Windows NT Kernel memory pool tags

Alter.Org.UA

<< Back

Home

www/www1/www2

Windows NT Kernel memory pool tags

All components of Windows NT marks allocated memory blocks with unique Tag. Tag is 4-byte word, that can be represented as ASCII string. It is used for monitoring of allocated memory, bounds checking, etc. In general, this information is available at Microsoft's web-site (http://support.microsoft.com), inside WinDbg package (search for file pooltag.txt). Here is the mirror.
NEW! Below you can find updatable pool-tag database. You can submit there information about tags used in your drivers.

Fresh pooltag.txt
.GZ'ipped pooltag.txt
Updated 2008.11.4 17:25

Edit pool-tag database
Submit pool-tag

Tag	Source	Description
`8042` (0)	i8042prt.sys	PS/2 kb and mouse
`@GMM` (0)		(Intel video driver) Memory manager
`@KCH`		(Intel video driver) Chipset specific service
`@MP`		(Intel video driver) Miniport related memory
`@SB`		(Intel video driver) Soft BIOS
`Abos` (0)		Abiosdsk
`AcdM`		TDI AcdObjectInfoG
`AcdN`		TDI AcdObjectInfoG
`Acp*`	acpi.sys	ACPI Pooltags
`ACPI`	acpi.sys	ACPI
`Adap`		Adapter objects
`Adbe`		Adobe's font driver
`AdSv`	vmsrvc.sys	Virtual Machines Additions Service
`AECi`		filter object interface for MS acoustic echo canceller
`Afd?`	afd.sys	AFD objects
`AfdA`	afd.sys	Afd EA buffer
`Afda`	afd.sys	Afd APC buffer (NT 3.51 only)
`AfdB`	afd.sys	Afd data buffer
`AfdC`	afd.sys	Afd connection structure
`Afdc`	afd.sys	Afd connect data buffer
`AfdD`	afd.sys	Afd debug data
`Afdd`	afd.sys	Afd disconnect data buffer
`AfdE`	afd.sys	Afd endpoint structure
`AfdF`	afd.sys	Afd TransmitFile info
`Afdf`	afd.sys	Afd TransmitFile debug data
`AfdG`	afd.sys	Afd group table
`Afdh`	afd.sys	Afd address list change buffer
`AfdI`	afd.sys	Afd TDI data
`Afdi`	afd.sys	Afd "set inline mode" buffer
`AfdL`	afd.sys	Afd local address buffer
`Afdl`	afd.sys	Afd lookaside lists buffer
`AfdP`	afd.sys	Afd poll info
`Afdp`	afd.sys	Afd transport IRP buffer
`AfdQ`	afd.sys	Afd work queue item
`Afdq`	afd.sys	Afd routing query buffer
`AfdR`	afd.sys	Afd remote address buffer
`Afdr`	afd.sys	Afd ERESOURCE buffer
`AfdS`	afd.sys	Afd security info
`AfdT`	afd.sys	Afd transport info
`Afdt`	afd.sys	Afd transport address buffer
`AfdW`	afd.sys	Afd work item
`AfdX`	afd.sys	Afd context buffer
`AFMM`	afw.sys, afwcore.sys	Agnitum Outpost Firewall Drivers
`Afp`		SFM File server
`AlCI`	nt!alpc	ALPC communication info
`AlEv`	nt!alpc	ALPC eventlog queue
`AlHa`	nt!alpc	ALPC port handle table
`AlIn`	nt!alpc	ALPC Internal allocation
`AlMs`	nt!alpc	ALPC message
`ALPC`	nt!alpc	ALPC port objects
`AlRe`	nt!alpc	ALPC section region
`AlRr`	nt!Alpc	ALPC resource reserves
`AlSc`	nt!alpc	ALPC section
`AlSe`	nt!alpc	ALPC client security
`AlVi`	nt!alpc	ALPC view
`Aml*`		ACPI AMLI Pooltags
`AoE*`	aoebus.sys	ATA over Ethernet driver
`APIC`	pnpapic.sys	I/O APIC Driver
`ArbA`	nt!arb	ARBITER_ALLOCATION_STATE_TAG
`ArbL`	nt!arb	ARBITER_ORDERING_LIST_TAG
`ArbM`	nt!arb	ARBITER_MISC_TAG
`ArbR`	nt!arb	ARBITER_RANGE_LIST_TAG
`Arp?`		ATM ARP server objects, atmarps.sys
`ArpA`		AtmArpS address
`ArpB`		AtmArpS buffer space
`ARPC`	atmarpc.sys	ATM ARP Client
`ArpI`		AtmArpS Interface structure
`ArpK`		AtmArpS ARP block
`ArpM`		AtmArpS MARS structure
`ArpR`		AtmArpS NDIS request
`ArpS`		AtmArpS SAP structure
`Asy1`		ndis / ASYNC_IOCTX_TAG
`Asy2`		ndis / ASYNC_INFO_TAG
`Asy3`		ndis / ASYNC_ADAPTER_TAG
`Asy4`		ndis / ASYNC_FRAME_TAG
`ATac`	AppTag ATR command buffer
`AtC`		IDE disk configuration
`AtD`		atdisk.c
`ATdi`	AppTag cliendata index buffer
`ATdt`	AppTag cliendata temp buffer
`ATFb`	AppTag file id buffer
`ATgb`	AppTag guid buffer
`ATIX`		WDM mini drivers for ATI tuner, xbar, etc.
`Atk`		Appletalk transport
`AtmA`		Atoms
`ATmp`	AppTag mount point
`AtmT`		Atom tables
`ATMU`	atmuni.sys	ATM UNI Call Manager
`Atom`		Atom Tables
`ATon`	AppTag object name
`ATub`	AppTag user buffer
`AudC`	wdmaud.sys	MMSYSTEM Wave/Midi API mapper
`AudL`	wdmaud.sys	MMSYSTEM Wave/Midi API mapper
`AuxL`		EXIFS Auxlist
`Bat?` (0)		Battery Class drivers
`BatC`		Composite battery driver
`BatM`		Control method battery driver
`BatS`		Smart battery driver
`Batt`		Battery class driver
`BCDK`	nt!init	Kernel boot configuration data.
`BCSP`	bthbcsp.sys	Bluetooth BCSP minidriver
`BIG`	nt!mm	Large session pool allocations (ntosexpool.c)
`BlCc`	blkcache.sys	Block Cache Driver
`Bmfd`		Font related stuff
`BT3C`	bt3c.sys	Bluetooth 3COM minidriver
`BT8x`		WDM mini drivers for Brooktree 848,829, etc.
`BTHP`	bthport.sys	Bluetooth port driver (generic)
`BthS`	bthport.sys	Bluetooth port driver (security)
`BTME`	bthenum.sys	Bluetooth enumerator
`BTMO`	bthmodem.sys	Bluetooth modem
`BTPT`		Bluetooth transport protocol library
`BTSR`	bthser.sys	Bluetooth serial minidriver
`BTUR`	bthuart.sys	Bluetooth UART minidriver
`Bu*`		burneng.sys from adaptec
`Call` (0)	nt!ex	kernel callback object signature
`call`		debugging call tables
`Cbrb`	nt!ExAllocateCallBack	Callback registration block (PEX_CALLBACK_FUNCTION, ptr to 'CMcb' structure)
`CBRe`		CallbackRegistration
`Cc`	nt!cc	Cache Manager allocations (catch
`CcBc`	nt!cc	Cache Manager Bcb from pool
`CcBm`	nt!cc	Cache Manager Bitmap
`CcBn`	nt!cc	Cache Manager Bcb trim notification entry
`CcBr`	nt!cc	Cache Manager Bitmap range
`CcBz`	nt!cc	Cache Manager Bcb Zone
`CcDw`	nt!cc	Cache Manager Deferred Write
`CcEv`	nt!cc	Cache Manager Event
`CcFn`	nt!cc	Cache Manager File name for popups
`CcMb`	nt!cc	Cache Manager Mbcb
`CcOb`	nt!cc	Cache Manager Overlap Bcb
`CcPB`	nt!ccpf	Prefetcher trace buffer
`CcPC`	nt!ccpf	Prefetcher context
`CcPc`	nt!cc	Cache Manager Private Cache Map
`CcPD`	nt!ccpf	Prefetcher trace dump
`CcPF`	nt!ccpf	Prefetcher file name
`CcPf`	nt!ccpf	Prefetcher
`CcPh`	nt!ccpf	Prefetcher header preallocation
`CcPI`	nt!ccpf	Prefetcher intermediate table
`CcPL`	nt!ccpf	Prefetcher read list
`CcPM`	nt!ccpf	Prefetcher metadata
`CcPp`	nt!ccpf	Prefetcher instructions
`CcPq`	nt!ccpf	Prefetcher query buffer
`CcPS`	nt!ccpf	Prefetcher scenario
`CcPs`	nt!ccpf	Prefetcher section table
`CcPT`	nt!ccpf	Prefetcher trace
`CcPv`	nt!ccpf	Prefetcher volume info
`CcPw`	nt!ccpf	Prefetcher boot worker
`CcSc`	nt!cc	Cache Manager Shared Cache Map - ok
`CctX`		EXIFX FCB Commit CTX
`CcVa`	nt!cc	Cache Manager Initial array of Vacbs
`CcVl`	nt!cc	Cache Manager Vacb Level structures (large streams)
`CcVp`	nt!cc	Cache Manager Array of Vacb pointers for a cached stream
`CcWK`	nt!cc	Kernel Cache Manager lookaside list
`CcWk`	nt!cc	Kernel Cache Manager lookaside list
`CcWq`	nt!cc	Cache Manager Work Queue Item
`CcZe`	nt!cc	Cache Manager Buffer of Zeros
`CdA`		CdAudio filter driver
`Cdcc`	cdfs.sys	CDFS Ccb
`Cddn`	cdfs.sys	CDFS CdName in dirent
`Cdee`	cdfs.sys	CDFS Search expression for enumeration
`Cdfd`	cdfs.sys	CDFS Data Fcb
`Cdfi`	cdfs.sys	CDFS Index Fcb
`Cdfl`	cdfs.sys	CDFS Filelock
`CdFn`	cdfs.sys	CDFS Filename buffer
`Cdfn`	cdfs.sys	CDFS Nonpaged Fcb
`Cdfs`	cdfs.sys	CDFS General Allocation
`Cdft`	cdfs.sys	CDFS Fcb Table entry
`Cdgs`	cdfs.sys	CDFS Generated short name
`Cdic`	cdfs.sys	CDFS Irp Context
`Cdil`	cdfs.sys	CDFS Irp Context lite
`Cdio`	cdfs.sys	CDFS Io context for async reads
`Cdma`	cdfs.sys	CDFS Mcb array
`Cdpe`	cdfs.sys	CDFS Prefix Entry
`CdPn`	cdfs.sys	CDFS CdName in path entry
`Cdpn`	cdfs.sys	CDFS Prefix Entry name
`CdRw`	dwcdrw.sys	(Dvd Write Now) cdrw driver's default tag
`Cdsp`	cdfs.sys	CDFS Buffer for spanning path table
`Cdtc`	cdfs.sys	CDFS TOC
`Cdun`	cdfs.sys	CDFS Buffer for upcased name
`Cdvd`	cdfs.sys	CDFS Buffer for volume descriptor
`Cdvp`	cdfs.sys	CDFS Vpb allocated in filesystem
`CEP`	wibcm.sys	CEP_INSTANCE_TAG
`cfsp`	cfosspeed.sys	cFosSpeed Driver
`CIcr`	ci.dll	Code Integrity allocations for image integrity checking
`CIha`	ci.dll	Code Integrity hashes
`CIsc`	ci.dll	Code Integrity core dll
`ClfA`	clfs.sys	CLFS_CONTAINER_TAG
`ClfB`	clfs.sys	CLFS_BASEFILE_TAG
`ClfC`	clfs.sys	CLFS_LOGFCBPHYSICAL_TAG
`ClfD`	clfs.sys	CLFS_LOGFCBVIRTUAL_TAG
`ClfE`	clfs.sys	CLFS_LOGCCB_TAG
`ClfF`	clfs.sys	CLFS_FLUSHELT_TAG
`ClfG`	clfs.sys	CLFS_REQUEST_TAG
`ClfH`	clfs.sys	CLFS_IOCB_TAG
`ClfI`	clfs.sys	CLFS_MARSHALBUFFER_TAG
`Clfs`	clfs.sys	CLFS_TAG
`CM`	nt!cm	Configuration Manager (registry)
`CM??`	nt!cm	Internal Configuration manager allocations
`CMAl`	nt!cm	internal registry memory allocator pool tag
`CMCa`	nt!cm	Configuration Manager Cache (registry)
`CMcb`	nt!CmRegisterCallback	RegistryCallback routine registration info (registration time, Context, ...)
`CmcD`	hal.dll	HAL CMC Driver Log
`CmcK`	hal.dll	HAL CMC Kernel Log
`CmcT`	hal.dll	HAL CMC temporary Log
`CMDa`	nt!cm	value data cache pool tag
`CMDc`	nt!cm	Configuration Manager Cache (registry)
`CMIn`	nt!cm	index hint pool tag
`CMkb`	nt!cm	registry key control blocks
`CMNb`	nt!cm	notification block pool tag
`CMnb`	nt!cm	registry notify blocks
`CMpa`	nt!cm	registry post apcs
`CMpb`	nt!cm	registry post blocks
`CMpe`	nt!cm	registry post events
`CMSb`	nt!cm	internal stash buffer pool tag
`CMsb`	nt!cm	registry stash buffer
`CMSc`	nt!cm	security cache pooltag
`CMSH`	wibcm.sys	WIBCM_SHARED_TAG
`CMVa`	nt!cm	value cache value tag
`CMVI`	nt!cm	value index cache tag
`CmVn`	nt!cm	captured value name
`CMVw`	nt!cm	registry mapped view of file
`CMWK`	wibcm.sys	WIBCM_WORK_TAG
`CMWT`	wibcm.sys	WIBCM_TIMER_TAG
`Cngb`	ksecdd.sys	CNG kmode crypto pool tag
`COMX`	serial.sys	serial driver allocations
`COMX` (1)	vspd.sys	Virtual Serial Port driver
`Cont`		Contiguous physical memory allocations for device drivers
`CopW`		EXIFS CopyOnWrite
`Covr`	nt!cov	Code Coverage pool tag
`CpeD`	hal.dll	HAL CPE Driver Log
`CpeK`	hal.dll	HAL CMC Kernel Log
`CpeT`	hal.dll	HAL CPE temporary Log
`CPnp`	classpnp.sys	ClassPnP transfer packets
`Crsp`	ksecdd.sys	CredSSP kernel mode client allocations
`CrtH`		EXIFS Create Header
`Cryp`	ksecdd.sys	Crypto allocations
`CSdk`		Cluster Disk Filter driver
`CSnt`		Cluster Network driver
`CTE`		Common transport environment (ntosinccxport.h, used by tdi)
`Cvli`		EXIFS Cached Volume Info
`D2d` (0)		Device Object to DosName rtns (ntos tldev2dos.c)
`D3Dd`		DX D3D driver (embedded in a display driver like s3mvirge.dll)
`D851`		8514a video driver
`Dacl`		Temp allocations for object DACLs
`Dati`		ati video driver
`DbLo`		Debug logging
`dcam`		WDM mini driver for IEEE 1394 digital camera
`Dcdd`	cdd.dll	Canonical display driver
`Dcl`		cirrus video driver
`Ddk`		Default for driver allocated memory (user's of ntddk.h)
`Devi`		Device objects
`Dfb`		framebuf video driver
`DfC?`	dfsc.sys	DFS Client allocations
`DfCa`	dfsc.sys	DFS Client PERUSERTABLE
`DfCb`	dfsc.sys	DFS Client REFCONTEXT
`DfCc`	dfsc.sys	DFS Client CONNECTION
`DfCd`	dfsc.sys	DFS Client CURRENTDC
`DfCe`	dfsc.sys	DFS Client CSCEA
`DfCf`	dfsc.sys	DFS Client FILENAME
`DfCg`	dfsc.sys	DFS Client PREFIXCACHE
`DfCh`	dfsc.sys	DFS Client HASH
`DfCi`	dfsc.sys	DFS Client INPUTBUFFER
`DfCj`	dfsc.sys	DFS Client REWRITTENNAME
`DfCl`	dfsc.sys	DFS Client DCLIST
`DfCm`	dfsc.sys	DFS Client CMCONTEXT
`DfCn`	dfsc.sys	DFS Client DOMAINNAME
`DfCp`	dfsc.sys	DFS Client PATH
`DfCq`	dfsc.sys	DFS Client REGSTRING
`DfCr`	dfsc.sys	DFS Client REFERRAL
`DfCs`	dfsc.sys	DFS Client SHARENAME
`DfCt`	dfsc.sys	DFS Client TREECONNECT
`DfCu`	dfsc.sys	DFS Client USETABLE
`DfCv`	dfsc.sys	DFS Client SERVERNAME
`DfCw`	dfsc.sys	DFS Client TARGETINFO
`DfCx`	dfsc.sys	DFS Client CREDENTIALS
`DfCy`	dfsc.sys	DFS Client REMOTEENTRY
`DfCz`	dfsc.sys	DFS Client DOMAINREFERRAL
`Dfs`		Distributed File System
`Dfsm`		Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdigre
`dfsr`		RDBSS IRP allocation
`dFVE`	dumpfve.sys	Full Volume Encryption crash dump filter (Bitlocker Drive Encryption)
`Dh 0`		DirectDraw/3D default object
`Dh 1`		DirectDraw/3D DirectDraw object
`Dh 2`		DirectDraw/3D Surface object
`Dh 3`		DirectDraw/3D Direct3D context object
`Dh 4`		DirectDraw/3D VideoPort object
`Dh 5`		DirectDraw/3D MotionComp object
`Dire`		Directory objects
`Dlck`		deadlock verifier (part of driver verifier) structures
`Dlmp`		Video utility library for Vista display drivers
`Dmga`		mga (matrox) video driver
`DmH?`		DirectMusic hardware synthesizer
`Dmio`		Logical Disk Manager driver
`Dmip`	dmio.sys	Logical Disk Manager driver
`Dmiq`	dmio.sys	Logical Disk Manager driver
`Dmld`		Logical Disk Manager loader
`DmpS`	dumpsvc.sys	Crashdump Service Driver
`DmS?`		DirectMusic kernel software synthesizer
`Dmst`		Logical Disk Manager driver static initialization
`Dndt`		Device node
`Dnod`		Device node structure
`DOPE`		Device Object Power Extension (po component)
`DPHk`	DbgPrnHk.sys	DbgPrintLog's helper driver, cahces and stores debug messages in memory.
`DPrf`		Disk performance filter driver
`Dprt`	dxgkrnl.sys	Video port for Vista display drivers
`Dps5`		NT5 PostScript printer driver
`Dpsh`		Postcript driver heap memory
`Dpsi`		psidisp video driver
`Dpsm`		Postcript driver memory
`DPwr`	nt!pnp	PnP power management
`Dqv`		qv (qvision) video driver
`Driv`		Driver objects
`Drsd`		Rasdd Printer Driver Pool Tag.
`Dtga`		tga video driver
`Dump`		Bugcheck dump allocations
`Dun5`		NT5 Universal printer driver
`DUQD`	mpsdrv.sys	MPSDRV upcall user request
`DV??`		RDR2 DAV MiniRedir Tags
`DVCx`		AsyncEngineContext, DAV MiniRedir
`DVEx`		Exchange, DAV MiniRedir
`DVFi`		FileInfo, DAV MiniRedir
`DVFn`		FileName, DAV MiniRedir
`Dvg2`		vga 256 color video driver
`Dvg6`		vga 64K color video driver
`Dvga`		vga 16 color video driver
`Dvgr`		vga for risc video driver
`DVRw`		ReadWrite, DAV MiniRedir
`DVSc`		SrvCall, DAV MiniRedir
`DVSh`		SharedHeap, DAV MiniRedir
`DW32`		W32 video driver
`Dwd`		wd90c24a video driver
`DWNb`	dwudf.sys	(DVD Write Now) I/O buffers and data verification request block
`DWNf`	dwudf.sys	(DVD Write Now) default allocation without internal bounds checker
`dwnF`	dwudf.sys	(DVD Write Now) default tag
`DWNm`	dwudf.sys	(DVD Write Now) pending verification bitmap
`DWNm` (1)	dwudf.sys	(DVD Write Now) default allocation tag when built-in memory manager is enabled
`dwnS`	dwudf.sys	(DVD Write Now) 'system' memory allocation
`DWNz`	dwudf.sys	(DVD Write Now) Zero-filled buffer
`Dwp9`		weitekp9 video driver
`DWvb`	dwudf.sys	(DVD Write Now) stored data verification block
`Dxga`		XGA video driver
`DxgK`	dxgkrnl.sys	Vista display driver support
`Efsc` (0)		EFS driver
`Efsm`		EFS driver
`Efst`		EXIFS FS Statistics
`Enli`	nt!tm	KTM Transaction Enlistment
`Envr`		Environment strings
`Err`		Error strings
`EtwA`	nt!etw	Etw APC
`EtwB`	nt!etw	Etw Buffer
`EtwC`	nt!etw	Etw Realtime Consumer
`EtwD`	nt!etw	Etw DataBlock
`EtwG`	nt!etw	Etw Guid
`EtwL`	nt!etw	ETW_LOGGER_CONTEXT
`EtwP`	nt!etw	Etw Pool
`Etwp`	nt!etw	ETW per
`EtwQ`	nt!etw	Etw Queue
`Etwq`	nt!etw	Etw ReplyQueue
`EtwR`	nt!etw	Etw Registration
`Etwr`	nt!etw	Etw ReplyQueue Entry
`EtwS`	nt!etw	Etw DataSource
`Evel`		EFS file system filter driver lookaside list
`Even`		Event objects
`Evid`		Rtl Event ID's
`ExWl`		Executive worker list entry
`Fat` (0)	fastfat.sys	Fat File System allocations
`FatB`	fastfat.sys	Fat allocation bitmaps
`Fatb`	fastfat.sys	Fat Bcb arrays
`FatC`	fastfat.sys	Fat Ccbs
`FatD`	fastfat.sys	Fat pool dirents
`Fatd`	fastfat.sys	Fat EA data
`FatE`	fastfat.sys	Fat EResources
`Fate`	fastfat.sys	Fat EA set headers
`FatF`	fastfat.sys	Fat Fcbs
`Fatf`	fastfat.sys	Fat deferred flush contexts
`FatI`	fastfat.sys	Fat IrpContexts
`Fati`	fastfat.sys	Fat IO run descriptor
`FatL`	fastfat.sys	Fat FAT entry lookup buffer on verify
`FatN`	fastfat.sys	Fat Nonpaged Fcbs
`Fatn`	fastfat.sys	Fat filename buffer
`FatO`	fastfat.sys	Fat I/O buffer
`FatP`	fastfat.sys	Fat output for query retrieval pointers (caller frees)
`FatQ`	fastfat.sys	Fat buffered user buffer
`FatR`	fastfat.sys	Fat repinned Bcb
`Fatr`	fastfat.sys	Fat verification
`FatS`	fastfat.sys	Fat stashed Bpb
`Fats`	fastfat.sys	Fat verification
`FatT`	fastfat.sys	Fat directory allocation bitmaps
`FatV`	fastfat.sys	Fat Vcb stat bucket
`Fatv`	fastfat.sys	Fat backpocket Vpb
`FatW`	fastfat.sys	Fat FAT windowing structure
`FatX`	fastfat.sys	Fat IO contexts
`Fatx`	fastfat.sys	Fat delayed close contexts
`fboX`		EXIFS FOBXVF List
`Fcbl`		EXIFS FCBlock
`FhCI`	substvol.sys	(AllenPort Virtual Volume) file handle cache item
`FIcn`	fileinfo.sys	FileInfo FS
`FIcp`	fileinfo.sys	FileInfo FS
`FIcs`	fileinfo.sys	FileInfo FS
`FIcv`	fileinfo.sys	FileInfo FS
`File`		File objects
`FIOc`	fileinfo.sys	FileInfo FS
`FIof`	fileinfo.sys	FileInfo FS
`FIou`	fileinfo.sys	FileInfo FS
`FIPc`	fileinfo.sys	FileInfo FS
`FIvn`	fileinfo.sys	FileInfo FS
`FIvp`	fileinfo.sys	FileInfo FS
`FLex`		exclusive file lock
`FLfl`		exported (non
`FLli`		per
`FLln`		shared lock tree node
`flnk`		font link tag used in ntgdigre
`Flop`		floppy driver
`Flop` (1)	flopx.sys	Alter's Floppy driver with non-standard format support (e.g. 1,76Mb)
`FLsh`		shared file lock
`Flst`		EXIFS Freelist
`FLwl`		waiting lock
`FM??`	fltmgr.sys	Unrecognized FltMgr tag (update pooltag.w)
`FMac`	fltmgr.sys	ASCII String buffers
`FMas`	fltmgr.sys	ASYNC_IO_COMPLETION_CONTEXT structure
`FMcb`	fltmgr.sys	FLT_CCB structure
`FMcr`	fltmgr.sys	Context registration structures
`FMct`	fltmgr.sys	TRACK_COMPLETION_NODES structure
`FMdl`	fltmgr.sys	Array of DEVICE_OBJECT pointers
`FMea`	fltmgr.sys	EA buffer for create
`FMfc`	fltmgr.sys	FLTMGR_FILE_OBJECT_CONTEXT structure
`FMfi`	fltmgr.sys	Fast IO dispatch table
`FMfk`	fltmgr.sys	Byte Range Lock structure
`FMfl`	fltmgr.sys	FLT_FILTER structure
`FMfn`	fltmgr.sys	NAME_CACHE_NODE structure
`FMfr`	fltmgr.sys	FLT_FRAME structure
`FMfz`	fltmgr.sys	FILE_LIST_CTRL structure
`FMib`	fltmgr.sys	Irp SYSTEM buffers
`FMic`	fltmgr.sys	IRP_CTRL completion node stack
`FMil`	fltmgr.sys	IRP_CTRL completion node stack
`FMin`	fltmgr.sys	FLT_INSTANCE name
`FMis`	fltmgr.sys	FLT_INSTANCE structure
`FMla`	fltmgr.sys	Per
`FMnc`	fltmgr.sys	NAME_CACHE_CREATE_CTRL structure
`FMng`	fltmgr.sys	NAME_GENERATION_CONTEXT structure
`FMol`	fltmgr.sys	OPLOCK_CONTEXT structure
`FMos`	fltmgr.sys	Operation status ctrl structure
`FMpl`	fltmgr.sys	Cache aware pushLock
`FMpr`	fltmgr.sys	FLT_PRCB structure
`FMrl`	fltmgr.sys	FLT_OBJECT rundown logs
`FMrp`	fltmgr.sys	Reparse point data buffer
`FMrr`	fltmgr.sys	Per
`FMsd`	fltmgr.sys	Security descriptors
`FMsl`	fltmgr.sys	STREAM_LIST_CTRL structure
`FMtn`	fltmgr.sys	Temporary file names
`FMtr`	fltmgr.sys	Temporary Registry information
`FMts`	fltmgr.sys	Tree Stack
`FMus`	fltmgr.sys	Unicode string
`FMvf`	fltmgr.sys	FLT_VERIFIER_EXTENSION structure
`FMvj`	fltmgr.sys	FLT_VERIFIER_OBJECT structure
`FMvo`	fltmgr.sys	FLT_VOLUME structure
`FMwi`	fltmgr.sys	Work item structures
`FOCX`	nt!fsrtl	File System Run Time File Object Context structure
`FS??`	nt!fsrtl	Unrecoginzed File System Run Time allocations (update pooltag.w)
`FSeh`	nt!fsrtl	File System Run Time Extra Create Parameter Entry
`FSel`	nt!fsrtl	File System Run Time Extra Create Parameter List
`FSfm`	nt!fsrtl	File System Run Time Fast Mutex Lookaside List
`FSim`	nt!fsrtl	File System Run Time Mcb Initial Mapping Lookaside List
`FSmg`	nt!fsrtl	File System Run Time
`Fsrc`	fsrec.sys	Filesystem recognizer (fsrec.sys)
`FSrd`	nt!fsrtl	File System Run Time
`FSrm`	nt!fsrtl	File System Run Time
`FSrN`	nt!fsrtl	File System Run Time
`FSrn`	nt!fsrtl	File System Run Time
`FSro`	nt!fsrtl	File System Run Time
`FSrs`	nt!fsrtl	File System Run Time Work Item for low
`FSrt`	nt!fsrtl	File System Run Time allocations (DO NOT USE!)
`FstB`		ntosfstub
`Fstb`		ntosfstub
`FSun`	nt!fsrtl	File System Run Time
`FsVg`	fsvga.sys	International VGA support
`FtC`		Fault tolerance driver
`FtM`		Fault tolerance driver
`FtpA`	mpsdrv.sys	MPSDRV FTP protocol analyzer
`FTrc`		Fault tolerance Slist tag.
`FtS`		Fault tolerance driver
`FtT`		Fault tolerance driver
`FtU`		Fault tolerance driver
`FtV`		Fault tolerance driver
`FVE0`	fvevol.sys	General allocations
`FVE?`	fvevol.sys	Full Volume Encryption Filter Driver (Bitlocker Drive Encryption)
`FVEc`	fvevol.sys	Cryptographic allocations
`FVEl`	fvevol.sys	FVELIB allocations
`FVEp`	fvevol.sys	Write buffers
`FVEr`	fvevol.sys	Reserved mapping addresses
`FVEv`	fvevol.sys	Conversion allocations
`FVEw`	fvevol.sys	Worker threads
`FVEx`	fvevol.sys	Read/write control structures
`FwfD`	mpsdrv.sys	MPSDRV driver buffer for flattening NET_BUFFFER
`Fwpp`	fwpkclnt.sys	Windows Filtering Platform export driver.
`FxDr`	wdf01000.sys	KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable.
`FxL?`	wdfldr.sys	KMDF Loader Pool allocation
`FxLg`	wdf01000.sys	KMDF IFR log tag
`G` (0)		Gdi Generic allocations
`G???`		Gdi Objects
`Gcac`		Gdi glyph cache
`Gcap`		Gdi capture buffer
`Gcsl`		Gdi string resource script names
`Gdbr`		Gdi driver brush realization
`Gdd`		Gdi ddraw PKEY_VALUE_FULL_INFORMATION
`Gdda`		Gdi ddraw attach list
`GddD`		Gdi ddraw dummy page
`Gdde`		Gdi ddraw event
`Gddf`		Gdi ddraw driver heaps
`Gddp`		Gdi ddraw driver caps
`Gddv`		Gdi ddraw driver video memory list
`GDev`		Gdi pdev
`Gdev`		Gdi GDITAG_DEVMODE
`Gdrs`		Gdi GDITAG_DRVSUP
`Gdwd`	win32k.sys	Gdi watchdog support objects
`Gdxd`		Gdi ddraw VPE directdraw object
`Gdxs`		Gdi ddraw VPE surface, videoport, capture object
`Gdxx`		Gdi ddraw VPE DXAPI object
`Gebr`		Gdi ENGBRUSH
`gEdg`		Gdi gradient fill triangle
`Gfcb`		EXIFS Grow FCB
`Gffv`		Gdi FONTFILEVIEW
`GFil`		Gdi engine descriptor list
`gFil`		Gdi FILEVIEW
`Gfsb`		Gdi font sustitution list
`Gfsm`		Gdi Fast mutex
`Ggb`		Gdi glyph bits
`Ggbl`		Gdi look aside buffers
`Ggdv`		Gdi GDITAG_GDEVICE
`Gglb`		Gdi temp buffer
`Ggls`		Gdi glyphset
`Gh ?`	win32k.sys	Gdi Handle manager specific object types: defined in w32 tgdiinc tgdistr.h
`Ghmg`		Gdi handle manager objects
`Gini`		Gdi fast mutex
`Gla?`	win32k.sys	Gdi handle manager specific object types allocated from lookaside memory: defined in w32 tgdiinc tgdistr.h
`Gldv`		Gdi Ldev
`Glnk`		Gdi PFELINK
`Gmap`		Gdi font map signature table
`Gpff`		Gdi physical font file
`Gpft`		Gdi font table
`Gsem`		Gdi Semaphores
`Gsp`		Gdi sprite
`Gspr`		Gdi sprite grow range
`Gtmp`		Gdi temporary allocations
`Gtmw`		Gdi TMW_INTERNAL
`Gxlt`		Gdi Xlate
`Hal` (0)	hal.dll	Hardware Abstraction Layer
`HalV`	ntoskrnl.exe	Driver Verifier DMA checking
`HcBm`	hcaport.sys	HCAPORT_TAG_BITMAP
`HcCm`	hcaport.sys	HCAPORT_TAG_CM
`HcCq`	hcaport.sys	HCAPORT_TAG_CQUEUE
`HcdI`	hcaport.sys	HCAPORT_TAG_HWID
`HcDr`	hcaport.sys	HCAPORT_TAG_DEVICE_RELATIONS
`HcEn`	hcaport.sys	HCAPORT_TAG_ENUM
`HcEv`	hcaport.sys	HCAPORT_TAG_EVENT
`HCID`	bthport.sys	Bluetooth port driver HCI debug
`HCIT`	bthport.sys	Bluetooth port driver (HCI)
`HcMa`	hcaport.sys	HCAPORT_TAG_MAD
`HcMc`	hcaport.sys	HCAPORT_TAG_MISC
`HcMp`	hcaport.sys	HCAPORT_TAG_MINIPORT
`HcMr`	hcaport.sys	HCAPORT_TAG_REMOVE_LOCK
`HcOb`	hcaport.sys	HCAPORT_TAG_OBJECT
`HcPr`	hcaport.sys	HCAPORT_TAG_PROTD
`HcRs`	hcaport.sys	HCAPORT_TAG_RESOURCE_LIST
`HcUc`	hcaport.sys	HCAPORT_TAG_UCONTEXT
`HdCl`		HID Client Sample Driver
`HidC`		HID Class
`HidP`		HID Parser
`Hioc`	hcaport.sys	HCAPORT_TAG_IOC_SERVICE_TABLE
`HisC`		histogram filter driver
`Hist`		histogram filter driver
`Hmgo`	hcaport.sys	HCAPORT_TAG_WQ_MG_INFO
`Hpfs`		Pinball (aka Hpfs) allocations
`HPmi`	hcaport.sys	HCAPORT_TAG_PMI_EXTENSION
`HpMM`	pnpmem.sys	HotPlug Memory Driver
`hSVD`	mrxdav.sys	Shared Heap Tag
`HT01`		GDI Halftone AddCachedDCI() for CurCDCIData
`HT02`		GDI Halftone GetCachedDCI() for Threshold
`HT03`		GDI Halftone FindCachedSMP() for CurCSMPData
`HT04`		GDI Halftone FindCachedSMP() for CurCSMPBmp
`HT05`		GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
`HT06`		GDI Halftone pDCIAdjClr() for DEVCLRADJ
`HT07`		GDI Halftone ComputeRGB555LUT() for RGBLUT
`HT08`		GDI Halftone ColorTriadSrcToDev() for RGB
`HT09`		GDI Halftone ColorTriadSrcToDev() for CRTX
`HT10`		GDI Halftone CreateDyesColorMappingTable() for DevPrims
`HT11`		GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
`HT12`		GDI Halftone ThresholdsFromYData() for pYData
`HT13`		GDI Halftone ComputeHTCellRegress() for pThresholds
`HT14`		GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
`HT15`		GDI Halftone CalculateStretch() for PrimColorInfo
`Hvlm`	nt!Hvl	Temporary MDL for the Hvl component.
`HvlP`	nt!Hvl	Hypercall marshalling pages for the Hvl component.
`IBCM` (0)	wibcm.sys	CM_INSTANCE_TAG Windows Infiniband Communications Manager
`IBm*`	wibms.sys	Windows Infiniband Management Server pool tags
`IbPA`	wibpm.sys	WIBPM_SAMPLE_TAG
`IbPI`	wibpm.sys	WIBPM_ITEM_TAG
`IbPm`	wibpm.sys	WIBPM_TAG Windows Infiniband Performance Manager
`IbPS`	wibpm.sys	WIBPM_SENT_TAG
`IbW0`	wibwmi.sys	WIBWMI0_TAG Windows Infiniband WMI Manager
`IbW1`	wibwmi.sys	WIBWMI1_TAG
`IbW2`	wibwmi.sys	WIBWMI2_TAG
`Icp`		I/O completion packets queue on a completion ports
`IcpP`		NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers
`ICSo`	substvol.sys	(AllenPort Virtual Volume) SectionObject cache
`IdeP`		atapi IDE
`IdeX`		PCI IDE
`idle`		Power Manager idle handler
`Ifs`		Default file system allocations (user's of ntifs.h)
`II??`		IP in IP tunneling
`IIdt`		Data
`IIhd`		Header
`IIpk`		Packet
`IIrf`		Free memory
`IIsc`		Send Context
`IITn`		Tunnel
`IIts`		Transfer Context
`IIwc`		Work Context
`Im*`		Imapi.sys from adaptec
`Info`		general system information allocations
`INTC`		Intel video driver
`INty`	substvol.sys	(AllenPort Virtual Volume) file notification item
`Io`	nt!io	general IO allocations
`IoCc`	nt!io	Io completion context
`IoEa`	nt!io	Io extended attributes
`IoEr`	nt!io	Io error log packets
`IoFc`	nt!io	Io name transmogrify operation
`IOfl`	substvol.sys	(AllenPort Virtual Volume) offline file descriptor
`IoFs`	nt!io	Io shutdown packet
`IoFu`	nt!pnp	Io file utils
`Ioin`		Io interrupts
`IoKB`		Registry basic key block (temp allocation)
`IoNm`	nt!io	Io parsing names
`IoOp`	nt!io	I/O subsystem open packet
`IoRb`	nt!io	Io remote boot related
`IoRi`	nt!io	I/O SubSystem Driver Reinitialization Callback Packet
`IoRN`	nt!io	Registry key name (temp allocation)
`IoSe`	nt!io	Io security related
`IoSh`	nt!io	Io shutdown packet
`IoSt`	nt!io	Io Stream Identifier Context
`IoTi`	nt!io	Io timers
`IoTt`	nt!vf	I/O verifier IRP tracking table
`IoUs`	nt!io	I/O SubSystem completion Context Allocation
`Ip??`	ipsec.sys	IP Security
`IpAT`	ipsec.sys	AH headers in transport mode
`IpAU`	ipsec.sys	AH headers in tunnel mode
`IpAX`	ipsec.sys	Key acquire contexts
`IpBP`	ipsec.sys	buffer pools
`IpCO`	ipsec.sys	IP compression
`IpEQ`	ipsec.sys	event queue
`IpET`	ipsec.sys	ESP headers in transport mode
`IpEU`	ipsec.sys	ESP headers in tunnel mode
`IpFI`	ipsec.sys	Filter blocks
`IpFl`	mpsdrv.sys	MPSDRV IP Flow
`IpHT`	ipsec.sys	HUGHES headers in transport mode
`IpHU`	ipsec.sys	HUGHES headers in tunnel mode
`IpHW`	ipsec.sys	hardware accleration items
`IpKE`	ipsec.sys	keys
`IpLA`	ipsec.sys	lookaside lists
`IPm?`		IP Multicasting
`IPmf`		Free memory (only in checked builds)
`IPmg`		Group
`IPmm`		Message
`IPmo`		Outgoing Interface
`IPms`		Source
`IpSA`	ipsec.sys	Security Associations
`IpSC`	ipsec.sys	send complete context
`IpSI`	ipsec.sys	initial allocations
`IpSQ`	ipsec.sys	stall queues
`IpTI`	ipsec.sys	timers
`IPX`		Nwlnkipx transport
`IrD?`		IrDA TDI and RAS drivers
`Irp`		Io, IRP packets
`Irp+`	nt!vf	I/O verifier allocated IRP packets
`IrpB`	nt!vf	I/O verifier direct I/O double buffer allocation
`IrpC`	nt!vf	I/O verifier stack contexts
`Irpd`	nt!vf	I/O verifier deferred completion context
`Irpl`	nt!io	system large IRP lookaside list
`Irps`	nt!io	system small IRP lookaside list
`Irpt`	nt!vf	I/O verifier per
`Isap`		Pnp Isa bus extender
`IU??`		IIS Utility Driver
`IUcp`		completion port minipackets
`IUDl`		Lookaside list allocations
`KAPC` (0)	nt!io	I/O SubSystem HardError APC
`KbdC`		Keyboard Class Driver
`KCfe`		Kernel COM factory entry
`Ke`		Kernel data structures
`KeIC`		Kernel Interrupt Object Chain
`Key`		Key objects
`KMIX`		Kmixer (wdm audio)
`KNMI`		Kernel NMI Callback object
`KrbC`	ksecdd.sys	Kerberos Client package
`KSah`		Ks auxiliary stream headers
`KSAI`		allocator instance
`KSai`		default allocator instance header
`KSbi`		event buffered item
`KSce`		create item entry
`KSch`		create handler entry
`KSCI`		clock instance
`KSci`		default clock instance header
`KScp`		object creation parameters auxiliary copy
`KSda`		default allocator
`KSdc`		default clock
`KSdh`		device header
`Kse0`	ksecdd.sys	Security driver allocs for sec package 0
`Kse1`	ksecdd.sys	Security driver allocs for sec package 1
`Kse2`	ksecdd.sys	Security driver allocs for sec package 2
`Kse3`	ksecdd.sys	Security driver allocs for sec package 3
`Kse4`	ksecdd.sys	Security driver allocs for sec package 4
`Kse5`	ksecdd.sys	Security driver allocs for sec package 5
`Kse6`	ksecdd.sys	Security driver allocs for sec package 6
`Kse7`	ksecdd.sys	Security driver allocs for sec package 7
`Kse8`	ksecdd.sys	Security driver allocs for sec package 8
`Kse9`	ksecdd.sys	Security driver allocs for sec package 9
`Ksec`	ksecdd.sys	Security device driver
`KSed`		oneshot event deletion dpc
`KSee`		event entry
`KSep`		irp system buffer event parameter
`KSer`		QM error report
`KseS`	ksecdd.sys	Security driver allocs for LSA proper
`KSew`		oneshot event deletion workitem
`KseZ`	ksecdd.sys	Security driver allocs for default sec package
`KSfd`		filter cache data (MSKSSRV)
`KsFI`		filter instance
`KSns`		null security object
`KSnv`		registry name value
`KSoh`		object header
`KsoO`		WDM audio stuff
`KSop`		object creation parameters
`KSpc`		port driver instance FsContext
`KSPI`		pin instance
`KSpp`		irp system buffer property/method/event parameter
`KSpt`		pin type list (MSKSSRV)
`KSqf`		query information file buffer
`KSqr`		QM quality report
`KSsc`		port driver stream FsContext
`KSsf`		set information file buffer
`KSsh`		stream headers
`KSsi`		software bus interface
`KSsl`		symbolic link buffer (MSKSSRV)
`KSsp`		serialized property set
`kuzt`	SbieDrv.sys	Sandboxie Kernel Mode Driver
`L2CA` (0)	bthport.sys	Bluetooth port driver (L2CAP)
`L2T0`		ndisl2tp / MTAG_FREED
`L2T1`		ndisl2tp / MTAG_ADAPTERCB
`L2T2`		ndisl2tp / MTAG_TUNNELCB
`L2T3`		ndisl2tp / MTAG_VCCB
`L2T4`		ndisl2tp / MTAG_VCTABLE
`L2T5`		ndisl2tp / MTAG_WORKITEM
`L2T6`		ndisl2tp / MTAG_TIMERQ
`L2T7`		ndisl2tp / MTAG_TIMERQITEM
`L2T8`		ndisl2tp / MTAG_PACKETPOOL
`L2T9`		ndisl2tp / MTAG_FBUFPOOL
`L2Ta`		ndisl2tp / MTAG_HBUFPOOL
`L2Tb`		ndisl2tp / MTAG_TDIXRDG
`L2Tc`		ndisl2tp / MTAG_TDIXSDG
`L2Td`		ndisl2tp / MTAG_CTRLRECD
`L2Te`		ndisl2tp / MTAG_CTRLSENT
`L2Tf`		ndisl2tp / MTAG_PAYLRECD
`L2Tg`		ndisl2tp / MTAG_PAYLSENT
`L2Th`		ndisl2tp / MTAG_INCALL
`L2Ti`		ndisl2tp / MTAG_UTIL
`L2Tj`		ndisl2tp / MTAG_ROUTEQUERY
`L2Tk`		ndisl2tp / MTAG_ROUTESET
`L2Tl`		ndisl2tp / MTAG_L2TPPARAMS
`L2Tm`		ndisl2tp / MTAG_TUNNELWORK
`L2Tn`		ndisl2tp / MTAG_TDIXROUTE
`LANE`	atmlane.sys	LAN Emulation Client for ATM
`LB??`		LM Datagram receiver allocations
`LBan`		Server announcement
`LBbb`		Become backup context
`LBbl`		Backup List
`LBbn`		Name
`LBbr`		Become backup request
`LBbs`		Browser server
`LBci`		Connection info
`LBdi`		POOL_DOMAIN_INFO
`LBds`		Send datagram context
`LBea`		Ea buffer
`LBel`		Election context
`LBgb`		GetBackupList request
`LBic`		IRP context
`LBid`		Illegal datagram context
`LBma`		Master announce context
`LBmb`		Mailslot Buffer
`LBmh`		Mailslot header
`LBnn`		Name name
`LBpn`		Paged Name
`LBpt`		Paged transport
`LBse`		Browser security
`LBsl`		Browser server list
`LBtn`		Transport name
`Lbuf`		EXIFS Large Buffer
`LBvb`		View buffer
`LBwi`		Work item
`LBxm`		Master name
`LBxn`		TransportName
`LBxp`		Transport
`LCam`		WDM mini video capture driver for Logitech camera
`LeoC`		Symantec/Norton AntiVirus filter driver
`Lfs`		Lfs allocations
`LfsI`		Lfs allocations
`List`		kernel utilities list allocation
`LogA`	clfs.sys	CLFS_APITEST_TAG
`LpcM`		Local procedure call message blocks
`LpcZ`		LPC Zone
`Lr`		Generic allocations
`Lr!!`		Cancel request context blocks
`Lr2x`		Transact SMB context
`Lr??`		Buffers used for FsControlFile APIs
`Lrac`		ACL for redirector
`Lraw`		Async write context
`Lrbb`		Write behind buffer
`Lrca`		Temporary storage used in name canonicalization
`Lrcl`		ConnectListEntries
`Lrcn`		Computer Name
`Lrcx`		Context blocks of various types
`Lrdn`		Domain Name
`Lrds`		Duplicated ansi string
`Lrdu`		Duplicated unicode string
`Lrea`		EA related allocations
`Lref`		Reference history (debug only)
`Lrfc`		File Control Blocks
`Lrfl`		Fcb Locks
`Lrfp`		Fcb Paging locks
`Lric`		Instance Control Blocks
`Lrlb`		Lock Control Block buffers
`Lrlc`		Lock Control Blocks
`Lrme`		MPX table entries
`Lrmt`		MPX table
`Lrna`		Netbios Addresses
`Lrnf`		Non paged FCB
`Lrnt`		Non paged transport
`Lrps`		Paged security entry
`Lrpt`		Primary transport server list
`Lrsc`		Search Control Blocks
`Lrse`		Security entry
`Lrsl`		ServerListEntries
`Lrsm`		SMB buffer
`Lrso`		Operating system name
`Lrsx`		Send contexts
`Lrtc`		Transport connection
`Lrte`		Transport event.
`Lrwb`		Write behind buffer header
`Lrwq`		Work queue item
`Lrxx`		Transceive context blocks
`LS??`		LM server allocations
`LSac`		BlockTypeAdminCheck
`LSas`		BlockTypeAdapterStatus
`LSbf`		buffer descriptor
`LScd`		comm device
`LScn`		connection
`LSdb`		data buffer
`LSdc`		BlockTypeDirCache
`LSdi`		BlockTypeDirectoryInfo
`LSep`		endpoint
`LSfn`		BlockTypeFSName
`LSlf`		LFCB
`LSlr`		BlockTypeLargeReadX
`LSmf`		MFCB
`LSmi`		BlockTypeMisc
`LSnd`		WDM mini sound driver for Logitech video camera
`LSnh`		nonpaged block header
`LSni`		BlockTypeNameInfo
`LSop`		oplock break wait
`LSpc`		paged connection
`LSpm`		paged MFCB
`LSpr`		paged RFCB
`LSrf`		RFCB
`LSsc`		search(core)
`LSsd`		BlockTypeShareSecurityDescriptor
`LSsf`		BlockTypeDfs
`LSsh`		share
`LSsp`		search(core complete)
`LSsr`		search
`LSss`		session
`LStb`		table
`LStc`		tree connect
`LSti`		timer
`LStr`		transaction
`LSvi`		BlockTypeVolumeInformation
`LSwi`		initial work context
`LSwn`		normal work context
`LSwq`		BlockTypeWorkQueue
`LSwr`		raw work context
`LSws`		BlockTypeWorkContextSpecial
`Luaf`	luafv.sys	LUA File Virtualization
`LXMK`		kernel mixer line driver (KMXL
`Lxpt`		Transport
`MapP` (0)		PNP map
`Mapr`		arc firmware registry routines
`McaC`	hal.dll	HAL MCA corrected Log
`McaD`	hal.dll	HAL MCA Driver Log
`McaK`	hal.dll	HAL MCA Kernel Log
`MCAM`		WDM mini driver for Intel USB camera
`McaP`	hal.dll	HAL MCA Log from previous boot
`McaT`	hal.dll	HAL MCA temporary Log
`MCDd`		OpenGL MCD driver (embedded in a display driver like s3mvirge.dll)
`MCDx`		OpenGL MCD server (mcdsrv32.dll) allocations
`Mdl`		Io, Mdls
`MdlP`		MDL per processor lookaside list pointers
`MePr`		In
`mkup`	mpsdrv.sys	MPSDRV upcall request
`Mm`	nt!mm	general Mm Allocations
`MmAc`	nt!mm	Mm access log buffers
`MmBk`	nt!mm	Mm banked sections
`MmCa`	nt!mm	Mm control areas for mapped files
`MmCd`	nt!mm	Mm fork clone descriptors
`MmCh`	nt!mm	Mm fork clone headers
`MmCi`	nt!mm	Mm control areas for images
`MmCl`	nt!mm	Mm fork clone prototype PTEs
`MmCm`	nt!mm	Calls made to MmAllocateContiguousMemory
`MmCr`	nt!mm	Mm fork clone roots
`MmCt`	nt!mm	Mm debug tracing
`MmCx`	nt!mm	info for dynamic section extension
`MmDb`	nt!mm	NtMapViewOfSection service
`Mmdl`	nt!mm	Mm Mdls for flushes
`MmDm`	nt!mm	deferred MmUnlock entries
`MmDT`	nt!mm	Mm debug
`MmEx`	nt!mm	Mm events
`MmHi`	nt!mm	Mm image entry
`MmHn`	nt!mm	Mm sessionwide address name string entry
`MmHt`	nt!mm	session space PTE data
`MmHv`	nt!mm	Mm sessionwide address entry
`MmIn`	nt!mm	Mm inpaged io structures
`MmLd`	nt!mm	Mm load module database
`MmLn`	nt!mm	temporary name buffer for driver loads
`MmMl`	nt!mm	physical memory range information
`MmPa`	nt!mm	pagefile space deletion slist entries
`MmPd`	nt!mm	Mm page table commitment bitmaps
`MmPg`	nt!mm	Mm page table pages at init time
`Mmpp`	nt!mm	Mm prototype PTEs for pool
`Mmpr`	nt!mm	Mm physical VAD roots
`Mmpv`	nt!mm	Physical view VAD info
`MmRl`	nt!mm	temporary readlists for file prefetch
`MmRp`	nt!mm	Mm repurpose logging
`MmRw`	nt!mm	Mm read write virtual memory buffers
`MmSb`	nt!mm	Mm subsections
`MmSc`	nt!mm	subsections used to map data files
`MmSd`	nt!mm	extended subsections used to map data files
`MmSe`	nt!mm	Mm secured VAD allocation
`MmSg`	nt!mm	Mm segments
`MmSi`	nt!mm	Control area security image stubs
`MmSm`	nt!mm	segments used to map data files
`MmSP`	nt!mm	SLIST entries for system PTE NB queues
`MmSt`	nt!mm	Mm section object prototype ptes
`MmSy`	nt!mm	Mm PTE and IO tracking logs
`MmVd`	nt!mm	Mm virtual address descriptors for mapped views
`MmVs`	nt!mm	Mm virtual address descriptors short form (private views)
`MmWe`	nt!mm	Work entries for writing out modified filesystem pages.
`MmWw`	nt!mm	Write watch VAD info
`Mmww`	nt!mm	Write watch bitmap VAD info
`Mmxx`	nt!mm	Mm temporary allocations
`Mn01`	monitor.sys	ACPI method evaluation output buffer
`Mn02`	monitor.sys	Unused
`Mn03`	monitor.sys	Raw E
`Mn04`	monitor.sys	Cached monitor ID WMI data block
`Mn05`	monitor.sys	Cached monitor basic display parameters WMI data block
`Mn06`	monitor.sys	Cached monitor analog video input parameters WMI data block
`Mn07`	monitor.sys	Cached monitor digitial video input parameters WMI data block
`Mn08`	monitor.sys	Cached monitor color characteristics WMI data block
`Mn09`	monitor.sys	Cached supported monitor source modes WMI data block
`Mn0A`	monitor.sys	Registry subkey info buffer
`Mn0B`	monitor.sys	Registry value buffer
`Mn0C`	monitor.sys	Cached supported monitor frequency ranges WMI data block (overrides from registry)
`Mn0D`	monitor.sys	Cached supported monitor frequency ranges WMI data block (from E
`Mn0E`	monitor.sys	Buffer for E
`Mn0F`	monitor.sys	Buffer for E
`MNFC`	msnfsflt.sys	NFS FS Filter, callback context
`MNFF`	msnfsflt.sys	NFS FS Filter, file context
`MNFf`	msnfsflt.sys	NFS FS Filter, filename buffer
`MNFI`	msnfsflt.sys	NFS FS Filter, instance context
`MNFi`	msnfsflt.sys	NFS FS Filter, instance name buffer
`MNFr`	msnfsflt.sys	NFS FS Filter, registry access buffer
`MNFS`	msnfsflt.sys	NFS FS Filter, stream context
`MNFs`	msnfsflt.sys	NFS FS Filter, general string buffer
`MNFT`	msnfsflt.sys	NFS FS Filter, thread array
`MNFv`	msnfsflt.sys	NFS FS Filter, volume name buffer
`MQAA`	mqac.sys	MSMQ driver, AVL allocations
`MQAB`	mqac.sys	MSMQ driver, CCursor allocations
`MQAC`	mqac.sys	MSMQ driver, generic allocations
`MQAD`	mqac.sys	MSMQ driver, CDistribution allocations
`MQAG`	mqac.sys	MSMQ driver, CGroup allocations
`MQAH`	mqac.sys	MSMQ driver, Heap allocations
`MQAP`	mqac.sys	MSMQ driver, CPacket allocations
`MQAQ`	mqac.sys	MSMQ driver, CQueue allocations
`MQAT`	mqac.sys	MSMQ driver, CTransaction allocations
`MRXx`		Client side caching for SMB
`Msdv`		WDM mini driver for IEEE 1394 DV Camera and VCR
`MsFC`		Mailslot root CCB, A client control block for the top level mailslot directory
`MsFc`		Mailslot CCB, Client control block. Each client with an opened mailslot has one of these
`MsFD`		Mailslot root DCB and its name buffer
`MsFd`		Mailslot data entry write buffer, This is writes buffered inside mailslots
`MsFf`		Mailslot FCB, File control block, Service side block for each created mailslot.
`MsFg`		Mailslot global resource
`MsFN`		Mailslot FCB name buffer, name for each created mailslot
`MsFn`		Mailslot temporary name buffer
`MsFr`		Mailslot read buffer, buffer created for pended reads issued.
`MsFt`		Mailslot query template, used for directory queries.
`MsFw`		Mailslot work context block, blocks create when we need to timeout reads.
`MST?`		MSTEE (mstee.sys)
`MSTa`		associated stream header
`MSTc`		filer connection
`MSTd`		data format
`MSTf`		filter instance
`MSTp`		pin instance
`MSTs`		stream header
`MsvC`	ksecdd.sys	Msv/Ntlm client package
`MuDn`	mup.sys	Device name
`MuFc`	mup.sys	File Context
`MuFn`	mup.sys	File name rewrite
`MuIc`	mup.sys	IRP Context
`MuMc`	mup.sys	Master context
`MuoC`		MOUSE_POOL_TAG Mouse Class Driver
`Mup`	mup.sys	Multiple UNC provider allocations, generic
`MuPe`	mup.sys	Known prefix entry
`MuPi`	mup.sys	Provider info
`MupI`	mup.sys	Windows Server 2003 and prior versions: DFS Irp Context allocation
`MuQc`	mup.sys	Query context
`MuSf`	mup.sys	Surrogate file info
`MuSi`	mup.sys	Surrogate info
`MuSr`	mup.sys	Surrogate IRP info
`Muta`		Mutant objects
`MuUn`	mup.sys	UNC provider
`MXF`		DirectMusic (MIDI Transform Filter)
`Nb??` (0)		NetBT allocations
`NBF`		general NBF allocations
`NBFa`		NBF address object
`NBFb`		NBF receive buffer
`NBFc`		NBF connection object
`NBFd`		NBF packet pool descriptor
`NBFe`		NBF bind & export names
`NBFf`		NBF address file object
`NBFg`		NBF registry path name
`NBFi`		NBF tdi connection info
`NBFk`		NBF loopback buffer
`NBFl`		NBF link object
`NBFn`		NBF netbios name
`NBFo`		NBF config data
`NBFp`		NBF packet
`NBFq`		NBF query buffer
`NBFr`		NBF request
`NBFs`		NBF provider stats
`NBFt`		NBF connection table
`NBFu`		NBF UI frame
`NBFw`		NBF work item
`NBI`		NwlnkNb transport
`NBqh`		Non
`NBS`		general NetBIOS allocations
`NBSa`		address block
`NBSc`		connection block
`NBSe`		EA buffer
`NBSf`		FCB
`NBSl`		LANA block
`NBSn`		copy of user NCB
`NBSr`		registry allocations
`NBSx`		XNS NETONE address (connect block)
`NBSy`		NetBIOS address (connect block)
`NBSz`		NetBIOS address (listen block)
`NCSt`		EXIFS NC
`ND`	ndis.sys	general NDIS allocations
`NDam`	ndis.sys	NdisAllocateMemory
`NDan`	ndis.sys	adapter name
`NDco`	ndis.sys	NDIS_TAG_CO
`NDd`	ndis.sys	NDIS_TAG_DBG
`NDdb`	ndis.sys	DMA block
`NDDl`	ndis.sys	NDIS_TAG_DBG_LOG
`NDdl`	ndis.sys	NDIS_TAG_DBG_L
`NDdp`	ndis.sys	NDIS_TAG_DBG_P
`NDds`	ndis.sys	NDIS_TAG_DBG_S
`NDdt`	ndis.sys	NDIS_TAG_DFRD_TMR
`NDfa`	ndis.sys	NDIS_TAG_FILTER_ADDR
`NDlb`	ndis.sys	lookahead buffer
`NDlp`	ndis.sys	NDIS_TAG_LOOP_PKT
`NDMb`	ndis.sys	NDIS_TAG_MAC_BLOCK
`NDmb`	ndis.sys	MAC block
`NDmr`	ndis.sys	map register entry array
`NDoa`	ndis.sys	NDIS_TAG_OID_ARRAY
`NDob`	ndis.sys	open block
`NDPa`	ndis.sys	Apple Talk
`NDPb`	ndis.sys	NBF
`NDpb`	ndis.sys	protocol block
`NDpf`	ndis.sys	NDIS_TAG_FILTER
`NDPi`	ndis.sys	NWLNKIPX
`NDpk`	ndis.sys	NDIS_TAG_PKT_PATTERN
`NDPn`	ndis.sys	NWLNKNB
`NDPp`	ndis.sys	Packet Scheduler.
`NDpp`	ndis.sys	packet pool
`NDPs`	ndis.sys	NWLNKSPX
`NDPt`	ndis.sys	TCPIP
`NDPw`	ndis.sys	WAN_PACKET_TAG
`NDPX`	ndis.sys	NDIS Proxy allocations
`NDrl`	ndis.sys	resource list
`NDrp`	ndis.sys	NDIS_TAG_REGISTRY_PATH
`NDrq`	ndis.sys	NDIS_TAG_Q_REQ
`NDsi`	ndis.sys	EISA slot information
`NDsm`	ndis.sys	Cached shared memory descriptor
`NDst`	ndis.sys	NDIS_TAG_STRING
`NDw0`	ndis.sys	NDIS_TAG_WMI_REG_INFO
`NDw1`	ndis.sys	NDIS_TAG_WMI_GUID_TO_OID
`NDw2`	ndis.sys	NDIS_TAG_WMI_OID_SUPPORTED_LIST
`NDw3`	ndis.sys	NDIS_TAG_WMI_EVENT_ITEM
`NDwi`	ndis.sys	NDIS_TAG_WORK_ITEM
`Nf??`	nfssvr.sys	NFS (Network File System) allocations
`NfR?`	nfsrdr.sys	NFS (Network File System) client re
`Nls`		Nls strings
`NlsK`	nt!ex	Nls data
`NmCc`	substvol.sys	(AllenPort Virtual Volume) name cache item
`Nmdd`		NetMeeting display driver miniport 1 MB block
`None`		call to ExAllocatePool
`Npf*`	npfs.sys	Npfs Allocations
`NpFC`	npfs.sys	ROOT_DCB CCB
`NpFc`	npfs.sys	CCB, client control block
`NpFD`	npfs.sys	DCB, directory block
`NpFg`	npfs.sys	Global storage
`NpFi`	npfs.sys	NPFS client info buffer.
`NpFn`	npfs.sys	Name block
`NpFq`	npfs.sys	Query template buffer used for directory query
`NpFr`	npfs.sys	DATA_ENTRY records (read/write buffers)
`NpFs`	npfs.sys	Client security context
`NpFW`	npfs.sys	Write block
`NpFw`	npfs.sys	Write block
`NS??`		Netware server allocations
`Ntf0`	ntfs.sys	general pool allocation
`Ntf9`	ntfs.sys	Large Temporary Buffer
`NtF?`	ntfs.sys	NTFS tags based on source module
`Ntf?`	ntfs.sys	NTFS Specific allocation tags
`NtFA`	ntfs.sys	AttrSup.c
`NtFa`	ntfs.sys	AllocSup.c
`NtFB`	ntfs.sys	BitmpSup.c
`NtFC`	ntfs.sys	Create.c
`NtfC`	ntfs.sys	CCB
`Ntfc`	ntfs.sys	CCB_DATA
`NtFD`	ntfs.sys	DevioSup.c
`NtFd`	ntfs.sys	DirCtrl.c
`NtfD`	ntfs.sys	DEALLOCATED_RECORDS
`NtFE`	ntfs.sys	Ea.c
`NtfE`	ntfs.sys	INDEX_CONTEXT
`NtFF`	ntfs.sys	FileInfo.c
`NtFf`	ntfs.sys	FsCtrl.c
`NtfF`	ntfs.sys	FCB_INDEX
`Ntff`	ntfs.sys	FCB_DATA
`NtFH`	ntfs.sys	SelfHeal.c
`NtFI`	ntfs.sys	IndexSup.c
`NtfI`	ntfs.sys	NTFS_IO_CONTEXT
`Ntfi`	ntfs.sys	IRP_CONTEXT
`NtfK`	ntfs.sys	KEVENT
`Ntfk`	ntfs.sys	FILE_LOCK
`NtFL`	ntfs.sys	LogSup.c
`Ntfl`	ntfs.sys	LCB
`NtFM`	ntfs.sys	McbSup.c
`NtfM`	ntfs.sys	NTFS_MCB_ENTRY
`Ntfm`	ntfs.sys	NTFS_MCB_ARRAY
`NtFN`	ntfs.sys	NtfsData.c
`NtfN`	ntfs.sys	NUKEM
`Ntfn`	ntfs.sys	SCB_NONPAGED
`NtFO`	ntfs.sys	ObjIdSup.c
`Ntfo`	ntfs.sys	SCB_INDEX normalized named buffer
`NtFQ`	ntfs.sys	QuotaSup.c
`NtfQ`	ntfs.sys	QUOTA_CONTROL_BLOCK
`Ntfq`	ntfs.sys	General Allocation with Quota
`NtFR`	ntfs.sys	RestrSup.c
`NtfR`	ntfs.sys	READ_AHEAD_THREAD
`Ntfr`	ntfs.sys	ERESOURCE
`NtFS`	ntfs.sys	SecurSup.c
`NtFs`	ntfs.sys	StrucSup.c
`NtfS`	ntfs.sys	SCB_INDEX
`Ntfs`	ntfs.sys	SCB_DATA
`NtfT`	ntfs.sys	SCB_SNAPSHOT
`Ntft`	ntfs.sys	SCB (Prerestart)
`NtFU`	ntfs.sys	usnsup.c
`NtFV`	ntfs.sys	VerfySup.c
`NtFv`	ntfs.sys	ViewSup.c
`NtfV`	ntfs.sys	VPB
`Ntfv`	ntfs.sys	COMPRESSION_SYNC
`NtFW`	ntfs.sys	Write.c
`Ntfw`	ntfs.sys	Workspace
`Ntfx`	ntfs.sys	General Allocation
`NTID`	HP Team Network Driver (cpqteam.sys)	Network Driver 8.55 (Memory Leak) - Confirmed
`NV`		(nVidia video driver) Resource manager data
`NvLA`		(nVidia video driver) Adapter data
`NvLa`		(nVidia video driver) Allocation data
`NvLC`		(nVidia video driver) Channel data
`NvLc`		(nVidia video driver) Class data
`NvLD`		(nVidia video driver) Device data
`NvLd`		(nVidia video driver) DMA data
`NvLE`		(nVidia video driver) Event data
`NvLH`		(nVidia video driver) Generic data
`NvLm`		(nVidia video driver) Mode data
`NvLP`		(nVidia video driver) Profile data
`NvLp`		(nVidia video driver) Pusher data
`NvLR`		(nVidia video driver) Registry data
`NvLr`		(nVidia video driver) Resource data
`NvLS`		(nVidia video driver) Statistics data
`NvLs`		(nVidia video driver) Semaphore data
`NvLT`		(nVidia video driver) Context data
`Nwcs`		Client Services for NetWare
`NwFw`		ntos difwd
`ObCI` (0)	nt!ob	object creation lookaside list
`ObCi`	nt!ob	captured information for ObCreateObject
`ObDi`	nt!ob	object directory
`ObDm`	nt!ob	object device map
`Obeb`	nt!ob	object tables extra bit tables via EX handle.c
`ObHd`	nt!ob	object handle count data base
`ObjT`	nt!ob	object type objects
`ObNM`	nt!ob	name buffer per processor lookaside pointers
`ObNm`	nt!ob	object names
`ObRt`	nt!ob	object reference stack tracing
`ObSc`	nt!ob	Object security descriptor cache block
`ObSq`	nt!ob	object security descriptors (query)
`ObSt`	nt!ob	Object Manager temporary storage
`Obtb`	nt!ob	object tables via EX handle.c
`ObTR`	nt!ob	object table ERESOURCEs
`ObZn`	nt!ob	object zone
`OCCB`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OCMD`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OCMX`	RepliStor.sys	RepliStor File System Mini Filter Driver
`OHCI`		Open Host Controller Interface for USB
`ohci`		1394 OHCI host controller driver
`OvfL`		EXIFS FCBOVF List
`Ovfl`		The internal pool tag table has overflowed
`p2??` (0)	perm2dll.dll	Permedia2 display driver
`p2cx`	perm2dll.dll	Permedia2 display driver
`p2d3`	perm2dll.dll	Permedia2 display driver
`p2d6`	perm2dll.dll	Permedia2 display driver
`p2de`	perm2dll.dll	Permedia2 display driver
`p2ds`	perm2dll.dll	Permedia2 display driver
`p2dt`	perm2dll.dll	Permedia2 display driver
`p2en`	perm2dll.dll	Permedia2 display driver
`p2fi`	perm2dll.dll	Permedia2 display driver
`p2he`	perm2dll.dll	Permedia2 display driver
`p2hw`	perm2dll.dll	Permedia2 display driver
`p2pa`	perm2dll.dll	Permedia2 display driver
`p2pe`	perm2dll.dll	Permedia2 display driver
`p2su`	perm2dll.dll	Permedia2 display driver
`p2tx`	perm2dll.dll	Permedia2 display driver
`P3D?`	perm3dd.dll	Permedia3 display driver
`P3G?`	perm3dd.dll	Permedia3 display driver
`PaeD`		PAE top level directory allocation blocks
`ParC`		Parallel class driver
`ParL`		Parallel link driver
`ParP`		Parallel port driver
`ParV`		ParVdm driver for vdm<
`PbCK`	DGbWAsfJiFZXk	comment5,
`PcCi`		WDM audio port class adapter device object stuff
`PcCr`		WDM audio stuff
`Pcdb`		Pcmcia bus enumerator, Databook controller specific structures
`PcDi`		WDM audio stuff
`PcDm`		DirectMusic MXF objects (WDM audio)
`PcFM`		WDM audio FM synthesizer
`PcFp`		WDM audio stuff
`PciB`	pci.sys	PnP pci bus enumerator
`PcIc`		WDM audio stuff
`Pcic`		Pcmcia bus enumerator, PCIC/Cardbus controller specific structures
`PciD`	PciDumpEx.sys	Alter's PCI Dump helper driver
`PcIl`		WDM audio stuff
`Pcmc`	pcmcia.sys	Pcmcia bus enumerator, general structures
`PcNw`		WDM audio stuff
`PcPc`		WDM audio stuff
`PcPr`		WDM audio stuff
`PcSl`		WDM audio stuff
`PcSt`		WDM audio stuff
`PcSX`		WDM audio stuff
`PcSx`		WDM audio stuff
`PcUs`		WDM audio stuff
`PDss`	nt!po	Po device system state
`Pf??`	nt!pf	Pf Allocations
`PfAL`	nt!pf	Pf Application launch event data
`PfAS`	nt!pf	Pf Prefetch support array
`PfDq`	nt!pf	Pf Directory query buffers
`PfED`	nt!pf	Pf Generic event data
`PfEL`	nt!pf	Pf Event logging buffers
`PfET`	nt!pf	Pf Entry info tables
`PfFH`	nt!pf	Pf RpContext FileKeyHash buckets
`PfFK`	nt!pf	Pf RpContext FileKeyHashEntry
`PfLB`	nt!pf	Pf Log buffers
`PfMP`	nt!pf	Pf Prefetch metadata buffers
`PfNL`	nt!pf	Pf Name logging buffers
`PfOB`	nt!pf	Pf Oplock buffers
`PfPB`	nt!pf	Pf Pfn query buffers
`PfRL`	nt!pf	Pf Prefetch read list
`PfRQ`	nt!pf	Pf Prefetch request buffers
`PfSA`	nt!pf	Pf Prefetch support array
`PfTD`	nt!pf	Pf Trace Dump
`PfTt`	nt!pf	Pf Translation tables
`PfVA`	nt!pf	Pf VA prefetching buffers
`PfVH`	nt!pf	Pf Prefetch volume handles
`Pgm?`		Pgm (Pragmatic General Multicast) protocol: RMCast.sys
`Plcl`		Cache aware pushlock entry. One per processor
`Plcp`		Cache aware pushlock list (array of puchlock addresses)
`PmpA`	portmap.sys	Portmap address list
`PmpC`	portmap.sys	Portmap device context
`PmpM`	portmap.sys	Portmap mapping
`PmpR`	portmap.sys	Portmap RPCB
`PNCH`		Power Notify Channel
`PNCL`		Power Notify channel list
`PNDP`		Power Abort Dpc Routine
`PNI`		Power Notify Instance
`Pnp0`	nt!pnp	PNPMGR rebalance resource request table
`Pnp1`	nt!pnp	PNPMGR IRP completion context
`Pnp2`	nt!pnp	PNPMGR device action request
`Pnp3`	nt!pnp	PNPMGR dock serial numbers
`Pnp4`	nt!pnp	PNPMGR dock state
`Pnp5`	nt!pnp	PNPMGR assign resources context
`Pnp6`	nt!pnp	PNPMGR resource request
`Pnp7`	nt!pnp	PNPMGR deferred notify entry
`Pnp8`	nt!pnp	PNPMGR async target device change notify
`Pnp9`	nt!pnp	PNPMGR HW profile notify
`PnpA`	nt!pnp	PNPMGR HW profile event
`PnPb`	nt!pnp	PnP BIOS resource manipulation
`PnpB`	nt!pnp	PNPMGR setup notify
`PnpC`	nt!pnp	PNPMGR target device notify
`PnpD`	nt!pnp	PNPMGR device class notify
`PnpE`	nt!pnp	PNPMGR veto name
`PnpF`	nt!pnp	PNPMGR eject data
`PnpG`	nt!pnp	PNPMGR generic
`PnpH`	nt!pnp	PNPMGR service name
`PnpI`