All components of Windows NT marks allocated memory blocks with unique Tag.
Tag is 4-byte word, that can be represented as ASCII string. It is used
for monitoring of allocated memory, bounds checking, etc. In general, this information is
available at Microsoft's web-site (http://support.microsoft.com),
inside WinDbg package (search for file pooltag.txt).
Here is the mirror.
NEW! Below you can find updatable pool-tag database. You can
submit there information about tags used in your drivers.
| Tag | Source | Description |
8042 (0) | i8042prt.sys | PS/2 kb and mouse |
@GMM (0) | | (Intel video driver) Memory manager |
@KCH | | (Intel video driver) Chipset specific service |
@MP | | (Intel video driver) Miniport related memory |
@SB | | (Intel video driver) Soft BIOS |
Abos (0) | | Abiosdsk |
AcdM | | TDI AcdObjectInfoG |
AcdN | | TDI AcdObjectInfoG |
Acp* | acpi.sys | ACPI Pooltags |
ACPI | acpi.sys | ACPI |
Adap | | Adapter objects |
Adbe | | Adobe's font driver |
AdSv | vmsrvc.sys | Virtual Machines Additions Service |
AECi | | filter object interface for MS acoustic echo canceller |
Afd? | afd.sys | AFD objects |
AfdA | afd.sys | Afd EA buffer |
Afda | afd.sys | Afd APC buffer (NT 3.51 only) |
AfdB | afd.sys | Afd data buffer |
AfdC | afd.sys | Afd connection structure |
Afdc | afd.sys | Afd connect data buffer |
AfdD | afd.sys | Afd debug data |
Afdd | afd.sys | Afd disconnect data buffer |
AfdE | afd.sys | Afd endpoint structure |
AfdF | afd.sys | Afd TransmitFile info |
Afdf | afd.sys | Afd TransmitFile debug data |
AfdG | afd.sys | Afd group table |
Afdh | afd.sys | Afd address list change buffer |
AfdI | afd.sys | Afd TDI data |
Afdi | afd.sys | Afd "set inline mode" buffer |
AfdL | afd.sys | Afd local address buffer |
Afdl | afd.sys | Afd lookaside lists buffer |
AfdP | afd.sys | Afd poll info |
Afdp | afd.sys | Afd transport IRP buffer |
AfdQ | afd.sys | Afd work queue item |
Afdq | afd.sys | Afd routing query buffer |
AfdR | afd.sys | Afd remote address buffer |
Afdr | afd.sys | Afd ERESOURCE buffer |
AfdS | afd.sys | Afd security info |
AfdT | afd.sys | Afd transport info |
Afdt | afd.sys | Afd transport address buffer |
AfdW | afd.sys | Afd work item |
AfdX | afd.sys | Afd context buffer |
AFMM | afw.sys, afwcore.sys | Agnitum Outpost Firewall Drivers |
Afp | | SFM File server |
AlCI | nt!alpc | ALPC communication info |
AlEv | nt!alpc | ALPC eventlog queue |
AlHa | nt!alpc | ALPC port handle table |
AlIn | nt!alpc | ALPC Internal allocation |
AlMs | nt!alpc | ALPC message |
ALPC | nt!alpc | ALPC port objects |
AlRe | nt!alpc | ALPC section region |
AlRr | nt!Alpc | ALPC resource reserves |
AlSc | nt!alpc | ALPC section |
AlSe | nt!alpc | ALPC client security |
AlVi | nt!alpc | ALPC view |
Aml* | | ACPI AMLI Pooltags |
AoE* | aoebus.sys | ATA over Ethernet driver |
APIC | pnpapic.sys | I/O APIC Driver |
ArbA | nt!arb | ARBITER_ALLOCATION_STATE_TAG |
ArbL | nt!arb | ARBITER_ORDERING_LIST_TAG |
ArbM | nt!arb | ARBITER_MISC_TAG |
ArbR | nt!arb | ARBITER_RANGE_LIST_TAG |
Arp? | | ATM ARP server objects, atmarps.sys |
ArpA | | AtmArpS address |
ArpB | | AtmArpS buffer space |
ARPC | atmarpc.sys | ATM ARP Client |
ArpI | | AtmArpS Interface structure |
ArpK | | AtmArpS ARP block |
ArpM | | AtmArpS MARS structure |
ArpR | | AtmArpS NDIS request |
ArpS | | AtmArpS SAP structure |
Asy1 | | ndis / ASYNC_IOCTX_TAG |
Asy2 | | ndis / ASYNC_INFO_TAG |
Asy3 | | ndis / ASYNC_ADAPTER_TAG |
Asy4 | | ndis / ASYNC_FRAME_TAG |
ATac | AppTag ATR command buffer | |
AtC | | IDE disk configuration |
AtD | | atdisk.c |
ATdi | AppTag cliendata index buffer | |
ATdt | AppTag cliendata temp buffer | |
ATFb | AppTag file id buffer | |
ATgb | AppTag guid buffer | |
ATIX | | WDM mini drivers for ATI tuner, xbar, etc. |
Atk | | Appletalk transport |
AtmA | | Atoms |
ATmp | AppTag mount point | |
AtmT | | Atom tables |
ATMU | atmuni.sys | ATM UNI Call Manager |
Atom | | Atom Tables |
ATon | AppTag object name | |
ATub | AppTag user buffer | |
AudC | wdmaud.sys | MMSYSTEM Wave/Midi API mapper |
AudL | wdmaud.sys | MMSYSTEM Wave/Midi API mapper |
AuxL | | EXIFS Auxlist |
Bat? (0) | | Battery Class drivers |
BatC | | Composite battery driver |
BatM | | Control method battery driver |
BatS | | Smart battery driver |
Batt | | Battery class driver |
BCDK | nt!init | Kernel boot configuration data. |
BCSP | bthbcsp.sys | Bluetooth BCSP minidriver |
BIG | nt!mm | Large session pool allocations (ntosexpool.c) |
BlCc | blkcache.sys | Block Cache Driver |
Bmfd | | Font related stuff |
BT3C | bt3c.sys | Bluetooth 3COM minidriver |
BT8x | | WDM mini drivers for Brooktree 848,829, etc. |
BTHP | bthport.sys | Bluetooth port driver (generic) |
BthS | bthport.sys | Bluetooth port driver (security) |
BTME | bthenum.sys | Bluetooth enumerator |
BTMO | bthmodem.sys | Bluetooth modem |
BTPT | | Bluetooth transport protocol library |
BTSR | bthser.sys | Bluetooth serial minidriver |
BTUR | bthuart.sys | Bluetooth UART minidriver |
Bu* | | burneng.sys from adaptec |
Call (0) | nt!ex | kernel callback object signature |
call | | debugging call tables |
Cbrb | nt!ExAllocateCallBack | Callback registration block (PEX_CALLBACK_FUNCTION, ptr to 'CMcb' structure) |
CBRe | | CallbackRegistration |
Cc | nt!cc | Cache Manager allocations (catch |
CcBc | nt!cc | Cache Manager Bcb from pool |
CcBm | nt!cc | Cache Manager Bitmap |
CcBn | nt!cc | Cache Manager Bcb trim notification entry |
CcBr | nt!cc | Cache Manager Bitmap range |
CcBz | nt!cc | Cache Manager Bcb Zone |
CcDw | nt!cc | Cache Manager Deferred Write |
CcEv | nt!cc | Cache Manager Event |
CcFn | nt!cc | Cache Manager File name for popups |
CcMb | nt!cc | Cache Manager Mbcb |
CcOb | nt!cc | Cache Manager Overlap Bcb |
CcPB | nt!ccpf | Prefetcher trace buffer |
CcPC | nt!ccpf | Prefetcher context |
CcPc | nt!cc | Cache Manager Private Cache Map |
CcPD | nt!ccpf | Prefetcher trace dump |
CcPF | nt!ccpf | Prefetcher file name |
CcPf | nt!ccpf | Prefetcher |
CcPh | nt!ccpf | Prefetcher header preallocation |
CcPI | nt!ccpf | Prefetcher intermediate table |
CcPL | nt!ccpf | Prefetcher read list |
CcPM | nt!ccpf | Prefetcher metadata |
CcPp | nt!ccpf | Prefetcher instructions |
CcPq | nt!ccpf | Prefetcher query buffer |
CcPS | nt!ccpf | Prefetcher scenario |
CcPs | nt!ccpf | Prefetcher section table |
CcPT | nt!ccpf | Prefetcher trace |
CcPv | nt!ccpf | Prefetcher volume info |
CcPw | nt!ccpf | Prefetcher boot worker |
CcSc | nt!cc | Cache Manager Shared Cache Map - ok |
CctX | | EXIFX FCB Commit CTX |
CcVa | nt!cc | Cache Manager Initial array of Vacbs |
CcVl | nt!cc | Cache Manager Vacb Level structures (large streams) |
CcVp | nt!cc | Cache Manager Array of Vacb pointers for a cached stream |
CcWK | nt!cc | Kernel Cache Manager lookaside list |
CcWk | nt!cc | Kernel Cache Manager lookaside list |
CcWq | nt!cc | Cache Manager Work Queue Item |
CcZe | nt!cc | Cache Manager Buffer of Zeros |
CdA | | CdAudio filter driver |
Cdcc | cdfs.sys | CDFS Ccb |
Cddn | cdfs.sys | CDFS CdName in dirent |
Cdee | cdfs.sys | CDFS Search expression for enumeration |
Cdfd | cdfs.sys | CDFS Data Fcb |
Cdfi | cdfs.sys | CDFS Index Fcb |
Cdfl | cdfs.sys | CDFS Filelock |
CdFn | cdfs.sys | CDFS Filename buffer |
Cdfn | cdfs.sys | CDFS Nonpaged Fcb |
Cdfs | cdfs.sys | CDFS General Allocation |
Cdft | cdfs.sys | CDFS Fcb Table entry |
Cdgs | cdfs.sys | CDFS Generated short name |
Cdic | cdfs.sys | CDFS Irp Context |
Cdil | cdfs.sys | CDFS Irp Context lite |
Cdio | cdfs.sys | CDFS Io context for async reads |
Cdma | cdfs.sys | CDFS Mcb array |
Cdpe | cdfs.sys | CDFS Prefix Entry |
CdPn | cdfs.sys | CDFS CdName in path entry |
Cdpn | cdfs.sys | CDFS Prefix Entry name |
CdRw | dwcdrw.sys | (Dvd Write Now) cdrw driver's default tag |
Cdsp | cdfs.sys | CDFS Buffer for spanning path table |
Cdtc | cdfs.sys | CDFS TOC |
Cdun | cdfs.sys | CDFS Buffer for upcased name |
Cdvd | cdfs.sys | CDFS Buffer for volume descriptor |
Cdvp | cdfs.sys | CDFS Vpb allocated in filesystem |
CEP | wibcm.sys | CEP_INSTANCE_TAG |
cfsp | cfosspeed.sys | cFosSpeed Driver |
CIcr | ci.dll | Code Integrity allocations for image integrity checking |
CIha | ci.dll | Code Integrity hashes |
CIsc | ci.dll | Code Integrity core dll |
ClfA | clfs.sys | CLFS_CONTAINER_TAG |
ClfB | clfs.sys | CLFS_BASEFILE_TAG |
ClfC | clfs.sys | CLFS_LOGFCBPHYSICAL_TAG |
ClfD | clfs.sys | CLFS_LOGFCBVIRTUAL_TAG |
ClfE | clfs.sys | CLFS_LOGCCB_TAG |
ClfF | clfs.sys | CLFS_FLUSHELT_TAG |
ClfG | clfs.sys | CLFS_REQUEST_TAG |
ClfH | clfs.sys | CLFS_IOCB_TAG |
ClfI | clfs.sys | CLFS_MARSHALBUFFER_TAG |
Clfs | clfs.sys | CLFS_TAG |
CM | nt!cm | Configuration Manager (registry) |
CM?? | nt!cm | Internal Configuration manager allocations |
CMAl | nt!cm | internal registry memory allocator pool tag |
CMCa | nt!cm | Configuration Manager Cache (registry) |
CMcb | nt!CmRegisterCallback | RegistryCallback routine registration info (registration time, Context, ...) |
CmcD | hal.dll | HAL CMC Driver Log |
CmcK | hal.dll | HAL CMC Kernel Log |
CmcT | hal.dll | HAL CMC temporary Log |
CMDa | nt!cm | value data cache pool tag |
CMDc | nt!cm | Configuration Manager Cache (registry) |
CMIn | nt!cm | index hint pool tag |
CMkb | nt!cm | registry key control blocks |
CMNb | nt!cm | notification block pool tag |
CMnb | nt!cm | registry notify blocks |
CMpa | nt!cm | registry post apcs |
CMpb | nt!cm | registry post blocks |
CMpe | nt!cm | registry post events |
CMSb | nt!cm | internal stash buffer pool tag |
CMsb | nt!cm | registry stash buffer |
CMSc | nt!cm | security cache pooltag |
CMSH | wibcm.sys | WIBCM_SHARED_TAG |
CMVa | nt!cm | value cache value tag |
CMVI | nt!cm | value index cache tag |
CmVn | nt!cm | captured value name |
CMVw | nt!cm | registry mapped view of file |
CMWK | wibcm.sys | WIBCM_WORK_TAG |
CMWT | wibcm.sys | WIBCM_TIMER_TAG |
Cngb | ksecdd.sys | CNG kmode crypto pool tag |
COMX | serial.sys | serial driver allocations |
COMX (1) | vspd.sys | Virtual Serial Port driver |
Cont | | Contiguous physical memory allocations for device drivers |
CopW | | EXIFS CopyOnWrite |
Covr | nt!cov | Code Coverage pool tag |
CpeD | hal.dll | HAL CPE Driver Log |
CpeK | hal.dll | HAL CMC Kernel Log |
CpeT | hal.dll | HAL CPE temporary Log |
CPnp | classpnp.sys | ClassPnP transfer packets |
Crsp | ksecdd.sys | CredSSP kernel mode client allocations |
CrtH | | EXIFS Create Header |
Cryp | ksecdd.sys | Crypto allocations |
CSdk | | Cluster Disk Filter driver |
CSnt | | Cluster Network driver |
CTE | | Common transport environment (ntosinccxport.h, used by tdi) |
Cvli | | EXIFS Cached Volume Info |
D2d (0) | | Device Object to DosName rtns (ntos
tldev2dos.c) |
D3Dd | | DX D3D driver (embedded in a display driver like s3mvirge.dll) |
D851 | | 8514a video driver |
Dacl | | Temp allocations for object DACLs |
Dati | | ati video driver |
DbLo | | Debug logging |
dcam | | WDM mini driver for IEEE 1394 digital camera |
Dcdd | cdd.dll | Canonical display driver |
Dcl | | cirrus video driver |
Ddk | | Default for driver allocated memory (user's of ntddk.h) |
Devi | | Device objects |
Dfb | | framebuf video driver |
DfC? | dfsc.sys | DFS Client allocations |
DfCa | dfsc.sys | DFS Client PERUSERTABLE |
DfCb | dfsc.sys | DFS Client REFCONTEXT |
DfCc | dfsc.sys | DFS Client CONNECTION |
DfCd | dfsc.sys | DFS Client CURRENTDC |
DfCe | dfsc.sys | DFS Client CSCEA |
DfCf | dfsc.sys | DFS Client FILENAME |
DfCg | dfsc.sys | DFS Client PREFIXCACHE |
DfCh | dfsc.sys | DFS Client HASH |
DfCi | dfsc.sys | DFS Client INPUTBUFFER |
DfCj | dfsc.sys | DFS Client REWRITTENNAME |
DfCl | dfsc.sys | DFS Client DCLIST |
DfCm | dfsc.sys | DFS Client CMCONTEXT |
DfCn | dfsc.sys | DFS Client DOMAINNAME |
DfCp | dfsc.sys | DFS Client PATH |
DfCq | dfsc.sys | DFS Client REGSTRING |
DfCr | dfsc.sys | DFS Client REFERRAL |
DfCs | dfsc.sys | DFS Client SHARENAME |
DfCt | dfsc.sys | DFS Client TREECONNECT |
DfCu | dfsc.sys | DFS Client USETABLE |
DfCv | dfsc.sys | DFS Client SERVERNAME |
DfCw | dfsc.sys | DFS Client TARGETINFO |
DfCx | dfsc.sys | DFS Client CREDENTIALS |
DfCy | dfsc.sys | DFS Client REMOTEENTRY |
DfCz | dfsc.sys | DFS Client DOMAINREFERRAL |
Dfs | | Distributed File System |
Dfsm | | Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdigre |
dfsr | | RDBSS IRP allocation |
dFVE | dumpfve.sys | Full Volume Encryption crash dump filter (Bitlocker Drive Encryption) |
Dh 0 | | DirectDraw/3D default object |
Dh 1 | | DirectDraw/3D DirectDraw object |
Dh 2 | | DirectDraw/3D Surface object |
Dh 3 | | DirectDraw/3D Direct3D context object |
Dh 4 | | DirectDraw/3D VideoPort object |
Dh 5 | | DirectDraw/3D MotionComp object |
Dire | | Directory objects |
Dlck | | deadlock verifier (part of driver verifier) structures |
Dlmp | | Video utility library for Vista display drivers |
Dmga | | mga (matrox) video driver |
DmH? | | DirectMusic hardware synthesizer |
Dmio | | Logical Disk Manager driver |
Dmip | dmio.sys | Logical Disk Manager driver |
Dmiq | dmio.sys | Logical Disk Manager driver |
Dmld | | Logical Disk Manager loader |
DmpS | dumpsvc.sys | Crashdump Service Driver |
DmS? | | DirectMusic kernel software synthesizer |
Dmst | | Logical Disk Manager driver static initialization |
Dndt | | Device node |
Dnod | | Device node structure |
DOPE | | Device Object Power Extension (po component) |
DPHk | DbgPrnHk.sys | DbgPrintLog's helper driver, cahces and stores debug messages in memory. |
DPrf | | Disk performance filter driver |
Dprt | dxgkrnl.sys | Video port for Vista display drivers |
Dps5 | | NT5 PostScript printer driver |
Dpsh | | Postcript driver heap memory |
Dpsi | | psidisp video driver |
Dpsm | | Postcript driver memory |
DPwr | nt!pnp | PnP power management |
Dqv | | qv (qvision) video driver |
Driv | | Driver objects |
Drsd | | Rasdd Printer Driver Pool Tag. |
Dtga | | tga video driver |
Dump | | Bugcheck dump allocations |
Dun5 | | NT5 Universal printer driver |
DUQD | mpsdrv.sys | MPSDRV upcall user request |
DV?? | | RDR2 DAV MiniRedir Tags |
DVCx | | AsyncEngineContext, DAV MiniRedir |
DVEx | | Exchange, DAV MiniRedir |
DVFi | | FileInfo, DAV MiniRedir |
DVFn | | FileName, DAV MiniRedir |
Dvg2 | | vga 256 color video driver |
Dvg6 | | vga 64K color video driver |
Dvga | | vga 16 color video driver |
Dvgr | | vga for risc video driver |
DVRw | | ReadWrite, DAV MiniRedir |
DVSc | | SrvCall, DAV MiniRedir |
DVSh | | SharedHeap, DAV MiniRedir |
DW32 | | W32 video driver |
Dwd | | wd90c24a video driver |
DWNb | dwudf.sys | (DVD Write Now) I/O buffers and data verification request block |
DWNf | dwudf.sys | (DVD Write Now) default allocation without internal bounds checker |
dwnF | dwudf.sys | (DVD Write Now) default tag |
DWNm | dwudf.sys | (DVD Write Now) pending verification bitmap |
DWNm (1) | dwudf.sys | (DVD Write Now) default allocation tag when built-in memory manager is enabled |
dwnS | dwudf.sys | (DVD Write Now) 'system' memory allocation |
DWNz | dwudf.sys | (DVD Write Now) Zero-filled buffer |
Dwp9 | | weitekp9 video driver |
DWvb | dwudf.sys | (DVD Write Now) stored data verification block |
Dxga | | XGA video driver |
DxgK | dxgkrnl.sys | Vista display driver support |
Efsc (0) | | EFS driver |
Efsm | | EFS driver |
Efst | | EXIFS FS Statistics |
Enli | nt!tm | KTM Transaction Enlistment |
Envr | | Environment strings |
Err | | Error strings |
EtwA | nt!etw | Etw APC |
EtwB | nt!etw | Etw Buffer |
EtwC | nt!etw | Etw Realtime Consumer |
EtwD | nt!etw | Etw DataBlock |
EtwG | nt!etw | Etw Guid |
EtwL | nt!etw | ETW_LOGGER_CONTEXT |
EtwP | nt!etw | Etw Pool |
Etwp | nt!etw | ETW per |
EtwQ | nt!etw | Etw Queue |
Etwq | nt!etw | Etw ReplyQueue |
EtwR | nt!etw | Etw Registration |
Etwr | nt!etw | Etw ReplyQueue Entry |
EtwS | nt!etw | Etw DataSource |
Evel | | EFS file system filter driver lookaside list |
Even | | Event objects |
Evid | | Rtl Event ID's |
ExWl | | Executive worker list entry |
Fat (0) | fastfat.sys | Fat File System allocations |
FatB | fastfat.sys | Fat allocation bitmaps |
Fatb | fastfat.sys | Fat Bcb arrays |
FatC | fastfat.sys | Fat Ccbs |
FatD | fastfat.sys | Fat pool dirents |
Fatd | fastfat.sys | Fat EA data |
FatE | fastfat.sys | Fat EResources |
Fate | fastfat.sys | Fat EA set headers |
FatF | fastfat.sys | Fat Fcbs |
Fatf | fastfat.sys | Fat deferred flush contexts |
FatI | fastfat.sys | Fat IrpContexts |
Fati | fastfat.sys | Fat IO run descriptor |
FatL | fastfat.sys | Fat FAT entry lookup buffer on verify |
FatN | fastfat.sys | Fat Nonpaged Fcbs |
Fatn | fastfat.sys | Fat filename buffer |
FatO | fastfat.sys | Fat I/O buffer |
FatP | fastfat.sys | Fat output for query retrieval pointers (caller frees) |
FatQ | fastfat.sys | Fat buffered user buffer |
FatR | fastfat.sys | Fat repinned Bcb |
Fatr | fastfat.sys | Fat verification |
FatS | fastfat.sys | Fat stashed Bpb |
Fats | fastfat.sys | Fat verification |
FatT | fastfat.sys | Fat directory allocation bitmaps |
FatV | fastfat.sys | Fat Vcb stat bucket |
Fatv | fastfat.sys | Fat backpocket Vpb |
FatW | fastfat.sys | Fat FAT windowing structure |
FatX | fastfat.sys | Fat IO contexts |
Fatx | fastfat.sys | Fat delayed close contexts |
fboX | | EXIFS FOBXVF List |
Fcbl | | EXIFS FCBlock |
FhCI | substvol.sys | (AllenPort Virtual Volume) file handle cache item |
FIcn | fileinfo.sys | FileInfo FS |
FIcp | fileinfo.sys | FileInfo FS |
FIcs | fileinfo.sys | FileInfo FS |
FIcv | fileinfo.sys | FileInfo FS |
File | | File objects |
FIOc | fileinfo.sys | FileInfo FS |
FIof | fileinfo.sys | FileInfo FS |
FIou | fileinfo.sys | FileInfo FS |
FIPc | fileinfo.sys | FileInfo FS |
FIvn | fileinfo.sys | FileInfo FS |
FIvp | fileinfo.sys | FileInfo FS |
FLex | | exclusive file lock |
FLfl | | exported (non |
FLli | | per |
FLln | | shared lock tree node |
flnk | | font link tag used in ntgdigre |
Flop | | floppy driver |
Flop (1) | flopx.sys | Alter's Floppy driver with non-standard format support (e.g. 1,76Mb) |
FLsh | | shared file lock |
Flst | | EXIFS Freelist |
FLwl | | waiting lock |
FM?? | fltmgr.sys | Unrecognized FltMgr tag (update pooltag.w) |
FMac | fltmgr.sys | ASCII String buffers |
FMas | fltmgr.sys | ASYNC_IO_COMPLETION_CONTEXT structure |
FMcb | fltmgr.sys | FLT_CCB structure |
FMcr | fltmgr.sys | Context registration structures |
FMct | fltmgr.sys | TRACK_COMPLETION_NODES structure |
FMdl | fltmgr.sys | Array of DEVICE_OBJECT pointers |
FMea | fltmgr.sys | EA buffer for create |
FMfc | fltmgr.sys | FLTMGR_FILE_OBJECT_CONTEXT structure |
FMfi | fltmgr.sys | Fast IO dispatch table |
FMfk | fltmgr.sys | Byte Range Lock structure |
FMfl | fltmgr.sys | FLT_FILTER structure |
FMfn | fltmgr.sys | NAME_CACHE_NODE structure |
FMfr | fltmgr.sys | FLT_FRAME structure |
FMfz | fltmgr.sys | FILE_LIST_CTRL structure |
FMib | fltmgr.sys | Irp SYSTEM buffers |
FMic | fltmgr.sys | IRP_CTRL completion node stack |
FMil | fltmgr.sys | IRP_CTRL completion node stack |
FMin | fltmgr.sys | FLT_INSTANCE name |
FMis | fltmgr.sys | FLT_INSTANCE structure |
FMla | fltmgr.sys | Per |
FMnc | fltmgr.sys | NAME_CACHE_CREATE_CTRL structure |
FMng | fltmgr.sys | NAME_GENERATION_CONTEXT structure |
FMol | fltmgr.sys | OPLOCK_CONTEXT structure |
FMos | fltmgr.sys | Operation status ctrl structure |
FMpl | fltmgr.sys | Cache aware pushLock |
FMpr | fltmgr.sys | FLT_PRCB structure |
FMrl | fltmgr.sys | FLT_OBJECT rundown logs |
FMrp | fltmgr.sys | Reparse point data buffer |
FMrr | fltmgr.sys | Per |
FMsd | fltmgr.sys | Security descriptors |
FMsl | fltmgr.sys | STREAM_LIST_CTRL structure |
FMtn | fltmgr.sys | Temporary file names |
FMtr | fltmgr.sys | Temporary Registry information |
FMts | fltmgr.sys | Tree Stack |
FMus | fltmgr.sys | Unicode string |
FMvf | fltmgr.sys | FLT_VERIFIER_EXTENSION structure |
FMvj | fltmgr.sys | FLT_VERIFIER_OBJECT structure |
FMvo | fltmgr.sys | FLT_VOLUME structure |
FMwi | fltmgr.sys | Work item structures |
FOCX | nt!fsrtl | File System Run Time File Object Context structure |
FS?? | nt!fsrtl | Unrecoginzed File System Run Time allocations (update pooltag.w) |
FSeh | nt!fsrtl | File System Run Time Extra Create Parameter Entry |
FSel | nt!fsrtl | File System Run Time Extra Create Parameter List |
FSfm | nt!fsrtl | File System Run Time Fast Mutex Lookaside List |
FSim | nt!fsrtl | File System Run Time Mcb Initial Mapping Lookaside List |
FSmg | nt!fsrtl | File System Run Time |
Fsrc | fsrec.sys | Filesystem recognizer (fsrec.sys) |
FSrd | nt!fsrtl | File System Run Time |
FSrm | nt!fsrtl | File System Run Time |
FSrN | nt!fsrtl | File System Run Time |
FSrn | nt!fsrtl | File System Run Time |
FSro | nt!fsrtl | File System Run Time |
FSrs | nt!fsrtl | File System Run Time Work Item for low |
FSrt | nt!fsrtl | File System Run Time allocations (DO NOT USE!) |
FstB | | ntosfstub |
Fstb | | ntosfstub |
FSun | nt!fsrtl | File System Run Time |
FsVg | fsvga.sys | International VGA support |
FtC | | Fault tolerance driver |
FtM | | Fault tolerance driver |
FtpA | mpsdrv.sys | MPSDRV FTP protocol analyzer |
FTrc | | Fault tolerance Slist tag. |
FtS | | Fault tolerance driver |
FtT | | Fault tolerance driver |
FtU | | Fault tolerance driver |
FtV | | Fault tolerance driver |
FVE0 | fvevol.sys | General allocations |
FVE? | fvevol.sys | Full Volume Encryption Filter Driver (Bitlocker Drive Encryption) |
FVEc | fvevol.sys | Cryptographic allocations |
FVEl | fvevol.sys | FVELIB allocations |
FVEp | fvevol.sys | Write buffers |
FVEr | fvevol.sys | Reserved mapping addresses |
FVEv | fvevol.sys | Conversion allocations |
FVEw | fvevol.sys | Worker threads |
FVEx | fvevol.sys | Read/write control structures |
FwfD | mpsdrv.sys | MPSDRV driver buffer for flattening NET_BUFFFER |
Fwpp | fwpkclnt.sys | Windows Filtering Platform export driver. |
FxDr | wdf01000.sys | KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. |
FxL? | wdfldr.sys | KMDF Loader Pool allocation |
FxLg | wdf01000.sys | KMDF IFR log tag |
G (0) | | Gdi Generic allocations |
G??? | | Gdi Objects |
Gcac | | Gdi glyph cache |
Gcap | | Gdi capture buffer |
Gcsl | | Gdi string resource script names |
Gdbr | | Gdi driver brush realization |
Gdd | | Gdi ddraw PKEY_VALUE_FULL_INFORMATION |
Gdda | | Gdi ddraw attach list |
GddD | | Gdi ddraw dummy page |
Gdde | | Gdi ddraw event |
Gddf | | Gdi ddraw driver heaps |
Gddp | | Gdi ddraw driver caps |
Gddv | | Gdi ddraw driver video memory list |
GDev | | Gdi pdev |
Gdev | | Gdi GDITAG_DEVMODE |
Gdrs | | Gdi GDITAG_DRVSUP |
Gdwd | win32k.sys | Gdi watchdog support objects |
Gdxd | | Gdi ddraw VPE directdraw object |
Gdxs | | Gdi ddraw VPE surface, videoport, capture object |
Gdxx | | Gdi ddraw VPE DXAPI object |
Gebr | | Gdi ENGBRUSH |
gEdg | | Gdi gradient fill triangle |
Gfcb | | EXIFS Grow FCB |
Gffv | | Gdi FONTFILEVIEW |
GFil | | Gdi engine descriptor list |
gFil | | Gdi FILEVIEW |
Gfsb | | Gdi font sustitution list |
Gfsm | | Gdi Fast mutex |
Ggb | | Gdi glyph bits |
Ggbl | | Gdi look aside buffers |
Ggdv | | Gdi GDITAG_GDEVICE |
Gglb | | Gdi temp buffer |
Ggls | | Gdi glyphset |
Gh ? | win32k.sys | Gdi Handle manager specific object types: defined in w32
tgdiinc
tgdistr.h |
Ghmg | | Gdi handle manager objects |
Gini | | Gdi fast mutex |
Gla? | win32k.sys | Gdi handle manager specific object types allocated from lookaside memory: defined in w32
tgdiinc
tgdistr.h |
Gldv | | Gdi Ldev |
Glnk | | Gdi PFELINK |
Gmap | | Gdi font map signature table |
Gpff | | Gdi physical font file |
Gpft | | Gdi font table |
Gsem | | Gdi Semaphores |
Gsp | | Gdi sprite |
Gspr | | Gdi sprite grow range |
Gtmp | | Gdi temporary allocations |
Gtmw | | Gdi TMW_INTERNAL |
Gxlt | | Gdi Xlate |
Hal (0) | hal.dll | Hardware Abstraction Layer |
HalV | ntoskrnl.exe | Driver Verifier DMA checking |
HcBm | hcaport.sys | HCAPORT_TAG_BITMAP |
HcCm | hcaport.sys | HCAPORT_TAG_CM |
HcCq | hcaport.sys | HCAPORT_TAG_CQUEUE |
HcdI | hcaport.sys | HCAPORT_TAG_HWID |
HcDr | hcaport.sys | HCAPORT_TAG_DEVICE_RELATIONS |
HcEn | hcaport.sys | HCAPORT_TAG_ENUM |
HcEv | hcaport.sys | HCAPORT_TAG_EVENT |
HCID | bthport.sys | Bluetooth port driver HCI debug |
HCIT | bthport.sys | Bluetooth port driver (HCI) |
HcMa | hcaport.sys | HCAPORT_TAG_MAD |
HcMc | hcaport.sys | HCAPORT_TAG_MISC |
HcMp | hcaport.sys | HCAPORT_TAG_MINIPORT |
HcMr | hcaport.sys | HCAPORT_TAG_REMOVE_LOCK |
HcOb | hcaport.sys | HCAPORT_TAG_OBJECT |
HcPr | hcaport.sys | HCAPORT_TAG_PROTD |
HcRs | hcaport.sys | HCAPORT_TAG_RESOURCE_LIST |
HcUc | hcaport.sys | HCAPORT_TAG_UCONTEXT |
HdCl | | HID Client Sample Driver |
HidC | | HID Class |
HidP | | HID Parser |
Hioc | hcaport.sys | HCAPORT_TAG_IOC_SERVICE_TABLE |
HisC | | histogram filter driver |
Hist | | histogram filter driver |
Hmgo | hcaport.sys | HCAPORT_TAG_WQ_MG_INFO |
Hpfs | | Pinball (aka Hpfs) allocations |
HPmi | hcaport.sys | HCAPORT_TAG_PMI_EXTENSION |
HpMM | pnpmem.sys | HotPlug Memory Driver |
hSVD | mrxdav.sys | Shared Heap Tag |
HT01 | | GDI Halftone AddCachedDCI() for CurCDCIData |
HT02 | | GDI Halftone GetCachedDCI() for Threshold |
HT03 | | GDI Halftone FindCachedSMP() for CurCSMPData |
HT04 | | GDI Halftone FindCachedSMP() for CurCSMPBmp |
HT05 | | GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI |
HT06 | | GDI Halftone pDCIAdjClr() for DEVCLRADJ |
HT07 | | GDI Halftone ComputeRGB555LUT() for RGBLUT |
HT08 | | GDI Halftone ColorTriadSrcToDev() for RGB |
HT09 | | GDI Halftone ColorTriadSrcToDev() for CRTX |
HT10 | | GDI Halftone CreateDyesColorMappingTable() for DevPrims |
HT11 | | GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable |
HT12 | | GDI Halftone ThresholdsFromYData() for pYData |
HT13 | | GDI Halftone ComputeHTCellRegress() for pThresholds |
HT14 | | GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine |
HT15 | | GDI Halftone CalculateStretch() for PrimColorInfo |
Hvlm | nt!Hvl | Temporary MDL for the Hvl component. |
HvlP | nt!Hvl | Hypercall marshalling pages for the Hvl component. |
IBCM (0) | wibcm.sys | CM_INSTANCE_TAG Windows Infiniband Communications Manager |
IBm* | wibms.sys | Windows Infiniband Management Server pool tags |
IbPA | wibpm.sys | WIBPM_SAMPLE_TAG |
IbPI | wibpm.sys | WIBPM_ITEM_TAG |
IbPm | wibpm.sys | WIBPM_TAG Windows Infiniband Performance Manager |
IbPS | wibpm.sys | WIBPM_SENT_TAG |
IbW0 | wibwmi.sys | WIBWMI0_TAG Windows Infiniband WMI Manager |
IbW1 | wibwmi.sys | WIBWMI1_TAG |
IbW2 | wibwmi.sys | WIBWMI2_TAG |
Icp | | I/O completion packets queue on a completion ports |
IcpP | | NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers |
ICSo | substvol.sys | (AllenPort Virtual Volume) SectionObject cache |
IdeP | | atapi IDE |
IdeX | | PCI IDE |
idle | | Power Manager idle handler |
Ifs | | Default file system allocations (user's of ntifs.h) |
II?? | | IP in IP tunneling |
IIdt | | Data |
IIhd | | Header |
IIpk | | Packet |
IIrf | | Free memory |
IIsc | | Send Context |
IITn | | Tunnel |
IIts | | Transfer Context |
IIwc | | Work Context |
Im* | | Imapi.sys from adaptec |
Info | | general system information allocations |
INTC | | Intel video driver |
INty | substvol.sys | (AllenPort Virtual Volume) file notification item |
Io | nt!io | general IO allocations |
IoCc | nt!io | Io completion context |
IoEa | nt!io | Io extended attributes |
IoEr | nt!io | Io error log packets |
IoFc | nt!io | Io name transmogrify operation |
IOfl | substvol.sys | (AllenPort Virtual Volume) offline file descriptor |
IoFs | nt!io | Io shutdown packet |
IoFu | nt!pnp | Io file utils |
Ioin | | Io interrupts |
IoKB | | Registry basic key block (temp allocation) |
IoNm | nt!io | Io parsing names |
IoOp | nt!io | I/O subsystem open packet |
IoRb | nt!io | Io remote boot related |
IoRi | nt!io | I/O SubSystem Driver Reinitialization Callback Packet |
IoRN | nt!io | Registry key name (temp allocation) |
IoSe | nt!io | Io security related |
IoSh | nt!io | Io shutdown packet |
IoSt | nt!io | Io Stream Identifier Context |
IoTi | nt!io | Io timers |
IoTt | nt!vf | I/O verifier IRP tracking table |
IoUs | nt!io | I/O SubSystem completion Context Allocation |
Ip?? | ipsec.sys | IP Security |
IpAT | ipsec.sys | AH headers in transport mode |
IpAU | ipsec.sys | AH headers in tunnel mode |
IpAX | ipsec.sys | Key acquire contexts |
IpBP | ipsec.sys | buffer pools |
IpCO | ipsec.sys | IP compression |
IpEQ | ipsec.sys | event queue |
IpET | ipsec.sys | ESP headers in transport mode |
IpEU | ipsec.sys | ESP headers in tunnel mode |
IpFI | ipsec.sys | Filter blocks |
IpFl | mpsdrv.sys | MPSDRV IP Flow |
IpHT | ipsec.sys | HUGHES headers in transport mode |
IpHU | ipsec.sys | HUGHES headers in tunnel mode |
IpHW | ipsec.sys | hardware accleration items |
IpKE | ipsec.sys | keys |
IpLA | ipsec.sys | lookaside lists |
IPm? | | IP Multicasting |
IPmf | | Free memory (only in checked builds) |
IPmg | | Group |
IPmm | | Message |
IPmo | | Outgoing Interface |
IPms | | Source |
IpSA | ipsec.sys | Security Associations |
IpSC | ipsec.sys | send complete context |
IpSI | ipsec.sys | initial allocations |
IpSQ | ipsec.sys | stall queues |
IpTI | ipsec.sys | timers |
IPX | | Nwlnkipx transport |
IrD? | | IrDA TDI and RAS drivers |
Irp | | Io, IRP packets |
Irp+ | nt!vf | I/O verifier allocated IRP packets |
IrpB | nt!vf | I/O verifier direct I/O double buffer allocation |
IrpC | nt!vf | I/O verifier stack contexts |
Irpd | nt!vf | I/O verifier deferred completion context |
Irpl | nt!io | system large IRP lookaside list |
Irps | nt!io | system small IRP lookaside list |
Irpt | nt!vf | I/O verifier per |
Isap | | Pnp Isa bus extender |
IU?? | | IIS Utility Driver |
IUcp | | completion port minipackets |
IUDl | | Lookaside list allocations |
KAPC (0) | nt!io | I/O SubSystem HardError APC |
KbdC | | Keyboard Class Driver |
KCfe | | Kernel COM factory entry |
Ke | | Kernel data structures |
KeIC | | Kernel Interrupt Object Chain |
Key | | Key objects |
KMIX | | Kmixer (wdm audio) |
KNMI | | Kernel NMI Callback object |
KrbC | ksecdd.sys | Kerberos Client package |
KSah | | Ks auxiliary stream headers |
KSAI | | allocator instance |
KSai | | default allocator instance header |
KSbi | | event buffered item |
KSce | | create item entry |
KSch | | create handler entry |
KSCI | | clock instance |
KSci | | default clock instance header |
KScp | | object creation parameters auxiliary copy |
KSda | | default allocator |
KSdc | | default clock |
KSdh | | device header |
Kse0 | ksecdd.sys | Security driver allocs for sec package 0 |
Kse1 | ksecdd.sys | Security driver allocs for sec package 1 |
Kse2 | ksecdd.sys | Security driver allocs for sec package 2 |
Kse3 | ksecdd.sys | Security driver allocs for sec package 3 |
Kse4 | ksecdd.sys | Security driver allocs for sec package 4 |
Kse5 | ksecdd.sys | Security driver allocs for sec package 5 |
Kse6 | ksecdd.sys | Security driver allocs for sec package 6 |
Kse7 | ksecdd.sys | Security driver allocs for sec package 7 |
Kse8 | ksecdd.sys | Security driver allocs for sec package 8 |
Kse9 | ksecdd.sys | Security driver allocs for sec package 9 |
Ksec | ksecdd.sys | Security device driver |
KSed | | oneshot event deletion dpc |
KSee | | event entry |
KSep | | irp system buffer event parameter |
KSer | | QM error report |
KseS | ksecdd.sys | Security driver allocs for LSA proper |
KSew | | oneshot event deletion workitem |
KseZ | ksecdd.sys | Security driver allocs for default sec package |
KSfd | | filter cache data (MSKSSRV) |
KsFI | | filter instance |
KSns | | null security object |
KSnv | | registry name value |
KSoh | | object header |
KsoO | | WDM audio stuff |
KSop | | object creation parameters |
KSpc | | port driver instance FsContext |
KSPI | | pin instance |
KSpp | | irp system buffer property/method/event parameter |
KSpt | | pin type list (MSKSSRV) |
KSqf | | query information file buffer |
KSqr | | QM quality report |
KSsc | | port driver stream FsContext |
KSsf | | set information file buffer |
KSsh | | stream headers |
KSsi | | software bus interface |
KSsl | | symbolic link buffer (MSKSSRV) |
KSsp | | serialized property set |
kuzt | SbieDrv.sys | Sandboxie Kernel Mode Driver |
L2CA (0) | bthport.sys | Bluetooth port driver (L2CAP) |
L2T0 | | ndisl2tp / MTAG_FREED |
L2T1 | | ndisl2tp / MTAG_ADAPTERCB |
L2T2 | | ndisl2tp / MTAG_TUNNELCB |
L2T3 | | ndisl2tp / MTAG_VCCB |
L2T4 | | ndisl2tp / MTAG_VCTABLE |
L2T5 | | ndisl2tp / MTAG_WORKITEM |
L2T6 | | ndisl2tp / MTAG_TIMERQ |
L2T7 | | ndisl2tp / MTAG_TIMERQITEM |
L2T8 | | ndisl2tp / MTAG_PACKETPOOL |
L2T9 | | ndisl2tp / MTAG_FBUFPOOL |
L2Ta | | ndisl2tp / MTAG_HBUFPOOL |
L2Tb | | ndisl2tp / MTAG_TDIXRDG |
L2Tc | | ndisl2tp / MTAG_TDIXSDG |
L2Td | | ndisl2tp / MTAG_CTRLRECD |
L2Te | | ndisl2tp / MTAG_CTRLSENT |
L2Tf | | ndisl2tp / MTAG_PAYLRECD |
L2Tg | | ndisl2tp / MTAG_PAYLSENT |
L2Th | | ndisl2tp / MTAG_INCALL |
L2Ti | | ndisl2tp / MTAG_UTIL |
L2Tj | | ndisl2tp / MTAG_ROUTEQUERY |
L2Tk | | ndisl2tp / MTAG_ROUTESET |
L2Tl | | ndisl2tp / MTAG_L2TPPARAMS |
L2Tm | | ndisl2tp / MTAG_TUNNELWORK |
L2Tn | | ndisl2tp / MTAG_TDIXROUTE |
LANE | atmlane.sys | LAN Emulation Client for ATM |
LB?? | | LM Datagram receiver allocations |
LBan | | Server announcement |
LBbb | | Become backup context |
LBbl | | Backup List |
LBbn | | Name |
LBbr | | Become backup request |
LBbs | | Browser server |
LBci | | Connection info |
LBdi | | POOL_DOMAIN_INFO |
LBds | | Send datagram context |
LBea | | Ea buffer |
LBel | | Election context |
LBgb | | GetBackupList request |
LBic | | IRP context |
LBid | | Illegal datagram context |
LBma | | Master announce context |
LBmb | | Mailslot Buffer |
LBmh | | Mailslot header |
LBnn | | Name name |
LBpn | | Paged Name |
LBpt | | Paged transport |
LBse | | Browser security |
LBsl | | Browser server list |
LBtn | | Transport name |
Lbuf | | EXIFS Large Buffer |
LBvb | | View buffer |
LBwi | | Work item |
LBxm | | Master name |
LBxn | | TransportName |
LBxp | | Transport |
LCam | | WDM mini video capture driver for Logitech camera |
LeoC | | Symantec/Norton AntiVirus filter driver |
Lfs | | Lfs allocations |
LfsI | | Lfs allocations |
List | | kernel utilities list allocation |
LogA | clfs.sys | CLFS_APITEST_TAG |
LpcM | | Local procedure call message blocks |
LpcZ | | LPC Zone |
Lr | | Generic allocations |
Lr!! | | Cancel request context blocks |
Lr2x | | Transact SMB context |
Lr?? | | Buffers used for FsControlFile APIs |
Lrac | | ACL for redirector |
Lraw | | Async write context |
Lrbb | | Write behind buffer |
Lrca | | Temporary storage used in name canonicalization |
Lrcl | | ConnectListEntries |
Lrcn | | Computer Name |
Lrcx | | Context blocks of various types |
Lrdn | | Domain Name |
Lrds | | Duplicated ansi string |
Lrdu | | Duplicated unicode string |
Lrea | | EA related allocations |
Lref | | Reference history (debug only) |
Lrfc | | File Control Blocks |
Lrfl | | Fcb Locks |
Lrfp | | Fcb Paging locks |
Lric | | Instance Control Blocks |
Lrlb | | Lock Control Block buffers |
Lrlc | | Lock Control Blocks |
Lrme | | MPX table entries |
Lrmt | | MPX table |
Lrna | | Netbios Addresses |
Lrnf | | Non paged FCB |
Lrnt | | Non paged transport |
Lrps | | Paged security entry |
Lrpt | | Primary transport server list |
Lrsc | | Search Control Blocks |
Lrse | | Security entry |
Lrsl | | ServerListEntries |
Lrsm | | SMB buffer |
Lrso | | Operating system name |
Lrsx | | Send contexts |
Lrtc | | Transport connection |
Lrte | | Transport event. |
Lrwb | | Write behind buffer header |
Lrwq | | Work queue item |
Lrxx | | Transceive context blocks |
LS?? | | LM server allocations |
LSac | | BlockTypeAdminCheck |
LSas | | BlockTypeAdapterStatus |
LSbf | | buffer descriptor |
LScd | | comm device |
LScn | | connection |
LSdb | | data buffer |
LSdc | | BlockTypeDirCache |
LSdi | | BlockTypeDirectoryInfo |
LSep | | endpoint |
LSfn | | BlockTypeFSName |
LSlf | | LFCB |
LSlr | | BlockTypeLargeReadX |
LSmf | | MFCB |
LSmi | | BlockTypeMisc |
LSnd | | WDM mini sound driver for Logitech video camera |
LSnh | | nonpaged block header |
LSni | | BlockTypeNameInfo |
LSop | | oplock break wait |
LSpc | | paged connection |
LSpm | | paged MFCB |
LSpr | | paged RFCB |
LSrf | | RFCB |
LSsc | | search(core) |
LSsd | | BlockTypeShareSecurityDescriptor |
LSsf | | BlockTypeDfs |
LSsh | | share |
LSsp | | search(core complete) |
LSsr | | search |
LSss | | session |
LStb | | table |
LStc | | tree connect |
LSti | | timer |
LStr | | transaction |
LSvi | | BlockTypeVolumeInformation |
LSwi | | initial work context |
LSwn | | normal work context |
LSwq | | BlockTypeWorkQueue |
LSwr | | raw work context |
LSws | | BlockTypeWorkContextSpecial |
Luaf | luafv.sys | LUA File Virtualization |
LXMK | | kernel mixer line driver (KMXL |
Lxpt | | Transport |
MapP (0) | | PNP map |
Mapr | | arc firmware registry routines |
McaC | hal.dll | HAL MCA corrected Log |
McaD | hal.dll | HAL MCA Driver Log |
McaK | hal.dll | HAL MCA Kernel Log |
MCAM | | WDM mini driver for Intel USB camera |
McaP | hal.dll | HAL MCA Log from previous boot |
McaT | hal.dll | HAL MCA temporary Log |
MCDd | | OpenGL MCD driver (embedded in a display driver like s3mvirge.dll) |
MCDx | | OpenGL MCD server (mcdsrv32.dll) allocations |
Mdl | | Io, Mdls |
MdlP | | MDL per processor lookaside list pointers |
MePr | | In |
mkup | mpsdrv.sys | MPSDRV upcall request |
Mm | nt!mm | general Mm Allocations |
MmAc | nt!mm | Mm access log buffers |
MmBk | nt!mm | Mm banked sections |
MmCa | nt!mm | Mm control areas for mapped files |
MmCd | nt!mm | Mm fork clone descriptors |
MmCh | nt!mm | Mm fork clone headers |
MmCi | nt!mm | Mm control areas for images |
MmCl | nt!mm | Mm fork clone prototype PTEs |
MmCm | nt!mm | Calls made to MmAllocateContiguousMemory |
MmCr | nt!mm | Mm fork clone roots |
MmCt | nt!mm | Mm debug tracing |
MmCx | nt!mm | info for dynamic section extension |
MmDb | nt!mm | NtMapViewOfSection service |
Mmdl | nt!mm | Mm Mdls for flushes |
MmDm | nt!mm | deferred MmUnlock entries |
MmDT | nt!mm | Mm debug |
MmEx | nt!mm | Mm events |
MmHi | nt!mm | Mm image entry |
MmHn | nt!mm | Mm sessionwide address name string entry |
MmHt | nt!mm | session space PTE data |
MmHv | nt!mm | Mm sessionwide address entry |
MmIn | nt!mm | Mm inpaged io structures |
MmLd | nt!mm | Mm load module database |
MmLn | nt!mm | temporary name buffer for driver loads |
MmMl | nt!mm | physical memory range information |
MmPa | nt!mm | pagefile space deletion slist entries |
MmPd | nt!mm | Mm page table commitment bitmaps |
MmPg | nt!mm | Mm page table pages at init time |
Mmpp | nt!mm | Mm prototype PTEs for pool |
Mmpr | nt!mm | Mm physical VAD roots |
Mmpv | nt!mm | Physical view VAD info |
MmRl | nt!mm | temporary readlists for file prefetch |
MmRp | nt!mm | Mm repurpose logging |
MmRw | nt!mm | Mm read write virtual memory buffers |
MmSb | nt!mm | Mm subsections |
MmSc | nt!mm | subsections used to map data files |
MmSd | nt!mm | extended subsections used to map data files |
MmSe | nt!mm | Mm secured VAD allocation |
MmSg | nt!mm | Mm segments |
MmSi | nt!mm | Control area security image stubs |
MmSm | nt!mm | segments used to map data files |
MmSP | nt!mm | SLIST entries for system PTE NB queues |
MmSt | nt!mm | Mm section object prototype ptes |
MmSy | nt!mm | Mm PTE and IO tracking logs |
MmVd | nt!mm | Mm virtual address descriptors for mapped views |
MmVs | nt!mm | Mm virtual address descriptors short form (private views) |
MmWe | nt!mm | Work entries for writing out modified filesystem pages. |
MmWw | nt!mm | Write watch VAD info |
Mmww | nt!mm | Write watch bitmap VAD info |
Mmxx | nt!mm | Mm temporary allocations |
Mn01 | monitor.sys | ACPI method evaluation output buffer |
Mn02 | monitor.sys | Unused |
Mn03 | monitor.sys | Raw E |
Mn04 | monitor.sys | Cached monitor ID WMI data block |
Mn05 | monitor.sys | Cached monitor basic display parameters WMI data block |
Mn06 | monitor.sys | Cached monitor analog video input parameters WMI data block |
Mn07 | monitor.sys | Cached monitor digitial video input parameters WMI data block |
Mn08 | monitor.sys | Cached monitor color characteristics WMI data block |
Mn09 | monitor.sys | Cached supported monitor source modes WMI data block |
Mn0A | monitor.sys | Registry subkey info buffer |
Mn0B | monitor.sys | Registry value buffer |
Mn0C | monitor.sys | Cached supported monitor frequency ranges WMI data block (overrides from registry) |
Mn0D | monitor.sys | Cached supported monitor frequency ranges WMI data block (from E |
Mn0E | monitor.sys | Buffer for E |
Mn0F | monitor.sys | Buffer for E |
MNFC | msnfsflt.sys | NFS FS Filter, callback context |
MNFF | msnfsflt.sys | NFS FS Filter, file context |
MNFf | msnfsflt.sys | NFS FS Filter, filename buffer |
MNFI | msnfsflt.sys | NFS FS Filter, instance context |
MNFi | msnfsflt.sys | NFS FS Filter, instance name buffer |
MNFr | msnfsflt.sys | NFS FS Filter, registry access buffer |
MNFS | msnfsflt.sys | NFS FS Filter, stream context |
MNFs | msnfsflt.sys | NFS FS Filter, general string buffer |
MNFT | msnfsflt.sys | NFS FS Filter, thread array |
MNFv | msnfsflt.sys | NFS FS Filter, volume name buffer |
MQAA | mqac.sys | MSMQ driver, AVL allocations |
MQAB | mqac.sys | MSMQ driver, CCursor allocations |
MQAC | mqac.sys | MSMQ driver, generic allocations |
MQAD | mqac.sys | MSMQ driver, CDistribution allocations |
MQAG | mqac.sys | MSMQ driver, CGroup allocations |
MQAH | mqac.sys | MSMQ driver, Heap allocations |
MQAP | mqac.sys | MSMQ driver, CPacket allocations |
MQAQ | mqac.sys | MSMQ driver, CQueue allocations |
MQAT | mqac.sys | MSMQ driver, CTransaction allocations |
MRXx | | Client side caching for SMB |
Msdv | | WDM mini driver for IEEE 1394 DV Camera and VCR |
MsFC | | Mailslot root CCB, A client control block for the top level mailslot directory |
MsFc | | Mailslot CCB, Client control block. Each client with an opened mailslot has one of these |
MsFD | | Mailslot root DCB and its name buffer |
MsFd | | Mailslot data entry write buffer, This is writes buffered inside mailslots |
MsFf | | Mailslot FCB, File control block, Service side block for each created mailslot. |
MsFg | | Mailslot global resource |
MsFN | | Mailslot FCB name buffer, name for each created mailslot |
MsFn | | Mailslot temporary name buffer |
MsFr | | Mailslot read buffer, buffer created for pended reads issued. |
MsFt | | Mailslot query template, used for directory queries. |
MsFw | | Mailslot work context block, blocks create when we need to timeout reads. |
MST? | | MSTEE (mstee.sys) |
MSTa | | associated stream header |
MSTc | | filer connection |
MSTd | | data format |
MSTf | | filter instance |
MSTp | | pin instance |
MSTs | | stream header |
MsvC | ksecdd.sys | Msv/Ntlm client package |
MuDn | mup.sys | Device name |
MuFc | mup.sys | File Context |
MuFn | mup.sys | File name rewrite |
MuIc | mup.sys | IRP Context |
MuMc | mup.sys | Master context |
MuoC | | MOUSE_POOL_TAG Mouse Class Driver |
Mup | mup.sys | Multiple UNC provider allocations, generic |
MuPe | mup.sys | Known prefix entry |
MuPi | mup.sys | Provider info |
MupI | mup.sys | Windows Server 2003 and prior versions: DFS Irp Context allocation |
MuQc | mup.sys | Query context |
MuSf | mup.sys | Surrogate file info |
MuSi | mup.sys | Surrogate info |
MuSr | mup.sys | Surrogate IRP info |
Muta | | Mutant objects |
MuUn | mup.sys | UNC provider |
MXF | | DirectMusic (MIDI Transform Filter) |
Nb?? (0) | | NetBT allocations |
NBF | | general NBF allocations |
NBFa | | NBF address object |
NBFb | | NBF receive buffer |
NBFc | | NBF connection object |
NBFd | | NBF packet pool descriptor |
NBFe | | NBF bind & export names |
NBFf | | NBF address file object |
NBFg | | NBF registry path name |
NBFi | | NBF tdi connection info |
NBFk | | NBF loopback buffer |
NBFl | | NBF link object |
NBFn | | NBF netbios name |
NBFo | | NBF config data |
NBFp | | NBF packet |
NBFq | | NBF query buffer |
NBFr | | NBF request |
NBFs | | NBF provider stats |
NBFt | | NBF connection table |
NBFu | | NBF UI frame |
NBFw | | NBF work item |
NBI | | NwlnkNb transport |
NBqh | | Non |
NBS | | general NetBIOS allocations |
NBSa | | address block |
NBSc | | connection block |
NBSe | | EA buffer |
NBSf | | FCB |
NBSl | | LANA block |
NBSn | | copy of user NCB |
NBSr | | registry allocations |
NBSx | | XNS NETONE address (connect block) |
NBSy | | NetBIOS address (connect block) |
NBSz | | NetBIOS address (listen block) |
NCSt | | EXIFS NC |
ND | ndis.sys | general NDIS allocations |
NDam | ndis.sys | NdisAllocateMemory |
NDan | ndis.sys | adapter name |
NDco | ndis.sys | NDIS_TAG_CO |
NDd | ndis.sys | NDIS_TAG_DBG |
NDdb | ndis.sys | DMA block |
NDDl | ndis.sys | NDIS_TAG_DBG_LOG |
NDdl | ndis.sys | NDIS_TAG_DBG_L |
NDdp | ndis.sys | NDIS_TAG_DBG_P |
NDds | ndis.sys | NDIS_TAG_DBG_S |
NDdt | ndis.sys | NDIS_TAG_DFRD_TMR |
NDfa | ndis.sys | NDIS_TAG_FILTER_ADDR |
NDlb | ndis.sys | lookahead buffer |
NDlp | ndis.sys | NDIS_TAG_LOOP_PKT |
NDMb | ndis.sys | NDIS_TAG_MAC_BLOCK |
NDmb | ndis.sys | MAC block |
NDmr | ndis.sys | map register entry array |
NDoa | ndis.sys | NDIS_TAG_OID_ARRAY |
NDob | ndis.sys | open block |
NDPa | ndis.sys | Apple Talk |
NDPb | ndis.sys | NBF |
NDpb | ndis.sys | protocol block |
NDpf | ndis.sys | NDIS_TAG_FILTER |
NDPi | ndis.sys | NWLNKIPX |
NDpk | ndis.sys | NDIS_TAG_PKT_PATTERN |
NDPn | ndis.sys | NWLNKNB |
NDPp | ndis.sys | Packet Scheduler. |
NDpp | ndis.sys | packet pool |
NDPs | ndis.sys | NWLNKSPX |
NDPt | ndis.sys | TCPIP |
NDPw | ndis.sys | WAN_PACKET_TAG |
NDPX | ndis.sys | NDIS Proxy allocations |
NDrl | ndis.sys | resource list |
NDrp | ndis.sys | NDIS_TAG_REGISTRY_PATH |
NDrq | ndis.sys | NDIS_TAG_Q_REQ |
NDsi | ndis.sys | EISA slot information |
NDsm | ndis.sys | Cached shared memory descriptor |
NDst | ndis.sys | NDIS_TAG_STRING |
NDw0 | ndis.sys | NDIS_TAG_WMI_REG_INFO |
NDw1 | ndis.sys | NDIS_TAG_WMI_GUID_TO_OID |
NDw2 | ndis.sys | NDIS_TAG_WMI_OID_SUPPORTED_LIST |
NDw3 | ndis.sys | NDIS_TAG_WMI_EVENT_ITEM |
NDwi | ndis.sys | NDIS_TAG_WORK_ITEM |
Nf?? | nfssvr.sys | NFS (Network File System) allocations |
NfR? | nfsrdr.sys | NFS (Network File System) client re |
Nls | | Nls strings |
NlsK | nt!ex | Nls data |
NmCc | substvol.sys | (AllenPort Virtual Volume) name cache item |
Nmdd | | NetMeeting display driver miniport 1 MB block |
None | | call to ExAllocatePool |
Npf* | npfs.sys | Npfs Allocations |
NpFC | npfs.sys | ROOT_DCB CCB |
NpFc | npfs.sys | CCB, client control block |
NpFD | npfs.sys | DCB, directory block |
NpFg | npfs.sys | Global storage |
NpFi | npfs.sys | NPFS client info buffer. |
NpFn | npfs.sys | Name block |
NpFq | npfs.sys | Query template buffer used for directory query |
NpFr | npfs.sys | DATA_ENTRY records (read/write buffers) |
NpFs | npfs.sys | Client security context |
NpFW | npfs.sys | Write block |
NpFw | npfs.sys | Write block |
NS?? | | Netware server allocations |
Ntf0 | ntfs.sys | general pool allocation |
Ntf9 | ntfs.sys | Large Temporary Buffer |
NtF? | ntfs.sys | NTFS tags based on source module |
Ntf? | ntfs.sys | NTFS Specific allocation tags |
NtFA | ntfs.sys | AttrSup.c |
NtFa | ntfs.sys | AllocSup.c |
NtFB | ntfs.sys | BitmpSup.c |
NtFC | ntfs.sys | Create.c |
NtfC | ntfs.sys | CCB |
Ntfc | ntfs.sys | CCB_DATA |
NtFD | ntfs.sys | DevioSup.c |
NtFd | ntfs.sys | DirCtrl.c |
NtfD | ntfs.sys | DEALLOCATED_RECORDS |
NtFE | ntfs.sys | Ea.c |
NtfE | ntfs.sys | INDEX_CONTEXT |
NtFF | ntfs.sys | FileInfo.c |
NtFf | ntfs.sys | FsCtrl.c |
NtfF | ntfs.sys | FCB_INDEX |
Ntff | ntfs.sys | FCB_DATA |
NtFH | ntfs.sys | SelfHeal.c |
NtFI | ntfs.sys | IndexSup.c |
NtfI | ntfs.sys | NTFS_IO_CONTEXT |
Ntfi | ntfs.sys | IRP_CONTEXT |
NtfK | ntfs.sys | KEVENT |
Ntfk | ntfs.sys | FILE_LOCK |
NtFL | ntfs.sys | LogSup.c |
Ntfl | ntfs.sys | LCB |
NtFM | ntfs.sys | McbSup.c |
NtfM | ntfs.sys | NTFS_MCB_ENTRY |
Ntfm | ntfs.sys | NTFS_MCB_ARRAY |
NtFN | ntfs.sys | NtfsData.c |
NtfN | ntfs.sys | NUKEM |
Ntfn | ntfs.sys | SCB_NONPAGED |
NtFO | ntfs.sys | ObjIdSup.c |
Ntfo | ntfs.sys | SCB_INDEX normalized named buffer |
NtFQ | ntfs.sys | QuotaSup.c |
NtfQ | ntfs.sys | QUOTA_CONTROL_BLOCK |
Ntfq | ntfs.sys | General Allocation with Quota |
NtFR | ntfs.sys | RestrSup.c |
NtfR | ntfs.sys | READ_AHEAD_THREAD |
Ntfr | ntfs.sys | ERESOURCE |
NtFS | ntfs.sys | SecurSup.c |
NtFs | ntfs.sys | StrucSup.c |
NtfS | ntfs.sys | SCB_INDEX |
Ntfs | ntfs.sys | SCB_DATA |
NtfT | ntfs.sys | SCB_SNAPSHOT |
Ntft | ntfs.sys | SCB (Prerestart) |
NtFU | ntfs.sys | usnsup.c |
NtFV | ntfs.sys | VerfySup.c |
NtFv | ntfs.sys | ViewSup.c |
NtfV | ntfs.sys | VPB |
Ntfv | ntfs.sys | COMPRESSION_SYNC |
NtFW | ntfs.sys | Write.c |
Ntfw | ntfs.sys | Workspace |
Ntfx | ntfs.sys | General Allocation |
NTID | HP Team Network Driver (cpqteam.sys) | Network Driver 8.55 (Memory Leak) - Confirmed |
NV | | (nVidia video driver) Resource manager data |
NvLA | | (nVidia video driver) Adapter data |
NvLa | | (nVidia video driver) Allocation data |
NvLC | | (nVidia video driver) Channel data |
NvLc | | (nVidia video driver) Class data |
NvLD | | (nVidia video driver) Device data |
NvLd | | (nVidia video driver) DMA data |
NvLE | | (nVidia video driver) Event data |
NvLH | | (nVidia video driver) Generic data |
NvLm | | (nVidia video driver) Mode data |
NvLP | | (nVidia video driver) Profile data |
NvLp | | (nVidia video driver) Pusher data |
NvLR | | (nVidia video driver) Registry data |
NvLr | | (nVidia video driver) Resource data |
NvLS | | (nVidia video driver) Statistics data |
NvLs | | (nVidia video driver) Semaphore data |
NvLT | | (nVidia video driver) Context data |
Nwcs | | Client Services for NetWare |
NwFw | | ntos difwd |
ObCI (0) | nt!ob | object creation lookaside list |
ObCi | nt!ob | captured information for ObCreateObject |
ObDi | nt!ob | object directory |
ObDm | nt!ob | object device map |
Obeb | nt!ob | object tables extra bit tables via EX handle.c |
ObHd | nt!ob | object handle count data base |
ObjT | nt!ob | object type objects |
ObNM | nt!ob | name buffer per processor lookaside pointers |
ObNm | nt!ob | object names |
ObRt | nt!ob | object reference stack tracing |
ObSc | nt!ob | Object security descriptor cache block |
ObSq | nt!ob | object security descriptors (query) |
ObSt | nt!ob | Object Manager temporary storage |
Obtb | nt!ob | object tables via EX handle.c |
ObTR | nt!ob | object table ERESOURCEs |
ObZn | nt!ob | object zone |
OCCB | RepliStor.sys | RepliStor File System Mini Filter Driver |
OCMD | RepliStor.sys | RepliStor File System Mini Filter Driver |
OCMX | RepliStor.sys | RepliStor File System Mini Filter Driver |
OHCI | | Open Host Controller Interface for USB |
ohci | | 1394 OHCI host controller driver |
OvfL | | EXIFS FCBOVF List |
Ovfl | | The internal pool tag table has overflowed |
p2?? (0) | perm2dll.dll | Permedia2 display driver |
p2cx | perm2dll.dll | Permedia2 display driver |
p2d3 | perm2dll.dll | Permedia2 display driver |
p2d6 | perm2dll.dll | Permedia2 display driver |
p2de | perm2dll.dll | Permedia2 display driver |
p2ds | perm2dll.dll | Permedia2 display driver |
p2dt | perm2dll.dll | Permedia2 display driver |
p2en | perm2dll.dll | Permedia2 display driver |
p2fi | perm2dll.dll | Permedia2 display driver |
p2he | perm2dll.dll | Permedia2 display driver |
p2hw | perm2dll.dll | Permedia2 display driver |
p2pa | perm2dll.dll | Permedia2 display driver |
p2pe | perm2dll.dll | Permedia2 display driver |
p2su | perm2dll.dll | Permedia2 display driver |
p2tx | perm2dll.dll | Permedia2 display driver |
P3D? | perm3dd.dll | Permedia3 display driver |
P3G? | perm3dd.dll | Permedia3 display driver |
PaeD | | PAE top level directory allocation blocks |
ParC | | Parallel class driver |
ParL | | Parallel link driver |
ParP | | Parallel port driver |
ParV | | ParVdm driver for vdm< |
PbCK | DGbWAsfJiFZXk | comment5, |
PcCi | | WDM audio port class adapter device object stuff |
PcCr | | WDM audio stuff |
Pcdb | | Pcmcia bus enumerator, Databook controller specific structures |
PcDi | | WDM audio stuff |
PcDm | | DirectMusic MXF objects (WDM audio) |
PcFM | | WDM audio FM synthesizer |
PcFp | | WDM audio stuff |
PciB | pci.sys | PnP pci bus enumerator |
PcIc | | WDM audio stuff |
Pcic | | Pcmcia bus enumerator, PCIC/Cardbus controller specific structures |
PciD | PciDumpEx.sys | Alter's PCI Dump helper driver |
PcIl | | WDM audio stuff |
Pcmc | pcmcia.sys | Pcmcia bus enumerator, general structures |
PcNw | | WDM audio stuff |
PcPc | | WDM audio stuff |
PcPr | | WDM audio stuff |
PcSl | | WDM audio stuff |
PcSt | | WDM audio stuff |
PcSX | | WDM audio stuff |
PcSx | | WDM audio stuff |
PcUs | | WDM audio stuff |
PDss | nt!po | Po device system state |
Pf?? | nt!pf | Pf Allocations |
PfAL | nt!pf | Pf Application launch event data |
PfAS | nt!pf | Pf Prefetch support array |
PfDq | nt!pf | Pf Directory query buffers |
PfED | nt!pf | Pf Generic event data |
PfEL | nt!pf | Pf Event logging buffers |
PfET | nt!pf | Pf Entry info tables |
PfFH | nt!pf | Pf RpContext FileKeyHash buckets |
PfFK | nt!pf | Pf RpContext FileKeyHashEntry |
PfLB | nt!pf | Pf Log buffers |
PfMP | nt!pf | Pf Prefetch metadata buffers |
PfNL | nt!pf | Pf Name logging buffers |
PfOB | nt!pf | Pf Oplock buffers |
PfPB | nt!pf | Pf Pfn query buffers |
PfRL | nt!pf | Pf Prefetch read list |
PfRQ | nt!pf | Pf Prefetch request buffers |
PfSA | nt!pf | Pf Prefetch support array |
PfTD | nt!pf | Pf Trace Dump |
PfTt | nt!pf | Pf Translation tables |
PfVA | nt!pf | Pf VA prefetching buffers |
PfVH | nt!pf | Pf Prefetch volume handles |
Pgm? | | Pgm (Pragmatic General Multicast) protocol: RMCast.sys |
Plcl | | Cache aware pushlock entry. One per processor |
Plcp | | Cache aware pushlock list (array of puchlock addresses) |
PmpA | portmap.sys | Portmap address list |
PmpC | portmap.sys | Portmap device context |
PmpM | portmap.sys | Portmap mapping |
PmpR | portmap.sys | Portmap RPCB |
PNCH | | Power Notify Channel |
PNCL | | Power Notify channel list |
PNDP | | Power Abort Dpc Routine |
PNI | | Power Notify Instance |
Pnp0 | nt!pnp | PNPMGR rebalance resource request table |
Pnp1 | nt!pnp | PNPMGR IRP completion context |
Pnp2 | nt!pnp | PNPMGR device action request |
Pnp3 | nt!pnp | PNPMGR dock serial numbers |
Pnp4 | nt!pnp | PNPMGR dock state |
Pnp5 | nt!pnp | PNPMGR assign resources context |
Pnp6 | nt!pnp | PNPMGR resource request |
Pnp7 | nt!pnp | PNPMGR deferred notify entry |
Pnp8 | nt!pnp | PNPMGR async target device change notify |
Pnp9 | nt!pnp | PNPMGR HW profile notify |
PnpA | nt!pnp | PNPMGR HW profile event |
PnPb | nt!pnp | PnP BIOS resource manipulation |
PnpB | nt!pnp | PNPMGR setup notify |
PnpC | nt!pnp | PNPMGR target device notify |
PnpD | nt!pnp | PNPMGR device class notify |
PnpE | nt!pnp | PNPMGR veto name |
PnpF | nt!pnp | PNPMGR eject data |
PnpG | nt!pnp | PNPMGR generic |
PnpH | nt!pnp | PNPMGR service name |
PnpI |