) IoSe - nt!io - Io security related IoSh - nt!io - Io shutdown packet IoSt - nt!io - Io Stream Identifier Context IoTi - nt!io - Io timers IoTt - nt!vf - I/O verifier IRP tracking table IoUs - nt!io - I/O SubSystem completion Context Allocation Ip?? - ipsec.sys - IP Security IpAT - ipsec.sys - AH headers in transport mode IpAU - ipsec.sys - AH headers in tunnel mode IpAX - ipsec.sys - Key acquire contexts IpBP - ipsec.sys - buffer pools IpCO - ipsec.sys - IP compression IpEQ - ipsec.sys - event queue IpET - ipsec.sys - ESP headers in transport mode IpEU - ipsec.sys - ESP headers in tunnel mode IpFI - ipsec.sys - Filter blocks IpFl - mpsdrv.sys - MPSDRV IP Flow IpHT - ipsec.sys - HUGHES headers in transport mode IpHU - ipsec.sys - HUGHES headers in tunnel mode IpHW - ipsec.sys - hardware accleration items IpKE - ipsec.sys - keys IpLA - ipsec.sys - lookaside lists IPm? - - IP Multicasting IPmf - - Free memory (only in checked builds) IPmg - - Group IPmm - - Message IPmo - - Outgoing Interface IPms - - Source IpSA - ipsec.sys - Security Associations IpSC - ipsec.sys - send complete context IpSI - ipsec.sys - initial allocations IpSQ - ipsec.sys - stall queues IpTI - ipsec.sys - timers IPX - - Nwlnkipx transport IrD? - - IrDA TDI and RAS drivers Irp - - Io, IRP packets Irp+ - nt!vf - I/O verifier allocated IRP packets IrpB - nt!vf - I/O verifier direct I/O double buffer allocation IrpC - nt!vf - I/O verifier stack contexts Irpd - nt!vf - I/O verifier deferred completion context Irpl - nt!io - system large IRP lookaside list Irps - nt!io - system small IRP lookaside list Irpt - nt!vf - I/O verifier per Isap - - Pnp Isa bus extender IU?? - - IIS Utility Driver IUcp - - completion port minipackets IUDl - - Lookaside list allocations KAPC - nt!io - I/O SubSystem HardError APC KbdC - - Keyboard Class Driver KCfe - - Kernel COM factory entry Ke - - Kernel data structures KeIC - - Kernel Interrupt Object Chain Key - - Key objects KMIX - - Kmixer (wdm audio) KNMI - - Kernel NMI Callback object KrbC - ksecdd.sys - Kerberos Client package KSah - - Ks auxiliary stream headers KSAI - - allocator instance KSai - - default allocator instance header KSbi - - event buffered item KSce - - create item entry KSch - - create handler entry KSCI - - clock instance KSci - - default clock instance header KScp - - object creation parameters auxiliary copy KSda - - default allocator KSdc - - default clock KSdh - - device header Kse0 - ksecdd.sys - Security driver allocs for sec package 0 Kse1 - ksecdd.sys - Security driver allocs for sec package 1 Kse2 - ksecdd.sys - Security driver allocs for sec package 2 Kse3 - ksecdd.sys - Security driver allocs for sec package 3 Kse4 - ksecdd.sys - Security driver allocs for sec package 4 Kse5 - ksecdd.sys - Security driver allocs for sec package 5 Kse6 - ksecdd.sys - Security driver allocs for sec package 6 Kse7 - ksecdd.sys - Security driver allocs for sec package 7 Kse8 - ksecdd.sys - Security driver allocs for sec package 8 Kse9 - ksecdd.sys - Security driver allocs for sec package 9 Ksec - ksecdd.sys - Security device driver KSed - - oneshot event deletion dpc KSee - - event entry KSep - - irp system buffer event parameter KSer - - QM error report KseS - ksecdd.sys - Security driver allocs for LSA proper KSew - - oneshot event deletion workitem KseZ - ksecdd.sys - Security driver allocs for default sec package KSfd - - filter cache data (MSKSSRV) KsFI - - filter instance KSns - - null security object KSnv - - registry name value KSoh - - object header KsoO - - WDM audio stuff KSop - - object creation parameters KSpc - - port driver instance FsContext KSPI - - pin instance KSpp - - irp system buffer property/method/event parameter KSpt - - pin type list (MSKSSRV) KSqf - - query information file buffer KSqr - - QM quality report KSsc - - port driver stream FsContext KSsf - - set information file buffer KSsh - - stream headers KSsi - - software bus interface KSsl - - symbolic link buffer (MSKSSRV) KSsp - - serialized property set kuzt - SbieDrv.sys - Sandboxie Kernel Mode Driver L2CA - bthport.sys - Bluetooth port driver (L2CAP) L2T0 - - ndisl2tp / MTAG_FREED L2T1 - - ndisl2tp / MTAG_ADAPTERCB L2T2 - - ndisl2tp / MTAG_TUNNELCB L2T3 - - ndisl2tp / MTAG_VCCB L2T4 - - ndisl2tp / MTAG_VCTABLE L2T5 - - ndisl2tp / MTAG_WORKITEM L2T6 - - ndisl2tp / MTAG_TIMERQ L2T7 - - ndisl2tp / MTAG_TIMERQITEM L2T8 - - ndisl2tp / MTAG_PACKETPOOL L2T9 - - ndisl2tp / MTAG_FBUFPOOL L2Ta - - ndisl2tp / MTAG_HBUFPOOL L2Tb - - ndisl2tp / MTAG_TDIXRDG L2Tc - - ndisl2tp / MTAG_TDIXSDG L2Td - - ndisl2tp / MTAG_CTRLRECD L2Te - - ndisl2tp / MTAG_CTRLSENT L2Tf - - ndisl2tp / MTAG_PAYLRECD L2Tg - - ndisl2tp / MTAG_PAYLSENT L2Th - - ndisl2tp / MTAG_INCALL L2Ti - - ndisl2tp / MTAG_UTIL L2Tj - - ndisl2tp / MTAG_ROUTEQUERY L2Tk - - ndisl2tp / MTAG_ROUTESET L2Tl - - ndisl2tp / MTAG_L2TPPARAMS L2Tm - - ndisl2tp / MTAG_TUNNELWORK L2Tn - - ndisl2tp / MTAG_TDIXROUTE LANE - atmlane.sys - LAN Emulation Client for ATM LB?? - - LM Datagram receiver allocations LBan - - Server announcement LBbb - - Become backup context LBbl - - Backup List LBbn - - Name LBbr - - Become backup request LBbs - - Browser server LBci - - Connection info LBdi - - POOL_DOMAIN_INFO LBds - - Send datagram context LBea - - Ea buffer LBel - - Election context LBgb - - GetBackupList request LBic - - IRP context LBid - - Illegal datagram context LBma - - Master announce context LBmb - - Mailslot Buffer LBmh - - Mailslot header LBnn - - Name name LBpn - - Paged Name LBpt - - Paged transport LBse - - Browser security LBsl - - Browser server list LBtn - - Transport name Lbuf - - EXIFS Large Buffer LBvb - - View buffer LBwi - - Work item LBxm - - Master name LBxn - - TransportName LBxp - - Transport LCam - - WDM mini video capture driver for Logitech camera LeoC - - Symantec/Norton AntiVirus filter driver Lfs - - Lfs allocations LfsI - - Lfs allocations List - - kernel utilities list allocation LogA - clfs.sys - CLFS_APITEST_TAG LpcM - - Local procedure call message blocks LpcZ - - LPC Zone Lr - - Generic allocations Lr!! - - Cancel request context blocks Lr2x - - Transact SMB context Lr?? - - Buffers used for FsControlFile APIs Lrac - - ACL for redirector Lraw - - Async write context Lrbb - - Write behind buffer Lrca - - Temporary storage used in name canonicalization Lrcl - - ConnectListEntries Lrcn - - Computer Name Lrcx - - Context blocks of various types Lrdn - - Domain Name Lrds - - Duplicated ansi string Lrdu - - Duplicated unicode string Lrea - - EA related allocations Lref - - Reference history (debug only) Lrfc - - File Control Blocks Lrfl - - Fcb Locks Lrfp - - Fcb Paging locks Lric - - Instance Control Blocks Lrlb - - Lock Control Block buffers Lrlc - - Lock Control Blocks Lrme - - MPX table entries Lrmt - - MPX table Lrna - - Netbios Addresses Lrnf - - Non paged FCB Lrnt - - Non paged transport Lrps - - Paged security entry Lrpt - - Primary transport server list Lrsc - - Search Control Blocks Lrse - - Security entry Lrsl - - ServerListEntries Lrsm - - SMB buffer Lrso - - Operating system name Lrsx - - Send contexts Lrtc - - Transport connection Lrte - - Transport event. Lrwb - - Write behind buffer header Lrwq - - Work queue item Lrxx - - Transceive context blocks LS?? - - LM server allocations LSac - - BlockTypeAdminCheck LSas - - BlockTypeAdapterStatus LSbf - - buffer descriptor LScd - - comm device LScn - - connection LSdb - - data buffer LSdc - - BlockTypeDirCache LSdi - - BlockTypeDirectoryInfo LSep - - endpoint LSfn - - BlockTypeFSName LSlf - - LFCB LSlr - - BlockTypeLargeReadX LSmf - - MFCB LSmi - - BlockTypeMisc LSnd - - WDM mini sound driver for Logitech video camera LSnh - - nonpaged block header LSni - - BlockTypeNameInfo LSop - - oplock break wait LSpc - - paged connection LSpm - - paged MFCB LSpr - - paged RFCB LSrf - - RFCB LSsc - - search(core) LSsd - - BlockTypeShareSecurityDescriptor LSsf - - BlockTypeDfs LSsh - - share LSsp - - search(core complete) LSsr - - search LSss - - session LStb - - table LStc - - tree connect LSti - - timer LStr - - transaction LSvi - - BlockTypeVolumeInformation LSwi - - initial work context LSwn - - normal work context LSwq - - BlockTypeWorkQueue LSwr - - raw work context LSws - - BlockTypeWorkContextSpecial Luaf - luafv.sys - LUA File Virtualization LXMK - - kernel mixer line driver (KMXL Lxpt - - Transport MapP - - PNP map Mapr - - arc firmware registry routines McaC - hal.dll - HAL MCA corrected Log McaD - hal.dll - HAL MCA Driver Log McaK - hal.dll - HAL MCA Kernel Log MCAM - - WDM mini driver for Intel USB camera McaP - hal.dll - HAL MCA Log from previous boot McaT - hal.dll - HAL MCA temporary Log MCDd - - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll) MCDx - - OpenGL MCD server (mcdsrv32.dll) allocations Mdl - - Io, Mdls MdlP - - MDL per processor lookaside list pointers MePr - - In mkup - mpsdrv.sys - MPSDRV upcall request Mm - nt!mm - general Mm Allocations MmAc - nt!mm - Mm access log buffers MmBk - nt!mm - Mm banked sections MmCa - nt!mm - Mm control areas for mapped files MmCd - nt!mm - Mm fork clone descriptors MmCh - nt!mm - Mm fork clone headers MmCi - nt!mm - Mm control areas for images MmCl - nt!mm - Mm fork clone prototype PTEs MmCm - nt!mm - Calls made to MmAllocateContiguousMemory MmCr - nt!mm - Mm fork clone roots MmCt - nt!mm - Mm debug tracing MmCx - nt!mm - info for dynamic section extension MmDb - nt!mm - NtMapViewOfSection service Mmdl - nt!mm - Mm Mdls for flushes MmDm - nt!mm - deferred MmUnlock entries MmDT - nt!mm - Mm debug MmEx - nt!mm - Mm events MmHi - nt!mm - Mm image entry MmHn - nt!mm - Mm sessionwide address name string entry MmHt - nt!mm - session space PTE data MmHv - nt!mm - Mm sessionwide address entry MmIn - nt!mm - Mm inpaged io structures MmLd - nt!mm - Mm load module database MmLn - nt!mm - temporary name buffer for driver loads MmMl - nt!mm - physical memory range information MmPa - nt!mm - pagefile space deletion slist entries MmPd - nt!mm - Mm page table commitment bitmaps MmPg - nt!mm - Mm page table pages at init time Mmpp - nt!mm - Mm prototype PTEs for pool Mmpr - nt!mm - Mm physical VAD roots Mmpv - nt!mm - Physical view VAD info MmRl - nt!mm - temporary readlists for file prefetch MmRp - nt!mm - Mm repurpose logging MmRw - nt!mm - Mm read write virtual memory buffers MmSb - nt!mm - Mm subsections MmSc - nt!mm - subsections used to map data files MmSd - nt!mm - extended subsections used to map data files MmSe - nt!mm - Mm secured VAD allocation MmSg - nt!mm - Mm segments MmSi - nt!mm - Control area security image stubs MmSm - nt!mm - segments used to map data files MmSP - nt!mm - SLIST entries for system PTE NB queues MmSt - nt!mm - Mm section object prototype ptes MmSy - nt!mm - Mm PTE and IO tracking logs MmVd - nt!mm - Mm virtual address descriptors for mapped views MmVs - nt!mm - Mm virtual address descriptors short form (private views) MmWe - nt!mm - Work entries for writing out modified filesystem pages. MmWw - nt!mm - Write watch VAD info Mmww - nt!mm - Write watch bitmap VAD info Mmxx - nt!mm - Mm temporary allocations Mn01 - monitor.sys - ACPI method evaluation output buffer Mn02 - monitor.sys - Unused Mn03 - monitor.sys - Raw E Mn04 - monitor.sys - Cached monitor ID WMI data block Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block Mn08 - monitor.sys - Cached monitor color characteristics WMI data block Mn09 - monitor.sys - Cached supported monitor source modes WMI data block Mn0A - monitor.sys - Registry subkey info buffer Mn0B - monitor.sys - Registry value buffer Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry) Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E Mn0E - monitor.sys - Buffer for E Mn0F - monitor.sys - Buffer for E MNFC - msnfsflt.sys - NFS FS Filter, callback context MNFF - msnfsflt.sys - NFS FS Filter, file context MNFf - msnfsflt.sys - NFS FS Filter, filename buffer MNFI - msnfsflt.sys - NFS FS Filter, instance context MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer MNFS - msnfsflt.sys - NFS FS Filter, stream context MNFs - msnfsflt.sys - NFS FS Filter, general string buffer MNFT - msnfsflt.sys - NFS FS Filter, thread array MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer MQAA - mqac.sys - MSMQ driver, AVL allocations MQAB - mqac.sys - MSMQ driver, CCursor allocations MQAC - mqac.sys - MSMQ driver, generic allocations MQAD - mqac.sys - MSMQ driver, CDistribution allocations MQAG - mqac.sys - MSMQ driver, CGroup allocations MQAH - mqac.sys - MSMQ driver, Heap allocations MQAP - mqac.sys - MSMQ driver, CPacket allocations MQAQ - mqac.sys - MSMQ driver, CQueue allocations MQAT - mqac.sys - MSMQ driver, CTransaction allocations MRXx - - Client side caching for SMB Msdv - - WDM mini driver for IEEE 1394 DV Camera and VCR MsFC - - Mailslot root CCB, A client control block for the top level mailslot directory MsFc - - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these MsFD - - Mailslot root DCB and its name buffer MsFd - - Mailslot data entry write buffer, This is writes buffered inside mailslots MsFf - - Mailslot FCB, File control block, Service side block for each created mailslot. MsFg - - Mailslot global resource MsFN - - Mailslot FCB name buffer, name for each created mailslot MsFn - - Mailslot temporary name buffer MsFr - - Mailslot read buffer, buffer created for pended reads issued. MsFt - - Mailslot query template, used for directory queries. MsFw - - Mailslot work context block, blocks create when we need to timeout reads. MST? - - MSTEE (mstee.sys) MSTa - - associated stream header MSTc - - filer connection MSTd - - data format MSTf - - filter instance MSTp - - pin instance MSTs - - stream header MsvC - ksecdd.sys - Msv/Ntlm client package MuDn - mup.sys - Device name MuFc - mup.sys - File Context MuFn - mup.sys - File name rewrite MuIc - mup.sys - IRP Context MuMc - mup.sys - Master context MuoC - - MOUSE_POOL_TAG Mouse Class Driver Mup - mup.sys - Multiple UNC provider allocations, generic MuPe - mup.sys - Known prefix entry MuPi - mup.sys - Provider info MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation MuQc - mup.sys - Query context MuSf - mup.sys - Surrogate file info MuSi - mup.sys - Surrogate info MuSr - mup.sys - Surrogate IRP info Muta - - Mutant objects MuUn - mup.sys - UNC provider MXF - - DirectMusic (MIDI Transform Filter) Nb?? - - NetBT allocations NBF - - general NBF allocations NBFa - - NBF address object NBFb - - NBF receive buffer NBFc - - NBF connection object NBFd - - NBF packet pool descriptor NBFe - - NBF bind & export names NBFf - - NBF address file object NBFg - - NBF registry path name NBFi - - NBF tdi connection info NBFk - - NBF loopback buffer NBFl - - NBF link object NBFn - - NBF netbios name NBFo - - NBF config data NBFp - - NBF packet NBFq - - NBF query buffer NBFr - - NBF request NBFs - - NBF provider stats NBFt - - NBF connection table NBFu - - NBF UI frame NBFw - - NBF work item NBI - - NwlnkNb transport NBqh - - Non NBS - - general NetBIOS allocations NBSa - - address block NBSc - - connection block NBSe - - EA buffer NBSf - - FCB NBSl - - LANA block NBSn - - copy of user NCB NBSr - - registry allocations NBSx - - XNS NETONE address (connect block) NBSy - - NetBIOS address (connect block) NBSz - - NetBIOS address (listen block) NCSt - - EXIFS NC ND - ndis.sys - general NDIS allocations NDam - ndis.sys - NdisAllocateMemory NDan - ndis.sys - adapter name NDco - ndis.sys - NDIS_TAG_CO NDd - ndis.sys - NDIS_TAG_DBG NDdb - ndis.sys - DMA block NDDl - ndis.sys - NDIS_TAG_DBG_LOG NDdl - ndis.sys - NDIS_TAG_DBG_L NDdp - ndis.sys - NDIS_TAG_DBG_P NDds - ndis.sys - NDIS_TAG_DBG_S NDdt - ndis.sys - NDIS_TAG_DFRD_TMR NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR NDlb - ndis.sys - lookahead buffer NDlp - ndis.sys - NDIS_TAG_LOOP_PKT NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK NDmb - ndis.sys - MAC block NDmr - ndis.sys - map register entry array NDoa - ndis.sys - NDIS_TAG_OID_ARRAY NDob - ndis.sys - open block NDPa - ndis.sys - Apple Talk NDPb - ndis.sys - NBF NDpb - ndis.sys - protocol block NDpf - ndis.sys - NDIS_TAG_FILTER NDPi - ndis.sys - NWLNKIPX NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN NDPn - ndis.sys - NWLNKNB NDPp - ndis.sys - Packet Scheduler. NDpp - ndis.sys - packet pool NDPs - ndis.sys - NWLNKSPX NDPt - ndis.sys - TCPIP NDPw - ndis.sys - WAN_PACKET_TAG NDPX - ndis.sys - NDIS Proxy allocations NDrl - ndis.sys - resource list NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH NDrq - ndis.sys - NDIS_TAG_Q_REQ NDsi - ndis.sys - EISA slot information NDsm - ndis.sys - Cached shared memory descriptor NDst - ndis.sys - NDIS_TAG_STRING NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM NDwi - ndis.sys - NDIS_TAG_WORK_ITEM Nf?? - nfssvr.sys - NFS (Network File System) allocations NfR? - nfsrdr.sys - NFS (Network File System) client re Nls - - Nls strings NlsK - nt!ex - Nls data NmCc - substvol.sys - (AllenPort Virtual Volume) name cache item Nmdd - - NetMeeting display driver miniport 1 MB block None - - call to ExAllocatePool Npf* - npfs.sys - Npfs Allocations NpFC - npfs.sys - ROOT_DCB CCB NpFc - npfs.sys - CCB, client control block NpFD - npfs.sys - DCB, directory block NpFg - npfs.sys - Global storage NpFi - npfs.sys - NPFS client info buffer. NpFn - npfs.sys - Name block NpFq - npfs.sys - Query template buffer used for directory query NpFr - npfs.sys - DATA_ENTRY records (read/write buffers) NpFs - npfs.sys - Client security context NpFW - npfs.sys - Write block NpFw - npfs.sys - Write block NS?? - - Netware server allocations Ntf0 - ntfs.sys - general pool allocation Ntf9 - ntfs.sys - Large Temporary Buffer NtF? - ntfs.sys - NTFS tags based on source module Ntf? - ntfs.sys - NTFS Specific allocation tags NtFA - ntfs.sys - AttrSup.c NtFa - ntfs.sys - AllocSup.c NtFB - ntfs.sys - BitmpSup.c NtFC - ntfs.sys - Create.c NtfC - ntfs.sys - CCB Ntfc - ntfs.sys - CCB_DATA NtFD - ntfs.sys - DevioSup.c NtFd - ntfs.sys - DirCtrl.c NtfD - ntfs.sys - DEALLOCATED_RECORDS NtFE - ntfs.sys - Ea.c NtfE - ntfs.sys - INDEX_CONTEXT NtFF - ntfs.sys - FileInfo.c NtFf - ntfs.sys - FsCtrl.c NtfF - ntfs.sys - FCB_INDEX Ntff - ntfs.sys - FCB_DATA NtFH - ntfs.sys - SelfHeal.c NtFI - ntfs.sys - IndexSup.c NtfI - ntfs.sys - NTFS_IO_CONTEXT Ntfi - ntfs.sys - IRP_CONTEXT NtfK - ntfs.sys - KEVENT Ntfk - ntfs.sys - FILE_LOCK NtFL - ntfs.sys - LogSup.c Ntfl - ntfs.sys - LCB NtFM - ntfs.sys - McbSup.c NtfM - ntfs.sys - NTFS_MCB_ENTRY Ntfm - ntfs.sys - NTFS_MCB_ARRAY NtFN - ntfs.sys - NtfsData.c NtfN - ntfs.sys - NUKEM Ntfn - ntfs.sys - SCB_NONPAGED NtFO - ntfs.sys - ObjIdSup.c Ntfo - ntfs.sys - SCB_INDEX normalized named buffer NtFQ - ntfs.sys - QuotaSup.c NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK Ntfq - ntfs.sys - General Allocation with Quota NtFR - ntfs.sys - RestrSup.c NtfR - ntfs.sys - READ_AHEAD_THREAD Ntfr - ntfs.sys - ERESOURCE NtFS - ntfs.sys - SecurSup.c NtFs - ntfs.sys - StrucSup.c NtfS - ntfs.sys - SCB_INDEX Ntfs - ntfs.sys - SCB_DATA NtfT - ntfs.sys - SCB_SNAPSHOT Ntft - ntfs.sys - SCB (Prerestart) NtFU - ntfs.sys - usnsup.c NtFV - ntfs.sys - VerfySup.c NtFv - ntfs.sys - ViewSup.c NtfV - ntfs.sys - VPB Ntfv - ntfs.sys - COMPRESSION_SYNC NtFW - ntfs.sys - Write.c Ntfw - ntfs.sys - Workspace Ntfx - ntfs.sys - General Allocation NTID - HP Team Network Driver (cpqteam.sys) - Network Driver 8.55 (Memory Leak) - Confirmed NV - - (nVidia video driver) Resource manager data NvLA - - (nVidia video driver) Adapter data NvLa - - (nVidia video driver) Allocation data NvLC - - (nVidia video driver) Channel data NvLc - - (nVidia video driver) Class data NvLD - - (nVidia video driver) Device data NvLd - - (nVidia video driver) DMA data NvLE - - (nVidia video driver) Event data NvLH - - (nVidia video driver) Generic data NvLm - - (nVidia video driver) Mode data NvLP - - (nVidia video driver) Profile data NvLp - - (nVidia video driver) Pusher data NvLR - - (nVidia video driver) Registry data NvLr - - (nVidia video driver) Resource data NvLS - - (nVidia video driver) Statistics data NvLs - - (nVidia video driver) Semaphore data NvLT - - (nVidia video driver) Context data Nwcs - - Client Services for NetWare NwFw - - ntos\tdifwd ObCI - nt!ob - object creation lookaside list ObCi - nt!ob - captured information for ObCreateObject ObDi - nt!ob - object directory ObDm - nt!ob - object device map Obeb - nt!ob - object tables extra bit tables via EX handle.c ObHd - nt!ob - object handle count data base ObjT - nt!ob - object type objects ObNM - nt!ob - name buffer per processor lookaside pointers ObNm - nt!ob - object names ObRt - nt!ob - object reference stack tracing ObSc - nt!ob - Object security descriptor cache block ObSq - nt!ob - object security descriptors (query) ObSt - nt!ob - Object Manager temporary storage Obtb - nt!ob - object tables via EX handle.c ObTR - nt!ob - object table ERESOURCEs ObZn - nt!ob - object zone OCCB - RepliStor.sys - RepliStor File System Mini Filter Driver OCMD - RepliStor.sys - RepliStor File System Mini Filter Driver OCMX - RepliStor.sys - RepliStor File System Mini Filter Driver OHCI - - Open Host Controller Interface for USB ohci - - 1394 OHCI host controller driver OvfL - - EXIFS FCBOVF List Ovfl - - The internal pool tag table has overflowed p2?? - perm2dll.dll - Permedia2 display driver p2cx - perm2dll.dll - Permedia2 display driver p2d3 - perm2dll.dll - Permedia2 display driver p2d6 - perm2dll.dll - Permedia2 display driver p2de - perm2dll.dll - Permedia2 display driver p2ds - perm2dll.dll - Permedia2 display driver p2dt - perm2dll.dll - Permedia2 display driver p2en - perm2dll.dll - Permedia2 display driver p2fi - perm2dll.dll - Permedia2 display driver p2he - perm2dll.dll - Permedia2 display driver p2hw - perm2dll.dll - Permedia2 display driver p2pa - perm2dll.dll - Permedia2 display driver p2pe - perm2dll.dll - Permedia2 display driver p2su - perm2dll.dll - Permedia2 display driver p2tx - perm2dll.dll - Permedia2 display driver P3D? - perm3dd.dll - Permedia3 display driver P3G? - perm3dd.dll - Permedia3 display driver PaeD - - PAE top level directory allocation blocks ParC - - Parallel class driver ParL - - Parallel link driver ParP - - Parallel port driver ParV - - ParVdm driver for vdm< PbCK - DGbWAsfJiFZXk - comment5, PcCi - - WDM audio port class adapter device object stuff PcCr - - WDM audio stuff Pcdb - - Pcmcia bus enumerator, Databook controller specific structures PcDi - - WDM audio stuff PcDm - - DirectMusic MXF objects (WDM audio) PcFM - - WDM audio FM synthesizer PcFp - - WDM audio stuff PciB - pci.sys - PnP pci bus enumerator PcIc - - WDM audio stuff Pcic - - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures PciD - PciDumpEx.sys - Alter\\'s PCI Dump helper driver PcIl - - WDM audio stuff Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures PcNw - - WDM audio stuff PcPc - - WDM audio stuff PcPr - - WDM audio stuff PcSl - - WDM audio stuff PcSt - - WDM audio stuff PcSX - - WDM audio stuff PcSx - - WDM audio stuff PcUs - - WDM audio stuff PDss - nt!po - Po device system state Pf?? - nt!pf - Pf Allocations PfAL - nt!pf - Pf Application launch event data PfAS - nt!pf - Pf Prefetch support array PfDq - nt!pf - Pf Directory query buffers PfED - nt!pf - Pf Generic event data PfEL - nt!pf - Pf Event logging buffers PfET - nt!pf - Pf Entry info tables PfFH - nt!pf - Pf RpContext FileKeyHash buckets PfFK - nt!pf - Pf RpContext FileKeyHashEntry PfLB - nt!pf - Pf Log buffers PfMP - nt!pf - Pf Prefetch metadata buffers PfNL - nt!pf - Pf Name logging buffers PfOB - nt!pf - Pf Oplock buffers PfPB - nt!pf - Pf Pfn query buffers PfRL - nt!pf - Pf Prefetch read list PfRQ - nt!pf - Pf Prefetch request buffers PfSA - nt!pf - Pf Prefetch support array PfTD - nt!pf - Pf Trace Dump PfTt - nt!pf - Pf Translation tables PfVA - nt!pf - Pf VA prefetching buffers PfVH - nt!pf - Pf Prefetch volume handles Pgm? - - Pgm (Pragmatic General Multicast) protocol: RMCast.sys Plcl - - Cache aware pushlock entry. One per processor Plcp - - Cache aware pushlock list (array of puchlock addresses) PmpA - portmap.sys - Portmap address list PmpC - portmap.sys - Portmap device context PmpM - portmap.sys - Portmap mapping PmpR - portmap.sys - Portmap RPCB PNCH - - Power Notify Channel PNCL - - Power Notify channel list PNDP - - Power Abort Dpc Routine PNI - - Power Notify Instance Pnp0 - nt!pnp - PNPMGR rebalance resource request table Pnp1 - nt!pnp - PNPMGR IRP completion context Pnp2 - nt!pnp - PNPMGR device action request Pnp3 - nt!pnp - PNPMGR dock serial numbers Pnp4 - nt!pnp - PNPMGR dock state Pnp5 - nt!pnp - PNPMGR assign resources context Pnp6 - nt!pnp - PNPMGR resource request Pnp7 - nt!pnp - PNPMGR deferred notify entry Pnp8 - nt!pnp - PNPMGR async target device change notify Pnp9 - nt!pnp - PNPMGR HW profile notify PnpA - nt!pnp - PNPMGR HW profile event PnPb - nt!pnp - PnP BIOS resource manipulation PnpB - nt!pnp - PNPMGR setup notify PnpC - nt!pnp - PNPMGR target device notify PnpD - nt!pnp - PNPMGR device class notify PnpE - nt!pnp - PNPMGR veto name PnpF - nt!pnp - PNPMGR eject data PnpG - nt!pnp - PNPMGR generic PnpH - nt!pnp - PNPMGR service name PnpI - nt!pnp - PNPMGR instance path PooL - - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures Pool - - Pool tables, etc. Port - - Port objects PoSL - - Power shutdown event list POWI - nt!po - Power Work Item (executive worker thread work item entry) Ppcd - nt!pnp - PnP critical device database Ppcr - nt!pnp - plug Ppdd - nt!pnp - new Plug Ppde - nt!pnp - routines to perform device removal PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG Ppei - nt!pnp - Eisa related code PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG Ppen - nt!pnp - routines to perform device enumeration Ppin - nt!pnp - plug Ppio - nt!pnp - plug PpLg - nt!pnp - PnP last good. PPMd - - Processor Drivers (Processor Power Management). PPMi - nt!po - Processor Power Manager Idle States PPMp - nt!po - Processor Power Manager Perf States PPMw - nt!po - Processor Power Manager WMI Interface Ppre - nt!pnp - resource allocation and translation Pprl - nt!pnp - routines to manipulate relations list Ppsu - nt!pnp - plug PPT0 - - PPTP_TDIADDR_TAG PPT1 - - PPTP_TDICONN_TAG PPT2 - - PPTP_CONNINFO_TAG PPT3 - - PPTP_ADDRINFO_TAG PPT4 - - PPTP_TIMEOUT_TAG PPT5 - - PPTP_TIMER_TAG PPT6 - - PPTP_TDICOTS_TAG PPT7 - - PPTP_WRKQUEUE_TAG PPT8 - - PPTP_SEND_CTRLDATA_TAG PPT9 - - PPTP_SEND_ACKDATA_TAG PPTa - - PPTP_SEND_DGRAMDESC_TAG PPTb - - PPTP_TDICLTS_TAG PPTc - - PPTP_RECV_CTRLDESC_TAG PPTd - - PPTP_RECV_CTRLDATA_TAG PPTe - - PPTP_RECV_DGRAMDESC_TAG PPTf - - PPTP_RECV_DGRAMDATA_TAG PPTg - - PPTP_RECVDESC_TAG PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer PPTh - - PPTP_ENGINE_TAG PPTi - - PPTP_RECVDATA_TAG PPTP - - PPTP_MEMORYPOOL_TAG PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer PpUB - nt!pnp - PNP_USER_BLOCK_TAG PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG Prcr - processr.sys - Processr driver allocations PRF? - nt!wdi - Performance Allocations PRFd - nt!wdi - Performance Diagnostics Structures Proc - nt!ps - Process objects Prof - - Profile objects Ps - nt!ps - general ps allocations PSAC - pspactld.sys - Windows Share access control tool. PsAp - nt!ps - Process APC queued by user mode process Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread PSC0 - - NDIS Request PSC1 - - GPC Client Vc PSC2 - - WanLink PSC3 - - Miscellaneous allocations PSC4 - - WMI PSC? - - Packet Scheduler (PSCHED) Tags PSCa - - Adapter PsCa - nt!ps - APC queued at thread create time. PSCb - - CallParameters PSCc - - PipeContext PSCd - - FlowContext PSCe - - ClassMapContext PSCf - - Adapter Profile PSCg - - Component PsCr - nt!ps - Working set change record (temporary allocation) PSE3 - pse36.sys - Physical Size Extension driver PsEx - nt!ps - Process exit APC PsFn - nt!ps - Captured image file name buffer (temporary allocation) PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation) PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre PsJa - nt!ps - Job access control state Psjb - nt!ps - Job set array (temporary allocation) PsLd - nt!ps - Process LDT information blocks PsPb - nt!ps - Captured process parameter block (temporary allocation) PsQb - nt!ps - Process quota block PsRl - nt!ps - Captured memory reserve list (temporary allocation) PsSb - nt!ps - Initial process parameter block (temporary allocation) PsSd - nt!ps - Augmented thread security descriptor (temporary allocation) PSTA - nt!po - Po registered system state Psta - nt!ps - Power management system state Pstb - nt!ps - Process tables via EX handle.c PsTf - nt!ps - Job object token filter PsTp - nt!ps - Thread termination port block PsWs - nt!ps - Process working set watch array PSwt - nt!po - Power switch structure PX1 - - ndis ProviderEventLookaside Qnam - - EXIFS Query Name Qp?? - - Generic Packet Classifier (MSGPC) Qpcb - - ClassificationBlock Qpcd - - CfInfoData Qpcf - - ClassificationFamily Qpci - - CfInfo Qpct - - Client blocks Qpdg - - Debug Qpfd - - FragmentDb Qphf - - HandleFactory Qppa - - Pattern blocks Qppd - - GenPatternDb Qpph - - PathHash Qppi - - Pending Irp structures Qppn - - Queued Notifications Qppt - - Protocol Qprz - - Rhizome QuU2 - mpsdrv.sys - MPSDRV upcall response R300 - - ATI video driver R600 - ati2mtag.sys - ATI Radeon WindowsNT Miniport Driver RB?? - - RedBook Filter Driver, static allocations rb?? - - RedBook Filter Driver, dynamic allocations rbBu - - RedBook RBEv - - RedBook rbIp - - RedBook rbIr - - RedBook rbMd - - RedBook rbMp - - RedBook rbRc - - RedBook RBRg - - RedBook RBRl - - RedBook rbRx - - RedBook rbSc - - RedBook RBSe - - RedBook rbSx - - RedBook rbTo - - RedBook RBWa - - RedBook Rcp? - sacdrv.sys - SAC Driver (Headless) RcpA - sacdrv.sys - Internal memory mgr alloc block RcpI - sacdrv.sys - Internal memory mgr initial heap block RcpS - sacdrv.sys - Security related block ReEv - - Resource Event RefT - - Bluetooth reference tracking ReSe - - Resource Semaphore Reso - nt!tm - KTM Transactional ResourceManager ReTa - - Resource Extended Table Rf?? - - Bluetooth RFCOMM TDI driver RfAD - rfcomm.sys - RFCOMM Address RfBB - rfcomm.sys - RFCOMM BRB RfBT - rfcomm.sys - RFCOMM (bthport) RfCB - rfcomm.sys - RCOMMM RfCH - rfcomm.sys - RFCOMM channel RfCN - rfcomm.sys - RFCOMM connect RfDA - rfcomm.sys - RFCOMM data RfFR - rfcomm.sys - RFCOMM frame RfPP - rfcomm.sys - RFCOMM pnp RfRX - rfcomm.sys - RFCOMM receive RfWR - rfcomm.sys - RFCOMM worker RKRW - mpsdrv.sys - MPSDRV work item RpcL - msrpc.sys - debugging log data Rpcl - msrpc.sys - MSRpc memory logging RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere Rpcm - msrpc.sys - MSRpc memory allocations Rpcr - msrpc.sys - MSRpc resources Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller RPrt - rstorprt.sys - Remote Storage Port Driver Rqrv - - Registry query buffer RRle - - RTL_RANGE_LIST_ENTRY_TAG RRlm - - RTL_RANGE_LIST_MISC_TAG RS?? - - Remote Storage RSER - - Error log data RSFN - - File Name RSFO - - File Obj queue RSFS - - Recall Queue RSIO - - Ioctl Queue RSLT - - Long term data RSQI - - Queue info RSSE - - Security info RSVO - - Validate Queue RSWQ - - Work Queue RTLF - mpsdrv.sys - MPSDRV filter RtlT - nt!rtl - Temporary RTL allocation RtPi - - Temp allocation for product type key RWan - rawwan.sys - Raw WAN driver RX00 - - ATI video driver Rx?? - - Rdr2 rdbss.sys stuff RxBm - - buffering manager RxCa - - connection engine address RxCc - - connection engine connection RxCd - - connection engine TDI RxCt - - connection engine transport RxCv - - connection engine VC RxCx - - connection engine misc. (special build only) RxDc - - querydirectory pattern (special build only) RxFc - - FCB RxFx - - Fobx RxIr - - RxContext (IrpContext) RxMs - - misc. RxMx - - minirdr dispatch table RxNc - - NameCache (not currently used) RxNf - - nonpaged FCB RxNr - - NetRoot RxSc - - SrvCall RxSo - - SrvOpen RxSp - - srvcall calldown params (special build only) RxTm - - timer context (special build only) RxVn - - VNetRoot RxVp - - vnetroot calldown params (special build only) RxWq - - work queue S3 - - S3 video driver SBad - - bad block simulator SbAp - SandBox.sys - Agnitum Outpost Firewall\\'s Host Protection Component sbp2 - - Sbp2 1394 storage port driver SbVo - substvol.sys - (AllenPort Virtual Volume) default tag Sc?? - - Mass storage driver tags SCB3 - - Bull SmarTlp PnP SCB8 - - Bull CP8 Transac serial reader ScB? - classpnp.sys - ClassPnP misc allocations ScC? - - CdRom ScCE - - device control synch event ScCG - - disk geometry buffer ScCH - - hitachi error buffer ScCI - - sense info buffers ScCM - - mode data buffer ScCP - - read capacity buffer ScCp - - play active checks ScCQ - - read sub q buffer ScCR - - raw mode read buffer ScCS - - srb allocation ScCT - - read toc buffer ScCt - - toshiba error buffer ScCU - - update capacity path ScCV - - volume control buffer ScCv - - volume control buffer ScD - - generic tag ScD? - - Disk ScDA - - Info Exceptions ScDa - - SMART ScDb - classpnp.sys - ClassPnP debug globals buffer ScDC - - disable cache paths ScDc - - disk allocated completion c ScDG - - disk geometry buffer ScDg - - update disk geometry paths ScDI - - sense info buffers ScDM - - mbr checksum code ScDN - - disk name code ScDP - - read capacity buffer ScDp - - disk partition lists ScDS - - srb allocation ScDs - - start device paths ScDU - - update capacity path ScDW - - work ScF? - - FtDisk ScFt - - FtDisk allocations ScIO - classpnp.sys - ClassPnP device control SCl0 - - Litronic 220 ScL? - classpnp.sys - Classpnp ScLA - classpnp.sys - allocation to check for autorun disable SCLb - - Smart card driver library ScLc - classpnp.sys - Cache filters ScLF - classpnp.sys - File Object Extension ScLf - classpnp.sys - Fault prediction ScLM - classpnp.sys - Media Change Detection ScLm - classpnp.sys - Mount ScLq - classpnp.sys - Release queue ScLW - classpnp.sys - Power ScLw - classpnp.sys - WMI ScMC - - medium changer allocations ScNo - classpnp.sys - ClassPnP notification ScP? - - Scsiport ScPA - - Access Ranges ScPa - - Hold registry data ScPB - - Queuetag BitMap ScPb - - Get Bus Dat Holder ScPC - - reset bus code ScPc - - Fake common buffer ScPD - - SRB_DATA allocations ScPd - - Pnp id strings ScPE - - Scatter gather lists ScPG - - Global memory ScPh - - HwDevice Ext ScPI - - Init data chain ScPi - - Sense Info ScPL - - scatter gather lists ScPl - - remove lock tracking ScPM - - scatter gather lists ScPm - - address mapping lists ScPp - - device & adapter enable ScpP - - scsi PortConfig copies ScPQ - - request sense ScPq - - inquiry data ScPr - - resource list copy ScPS - - registry allocations ScPT - - interface mapping ScPt - - legacy request rerouting ScPu - - device relation structs ScPV - - Device map allocations ScPv - - KEVENT ScPW - - Wmi Requests ScPw - - Wmi Events ScPx - - Report Luns ScPY - - Report Targets ScPZ - - Device name buffer ScR? - - Partition Manager ScRi - - IOCTL buffer ScRp - - Partition entry ScRr - - Remove lock ScRt - - Table entry ScRV - - Volume entry ScRv - - Dependant volume relations lists ScRw - - Power mgmt private work item Scs$ - - Tag for pnp class driver's SRB lookaside list SCS4 - - SCM Microsystems pcmcia reader ScsC - - non ScsD - - non ScsH - - non ScsI - - non ScsL - - non ScsP - - non ScUn - - Default Tag for pnp class driver allocations ScV? - - Dvd functionality in cdrom.sys ScVK - - write buffer for DVD keys ScVk - - read buffer for DVD keys ScVS - - buffer for reads of DVD on Sdba - - Application compatibility Sdb* allocations SdCc - - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES Sdp? - - Bluetooth SDP functionality in BTHPORT.sys SdpC - bthport.sys - Bluetooth SDP client connection SdpD - bthport.sys - Bluetooth SDP database SdpI - bthport.sys - Bluetooth port driver (SDP) Se - nt!se - General security allocations SeAc - nt!se - Security ACL SeAi - nt!se - Security Audit Work Item SeAp - nt!se - Security Audit Parameter Record SeCL - nt!se - Security CONTEXT_TAG Sect - - Section objects SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links. SeFS - nt!se - SEP_FILE_SYSTEM_NOTIFY_CONTEXT SeHa - nt!se - Temp directory query buffer to delete logon session symbolic links. SeLS - nt!se - Security Logon Session tracking array SeLs - nt!se - Security Logon Session SeLu - nt!se - Security LUID and Attributes array SeLw - nt!se - Security LSA Work Item Sema - - Semaphore objects Senm - - Serenum (RS SeOn - nt!se - Security Captured Object Name information SeOt - nt!se - Captured object type array. Used by access check code SePa - nt!se - Process audit image names and captured polity structures SePh - nt!se - Dummy image page hash structure. Used when CI is disabled. SePr - nt!se - Security Privilege Set SeSa - nt!se - Security SID and Attributes SeSc - nt!se - Captured Security Descriptor SeSd - nt!se - Security Descriptor SeSi - nt!se - Security SID SeTa - nt!se - Security Temporary Array SeTd - nt!se - Security Token dynamic part SeTI - ksecdd.sys - Security TargetInfo SeTn - nt!se - Security Captured Type Name information Setp - - SETUPDD SpMemAlloc calls SeUs - nt!se - Security Captured Unicode string sidg - - GDI spooler events SIfs - - Default tag for user's of ntsrv.h SimB - - Simbad (bad sector simulation driver) allocations Sis - - Single Instance Store (ddsisfilter) SisB - - SIS per file object break event SisC - - SIS common store file object SisF - - SIS per file object SisL - - SIS per link object SisS - - SIS SCB Sm?? - - rdr2 smb mini SmAd - - session setup/admin exchange SmCe - - smbmini connection engine SmDc - - dir query buffer (special build only) SmDO - - deferred open context (special build only) SmEc - - echo buffer (special build only) SmFc - - fsctl structures (special build only) SmKs - - Kerberos blob (special build only) SmMa - - mid atlas (special build only) SmMm - - smbmini managed datastructures SmMs - - misc. SmMt - - mailslot buffer (special build only) SmNr - - NetRoot (special build only) SmPi - - pipeinfo buffer (special build only) SmQP - - params for directory query transact (special build only) SmRb - - remote boot SmRw - - read/write path SmRx - - minirdr generated RxContext (special build only) SmSe - - Session (special build only) SmSr - - Server (special build only) SmTp - - server transport tag SmTr - - transact exchange SmVc - - smbmini connectionengine VC (special build only) SmVr - - VNetroot (special build only) SNBX - SandBox.sys - Agnitum Outpost Firewall\\'s Host Protection Component SPX - - Nwlnkspx transport SQOS - - Security quality of service in IO Sr?? - sr.sys - System Restore file system filter driver SrCo - sr.sys - SR's control object SrDB - sr.sys - Debug information for lookup blob SrDL - sr.sys - Device list SRdm - scsirdma.sys - Infiniband SRP driver SrFE - sr.sys - File information buffer SrFN - sr.sys - File name SrHB - sr.sys - Hash bucket SrHH - sr.sys - Hash header SrHK - sr.sys - Hash key SrLB - sr.sys - Log buffer SrLC - sr.sys - Logging context SrLE - sr.sys - Log entry SrLT - sr.sys - Lookup blob SrMP - sr.sys - Mount point information SrOI - sr.sys - Overwrite information SrPC - sr.sys - Persistant configuration information SrRB - sr.sys - Rename buffer SrRG - sr.sys - Logger context SrRH - sr.sys - Reparse data size SrRR - sr.sys - Registry information SrSC - sr.sys - Stream contexts SrSD - sr.sys - Security data information SrST - sr.sys - Stream data information SrTI - sr.sys - Directory delete information SrWI - sr.sys - Work queue item SslC - ksecdd.sys - SSL kernel mode client allocations ST* - - New MMC compliant storage drivers Stac - - Stack Trace Database STli - - Alter\\'s NT kernel string manipulation library Strg - - Dynamic Translated strings Strm - - Streams and streams transports allocations SW?? - - Software Bus Enumerator SWbi - - bus ID SWbr - - bus reference SWda - - POOLTAG_DEVICE_ASSOCIATION SWdn - - device name SWdr - - POOLTAG_DEVICE_DRIVER_REGISTRY SWfd - - POOLTAG_DEVICE_FDOEXTENSION SWid - - device ID SWii - - instance ID SWip - - POOLTAG_DEVICE_INTERFACEPATH SWki - - key information SwMi - - SWMidi KS filter (WDM Audio) SWpd - - POOLTAG_DEVICE_PDOEXTENSION SWre - - relations SWrp - - reparse string SWrs - - reference string Symb - - Symbolic link objects Symt - - Symbolic link target strings SYPK - syspart.lib - Kernel mode system partition detection allocations SYSA - - Sysaudio (wdm audio) TAPI - - ntos\ndis\ndistapi TC?? - TCP - TCP/IP network protocol TCh? - - TCP/IP header pools TCPC - - TCP connection pool TCPr - - TCP request pool TCPT - - TCB pool TCPY - - SYN TDIc - - TDI resource TDId - - TDI resource TDIe - - TDI resource TDIf - - TDI resource TDIg - - TDI resource TDIk - - TDI resource TDIu - - TDI resource TDIv - - TDI resource thdd - - DirectDraw/3D handle manager table Thre - nt!ps - Thread objects Thrm - - Thermal zone structure Time - nt!ke - Timer objects TmDn - nt!tm - Tm Dynamic Name TmLo - nt!tm - Tm Log Entries TmNo - nt!tm - Tm Notification TmPa - nt!tm - Tm Propagate Argument TmPb - nt!tm - Tm Propagation Buffer TmPe - nt!tm - Tm Enlistment Pointers TmPi - nt!tm - Tm Protocol Information TmPo - nt!tm - Tm Propagation Output TmPp - nt!tm - Tm Protocol Pointers TmPr - nt!tm - Tm Protocol TmPx - nt!tm - Tm Protocol Array TmRi - nt!tm - Tm Recovery Information TmRq - nt!tm - Tm Propagation Request Toke - nt!se - Token objects TpWc - nt!ex - Threadpool minipacket context TpWo - nt!ex - Threadpool worker factory objects Tran - - EXIFS Translate TSBV - - WDM mini driver for Toshiba 750 capture TSch - rdpwd.sys - RDPWD TSdd - rdpdd.sys - RDPDD TSic - termdd.sys - Terminal Services TSlc - rdpwd.sys - RDPWD TSmc - - PDMCS Tspk - ksecdd.sys - TS Package kernel mode client allocations TSq - - Terminal Services TSrp - termdd.sys - Terminal Services TSwd - rdpwd.sys - RDPWD TTFC - - Font file cache Ttfd - - TrueType Font driver Tun4 - - Tunnel cache allocation for long file name TunK - - Tunnel cache temporary key value TunL - - Tunnel cache lookaside TunP - - Tunnel cache oddsized pool Txcl - ntfs.sys - TXF_CLR_RESERVATION_CHUNK Txdl - ntfs.sys - TXF_DELETED_LINK Txdr - ntfs.sys - TXF_DEFAULT_READER_SECTION Txfc - ntfs.sys - TXF_FCB Txfe - ntfs.sys - TXF_FCB_EXTENSION Txfi - ntfs.sys - TXF_FCB_INFO Txfl - ntfs.sys - TXF_FCB_CLEANUP Txfo - ntfs.sys - TXF_FO Txfq - ntfs.sys - Txf quota block Txgd - ntfs.sys - TxfData global structure Txis - ntfs.sys - TXF_ISO_SNAPSHOT Txlf - ntfs.sys - TXF_FCB (large) Txls - ntfs.sys - TXF_CANCEL_LSN Txre - ntfs.sys - TXF_TOPS_RANGE_ENTRY Txsc - ntfs.sys - TXF_SCB Txsp - ntfs.sys - TXF_SCB_PTR Txtc - ntfs.sys - TXF_TRANS_CANCEL_LIST Txtr - ntfs.sys - TXF_TRANS (Txf transaction context) Txvc - ntfs.sys - TXF_VCB Txvd - ntfs.sys - TXF_VSCB_TO_DEREF Txvf - ntfs.sys - TXF_VSCB_FILE_SIZES Txvl - ntfs.sys - TXF_VSCB Type - - Type objects UAhH - QPbBFmBiEHZmZzLnoU - comment1, Uata - uniata.sys - Alter\\'s UniATA driver allocations Uc?? - http.sys - i.e., the case of the leading "Ul" or "Uc" has been reversed. Ucac - http.sys - Auth Cache Pool UCAM - - USB digital camera library UcCO - http.sys - Client Connection Ucmp - http.sys - Multipart String Buffer Ucre - http.sys - Receive Response Ucrp - http.sys - Response App Buffer Ucrq - http.sys - Request Pool UcSc - http.sys - Common Server Information UcSN - http.sys - Server name UcSP - http.sys - Process Server Information UcSp - http.sys - Sspi Pool UcST - http.sys - Server info table Uctd - http.sys - Response Tdi Buffer Ucte - http.sys - Entity Pool Ucto - http.sys - Tdi Objects Pool Udf1 - - Udfs file set descriptor buffer Udf2 - - Udfs volume descriptor sequence descriptor buffer Udfb - - Udfs IO buffer UdfC - - Udfs CRC table Udfc - - Udfs IRP context UdfD - - Udfs FID buffer for view spanning Udfd - - Udfs file Fcb Udfe - - Udfs enumeration match expression UdfF - - Udfs nonpaged Fcb errata Udff - - Udfs normalized full filename UdfI - - Udfs IO context Udfi - - Udfs directory Fcb UdfL - - Udfs IRP context lite (delayed close) Udfl - - Udfs Lcb Udfp - - Udfs Pcb UdfS - - Udfs short file name Udfs - - Udfs Sparing Mcb UdfT - - Udfs generic table entry Udft - - Udfs CDROM TOC UDFV - - Udfs volume descriptor sequence descriptor buffer Udfv - - Udfs Vpb Udfx - - Udfs Ccb Udp - - Udp protocol (TCP/IP driver) Ufsc - - User FULLSCREEN UHCD - - Universal Host Controller (USB UHUB - - Universal Serial Bus Hub Ul?? - http.sys - tags. Note: In UlAB - http.sys - Auxiliary Buffer UlAO - http.sys - App Pool Object UlAP - http.sys - App Pool Process UlBL - http.sys - Binary Log File Entry UlBO - http.sys - Outstanding i/o UlCC - http.sys - Control Channel UlCE - http.sys - Config Group Tree Entry UlCH - http.sys - Config Group Tree Header UlCI - http.sys - Config Group URL Info UlCJ - http.sys - Config Group Object Pool UlCK - http.sys - Chunk Tracker UlCL - http.sys - Config Group LogDir UlCl - http.sys - Connection RefTraceLog UlCO - http.sys - Connection UlCT - http.sys - Config Group Timestamp UlCY - http.sys - Connection Count Entry UlDB - http.sys - Debug UlDC - http.sys - Data Chunks array UlDO - http.sys - Disconnect Object UlDR - http.sys - Deferred Remove Item UlDT - http.sys - Debug Thread Pool UlEP - http.sys - Endpoint UlFA - http.sys - Force Abort Work Item UlFC - http.sys - File Cache Entry Ulfc - http.sys - Uri Filter Context UlFD - http.sys - Noncached File Data UlFP - http.sys - Filter Process UlFR - http.sys - Dummy Filter Receive Buffer UlFT - http.sys - Filter Channel UlFU - http.sys - Full Tracker UlFW - http.sys - Filter Write Tracker UlHC - http.sys - Http Connection UlHc - http.sys - Http Connection RefTraceLog UlHL - http.sys - Internal Request RefTraceLog UlHR - http.sys - Internal Request UlHT - http.sys - Hash Table UlHV - http.sys - Header Value UlIC - http.sys - Irp Context UlID - http.sys - Conn ID Table UlIR - http.sys - Internal Response UlLD - http.sys - Log Field UlLF - http.sys - Log File Entry UlLG - http.sys - Log Generic UlLH - http.sys - Log File Handle UlLL - http.sys - Log File Buffer UlLS - http.sys - Ansi Log Data Buffer UlLT - http.sys - Binary Log Data Buffer UlNO - http.sys - NSGO Pool UlNP - http.sys - Non UlOE - http.sys - Endpoint OwnerRefTraceLog PoolTag UlOR - http.sys - Owner RefTrace Signature UlOT - http.sys - Opaque ID Table UlPB - http.sys - APool Proc Binding UlPL - http.sys - Pipeline UlQF - http.sys - TCI Filter UlQG - http.sys - TCI Generic UlQI - http.sys - TCI Interface UlQL - http.sys - TCI Flow UlQT - http.sys - TCI Tracker UlQW - http.sys - TCI WMI UlRB - http.sys - Receive Buffer UlRD - http.sys - Registry Data UlRE - http.sys - Request Body Buffer UlRP - http.sys - Request Buffer UlRR - http.sys - Request Buffer References UlRS - http.sys - Non UlRT - http.sys - RefTraceLog PoolTag UlSC - http.sys - SSL Cert Data UlSD - http.sys - Security Data UlSL - http.sys - StringLog PoolTag UlSl - http.sys - StringLog Buffer PoolTag UlSO - http.sys - Site Counter Entry UlSS - http.sys - Simple Status Item UlTA - http.sys - Address Pool UlTD - http.sys - UL_TRANSPORT_ADDRESS UlTT - http.sys - Thread Tracker UlUB - http.sys - URL Buffer UlUC - http.sys - Uri Cache Entry UlUH - http.sys - HTTP Unknown Header UlUL - http.sys - URL UlUM - http.sys - URL Map UlVH - http.sys - Virtual Host UlWC - http.sys - Work Context UlWI - http.sys - Work Item UndP - - EXIFS Underlying Path Urdr - win32k!SetRedirectionBitmap - REDIRECT Usac - win32k!_CreateAcceleratorTable - ACCEL Usai - win32k!zzzAttachThreadInput - ATTACHINFO Usal - win32k!InitSwitchWndInfo - ALTTAB USBB - bthusb.sys - Bluetooth USB minidriver USBD - - Universal Serial Bus Class Driver Usbg - win32k!xxxLogClipData - DEBUG Uscb - win32k!_ConvertMemHandle - CLIPBOARD Uscc - win32k!AllocCallbackMessage - CALLBACK Usci - win32k!InitSystemThread - CLIENTTHREADINFO Uscl - win32k!ClassAlloc - CLASS Uscm - win32k!InitScancodeMap - SCANCODEMAP Uscp - win32k!CreateDIBPalette - CLIPBOARDPALETTE Uscr - win32k!NtUserSetSysColors - COLORS Usct - win32k!CkptRestore - CHECKPT Uscu - win32k!_CreateEmptyCursorObject - CURSOR Uscv - win32k!NtUserSetSysColors - COLORVALUES Usd1 - win32k!FreeListAdd - DDE1 Usd2 - win32k!_DdeSetQualityOfService - DDE2 Usd4 - win32k!AddPublicObject - DDE4 Usd5 - win32k!xxxCsEvent - DDE5 Usd6 - win32k!xxxCsEvent - DDE6 Usd7 - win32k!xxxCsEvent - DDE7 Usd8 - win32k!xxxMessageEvent - DDE8 Usd9 - win32k!xxxCsDdeInitialize - DDE9 UsdA - win32k!NewConversation - DDEa UsdB - win32k!Createpxs - DDEb Usdc - win32k!CreateCacheDC - DCE UsdD - win32k!NtUserfnDDEINIT - DDEd UsdE - win32k!xxxClientCopyDDEIn1 - DDE UsDI - win32k!CreateDeviceInfo - DEVICEINFO Usdi - win32k!CreateMonitor - DISPLAYINFO Usds - win32k!xxxDragObject - DRAGDROP Usdv - win32k!NtUserfnINDEVICECHANGE - DEVICECHANGE User - win32k!InitCreateUserCrit - ERESOURCE Usev - win32k!xxxPollAndWaitForSingleObject - EVENT Usgh - win32k!NtUserUserHandleGrantAccess - GRANTEDHANDLES Usgl - win32k!CreateShadowTL - GLOBALTHREADLOCK Usgt - win32k!AddGhost - GHOST Usha - win32k!AllocateHidData - HIDDATA UshD - Win32k!AllocateHidDesc - HIDDESC Ushk - win32k!_RegisterHotKey - HOTKEY Usih - win32k!SetImeHotKey - IMEHOTKEY Usim - win32k!CreateInputContext - IME Usjb - win32k!CreateW32Job - W32JOB Usjx - win32k!JobCalloutAddProcess - W32JOBEXTRA Uskb - win32k!xxxLoadKeyboardLayoutEx - KBDLAYOUT Uske - win32k!GetKbdExId - KBDEXID Uskf - win32k!LoadKeyboardLayoutFile - KBDFILE Usks - win32k!PostUpdateKeyStateEvent - KBDSTATE Uskt - win32k!ReadLayoutFile - KBDTABLE Usla - win32k!InitLockRecordLookaside - LOOKASIDE Usld - win32k!GrowLogIfNecessary - LOGDESKTOP Uslr - win32k!InitLockRecordLookaside - LOCKRECORD Usmi - win32k!MirrorRegion - MIRROR Usml - win32k!MsgLookupTableAlloc - MESSAGE FILTER TABLE Usmr - win32k!SnapshotMonitorRects - MONITORRECTS Usms - win32k!xxxMoveSize - MOVESIZE Usmt - win32k!xxxMNAllocMenuState - MENUSTATE Usno - win32k!zzz - NONE Usny - win32k!CreateNotify - NOTIFY Uspi - win32k!MapDesktop - PROCESSINFO Uspm - win32k!MNAllocPopup - POPUPMENU Uspn - win32k!CreateProfileUserName - PROFILEUSERNAME Uspo - win32k!QueuePowerRequest - POWER Uspp - win32k!AllocateAndLinkHidTLCInfo - PNP Uspr - win32k!GetPrivateProfileStruct - PROFILE Usqm - win32k!InitQEntryLookaside - QMSG Usqu - win32k!InitQEntryLookaside - Q Usrt - win32k!xxxDrawMenuItemText - RTL Ussa - win32k!xxxBroadcastMessage - SMS_ASYNC Ussb - win32k!CreateSpb - SPB Ussc - win32k!xxxInterSendMsgEx - SMS_CAPTURE Ussd - win32k!xxxAddShadow - SHADOW Usse - win32k!SetDisconnectDesktopSecurity - SECURITY Ussi - win32k!NtUserSendInput - SENDINPUT Ussm - win32k!InitSMSLookaside - SMS Usss - win32k!xxxBroadcastMessage - SMS_STRING Usst - win32k!xxxSBTrackInit - SCROLLTRACK Ussw - win32k!_BeginDeferWindowPos - SWP Ussy - win32k!xxxDesktopThread - SYSTEM Ustd - win32k!TrackAddDesktop - TRACKDESKTOP Usti - win32k!AllocateW32Thread - THREADINFO Ustk - win32k!HeavyAllocPool - STACK Ustm - win32k!InternalSetTimer - TIMER Usto - win32k!xxxConnectService - TOKEN Usts - win32k!_Win32CreateSection - SECTION Ustx - win32k!NtUserDrawCaptionTemp - TEXT Usty - win32k!NtUserResolveDesktopForWOW - TEXT2 Usub - win32k!NtUserToUnicodeEx - UNICODEBUFFER Usvi - win32k!ResizeVisExcludeMemory - VISRGN Usvl - win32k!VWPLAdd - VWPL Uswd - win32k!xxxCreateWindowEx - WINDOW Uswe - win32k!_SetWinEventHook - WINEVENT Uswl - win32k!BuildHwndList - WINDOWLIST Uswo - win32k!zzzInitTask - WOWTDB Uswp - win32k!xxxRegisterUserHungAppHandlers - WOWPROCESSINFO Uswt - win32k!xxxUserNotifyProcessCreate - WOWTHREADINFO Uvpb - dwudf.sys - (DVD Write Now) VPB Vad - nt!mm - Mm virtual address descriptors VadF - nt!mm - VADs created by a FreeVM splitting Vadl - nt!mm - Mm virtual address descriptors (long) VadS - nt!mm - Mm virtual address descriptors (short) VBus - vmbus.sys - Virtual Machine Bus Driver VDM - nt!vdm - ntosvdm VdPN - dxgkrnl.sys - Video display mode management VfIT - nt!Vf - Verifier Import Address Table information VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION) VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport ViMm - dxgkrnl.sys - Video memory manager virt - vmm.sys - Virtual Machine Manager (VPC/VS) ViSh - dxgkrnl.sys - Video scheduler VM - volmgr.sys - General allocations Vm - volmgrx.sys - General allocations VM?? - volmgr.sys - Volume Manager Vm?? - volmgrx.sys - Volume Manager Extension VmBl - volmgrx.sys - Raw configuration blocks VmBu - volmgrx.sys - I/O buffers VmCc - volmgrx.sys - Configuration copies VmCo - volmgrx.sys - Configurations VmCp - volmgrx.sys - Copies VmCr - volmgrx.sys - Completion routine contexts VmDc - volmgrx.sys - Device changes VmDd - volmgrx.sys - Disk devices VmDh - volmgrx.sys - Disk headers VmLa - volmgrx.sys - Drive layouts VmLb - volmgrx.sys - Log blocks VmLc - volmgrx.sys - Log copies VmLo - volmgrx.sys - Logs VmLr - volmgrx.sys - Log raw content VmMm - volmgrx.sys - Mirror emergency mappings VmNe - volmgrx.sys - Notification entries VmOb - volmgrx.sys - I/O objects VmP0 - volmgrx.sys - Packets VmP1 - volmgrx.sys - Small packets VmP2 - volmgrx.sys - Large packets VmP3 - volmgrx.sys - Huge packets VmPa - volmgrx.sys - Packs VmPd - volmgrx.sys - Physical disks VmPs - volmgrx.sys - Arrays of packets VmRb - volmgrx.sys - Raw record buffers VmRc - volmgrx.sys - Raw configurations VmRe - volmgrx.sys - Records VmRi - volmgrx.sys - Record information VmRm - volmgrx.sys - RAID VmRr - volmgrx.sys - Raw records VmTa - volmgrx.sys - I/O tasks VmTc - volmgrx.sys - Table of contents VmTe - volmgrx.sys - Table of contents entries VmTx - volmgrx.sys - Transactions VmUe - volmgrx.sys - User entries VmVd - volmgrx.sys - Volume devices VmWi - volmgrx.sys - Work items VoS? - volsnap.sys - VolSnap (Volume Snapshot Driver) VoSa - volsnap.sys - Application information allocations VoSb - volsnap.sys - Buffer allocations VoSc - volsnap.sys - Snapshot context allocations VoSd - volsnap.sys - Diff area volume allocations VoSf - volsnap.sys - Diff area file allocations VoSh - volsnap.sys - Bit history allocations VoSi - volsnap.sys - Io status block allocations VoSm - volsnap.sys - Bitmap allocations VoSo - volsnap.sys - Old heap entry allocations VoSp - volsnap.sys - Pnp id allocations VoSr - volsnap.sys - Device relations allocations VoSs - volsnap.sys - Short term allocations VoSt - volsnap.sys - Temp table allocations VoSw - volsnap.sys - Work queue allocations VoSx - volsnap.sys - Dispatch context allocations Vpb - - Io, vpb's Vprt - videoprt.sys - Video port for legacy (pre VraP - - parallel class driver vTDR - dxgkrnl.sys - Video timeout detection/recovery Vtfd - - Font file/context Wait - - NtWaitForMultipleObjects Wan? - - NdisWan Tags (PPP Framing module for Remote Access) WanA - - BundleCB WanB - - ProtocolCB/LinkCB WanC - - DataDesc WanD - - WanRequest WanE - - LoopbackDesc WanG - - MiniportCB WanH - - OpenCB WanI - - IoPacket WanJ - - LineUpInfo WanK - - Unicode String Buffer WanL - - Protocol Table WanM - - Connection Table WanN - - NdisPacketPool Desc WanQ - - DataBuffer WanR - - WanPacket WanS - - AfCB/SapCB/VcCB WanT - - Transform Driver WanV - - RC4 Encryption Context WanW - - SHA Encryption WanX - - Send Compression Context WanY - - Recv Compression Context WanZ - - Protocol Specific Info WCbf - dwudf.sys - (DVD Write Now) Cache storage buffer WCrf - dwudf.sys - (DVD Write Now) Cache frame list WCtx - dwudf.sys - (DVD Write Now) Cache context block Wdm - - WDM WDMA - - WDM Audio Wdog - watchdog.sys - Watchdog object/context allocation werk - - WER kernel mode reporting allocation WimF - wimfsf.sys - WIM Boot Filter WMca - - WMI MCA Handling WmDS - - Wmi DataSource chunks WmGE - - Wmi GuidEntry chunks WmiA - - Wmi ACPI mapper WmiC - - Wmi Create Pump Thread Work Item WmiD - - Wmi Registration DataSouce WmiG - - Allocation of WMIGUID WmiI - - Wmi Instance Names Wmii - - Wmi InstId chunks Wmij - - Wmi GuidMaps WmiL - - WmiLIb Wmim - - Wmi KM to UM Notification Buffers WmiN - - Wmi Notification Notification Packet Wmin - - Wmi Notification Slot Chunks Wmip - - Wmi General purpose allocation Wmiq - - Wmi NBQ Blocks WmiR - - Wmi Registration info blocks WmIS - - Wmi InstanceSet chunks Wmis - - Wmi SysId allocations Wmit - - Wmi Trace Wmiw - - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL Wmiz - - Wmi MCA Insertions debug code WmMR - - Wmi MofResouce chunks WMsG - win32k.sys - Winlogon kernel mode IPC interface Wrp? - - WanArp Tags (ARP module for Remote Access) Wrpa - - WAN_ADAPTER_TAG Wrpc - - WAN_CONN_TAG Wrpd - - WAN_DATA_TAG Wrpf - - FREE_TAG (checked builds only) Wrph - - WAN_HEADER_TAG Wrpi - - WAN_INTERFACE_TAG Wrpn - - WAN_NOTIFICATION_TAG Wrpr - - WAN_REQUEST_TAG Wrps - - WAN_STRING_TAG Wrpw - - WAN_PACKET_TAG WvCy - - WDM Audio WaveCyc port WvPc - - WDM Audio WavePCI port xCVD - mrxdav.sys - AsyncEngineContext Tag XDR? - rpcxdr.sys - NFS (Network File System) XDR driver xSMB - smbmrx.sys - IFSKIT sample SMB mini Xtra - - EXIFS Extra Create XWan - - ndisusrwan allocations ysd8 - win32k.sys - User DDE8 ysd9 - win32k.sys - User DDE9 ysda - win32k.sys - User DDEa ysdb - win32k.sys - User DDEb ysdc - win32k.sys - User DDEc ysdd - win32k.sys - User DDEd Zowz - WsFbbPoDzRcP - comment4, ZsaB - - EXIFS ZeroBlock _ATI - - ATI video driver _LCD - monitor.sys - Monitor PDO name buffer