All components of Windows NT marks allocated memory blocks with unique Tag.
Tag is 4-byte word, that can be represented as ASCII string. It is used
for monitoring of allocated memory, bounds checking, etc. In general, this information is
available at Microsoft's web-site (http://support.microsoft.com),
inside WinDbg package (search for file pooltag.txt).
Here is the mirror.
NEW! Below you can find updatable pool-tag database. You can
submit there information about tags used in your drivers.
| Tag | Source | Description |
8042 (0) |
i8042prt.sys | PS/2 kb and mouse |
@GMM (0) |
| (Intel video driver) Memory manager |
@KCH (0) |
| (Intel video driver) Chipset specific service |
@MP (0) |
| (Intel video driver) Miniport related memory |
@SB (0) |
| (Intel video driver) Soft BIOS |
Abos (0) |
| Abiosdsk |
AcdM (0) |
| TDI AcdObjectInfoG |
AcdN (0) |
| TDI AcdObjectInfoG |
Acp* (0) |
acpi.sys | ACPI Pooltags |
ACPI (0) |
acpi.sys | ACPI |
Adap (0) |
| Adapter objects |
Adbe (0) |
| Adobe's font driver |
AdSv (0) |
vmsrvc.sys | Virtual Machines Additions Service |
AECi (0) |
| filter object interface for MS acoustic echo canceller |
Afd? (0) |
afd.sys | AFD objects |
AfdA (0) |
afd.sys | Afd EA buffer |
Afda (0) |
afd.sys | Afd APC buffer (NT 3.51 only) |
AfdB (0) |
afd.sys | Afd data buffer |
AfdC (0) |
afd.sys | Afd connection structure |
Afdc (0) |
afd.sys | Afd connect data buffer |
AfdD (0) |
afd.sys | Afd debug data |
Afdd (0) |
afd.sys | Afd disconnect data buffer |
AfdE (0) |
afd.sys | Afd endpoint structure |
AfdF (0) |
afd.sys | Afd TransmitFile info |
Afdf (0) |
afd.sys | Afd TransmitFile debug data |
AfdG (0) |
afd.sys | Afd group table |
Afdh (0) |
afd.sys | Afd address list change buffer |
AfdI (0) |
afd.sys | Afd TDI data |
Afdi (0) |
afd.sys | Afd "set inline mode" buffer |
AfdL (0) |
afd.sys | Afd local address buffer |
Afdl (0) |
afd.sys | Afd lookaside lists buffer |
AfdP (0) |
afd.sys | Afd poll info |
Afdp (0) |
afd.sys | Afd transport IRP buffer |
AfdQ (0) |
afd.sys | Afd work queue item |
Afdq (0) |
afd.sys | Afd routing query buffer |
AfdR (0) |
afd.sys | Afd remote address buffer |
Afdr (0) |
afd.sys | Afd ERESOURCE buffer |
AfdS (0) |
afd.sys | Afd security info |
AfdT (0) |
afd.sys | Afd transport info |
Afdt (0) |
afd.sys | Afd transport address buffer |
AfdW (0) |
afd.sys | Afd work item |
AfdX (0) |
afd.sys | Afd context buffer |
AFMM (0) |
afw.sys, afwcore.sys | Agnitum Outpost Firewall Drivers |
Afp (0) |
| SFM File server |
AlCI (0) |
nt!alpc | ALPC communication info |
AlEv (0) |
nt!alpc | ALPC eventlog queue |
AlHa (0) |
nt!alpc | ALPC port handle table |
AlIn (0) |
nt!alpc | ALPC Internal allocation |
AlMs (0) |
nt!alpc | ALPC message |
ALPC (0) |
nt!alpc | ALPC port objects |
AlRe (0) |
nt!alpc | ALPC section region |
AlRr (0) |
nt!Alpc | ALPC resource reserves |
AlSc (0) |
nt!alpc | ALPC section |
AlSe (0) |
nt!alpc | ALPC client security |
AlVi (0) |
nt!alpc | ALPC view |
Aml* (0) |
| ACPI AMLI Pooltags |
AoE* (0) |
aoebus.sys | ATA over Ethernet driver |
APIC (0) |
pnpapic.sys | I/O APIC Driver |
ArbA (0) |
nt!arb | ARBITER_ALLOCATION_STATE_TAG |
ArbL (0) |
nt!arb | ARBITER_ORDERING_LIST_TAG |
ArbM (0) |
nt!arb | ARBITER_MISC_TAG |
ArbR (0) |
nt!arb | ARBITER_RANGE_LIST_TAG |
Arp? (0) |
| ATM ARP server objects, atmarps.sys |
ArpA (0) |
| AtmArpS address |
ArpB (0) |
| AtmArpS buffer space |
ARPC (0) |
atmarpc.sys | ATM ARP Client |
ArpI (0) |
| AtmArpS Interface structure |
ArpK (0) |
| AtmArpS ARP block |
ArpM (0) |
| AtmArpS MARS structure |
ArpR (0) |
| AtmArpS NDIS request |
ArpS (0) |
| AtmArpS SAP structure |
Asy1 (0) |
| ndis / ASYNC_IOCTX_TAG |
Asy2 (0) |
| ndis / ASYNC_INFO_TAG |
Asy3 (0) |
| ndis / ASYNC_ADAPTER_TAG |
Asy4 (0) |
| ndis / ASYNC_FRAME_TAG |
ATac (0) |
AppTag ATR command buffer | |
AtC (0) |
| IDE disk configuration |
AtD (0) |
| atdisk.c |
ATdi (0) |
AppTag cliendata index buffer | |
ATdt (0) |
AppTag cliendata temp buffer | |
ATFb (0) |
AppTag file id buffer | |
ATgb (0) |
AppTag guid buffer | |
ATIX (0) |
| WDM mini drivers for ATI tuner, xbar, etc. |
Atk (0) |
| Appletalk transport |
AtmA (0) |
| Atoms |
ATmp (0) |
AppTag mount point | |
AtmT (0) |
| Atom tables |
ATMU (0) |
atmuni.sys | ATM UNI Call Manager |
Atom (0) |
| Atom Tables |
ATon (0) |
AppTag object name | |
ATub (0) |
AppTag user buffer | |
AudC (0) |
wdmaud.sys | MMSYSTEM Wave/Midi API mapper |
AudL (0) |
wdmaud.sys | MMSYSTEM Wave/Midi API mapper |
AuxL (0) |
| EXIFS Auxlist |
Bat? (0) |
| Battery Class drivers |
BatC (0) |
| Composite battery driver |
BatM (0) |
| Control method battery driver |
BatS (0) |
| Smart battery driver |
Batt (0) |
| Battery class driver |
BCDK (0) |
nt!init | Kernel boot configuration data. |
BCSP (0) |
bthbcsp.sys | Bluetooth BCSP minidriver |
BIG (0) |
nt!mm | Large session pool allocations (ntosexpool.c) |
BlCc (0) |
blkcache.sys | Block Cache Driver |
Bmfd (0) |
| Font related stuff |
BT3C (0) |
bt3c.sys | Bluetooth 3COM minidriver |
BT8x (0) |
| WDM mini drivers for Brooktree 848,829, etc. |
BTHP (0) |
bthport.sys | Bluetooth port driver (generic) |
BthS (0) |
bthport.sys | Bluetooth port driver (security) |
BTME (0) |
bthenum.sys | Bluetooth enumerator |
BTMO (0) |
bthmodem.sys | Bluetooth modem |
BTPT (0) |
| Bluetooth transport protocol library |
BTSR (0) |
bthser.sys | Bluetooth serial minidriver |
BTUR (0) |
bthuart.sys | Bluetooth UART minidriver |
Bu* (0) |
| burneng.sys from adaptec |
Call (0) |
nt!ex | kernel callback object signature |
call (0) |
| debugging call tables |
Cbrb (0) |
nt!ExAllocateCallBack | Callback registration block (PEX_CALLBACK_FUNCTION, ptr to 'CMcb' structure) |
CBRe (0) |
| CallbackRegistration |
Cc (0) |
nt!cc | Cache Manager allocations (catch |
CcBc (0) |
nt!cc | Cache Manager Bcb from pool |
CcBm (0) |
nt!cc | Cache Manager Bitmap |
CcBn (0) |
nt!cc | Cache Manager Bcb trim notification entry |
CcBr (0) |
nt!cc | Cache Manager Bitmap range |
CcBz (0) |
nt!cc | Cache Manager Bcb Zone |
CcDw (0) |
nt!cc | Cache Manager Deferred Write |
CcEv (0) |
nt!cc | Cache Manager Event |
CcFn (0) |
nt!cc | Cache Manager File name for popups |
CcMb (0) |
nt!cc | Cache Manager Mbcb |
CcOb (0) |
nt!cc | Cache Manager Overlap Bcb |
CcPB (0) |
nt!ccpf | Prefetcher trace buffer |
CcPC (0) |
nt!ccpf | Prefetcher context |
CcPc (0) |
nt!cc | Cache Manager Private Cache Map |
CcPD (0) |
nt!ccpf | Prefetcher trace dump |
CcPF (0) |
nt!ccpf | Prefetcher file name |
CcPf (0) |
nt!ccpf | Prefetcher |
CcPh (0) |
nt!ccpf | Prefetcher header preallocation |
CcPI (0) |
nt!ccpf | Prefetcher intermediate table |
CcPL (0) |
nt!ccpf | Prefetcher read list |
CcPM (0) |
nt!ccpf | Prefetcher metadata |
CcPp (0) |
nt!ccpf | Prefetcher instructions |
CcPq (0) |
nt!ccpf | Prefetcher query buffer |
CcPS (0) |
nt!ccpf | Prefetcher scenario |
CcPs (0) |
nt!ccpf | Prefetcher section table |
CcPT (0) |
nt!ccpf | Prefetcher trace |
CcPv (0) |
nt!ccpf | Prefetcher volume info |
CcPw (0) |
nt!ccpf | Prefetcher boot worker |
CcSc (0) |
nt!cc | Cache Manager Shared Cache Map - ok |
CctX (0) |
| EXIFX FCB Commit CTX |
CcVa (0) |
nt!cc | Cache Manager Initial array of Vacbs |
CcVl (0) |
nt!cc | Cache Manager Vacb Level structures (large streams) |
CcVp (0) |
nt!cc | Cache Manager Array of Vacb pointers for a cached stream |
CcWK (0) |
nt!cc | Kernel Cache Manager lookaside list |
CcWk (0) |
nt!cc | Kernel Cache Manager lookaside list |
CcWq (0) |
nt!cc | Cache Manager Work Queue Item |
CcZe (0) |
nt!cc | Cache Manager Buffer of Zeros |
CdA (0) |
| CdAudio filter driver |
Cdcc (0) |
cdfs.sys | CDFS Ccb |
Cddn (0) |
cdfs.sys | CDFS CdName in dirent |
Cdee (0) |
cdfs.sys | CDFS Search expression for enumeration |
Cdfd (0) |
cdfs.sys | CDFS Data Fcb |
Cdfi (0) |
cdfs.sys | CDFS Index Fcb |
Cdfl (0) |
cdfs.sys | CDFS Filelock |
CdFn (0) |
cdfs.sys | CDFS Filename buffer |
Cdfn (0) |
cdfs.sys | CDFS Nonpaged Fcb |
Cdfs (0) |
cdfs.sys | CDFS General Allocation |
Cdft (0) |
cdfs.sys | CDFS Fcb Table entry |
Cdgs (0) |
cdfs.sys | CDFS Generated short name |
Cdic (0) |
cdfs.sys | CDFS Irp Context |
Cdil (0) |
cdfs.sys | CDFS Irp Context lite |
Cdio (0) |
cdfs.sys | CDFS Io context for async reads |
Cdma (0) |
cdfs.sys | CDFS Mcb array |
Cdpe (0) |
cdfs.sys | CDFS Prefix Entry |
CdPn (0) |
cdfs.sys | CDFS CdName in path entry |
Cdpn (0) |
cdfs.sys | CDFS Prefix Entry name |
CdRw (0) |
dwcdrw.sys | (Dvd Write Now) cdrw driver's default tag |
Cdsp (0) |
cdfs.sys | CDFS Buffer for spanning path table |
Cdtc (0) |
cdfs.sys | CDFS TOC |
Cdun (0) |
cdfs.sys | CDFS Buffer for upcased name |
Cdvd (0) |
cdfs.sys | CDFS Buffer for volume descriptor |
Cdvp (0) |
cdfs.sys | CDFS Vpb allocated in filesystem |
CEP (0) |
wibcm.sys | CEP_INSTANCE_TAG |
cfsp (0) |
cfosspeed.sys | cFosSpeed Driver |
CIcr (0) |
ci.dll | Code Integrity allocations for image integrity checking |
CIha (0) |
ci.dll | Code Integrity hashes |
CIsc (0) |
ci.dll | Code Integrity core dll |
ClfA (0) |
clfs.sys | CLFS_CONTAINER_TAG |
ClfB (0) |
clfs.sys | CLFS_BASEFILE_TAG |
ClfC (0) |
clfs.sys | CLFS_LOGFCBPHYSICAL_TAG |
ClfD (0) |
clfs.sys | CLFS_LOGFCBVIRTUAL_TAG |
ClfE (0) |
clfs.sys | CLFS_LOGCCB_TAG |
ClfF (0) |
clfs.sys | CLFS_FLUSHELT_TAG |
ClfG (0) |
clfs.sys | CLFS_REQUEST_TAG |
ClfH (0) |
clfs.sys | CLFS_IOCB_TAG |
ClfI (0) |
clfs.sys | CLFS_MARSHALBUFFER_TAG |
Clfs (0) |
clfs.sys | CLFS_TAG |
CM (0) |
nt!cm | Configuration Manager (registry) |
CM?? (0) |
nt!cm | Internal Configuration manager allocations |
CMAl (0) |
nt!cm | internal registry memory allocator pool tag |
CMCa (0) |
nt!cm | Configuration Manager Cache (registry) |
CMcb (0) |
nt!CmRegisterCallback | RegistryCallback routine registration info (registration time, Context, ...) |
CmcD (0) |
hal.dll | HAL CMC Driver Log |
CmcK (0) |
hal.dll | HAL CMC Kernel Log |
CmcT (0) |
hal.dll | HAL CMC temporary Log |
CMDa (0) |
nt!cm | value data cache pool tag |
CMDc (0) |
nt!cm | Configuration Manager Cache (registry) |
CMIn (0) |
nt!cm | index hint pool tag |
CMkb (0) |
nt!cm | registry key control blocks |
CMNb (0) |
nt!cm | notification block pool tag |
CMnb (0) |
nt!cm | registry notify blocks |
CMpa (0) |
nt!cm | registry post apcs |
CMpb (0) |
nt!cm | registry post blocks |
CMpe (0) |
nt!cm | registry post events |
CMSb (0) |
nt!cm | internal stash buffer pool tag |
CMsb (0) |
nt!cm | registry stash buffer |
CMSc (0) |
nt!cm | security cache pooltag |
CMSH (0) |
wibcm.sys | WIBCM_SHARED_TAG |
CMVa (0) |
nt!cm | value cache value tag |
CMVI (0) |
nt!cm | value index cache tag |
CmVn (0) |
nt!cm | captured value name |
CMVw (0) |
nt!cm | registry mapped view of file |
CMWK (0) |
wibcm.sys | WIBCM_WORK_TAG |
CMWT (0) |
wibcm.sys | WIBCM_TIMER_TAG |
Cngb (0) |
ksecdd.sys | CNG kmode crypto pool tag |
COMX (0) |
serial.sys | serial driver allocations |
COMX (1) |
vspd.sys | Virtual Serial Port driver |
Cont (0) |
| Contiguous physical memory allocations for device drivers |
CopW (0) |
| EXIFS CopyOnWrite |
Covr (0) |
nt!cov | Code Coverage pool tag |
CpeD (0) |
hal.dll | HAL CPE Driver Log |
CpeK (0) |
hal.dll | HAL CMC Kernel Log |
CpeT (0) |
hal.dll | HAL CPE temporary Log |
CPnp (0) |
classpnp.sys | ClassPnP transfer packets |
Crsp (0) |
ksecdd.sys | CredSSP kernel mode client allocations |
CrtH (0) |
| EXIFS Create Header |
Cryp (0) |
ksecdd.sys | Crypto allocations |
CSdk (0) |
| Cluster Disk Filter driver |
CSnt (0) |
| Cluster Network driver |
CTE (0) |
| Common transport environment (ntosinccxport.h, used by tdi) |
Cvli (0) |
| EXIFS Cached Volume Info |
D2d (0) |
| Device Object to DosName rtns (ntos
tldev2dos.c) |
D3Dd (0) |
| DX D3D driver (embedded in a display driver like s3mvirge.dll) |
D851 (0) |
| 8514a video driver |
Dacl (0) |
| Temp allocations for object DACLs |
Dati (0) |
| ati video driver |
DbLo (0) |
| Debug logging |
dcam (0) |
| WDM mini driver for IEEE 1394 digital camera |
Dcdd (0) |
cdd.dll | Canonical display driver |
Dcl (0) |
| cirrus video driver |
Ddk (0) |
| Default for driver allocated memory (user's of ntddk.h) |
Devi (0) |
| Device objects |
Dfb (0) |
| framebuf video driver |
DfC? (0) |
dfsc.sys | DFS Client allocations |
DfCa (0) |
dfsc.sys | DFS Client PERUSERTABLE |
DfCb (0) |
dfsc.sys | DFS Client REFCONTEXT |
DfCc (0) |
dfsc.sys | DFS Client CONNECTION |
DfCd (0) |
dfsc.sys | DFS Client CURRENTDC |
DfCe (0) |
dfsc.sys | DFS Client CSCEA |
DfCf (0) |
dfsc.sys | DFS Client FILENAME |
DfCg (0) |
dfsc.sys | DFS Client PREFIXCACHE |
DfCh (0) |
dfsc.sys | DFS Client HASH |
DfCi (0) |
dfsc.sys | DFS Client INPUTBUFFER |
DfCj (0) |
dfsc.sys | DFS Client REWRITTENNAME |
DfCl (0) |
dfsc.sys | DFS Client DCLIST |
DfCm (0) |
dfsc.sys | DFS Client CMCONTEXT |
DfCn (0) |
dfsc.sys | DFS Client DOMAINNAME |
DfCp (0) |
dfsc.sys | DFS Client PATH |
DfCq (0) |
dfsc.sys | DFS Client REGSTRING |
DfCr (0) |
dfsc.sys | DFS Client REFERRAL |
DfCs (0) |
dfsc.sys | DFS Client SHARENAME |
DfCt (0) |
dfsc.sys | DFS Client TREECONNECT |
DfCu (0) |
dfsc.sys | DFS Client USETABLE |
DfCv (0) |
dfsc.sys | DFS Client SERVERNAME |
DfCw (0) |
dfsc.sys | DFS Client TARGETINFO |
DfCx (0) |
dfsc.sys | DFS Client CREDENTIALS |
DfCy (0) |
dfsc.sys | DFS Client REMOTEENTRY |
DfCz (0) |
dfsc.sys | DFS Client DOMAINREFERRAL |
Dfs (0) |
| Distributed File System |
Dfsm (0) |
| Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdigre |
dfsr (0) |
| RDBSS IRP allocation |
dFVE (0) |
dumpfve.sys | Full Volume Encryption crash dump filter (Bitlocker Drive Encryption) |
Dh 0 (0) |
| DirectDraw/3D default object |
Dh 1 (0) |
| DirectDraw/3D DirectDraw object |
Dh 2 (0) |
| DirectDraw/3D Surface object |
Dh 3 (0) |
| DirectDraw/3D Direct3D context object |
Dh 4 (0) |
| DirectDraw/3D VideoPort object |
Dh 5 (0) |
| DirectDraw/3D MotionComp object |
Dire (0) |
| Directory objects |
Dlck (0) |
| deadlock verifier (part of driver verifier) structures |
Dlmp (0) |
| Video utility library for Vista display drivers |
Dmga (0) |
| mga (matrox) video driver |
DmH? (0) |
| DirectMusic hardware synthesizer |
Dmio (0) |
| Logical Disk Manager driver |
Dmip (0) |
dmio.sys | Logical Disk Manager driver |
Dmiq (0) |
dmio.sys | Logical Disk Manager driver |
Dmld (0) |
| Logical Disk Manager loader |
DmpS (0) |
dumpsvc.sys | Crashdump Service Driver |
DmS? (0) |
| DirectMusic kernel software synthesizer |
Dmst (0) |
| Logical Disk Manager driver static initialization |
Dndt (0) |
| Device node |
Dnod (0) |
| Device node structure |
DOPE (0) |
| Device Object Power Extension (po component) |
DPHk (0) |
DbgPrnHk.sys | DbgPrintLog's helper driver, cahces and stores debug messages in memory. |
DPrf (0) |
| Disk performance filter driver |
Dprt (0) |
dxgkrnl.sys | Video port for Vista display drivers |
Dps5 (0) |
| NT5 PostScript printer driver |
Dpsh (0) |
| Postcript driver heap memory |
Dpsi (0) |
| psidisp video driver |
Dpsm (0) |
| Postcript driver memory |
DPwr (0) |
nt!pnp | PnP power management |
Dqv (0) |
| qv (qvision) video driver |
Driv (0) |
| Driver objects |
Drsd (0) |
| Rasdd Printer Driver Pool Tag. |
Dtga (0) |
| tga video driver |
Dump (0) |
| Bugcheck dump allocations |
Dun5 (0) |
| NT5 Universal printer driver |
DUQD (0) |
mpsdrv.sys | MPSDRV upcall user request |
DV?? (0) |
| RDR2 DAV MiniRedir Tags |
DVCx (0) |
| AsyncEngineContext, DAV MiniRedir |
DVEx (0) |
| Exchange, DAV MiniRedir |
DVFi (0) |
| FileInfo, DAV MiniRedir |
DVFn (0) |
| FileName, DAV MiniRedir |
Dvg2 (0) |
| vga 256 color video driver |
Dvg6 (0) |
| vga 64K color video driver |
Dvga (0) |
| vga 16 color video driver |
Dvgr (0) |
| vga for risc video driver |
DVRw (0) |
| ReadWrite, DAV MiniRedir |
DVSc (0) |
| SrvCall, DAV MiniRedir |
DVSh (0) |
| SharedHeap, DAV MiniRedir |
DW32 (0) |
| W32 video driver |
Dwd (0) |
| wd90c24a video driver |
DWNb (0) |
dwudf.sys | (DVD Write Now) I/O buffers and data verification request block |
DWNf (0) |
dwudf.sys | (DVD Write Now) default allocation without internal bounds checker |
dwnF (0) |
dwudf.sys | (DVD Write Now) default tag |
DWNm (0) |
dwudf.sys | (DVD Write Now) pending verification bitmap |
DWNm (1) |
dwudf.sys | (DVD Write Now) default allocation tag when built-in memory manager is enabled |
dwnS (0) |
dwudf.sys | (DVD Write Now) 'system' memory allocation |
DWNz (0) |
dwudf.sys | (DVD Write Now) Zero-filled buffer |
Dwp9 (0) |
| weitekp9 video driver |
DWvb (0) |
dwudf.sys | (DVD Write Now) stored data verification block |
Dxga (0) |
| XGA video driver |
DxgK (0) |
dxgkrnl.sys | Vista display driver support |
Efsc (0) |
| EFS driver |
Efsm (0) |
| EFS driver |
Efst (0) |
| EXIFS FS Statistics |
Enli (0) |
nt!tm | KTM Transaction Enlistment |
Envr (0) |
| Environment strings |
Err (0) |
| Error strings |
EtwA (0) |
nt!etw | Etw APC |
EtwB (0) |
nt!etw | Etw Buffer |
EtwC (0) |
nt!etw | Etw Realtime Consumer |
EtwD (0) |
nt!etw | Etw DataBlock |
EtwG (0) |
nt!etw | Etw Guid |
EtwL (0) |
nt!etw | ETW_LOGGER_CONTEXT |
EtwP (0) |
nt!etw | Etw Pool |
Etwp (0) |
nt!etw | ETW per |
EtwQ (0) |
nt!etw | Etw Queue |
Etwq (0) |
nt!etw | Etw ReplyQueue |
EtwR (0) |
nt!etw | Etw Registration |
Etwr (0) |
nt!etw | Etw ReplyQueue Entry |
EtwS (0) |
nt!etw | Etw DataSource |
Evel (0) |
| EFS file system filter driver lookaside list |
Even (0) |
| Event objects |
Evid (0) |
| Rtl Event ID's |
ExWl (0) |
| Executive worker list entry |
Fat (0) |
fastfat.sys | Fat File System allocations |
FatB (0) |
fastfat.sys | Fat allocation bitmaps |
Fatb (0) |
fastfat.sys | Fat Bcb arrays |
FatC (0) |
fastfat.sys | Fat Ccbs |
FatD (0) |
fastfat.sys | Fat pool dirents |
Fatd (0) |
fastfat.sys | Fat EA data |
FatE (0) |
fastfat.sys | Fat EResources |
Fate (0) |
fastfat.sys | Fat EA set headers |
FatF (0) |
fastfat.sys | Fat Fcbs |
Fatf (0) |
fastfat.sys | Fat deferred flush contexts |
FatI (0) |
fastfat.sys | Fat IrpContexts |
Fati (0) |
fastfat.sys | Fat IO run descriptor |
FatL (0) |
fastfat.sys | Fat FAT entry lookup buffer on verify |
FatN (0) |
fastfat.sys | Fat Nonpaged Fcbs |
Fatn (0) |
fastfat.sys | Fat filename buffer |
FatO (0) |
fastfat.sys | Fat I/O buffer |
FatP (0) |
fastfat.sys | Fat output for query retrieval pointers (caller frees) |
FatQ (0) |
fastfat.sys | Fat buffered user buffer |
FatR (0) |
fastfat.sys | Fat repinned Bcb |
Fatr (0) |
fastfat.sys | Fat verification |
FatS (0) |
fastfat.sys | Fat stashed Bpb |
Fats (0) |
fastfat.sys | Fat verification |
FatT (0) |
fastfat.sys | Fat directory allocation bitmaps |
FatV (0) |
fastfat.sys | Fat Vcb stat bucket |
Fatv (0) |
fastfat.sys | Fat backpocket Vpb |
FatW (0) |
fastfat.sys | Fat FAT windowing structure |
FatX (0) |
fastfat.sys | Fat IO contexts |
Fatx (0) |
fastfat.sys | Fat delayed close contexts |
fboX (0) |
| EXIFS FOBXVF List |
Fcbl (0) |
| EXIFS FCBlock |
FhCI (0) |
substvol.sys | (AllenPort Virtual Volume) file handle cache item |
FIcn (0) |
fileinfo.sys | FileInfo FS |
FIcp (0) |
fileinfo.sys | FileInfo FS |
FIcs (0) |
fileinfo.sys | FileInfo FS |
FIcv (0) |
fileinfo.sys | FileInfo FS |
File (0) |
| File objects |
FIOc (0) |
fileinfo.sys | FileInfo FS |
FIof (0) |
fileinfo.sys | FileInfo FS |
FIou (0) |
fileinfo.sys | FileInfo FS |
FIPc (0) |
fileinfo.sys | FileInfo FS |
FIvn (0) |
fileinfo.sys | FileInfo FS |
FIvp (0) |
fileinfo.sys | FileInfo FS |
FLex (0) |
| exclusive file lock |
FLfl (0) |
| exported (non |
FLli (0) |
| per |
FLln (0) |
| shared lock tree node |
flnk (0) |
| font link tag used in ntgdigre |
Flop (0) |
| floppy driver |
Flop (1) |
flopx.sys | Alter's Floppy driver with non-standard format support (e.g. 1,76Mb) |
FLsh (0) |
| shared file lock |
Flst (0) |
| EXIFS Freelist |
FLwl (0) |
| waiting lock |
FM?? (0) |
fltmgr.sys | Unrecognized FltMgr tag (update pooltag.w) |
FMac (0) |
fltmgr.sys | ASCII String buffers |
FMas (0) |
fltmgr.sys | ASYNC_IO_COMPLETION_CONTEXT structure |
FMcb (0) |
fltmgr.sys | FLT_CCB structure |
FMcr (0) |
fltmgr.sys | Context registration structures |
FMct (0) |
fltmgr.sys | TRACK_COMPLETION_NODES structure |
FMdl (0) |
fltmgr.sys | Array of DEVICE_OBJECT pointers |
FMea (0) |
fltmgr.sys | EA buffer for create |
FMfc (0) |
fltmgr.sys | FLTMGR_FILE_OBJECT_CONTEXT structure |
FMfi (0) |
fltmgr.sys | Fast IO dispatch table |
FMfk (0) |
fltmgr.sys | Byte Range Lock structure |
FMfl (0) |
fltmgr.sys | FLT_FILTER structure |
FMfn (0) |
fltmgr.sys | NAME_CACHE_NODE structure |
FMfr (0) |
fltmgr.sys | FLT_FRAME structure |
FMfz (0) |
fltmgr.sys | FILE_LIST_CTRL structure |
FMib (0) |
fltmgr.sys | Irp SYSTEM buffers |
FMic (0) |
fltmgr.sys | IRP_CTRL completion node stack |
FMil (0) |
fltmgr.sys | IRP_CTRL completion node stack |
FMin (0) |
fltmgr.sys | FLT_INSTANCE name |
FMis (0) |
fltmgr.sys | FLT_INSTANCE structure |
FMla (0) |
fltmgr.sys | Per |
FMnc (0) |
fltmgr.sys | NAME_CACHE_CREATE_CTRL structure |
FMng (0) |
fltmgr.sys | NAME_GENERATION_CONTEXT structure |
FMol (0) |
fltmgr.sys | OPLOCK_CONTEXT structure |
FMos (0) |
fltmgr.sys | Operation status ctrl structure |
FMpl (0) |
fltmgr.sys | Cache aware pushLock |
FMpr (0) |
fltmgr.sys | FLT_PRCB structure |
FMrl (0) |
fltmgr.sys | FLT_OBJECT rundown logs |
FMrp (0) |
fltmgr.sys | Reparse point data buffer |
FMrr (0) |
fltmgr.sys | Per |
FMsd (0) |
fltmgr.sys | Security descriptors |
FMsl (0) |
fltmgr.sys | STREAM_LIST_CTRL structure |
FMtn (0) |
fltmgr.sys | Temporary file names |
FMtr (0) |
fltmgr.sys | Temporary Registry information |
FMts (0) |
fltmgr.sys | Tree Stack |
FMus (0) |
fltmgr.sys | Unicode string |
FMvf (0) |
fltmgr.sys | FLT_VERIFIER_EXTENSION structure |
FMvj (0) |
fltmgr.sys | FLT_VERIFIER_OBJECT structure |
FMvo (0) |
fltmgr.sys | FLT_VOLUME structure |
FMwi (0) |
fltmgr.sys | Work item structures |
FOCX (0) |
nt!fsrtl | File System Run Time File Object Context structure |
FS?? (0) |
nt!fsrtl | Unrecoginzed File System Run Time allocations (update pooltag.w) |
FSeh (0) |
nt!fsrtl | File System Run Time Extra Create Parameter Entry |
FSel (0) |
nt!fsrtl | File System Run Time Extra Create Parameter List |
FSfm (0) |
nt!fsrtl | File System Run Time Fast Mutex Lookaside List |
FSim (0) |
nt!fsrtl | File System Run Time Mcb Initial Mapping Lookaside List |
FSmg (0) |
nt!fsrtl | File System Run Time |
Fsrc (0) |
fsrec.sys | Filesystem recognizer (fsrec.sys) |
FSrd (0) |
nt!fsrtl | File System Run Time |
FSrm (0) |
nt!fsrtl | File System Run Time |
FSrN (0) |
nt!fsrtl | File System Run Time |
FSrn (0) |
nt!fsrtl | File System Run Time |
FSro (0) |
nt!fsrtl | File System Run Time |
FSrs (0) |
nt!fsrtl | File System Run Time Work Item for low |
FSrt (0) |
nt!fsrtl | File System Run Time allocations (DO NOT USE!) |
FstB (0) |
| ntosfstub |
Fstb (0) |
| ntosfstub |
FSun (0) |
nt!fsrtl | File System Run Time |
FsVg (0) |
fsvga.sys | International VGA support |
FtC (0) |
| Fault tolerance driver |
FtM (0) |
| Fault tolerance driver |
FtpA (0) |
mpsdrv.sys | MPSDRV FTP protocol analyzer |
FTrc (0) |
| Fault tolerance Slist tag. |
FtS (0) |
| Fault tolerance driver |
FtT (0) |
| Fault tolerance driver |
FtU (0) |
| Fault tolerance driver |
FtV (0) |
| Fault tolerance driver |
FVE0 (0) |
fvevol.sys | General allocations |
FVE? (0) |
fvevol.sys | Full Volume Encryption Filter Driver (Bitlocker Drive Encryption) |
FVEc (0) |
fvevol.sys | Cryptographic allocations |
FVEl (0) |
fvevol.sys | FVELIB allocations |
FVEp (0) |
fvevol.sys | Write buffers |
FVEr (0) |
fvevol.sys | Reserved mapping addresses |
FVEv (0) |
fvevol.sys | Conversion allocations |
FVEw (0) |
fvevol.sys | Worker threads |
FVEx (0) |
fvevol.sys | Read/write control structures |
FwfD (0) |
mpsdrv.sys | MPSDRV driver buffer for flattening NET_BUFFFER |
Fwpp (0) |
fwpkclnt.sys | Windows Filtering Platform export driver. |
FxDr (0) |
wdf01000.sys | KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. |
FxL? (0) |
wdfldr.sys | KMDF Loader Pool allocation |
FxLg (0) |
wdf01000.sys | KMDF IFR log tag |
G (0) |
| Gdi Generic allocations |
G??? (0) |
| Gdi Objects |
Gcac (0) |
| Gdi glyph cache |
Gcap (0) |
| Gdi capture buffer |
Gcsl (0) |
| Gdi string resource script names |
Gdbr (0) |
| Gdi driver brush realization |
Gdd (0) |
| Gdi ddraw PKEY_VALUE_FULL_INFORMATION |
Gdda (0) |
| Gdi ddraw attach list |
GddD (0) |
| Gdi ddraw dummy page |
Gdde (0) |
| Gdi ddraw event |
Gddf (0) |
| Gdi ddraw driver heaps |
Gddp (0) |
| Gdi ddraw driver caps |
Gddv (0) |
| Gdi ddraw driver video memory list |
GDev (0) |
| Gdi pdev |
Gdev (0) |
| Gdi GDITAG_DEVMODE |
Gdrs (0) |
| Gdi GDITAG_DRVSUP |
Gdwd (0) |
win32k.sys | Gdi watchdog support objects |
Gdxd (0) |
| Gdi ddraw VPE directdraw object |
Gdxs (0) |
| Gdi ddraw VPE surface, videoport, capture object |
Gdxx (0) |
| Gdi ddraw VPE DXAPI object |
Gebr (0) |
| Gdi ENGBRUSH |
gEdg (0) |
| Gdi gradient fill triangle |
Gfcb (0) |
| EXIFS Grow FCB |
Gffv (0) |
| Gdi FONTFILEVIEW |
GFil (0) |
| Gdi engine descriptor list |
gFil (0) |
| Gdi FILEVIEW |
Gfsb (0) |
| Gdi font sustitution list |
Gfsm (0) |
| Gdi Fast mutex |
Ggb (0) |
| Gdi glyph bits |
Ggbl (0) |
| Gdi look aside buffers |
Ggdv (0) |
| Gdi GDITAG_GDEVICE |
Gglb (0) |
| Gdi temp buffer |
Ggls (0) |
| Gdi glyphset |
Gh ? (0) |
win32k.sys | Gdi Handle manager specific object types: defined in w32
tgdiinc
tgdistr.h |
Ghmg (0) |
| Gdi handle manager objects |
Gini (0) |
| Gdi fast mutex |
Gla? (0) |
win32k.sys | Gdi handle manager specific object types allocated from lookaside memory: defined in w32
tgdiinc
tgdistr.h |
Gldv (0) |
| Gdi Ldev |
Glnk (0) |
| Gdi PFELINK |
Gmap (0) |
| Gdi font map signature table |
Gpff (0) |
| Gdi physical font file |
Gpft (0) |
| Gdi font table |
Gsem (0) |
| Gdi Semaphores |
Gsp (0) |
| Gdi sprite |
Gspr (0) |
| Gdi sprite grow range |
Gtmp (0) |
| Gdi temporary allocations |
Gtmw (0) |
| Gdi TMW_INTERNAL |
Gxlt (0) |
| Gdi Xlate |
Hal (0) |
hal.dll | Hardware Abstraction Layer |
HalV (0) |
ntoskrnl.exe | Driver Verifier DMA checking |
HcBm (0) |
hcaport.sys | HCAPORT_TAG_BITMAP |
HcCm (0) |
hcaport.sys | HCAPORT_TAG_CM |
HcCq (0) |
hcaport.sys | HCAPORT_TAG_CQUEUE |
HcdI (0) |
hcaport.sys | HCAPORT_TAG_HWID |
HcDr (0) |
hcaport.sys | HCAPORT_TAG_DEVICE_RELATIONS |
HcEn (0) |
hcaport.sys | HCAPORT_TAG_ENUM |
HcEv (0) |
hcaport.sys | HCAPORT_TAG_EVENT |
HCID (0) |
bthport.sys | Bluetooth port driver HCI debug |
HCIT (0) |
bthport.sys | Bluetooth port driver (HCI) |
HcMa (0) |
hcaport.sys | HCAPORT_TAG_MAD |
HcMc (0) |
hcaport.sys | HCAPORT_TAG_MISC |
HcMp (0) |
hcaport.sys | HCAPORT_TAG_MINIPORT |
HcMr (0) |
hcaport.sys | HCAPORT_TAG_REMOVE_LOCK |
HcOb (0) |
hcaport.sys | HCAPORT_TAG_OBJECT |
HcPr (0) |
hcaport.sys | HCAPORT_TAG_PROTD |
HcRs (0) |
hcaport.sys | HCAPORT_TAG_RESOURCE_LIST |
HcUc (0) |
hcaport.sys | HCAPORT_TAG_UCONTEXT |
HdCl (0) |
| HID Client Sample Driver |
HidC (0) |
| HID Class |
HidP (0) |
| HID Parser |
Hioc (0) |
hcaport.sys | HCAPORT_TAG_IOC_SERVICE_TABLE |
HisC (0) |
| histogram filter driver |
Hist (0) |
| histogram filter driver |
Hmgo (0) |
hcaport.sys | HCAPORT_TAG_WQ_MG_INFO |
Hpfs (0) |
| Pinball (aka Hpfs) allocations |
HPmi (0) |
hcaport.sys | HCAPORT_TAG_PMI_EXTENSION |
HpMM (0) |
pnpmem.sys | HotPlug Memory Driver |
hSVD (0) |
mrxdav.sys | Shared Heap Tag |
HT01 (0) |
| GDI Halftone AddCachedDCI() for CurCDCIData |
HT02 (0) |
| GDI Halftone GetCachedDCI() for Threshold |
HT03 (0) |
| GDI Halftone FindCachedSMP() for CurCSMPData |
HT04 (0) |
| GDI Halftone FindCachedSMP() for CurCSMPBmp |
HT05 (0) |
| GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI |
HT06 (0) |
| GDI Halftone pDCIAdjClr() for DEVCLRADJ |
HT07 (0) |
| GDI Halftone ComputeRGB555LUT() for RGBLUT |
HT08 (0) |
| GDI Halftone ColorTriadSrcToDev() for RGB |
HT09 (0) |
| GDI Halftone ColorTriadSrcToDev() for CRTX |
HT10 (0) |
| GDI Halftone CreateDyesColorMappingTable() for DevPrims |
HT11 (0) |
| GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable |
HT12 (0) |
| GDI Halftone ThresholdsFromYData() for pYData |
HT13 (0) |
| GDI Halftone ComputeHTCellRegress() for pThresholds |
HT14 (0) |
| GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine |
HT15 (0) |
| GDI Halftone CalculateStretch() for PrimColorInfo |
Hvlm (0) |
nt!Hvl | Temporary MDL for the Hvl component. |
HvlP (0) |
nt!Hvl | Hypercall marshalling pages for the Hvl component. |
IBCM (0) |
wibcm.sys | CM_INSTANCE_TAG Windows Infiniband Communications Manager |
IBm* (0) |
wibms.sys | Windows Infiniband Management Server pool tags |
IbPA (0) |
wibpm.sys | WIBPM_SAMPLE_TAG |
IbPI (0) |
wibpm.sys | WIBPM_ITEM_TAG |
IbPm (0) |
wibpm.sys | WIBPM_TAG Windows Infiniband Performance Manager |
IbPS (0) |
wibpm.sys | WIBPM_SENT_TAG |
IbW0 (0) |
wibwmi.sys | WIBWMI0_TAG Windows Infiniband WMI Manager |
IbW1 (0) |
wibwmi.sys | WIBWMI1_TAG |
IbW2 (0) |
wibwmi.sys | WIBWMI2_TAG |
Icp (0) |
| I/O completion packets queue on a completion ports |
IcpP (0) |
| NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers |
ICSo (0) |
substvol.sys | (AllenPort Virtual Volume) SectionObject cache |
IdeP (0) |
| atapi IDE |
IdeX (0) |
| PCI IDE |
idle (0) |
| Power Manager idle handler |
Ifs (0) |
| Default file system allocations (user's of ntifs.h) |
II?? (0) |
| IP in IP tunneling |
IIdt (0) |
| Data |
IIhd (0) |
| Header |
IIpk (0) |
| Packet |
IIrf (0) |
| Free memory |
IIsc (0) |
| Send Context |
IITn (0) |
| Tunnel |
IIts (0) |
| Transfer Context |
IIwc (0) |
| Work Context |
Im* (0) |
| Imapi.sys from adaptec |
Info (0) |
| general system information allocations |
INTC (0) |
| Intel video driver |
INty (0) |
substvol.sys | (AllenPort Virtual Volume) file notification item |
Io (0) |
nt!io | general IO allocations |
IoCc (0) |
nt!io | Io completion context |
IoEa (0) |
nt!io | Io extended attributes |
IoEr (0) |
nt!io | Io error log packets |
IoFc (0) |
nt!io | Io name transmogrify operation |
IOfl (0) |
substvol.sys | (AllenPort Virtual Volume) offline file descriptor |
IoFs (0) |
nt!io | Io shutdown packet |
IoFu (0) |
nt!pnp | Io file utils |
Ioin (0) |
| Io interrupts |
IoKB (0) |
| Registry basic key block (temp allocation) |
IoNm (0) |
nt!io | Io parsing names |
IoOp (0) |
nt!io | I/O subsystem open packet |
IoRb (0) |
nt!io | Io remote boot related |
IoRi (0) |
nt!io | I/O SubSystem Driver Reinitialization Callback Packet |
IoRN (0) |
nt!io | Registry key name (temp allocation) |
IoSe (0) |
nt!io | Io security related |
IoSh (0) |
nt!io | Io shutdown packet |
IoSt (0) |
nt!io | Io Stream Identifier Context |
IoTi (0) |
nt!io | Io timers |
IoTt (0) |
nt!vf | I/O verifier IRP tracking table |
IoUs (0) |
nt!io | I/O SubSystem completion Context Allocation |
Ip?? (0) |
ipsec.sys | IP Security |
IpAT (0) |
ipsec.sys | AH headers in transport mode |
IpAU (0) |
ipsec.sys | AH headers in tunnel mode |
IpAX (0) |
ipsec.sys | Key acquire contexts |
IpBP (0) |
ipsec.sys | buffer pools |
IpCO (0) |
ipsec.sys | IP compression |
IpEQ (0) |
ipsec.sys | event queue |
IpET (0) |
ipsec.sys | ESP headers in transport mode |
IpEU (0) |
ipsec.sys | ESP headers in tunnel mode |
IpFI (0) |
ipsec.sys | Filter blocks |
IpFl (0) |
mpsdrv.sys | MPSDRV IP Flow |
IpHT (0) |
ipsec.sys | HUGHES headers in transport mode |
IpHU (0) |
ipsec.sys | HUGHES headers in tunnel mode |
IpHW (0) |
ipsec.sys | hardware accleration items |
IpKE (0) |
ipsec.sys | keys |
IpLA (0) |
ipsec.sys | lookaside lists |
IPm? (0) |
| IP Multicasting |
IPmf (0) |
| Free memory (only in checked builds) |
IPmg (0) |
| Group |
IPmm (0) |
| Message |
IPmo (0) |
| Outgoing Interface |
IPms (0) |
| Source |
IpSA (0) |
ipsec.sys | Security Associations |
IpSC (0) |
ipsec.sys | send complete context |
IpSI (0) |
ipsec.sys | initial allocations |
IpSQ (0) |
ipsec.sys | stall queues |
IpTI (0) |
ipsec.sys | timers |
IPX (0) |
| Nwlnkipx transport |
IrD? (0) |
| IrDA TDI and RAS drivers |
Irp (0) |
| Io, IRP packets |
Irp+ (0) |
nt!vf | I/O verifier allocated IRP packets |
IrpB (0) |
nt!vf | I/O verifier direct I/O double buffer allocation |
IrpC (0) |
nt!vf | I/O verifier stack contexts |
Irpd (0) |
nt!vf | I/O verifier deferred completion context |
Irpl (0) |
nt!io | system large IRP lookaside list |
Irps (0) |
nt!io | system small IRP lookaside list |
Irpt (0) |
nt!vf | I/O verifier per |
Isap (0) |
| Pnp Isa bus extender |
IU?? (0) |
| IIS Utility Driver |
IUcp (0) |
| completion port minipackets |
IUDl (0) |
| Lookaside list allocations |
KAPC (0) |
nt!io | I/O SubSystem HardError APC |
KbdC (0) |
| Keyboard Class Driver |
KCfe (0) |
| Kernel COM factory entry |
Ke (0) |
| Kernel data structures |
KeIC (0) |
| Kernel Interrupt Object Chain |
Key (0) |
| Key objects |
KMIX (0) |
| Kmixer (wdm audio) |
KNMI (0) |
| Kernel NMI Callback object |
KrbC (0) |
ksecdd.sys | Kerberos Client package |
KSah (0) |
| Ks auxiliary stream headers |
KSAI (0) |
| allocator instance |
KSai (0) |
| default allocator instance header |
KSbi (0) |
| event buffered item |
KSce (0) |
| create item entry |
KSch (0) |
| create handler entry |
KSCI (0) |
| clock instance |
KSci (0) |
| default clock instance header |
KScp (0) |
| object creation parameters auxiliary copy |
KSda (0) |
| default allocator |
KSdc (0) |
| default clock |
KSdh (0) |
| device header |
Kse0 (0) |
ksecdd.sys | Security driver allocs for sec package 0 |
Kse1 (0) |
ksecdd.sys | Security driver allocs for sec package 1 |
Kse2 (0) |
ksecdd.sys | Security driver allocs for sec package 2 |
Kse3 (0) |
ksecdd.sys | Security driver allocs for sec package 3 |
Kse4 (0) |
ksecdd.sys | Security driver allocs for sec package 4 |
Kse5 (0) |
ksecdd.sys | Security driver allocs for sec package 5 |
Kse6 (0) |
ksecdd.sys | Security driver allocs for sec package 6 |
Kse7 (0) |
ksecdd.sys | Security driver allocs for sec package 7 |
Kse8 (0) |
ksecdd.sys | Security driver allocs for sec package 8 |
Kse9 (0) |
ksecdd.sys | Security driver allocs for sec package 9 |
Ksec (0) |
ksecdd.sys | Security device driver |
KSed (0) |
| oneshot event deletion dpc |
KSee (0) |
| event entry |
KSep (0) |
| irp system buffer event parameter |
KSer (0) |
| QM error report |
KseS (0) |
ksecdd.sys | Security driver allocs for LSA proper |
KSew (0) |
| oneshot event deletion workitem |
KseZ (0) |
ksecdd.sys | Security driver allocs for default sec package |
KSfd (0) |
| filter cache data (MSKSSRV) |
KsFI (0) |
| filter instance |
KSns (0) |
| null security object |
KSnv (0) |
| registry name value |
KSoh (0) |
| object header |
KsoO (0) |
| WDM audio stuff |
KSop (0) |
| object creation parameters |
KSpc (0) |
| port driver instance FsContext |
KSPI (0) |
| pin instance |
KSpp (0) |
| irp system buffer property/method/event parameter |
KSpt (0) |
| pin type list (MSKSSRV) |
KSqf (0) |
| query information file buffer |
KSqr (0) |
| QM quality report |
KSsc (0) |
| port driver stream FsContext |
KSsf (0) |
| set information file buffer |
KSsh (0) |
| stream headers |
KSsi (0) |
| software bus interface |
KSsl (0) |
| symbolic link buffer (MSKSSRV) |
KSsp (0) |
| serialized property set |
kuzt (0) |
SbieDrv.sys | Sandboxie Kernel Mode Driver |
L2CA (0) |
bthport.sys | Bluetooth port driver (L2CAP) |
L2T0 (0) |
| ndisl2tp / MTAG_FREED |
L2T1 (0) |
| ndisl2tp / MTAG_ADAPTERCB |
L2T2 (0) |
| ndisl2tp / MTAG_TUNNELCB |
L2T3 (0) |
| ndisl2tp / MTAG_VCCB |
L2T4 (0) |
| ndisl2tp / MTAG_VCTABLE |
L2T5 (0) |
| ndisl2tp / MTAG_WORKITEM |
L2T6 (0) |
| ndisl2tp / MTAG_TIMERQ |
L2T7 (0) |
| ndisl2tp / MTAG_TIMERQITEM |
L2T8 (0) |
| ndisl2tp / MTAG_PACKETPOOL |
L2T9 (0) |
| ndisl2tp / MTAG_FBUFPOOL |
L2Ta (0) |
| ndisl2tp / MTAG_HBUFPOOL |
L2Tb (0) |
| ndisl2tp / MTAG_TDIXRDG |
L2Tc (0) |
| ndisl2tp / MTAG_TDIXSDG |
L2Td (0) |
| ndisl2tp / MTAG_CTRLRECD |
L2Te (0) |
| ndisl2tp / MTAG_CTRLSENT |
L2Tf (0) |
| ndisl2tp / MTAG_PAYLRECD |
L2Tg (0) |
| ndisl2tp / MTAG_PAYLSENT |
L2Th (0) |
| ndisl2tp / MTAG_INCALL |
L2Ti (0) |
| ndisl2tp / MTAG_UTIL |
L2Tj (0) |
| ndisl2tp / MTAG_ROUTEQUERY |
L2Tk (0) |
| ndisl2tp / MTAG_ROUTESET |
L2Tl (0) |
| ndisl2tp / MTAG_L2TPPARAMS |
L2Tm (0) |
| ndisl2tp / MTAG_TUNNELWORK |
L2Tn (0) |
| ndisl2tp / MTAG_TDIXROUTE |
LANE (0) |
atmlane.sys | LAN Emulation Client for ATM |
LB?? (0) |
| LM Datagram receiver allocations |
LBan (0) |
| Server announcement |
LBbb (0) |
| Become backup context |
LBbl (0) |
| Backup List |
LBbn (0) |
| Name |
LBbr (0) |
| Become backup request |
LBbs (0) |
| Browser server |
LBci (0) |
| Connection info |
LBdi (0) |
| POOL_DOMAIN_INFO |
LBds (0) |
| Send datagram context |
LBea (0) |
| Ea buffer |
LBel (0) |
| Election context |
LBgb (0) |
| GetBackupList request |
LBic (0) |
| IRP context |
LBid (0) |
| Illegal datagram context |
LBma (0) |
| Master announce context |
LBmb (0) |
| Mailslot Buffer |
LBmh (0) |
| Mailslot header |
LBnn (0) |
| Name name |
LBpn (0) |
| Paged Name |
LBpt (0) |
| Paged transport |
LBse (0) |
| Browser security |
LBsl (0) |
| Browser server list |
LBtn (0) |
| Transport name |
Lbuf (0) |
| EXIFS Large Buffer |
LBvb (0) |
| View buffer |
LBwi (0) |
| Work item |
LBxm (0) |
| Master name |
LBxn (0) |
| TransportName |
LBxp (0) |
| Transport |
LCam (0) |
| WDM mini video capture driver for Logitech camera |
LeoC (0) |
| Symantec/Norton AntiVirus filter driver |
Lfs (0) |
| Lfs allocations |
LfsI (0) |
| Lfs allocations |
List (0) |
| kernel utilities list allocation |
LogA (0) |
clfs.sys | CLFS_APITEST_TAG |
LpcM (0) |
| Local procedure call message blocks |
LpcZ (0) |
| LPC Zone |
Lr (0) |
| Generic allocations |
Lr!! (0) |
| Cancel request context blocks |
Lr2x (0) |
| Transact SMB context |
Lr?? (0) |
| Buffers used for FsControlFile APIs |
Lrac (0) |
| ACL for redirector |
Lraw (0) |
| Async write context |
Lrbb (0) |
| Write behind buffer |
Lrca (0) |
| Temporary storage used in name canonicalization |
Lrcl (0) |
| ConnectListEntries |
Lrcn (0) |
| Computer Name |
Lrcx (0) |
| Context blocks of various types |
Lrdn (0) |
| Domain Name |
Lrds (0) |
| Duplicated ansi string |
Lrdu (0) |
| Duplicated unicode string |
Lrea (0) |
| EA related allocations |
Lref (0) |
| Reference history (debug only) |
Lrfc (0) |
| File Control Blocks |
Lrfl (0) |
| Fcb Locks |
Lrfp (0) |
| Fcb Paging locks |
Lric (0) |
| Instance Control Blocks |
Lrlb (0) |
| Lock Control Block buffers |
Lrlc (0) |
| Lock Control Blocks |
Lrme (0) |
| MPX table entries |
Lrmt (0) |
| MPX table |
Lrna (0) |
| Netbios Addresses |
Lrnf (0) |
| Non paged FCB |
Lrnt (0) |
| Non paged transport |
Lrps (0) |
| Paged security entry |
Lrpt (0) |
| Primary transport server list |
Lrsc (0) |
| Search Control Blocks |
Lrse (0) |
| Security entry |
Lrsl (0) |
| ServerListEntries |
Lrsm (0) |
| SMB buffer |
Lrso (0) |
| Operating system name |
Lrsx (0) |
| Send contexts |
Lrtc (0) |
| Transport connection |
Lrte (0) |
| Transport event. |
Lrwb (0) |
| Write behind buffer header |
Lrwq (0) |
| Work queue item |
Lrxx (0) |
| Transceive context blocks |
LS?? (0) |
| LM server allocations |
LSac (0) |
| BlockTypeAdminCheck |
LSas (0) |
| BlockTypeAdapterStatus |
LSbf (0) |
| buffer descriptor |
LScd (0) |
| comm device |
LScn (0) |
| connection |
LSdb (0) |
| data buffer |
LSdc (0) |
| BlockTypeDirCache |
LSdi (0) |
| BlockTypeDirectoryInfo |
LSep (0) |
| endpoint |
LSfn (0) |
| BlockTypeFSName |
LSlf (0) |
| LFCB |
LSlr (0) |
| BlockTypeLargeReadX |
LSmf (0) |
| MFCB |
LSmi (0) |
| BlockTypeMisc |
LSnd (0) |
| WDM mini sound driver for Logitech video camera |
LSnh (0) |
| nonpaged block header |
LSni (0) |
| BlockTypeNameInfo |
LSop (0) |
| oplock break wait |
LSpc (0) |
| paged connection |
LSpm (0) |
| paged MFCB |
LSpr (0) |
| paged RFCB |
LSrf (0) |
| RFCB |
LSsc (0) |
| search(core) |
LSsd (0) |
| BlockTypeShareSecurityDescriptor |
LSsf (0) |
| BlockTypeDfs |
LSsh (0) |
| share |
LSsp (0) |
| search(core complete) |
LSsr (0) |
| search |
LSss (0) |
| session |
LStb (0) |
| table |
LStc (0) |
| tree connect |
LSti (0) |
| timer |
LStr (0) |
| transaction |
LSvi (0) |
| BlockTypeVolumeInformation |
LSwi (0) |
| initial work context |
LSwn (0) |
| normal work context |
LSwq (0) |
| BlockTypeWorkQueue |
LSwr (0) |
| raw work context |
LSws (0) |
| BlockTypeWorkContextSpecial |
Luaf (0) |
luafv.sys | LUA File Virtualization |
LXMK (0) |
| kernel mixer line driver (KMXL |
Lxpt (0) |
| Transport |
MapP (0) |
| PNP map |
Mapr (0) |
| arc firmware registry routines |
McaC (0) |
hal.dll | HAL MCA corrected Log |
McaD (0) |
hal.dll | HAL MCA Driver Log |
McaK (0) |
hal.dll | HAL MCA Kernel Log |
MCAM (0) |
| WDM mini driver for Intel USB camera |
McaP (0) |
hal.dll | HAL MCA Log from previous boot |
McaT (0) |
hal.dll | HAL MCA temporary Log |
MCDd (0) |
| OpenGL MCD driver (embedded in a display driver like s3mvirge.dll) |
MCDx (0) |
| OpenGL MCD server (mcdsrv32.dll) allocations |
Mdl (0) |
| Io, Mdls |
MdlP (0) |
| MDL per processor lookaside list pointers |
MePr (0) |
| In |
mkup (0) |
mpsdrv.sys | MPSDRV upcall request |
Mm (0) |
nt!mm | general Mm Allocations |
MmAc (0) |
nt!mm | Mm access log buffers |
MmBk (0) |
nt!mm | Mm banked sections |
MmCa (0) |
nt!mm | Mm control areas for mapped files |
MmCd (0) |
nt!mm | Mm fork clone descriptors |
MmCh (0) |
nt!mm | Mm fork clone headers |
MmCi (0) |
nt!mm | Mm control areas for images |
MmCl (0) |
nt!mm | Mm fork clone prototype PTEs |
MmCm (0) |
nt!mm | Calls made to MmAllocateContiguousMemory |
MmCr (0) |
nt!mm | Mm fork clone roots |
MmCt (0) |
nt!mm | Mm debug tracing |
MmCx (0) |
nt!mm | info for dynamic section extension |
MmDb (0) |
nt!mm | NtMapViewOfSection service |
Mmdl (0) |
nt!mm | Mm Mdls for flushes |
MmDm (0) |
nt!mm | deferred MmUnlock entries |
MmDT (0) |
nt!mm | Mm debug |
MmEx (0) |
nt!mm | Mm events |
MmHi (0) |
nt!mm | Mm image entry |
MmHn (0) |
nt!mm | Mm sessionwide address name string entry |
MmHt (0) |
nt!mm | session space PTE data |
MmHv (0) |
nt!mm | Mm sessionwide address entry |
MmIn (0) |
nt!mm | Mm inpaged io structures |
MmLd (0) |
nt!mm | Mm load module database |
MmLn (0) |
nt!mm | temporary name buffer for driver loads |
MmMl (0) |
nt!mm | physical memory range information |
MmPa (0) |
nt!mm | pagefile space deletion slist entries |
MmPd (0) |
nt!mm | Mm page table commitment bitmaps |
MmPg (0) |
nt!mm | Mm page table pages at init time |
Mmpp (0) |
nt!mm | Mm prototype PTEs for pool |
Mmpr (0) |
nt!mm | Mm physical VAD roots |
Mmpv (0) |
nt!mm | Physical view VAD info |
MmRl (0) |
nt!mm | temporary readlists for file prefetch |
MmRp (0) |
nt!mm | Mm repurpose logging |
MmRw (0) |
nt!mm | Mm read write virtual memory buffers |
MmSb (0) |
nt!mm | Mm subsections |
MmSc (0) |
nt!mm | subsections used to map data files |
MmSd (0) |
nt!mm | extended subsections used to map data files |
MmSe (0) |
nt!mm | Mm secured VAD allocation |
MmSg (0) |
nt!mm | Mm segments |
MmSi (0) |
nt!mm | Control area security image stubs |
MmSm (0) |
nt!mm | segments used to map data files |
MmSP (0) |
nt!mm | SLIST entries for system PTE NB queues |
MmSt (0) |
nt!mm | Mm section object prototype ptes |
MmSy (0) |
nt!mm | Mm PTE and IO tracking logs |
MmVd (0) |
nt!mm | Mm virtual address descriptors for mapped views |
MmVs (0) |
nt!mm | Mm virtual address descriptors short form (private views) |
MmWe (0) |
nt!mm | Work entries for writing out modified filesystem pages. |
MmWw (0) |
nt!mm | Write watch VAD info |
Mmww (0) |
nt!mm | Write watch bitmap VAD info |
Mmxx (0) |
nt!mm | Mm temporary allocations |
Mn01 (0) |
monitor.sys | ACPI method evaluation output buffer |
Mn02 (0) |
monitor.sys | Unused |
Mn03 (0) |
monitor.sys | Raw E |
Mn04 (0) |
monitor.sys | Cached monitor ID WMI data block |
Mn05 (0) |
monitor.sys | Cached monitor basic display parameters WMI data block |
Mn06 (0) |
monitor.sys | Cached monitor analog video input parameters WMI data block |
Mn07 (0) |
monitor.sys | Cached monitor digitial video input parameters WMI data block |
Mn08 (0) |
monitor.sys | Cached monitor color characteristics WMI data block |
Mn09 (0) |
monitor.sys | Cached supported monitor source modes WMI data block |
Mn0A (0) |
monitor.sys | Registry subkey info buffer |
Mn0B (0) |
monitor.sys | Registry value buffer |
Mn0C (0) |
monitor.sys | Cached supported monitor frequency ranges WMI data block (overrides from registry) |
Mn0D (0) |
monitor.sys | Cached supported monitor frequency ranges WMI data block (from E |
Mn0E (0) |
monitor.sys | Buffer for E |
Mn0F (0) |
monitor.sys | Buffer for E |
MNFC (0) |
msnfsflt.sys | NFS FS Filter, callback context |
MNFF (0) |
msnfsflt.sys | NFS FS Filter, file context |
MNFf (0) |
msnfsflt.sys | NFS FS Filter, filename buffer |
MNFI (0) |
msnfsflt.sys | NFS FS Filter, instance context |
MNFi (0) |
msnfsflt.sys | NFS FS Filter, instance name buffer |
MNFr (0) |
msnfsflt.sys | NFS FS Filter, registry access buffer |
MNFS (0) |
msnfsflt.sys | NFS FS Filter, stream context |
MNFs (0) |
msnfsflt.sys | NFS FS Filter, general string buffer |
MNFT (0) |
msnfsflt.sys | NFS FS Filter, thread array |
MNFv (0) |
msnfsflt.sys | NFS FS Filter, volume name buffer |
MQAA (0) |
mqac.sys | MSMQ driver, AVL allocations |
MQAB (0) |
mqac.sys | MSMQ driver, CCursor allocations |
MQAC (0) |
mqac.sys | MSMQ driver, generic allocations |
MQAD (0) |
mqac.sys | MSMQ driver, CDistribution allocations |
MQAG (0) |
mqac.sys | MSMQ driver, CGroup allocations |
MQAH (0) |
mqac.sys | MSMQ driver, Heap allocations |
MQAP (0) |
mqac.sys | MSMQ driver, CPacket allocations |
MQAQ (0) |
mqac.sys | MSMQ driver, CQueue allocations |
MQAT (0) |
mqac.sys | MSMQ driver, CTransaction allocations |
MRXx (0) |
| Client side caching for SMB |
Msdv (0) |
| WDM mini driver for IEEE 1394 DV Camera and VCR |
MsFC (0) |
| Mailslot root CCB, A client control block for the top level mailslot directory |
MsFc (0) |
| Mailslot CCB, Client control block. Each client with an opened mailslot has one of these |
MsFD (0) |
| Mailslot root DCB and its name buffer |
MsFd (0) |
| Mailslot data entry write buffer, This is writes buffered inside mailslots |
MsFf (0) |
| Mailslot FCB, File control block, Service side block for each created mailslot. |
MsFg (0) |
| Mailslot global resource |
MsFN (0) |
| Mailslot FCB name buffer, name for each created mailslot |
MsFn (0) |
| Mailslot temporary name buffer |
MsFr (0) |
| Mailslot read buffer, buffer created for pended reads issued. |
MsFt (0) |
| Mailslot query template, used for directory queries. |
MsFw (0) |
| Mailslot work context block, blocks create when we need to timeout reads. |
MST? (0) |
| MSTEE (mstee.sys) |
MSTa (0) |
| associated stream header |
MSTc (0) |
| filer connection |
MSTd (0) |
| data format |
MSTf (0) |
| filter instance |
MSTp (0) |
| pin instance |
MSTs (0) |
| stream header |
MsvC (0) |
ksecdd.sys | Msv/Ntlm client package |
MuDn (0) |
mup.sys | Device name |
MuFc (0) |
mup.sys | File Context |
MuFn (0) |
mup.sys | File name rewrite |
MuIc (0) |
mup.sys | IRP Context |
MuMc (0) |
mup.sys | Master context |
MuoC (0) |
| MOUSE_POOL_TAG Mouse Class Driver |
Mup (0) |
mup.sys | Multiple UNC provider allocations, generic |
MuPe (0) |
mup.sys | Known prefix entry |
MuPi (0) |
mup.sys | Provider info |
MupI (0) |
mup.sys | Windows Server 2003 and prior versions: DFS Irp Context allocation |
MuQc (0) |
mup.sys | Query context |
MuSf (0) |
mup.sys | Surrogate file info |
MuSi (0) |
mup.sys | Surrogate info |
MuSr (0) |
mup.sys | Surrogate IRP info |
Muta (0) |
| Mutant objects |
MuUn (0) |
mup.sys | UNC provider |
MXF (0) |
| DirectMusic (MIDI Transform Filter) |
Nb?? (0) |
| NetBT allocations |
NBF (0) |
| general NBF allocations |
NBFa (0) |
| NBF address object |
NBFb (0) |
| NBF receive buffer |
NBFc (0) |
| NBF connection object |
NBFd (0) |
| NBF packet pool descriptor |
NBFe (0) |
| NBF bind & export names |
NBFf (0) |
| NBF address file object |
NBFg (0) |
| NBF registry path name |
NBFi (0) |
| NBF tdi connection info |
NBFk (0) |
| NBF loopback buffer |
NBFl (0) |
| NBF link object |
NBFn (0) |
| NBF netbios name |
NBFo (0) |
| NBF config data |
NBFp (0) |
| NBF packet |
NBFq (0) |
| NBF query buffer |
NBFr (0) |
| NBF request |
NBFs (0) |
| NBF provider stats |
NBFt (0) |
| NBF connection table |
NBFu (0) |
| NBF UI frame |
NBFw (0) |
| NBF work item |
NBI (0) |
| NwlnkNb transport |
NBqh (0) |
| Non |
NBS (0) |
| general NetBIOS allocations |
NBSa (0) |
| address block |
NBSc (0) |
| connection block |
NBSe (0) |
| EA buffer |
NBSf (0) |
| FCB |
NBSl (0) |
| LANA block |
NBSn (0) |
| copy of user NCB |
NBSr (0) |
| registry allocations |
NBSx (0) |
| XNS NETONE address (connect block) |
NBSy (0) |
| NetBIOS address (connect block) |
NBSz (0) |
| NetBIOS address (listen block) |
NCSt (0) |
| EXIFS NC |
ND (0) |
ndis.sys | general NDIS allocations |
NDam (0) |
ndis.sys | NdisAllocateMemory |
NDan (0) |
ndis.sys | adapter name |
NDco (0) |
ndis.sys | NDIS_TAG_CO |
NDd (0) |
ndis.sys | NDIS_TAG_DBG |
NDdb (0) |
ndis.sys | DMA block |
NDDl (0) |
ndis.sys | NDIS_TAG_DBG_LOG |
NDdl (0) |
ndis.sys | NDIS_TAG_DBG_L |
NDdp (0) |
ndis.sys | NDIS_TAG_DBG_P |
NDds (0) |
ndis.sys | NDIS_TAG_DBG_S |
NDdt (0) |
ndis.sys | NDIS_TAG_DFRD_TMR |
NDfa (0) |
ndis.sys | NDIS_TAG_FILTER_ADDR |
NDlb (0) |
ndis.sys | lookahead buffer |
NDlp (0) |
ndis.sys | NDIS_TAG_LOOP_PKT |
NDMb (0) |
ndis.sys | NDIS_TAG_MAC_BLOCK |
NDmb (0) |
ndis.sys | MAC block |
NDmr (0) |
ndis.sys | map register entry array |
NDoa (0) |
ndis.sys | NDIS_TAG_OID_ARRAY |
NDob (0) |
ndis.sys | open block |
NDPa (0) |
ndis.sys | Apple Talk |
NDPb (0) |
ndis.sys | NBF |
NDpb (0) |
ndis.sys | protocol block |
NDpf (0) |
ndis.sys | NDIS_TAG_FILTER |
NDPi (0) |
ndis.sys | NWLNKIPX |
NDpk (0) |
ndis.sys | NDIS_TAG_PKT_PATTERN |
NDPn (0) |
ndis.sys | NWLNKNB |
NDPp (0) |
ndis.sys | Packet Scheduler. |
NDpp (0) |
ndis.sys | packet pool |
NDPs (0) |
ndis.sys | NWLNKSPX |
NDPt (0) |
ndis.sys | TCPIP |
NDPw (0) |
ndis.sys | WAN_PACKET_TAG |
NDPX (0) |
ndis.sys | NDIS Proxy allocations |
NDrl (0) |
ndis.sys | resource list |
NDrp (0) |
ndis.sys | NDIS_TAG_REGISTRY_PATH |
NDrq (0) |
ndis.sys | NDIS_TAG_Q_REQ |
NDsi (0) |
ndis.sys | EISA slot information |
NDsm (0) |
ndis.sys | Cached shared memory descriptor |
NDst (0) |
ndis.sys | NDIS_TAG_STRING |
NDw0 (0) |
ndis.sys | NDIS_TAG_WMI_REG_INFO |
NDw1 (0) |
ndis.sys | NDIS_TAG_WMI_GUID_TO_OID |
NDw2 (0) |
ndis.sys | NDIS_TAG_WMI_OID_SUPPORTED_LIST |
NDw3 (0) |
ndis.sys | NDIS_TAG_WMI_EVENT_ITEM |
NDwi (0) |
ndis.sys | NDIS_TAG_WORK_ITEM |
Nf?? (0) |
nfssvr.sys | NFS (Network File System) allocations |
NfR? (0) |
nfsrdr.sys | NFS (Network File System) client re |
Nls (0) |
| Nls strings |
NlsK (0) |
nt!ex | Nls data |
NmCc (0) |
substvol.sys | (AllenPort Virtual Volume) name cache item |
Nmdd (0) |
| NetMeeting display driver miniport 1 MB block |
None (0) |
| call to ExAllocatePool |
Npf* (0) |
npfs.sys | Npfs Allocations |
NpFC (0) |
npfs.sys | ROOT_DCB CCB |
NpFc (0) |
npfs.sys | CCB, client control block |
NpFD (0) |
npfs.sys | DCB, directory block |
NpFg (0) |
npfs.sys | Global storage |
NpFi (0) |
npfs.sys | NPFS client info buffer. |
NpFn (0) |
npfs.sys | Name block |
NpFq (0) |
npfs.sys | Query template buffer used for directory query |
NpFr (0) |
npfs.sys | DATA_ENTRY records (read/write buffers) |
NpFs (0) |
npfs.sys | Client security context |
NpFW (0) |
npfs.sys | Write block |
NpFw (0) |
npfs.sys | Write block |
NS?? (0) |
| Netware server allocations |
Ntf0 (0) |
ntfs.sys | general pool allocation |
Ntf9 (0) |
ntfs.sys | Large Temporary Buffer |
NtF? (0) |
ntfs.sys | NTFS tags based on source module |
Ntf? (0) |
ntfs.sys | NTFS Specific allocation tags |
NtFA (0) |
ntfs.sys | AttrSup.c |
NtFa (0) |
ntfs.sys | AllocSup.c |
NtFB (0) |
ntfs.sys | BitmpSup.c |
NtFC (0) |
ntfs.sys | Create.c |
NtfC (0) |
ntfs.sys | CCB |
Ntfc (0) |
ntfs.sys | CCB_DATA |
NtFD (0) |
ntfs.sys | DevioSup.c |
NtFd (0) |
ntfs.sys | DirCtrl.c |
NtfD (0) |
ntfs.sys | DEALLOCATED_RECORDS |
NtFE (0) |
ntfs.sys | Ea.c |
NtfE (0) |
ntfs.sys | INDEX_CONTEXT |
NtFF (0) |
ntfs.sys | FileInfo.c |
NtFf (0) |
ntfs.sys | FsCtrl.c |
NtfF (0) |
ntfs.sys | FCB_INDEX |
Ntff (0) |
ntfs.sys | FCB_DATA |
NtFH (0) |
ntfs.sys | SelfHeal.c |
NtFI (0) |
ntfs.sys | IndexSup.c |
NtfI (0) |
ntfs.sys | NTFS_IO_CONTEXT |
Ntfi (0) |
ntfs.sys | IRP_CONTEXT |
NtfK (0) |
ntfs.sys | KEVENT |
Ntfk (0) |
ntfs.sys | FILE_LOCK |
NtFL (0) |
ntfs.sys | LogSup.c |
Ntfl (0) |
ntfs.sys | LCB |
NtFM (0) |
ntfs.sys | McbSup.c |
NtfM (0) |
ntfs.sys | NTFS_MCB_ENTRY |
Ntfm (0) |
ntfs.sys | NTFS_MCB_ARRAY |
NtFN (0) |
ntfs.sys | NtfsData.c |
NtfN (0) |
ntfs.sys | NUKEM |
Ntfn (0) |
ntfs.sys | SCB_NONPAGED |
NtFO (0) |
ntfs.sys | ObjIdSup.c |
Ntfo (0) |
ntfs.sys | SCB_INDEX normalized named buffer |
NtFQ (0) |
ntfs.sys | QuotaSup.c |
NtfQ (0) |
ntfs.sys | QUOTA_CONTROL_BLOCK |
Ntfq (0) |
ntfs.sys | General Allocation with Quota |
NtFR (0) |
ntfs.sys | RestrSup.c |
NtfR (0) |
ntfs.sys | READ_AHEAD_THREAD |
Ntfr (0) |
ntfs.sys | ERESOURCE |
NtFS (0) |
ntfs.sys | SecurSup.c |
NtFs (0) |
ntfs.sys | StrucSup.c |
NtfS (0) |
ntfs.sys | SCB_INDEX |
Ntfs (0) |
ntfs.sys | SCB_DATA |
NtfT (0) |
ntfs.sys | SCB_SNAPSHOT |
Ntft (0) |
ntfs.sys | SCB (Prerestart) |
NtFU (0) |
ntfs.sys | usnsup.c |
NtFV (0) |
ntfs.sys | VerfySup.c |
NtFv (0) |
ntfs.sys | ViewSup.c |
NtfV (0) |
ntfs.sys | VPB |
Ntfv (0) |
ntfs.sys | COMPRESSION_SYNC |
NtFW (0) |
ntfs.sys | Write.c |
Ntfw (0) |
ntfs.sys | Workspace |
Ntfx (0) |
ntfs.sys | General Allocation |
NTID (0) |
HP Team Network Driver (cpqteam.sys) | Network Driver 8.55 (Memory Leak) - Confirmed |
NV (0) |
| (nVidia video driver) Resource manager data |
NvLA (0) |
| (nVidia video driver) Adapter data |
NvLa (0) |
| (nVidia video driver) Allocation data |
NvLC (0) |
| (nVidia video driver) Channel data |
NvLc (0) |
| (nVidia video driver) Class data |
NvLD (0) |
| (nVidia video driver) Device data |
NvLd (0) |
| (nVidia video driver) DMA data |
NvLE (0) |
| (nVidia video driver) Event data |
NvLH (0) |
| (nVidia video driver) Generic data |
NvLm (0) |
| (nVidia video driver) Mode data |
NvLP (0) |
| (nVidia video driver) Profile data |
NvLp (0) |
| (nVidia video driver) Pusher data |
NvLR (0) |
| (nVidia video driver) Registry data |
NvLr (0) |
| (nVidia video driver) Resource data |
NvLS (0) |
| (nVidia video driver) Statistics data |
NvLs (0) |
| (nVidia video driver) Semaphore data |
NvLT (0) |
| (nVidia video driver) Context data |
Nwcs (0) |
| Client Services for NetWare |
NwFw (0) |
| ntos difwd |
ObCI (0) |
nt!ob | object creation lookaside list |
ObCi (0) |
nt!ob | captured information for ObCreateObject |
ObDi (0) |
nt!ob | object directory |
ObDm (0) |
nt!ob | object device map |
Obeb (0) |
nt!ob | object tables extra bit tables via EX handle.c |
ObHd (0) |
nt!ob | object handle count data base |
ObjT (0) |
nt!ob | object type objects |
ObNM (0) |
nt!ob | name buffer per processor lookaside pointers |
ObNm (0) |
nt!ob | object names |
ObRt (0) |
nt!ob | object reference stack tracing |
ObSc (0) |
nt!ob | Object security descriptor cache block |
ObSq (0) |
nt!ob | object security descriptors (query) |
ObSt (0) |
nt!ob | Object Manager temporary storage |
Obtb (0) |
nt!ob | object tables via EX handle.c |
ObTR (0) |
nt!ob | object table ERESOURCEs |
ObZn (0) |
nt!ob | object zone |
OCCB (0) |
RepliStor.sys | RepliStor File System Mini Filter Driver |
OCMD (0) |
RepliStor.sys | RepliStor File System Mini Filter Driver |
OCMX (0) |
RepliStor.sys | RepliStor File System Mini Filter Driver |
OHCI (0) |
| Open Host Controller Interface for USB |
ohci (0) |
| 1394 OHCI host controller driver |
OvfL (0) |
| EXIFS FCBOVF List |
Ovfl (0) |
| The internal pool tag table has overflowed |
p2?? (0) |
perm2dll.dll | Permedia2 display driver |
p2cx (0) |
perm2dll.dll | Permedia2 display driver |
p2d3 (0) |
perm2dll.dll | Permedia2 display driver |
p2d6 (0) |
perm2dll.dll | Permedia2 display driver |
p2de (0) |
perm2dll.dll | Permedia2 display driver |
p2ds (0) |
perm2dll.dll | Permedia2 display driver |
p2dt (0) |
perm2dll.dll | Permedia2 display driver |
p2en (0) |
perm2dll.dll | Permedia2 display driver |
p2fi (0) |
perm2dll.dll | Permedia2 display driver |
p2he (0) |
perm2dll.dll | Permedia2 display driver |
p2hw (0) |
perm2dll.dll | Permedia2 display driver |
p2pa (0) |
perm2dll.dll | Permedia2 display driver |
p2pe (0) |
perm2dll.dll | Permedia2 display driver |
p2su (0) |
perm2dll.dll | Permedia2 display driver |
p2tx (0) |
perm2dll.dll | Permedia2 display driver |
P3D? (0) |
perm3dd.dll | Permedia3 display driver |
P3G? (0) |
perm3dd.dll | Permedia3 display driver |
PaeD (0) |
| PAE top level directory allocation blocks |
ParC (0) |
| Parallel class driver |
ParL (0) |
| Parallel link driver |
ParP (0) |
| Parallel port driver |
ParV (0) |
| ParVdm driver for vdm< |
PcCi (0) |
| WDM audio port class adapter device object stuff |
PcCr (0) |
| WDM audio stuff |
Pcdb (0) |
| Pcmcia bus enumerator, Databook controller specific structures |
PcDi (0) |
| WDM audio stuff |
PcDm (0) |
| DirectMusic MXF objects (WDM audio) |
PcFM (0) |
| WDM audio FM synthesizer |
PcFp (0) |
| WDM audio stuff |
PciB (0) |
pci.sys | PnP pci bus enumerator |
PcIc (0) |
| WDM audio stuff |
Pcic (0) |
| Pcmcia bus enumerator, PCIC/Cardbus controller specific structures |
PciD (0) |
PciDumpEx.sys | Alter's PCI Dump helper driver |
PcIl (0) |
| WDM audio stuff |
Pcmc (0) |
pcmcia.sys | Pcmcia bus enumerator, general structures |
PcNw (0) |
| WDM audio stuff |
PcPc (0) |
| WDM audio stuff |
PcPr (0) |
| WDM audio stuff |
PcSl (0) |
| WDM audio stuff |
PcSt (0) |
| WDM audio stuff |
PcSX (0) |
| WDM audio stuff |
PcSx (0) |
| WDM audio stuff |
PcUs (0) |
| WDM audio stuff |
PDss (0) |
nt!po | Po device system state |
Pf?? (0) |
nt!pf | Pf Allocations |
PfAL (0) |
nt!pf | Pf Application launch event data |
PfAS (0) |
nt!pf | Pf Prefetch support array |
PfDq (0) |
nt!pf | Pf Directory query buffers |
PfED (0) |
nt!pf | Pf Generic event data |
PfEL (0) |
nt!pf | Pf Event logging buffers |
PfET (0) |
nt!pf | Pf Entry info tables |
PfFH (0) |
nt!pf | Pf RpContext FileKeyHash buckets |
PfFK (0) |
nt!pf | Pf RpContext FileKeyHashEntry |
PfLB (0) |
nt!pf | Pf Log buffers |
PfMP (0) |
nt!pf | Pf Prefetch metadata buffers |
PfNL (0) |
nt!pf | Pf Name logging buffers |
PfOB (0) |
nt!pf | Pf Oplock buffers |
PfPB (0) |
nt!pf | Pf Pfn query buffers |
PfRL (0) |
nt!pf | Pf Prefetch read list |
PfRQ (0) |
nt!pf | Pf Prefetch request buffers |
PfSA (0) |
nt!pf | Pf Prefetch support array |
PfTD (0) |
nt!pf | Pf Trace Dump |
PfTt (0) |
nt!pf | Pf Translation tables |
PfVA (0) |
nt!pf | Pf VA prefetching buffers |
PfVH (0) |
nt!pf | Pf Prefetch volume handles |
Pgm? (0) |
| Pgm (Pragmatic General Multicast) protocol: RMCast.sys |
Plcl (0) |
| Cache aware pushlock entry. One per processor |
Plcp (0) |
| Cache aware pushlock list (array of puchlock addresses) |
PmpA (0) |
portmap.sys | Portmap address list |
PmpC (0) |
portmap.sys | Portmap device context |
PmpM (0) |
portmap.sys | Portmap mapping |
PmpR (0) |
portmap.sys | Portmap RPCB |
PNCH (0) |
| Power Notify Channel |
PNCL (0) |
| Power Notify channel list |
PNDP (0) |
| Power Abort Dpc Routine |
PNI (0) |
| Power Notify Instance |
Pnp0 (0) |
nt!pnp | PNPMGR rebalance resource request table |
Pnp1 (0) |
nt!pnp | PNPMGR IRP completion context |
Pnp2 (0) |
nt!pnp | PNPMGR device action request |
Pnp3 (0) |
nt!pnp | PNPMGR dock serial numbers |
Pnp4 (0) |
nt!pnp | PNPMGR dock state |
Pnp5 (0) |
nt!pnp | PNPMGR assign resources context |
Pnp6 (0) |
nt!pnp | PNPMGR resource request |
Pnp7 (0) |
nt!pnp | PNPMGR deferred notify entry |
Pnp8 (0) |
nt!pnp | PNPMGR async target device change notify |
Pnp9 (0) |
nt!pnp | PNPMGR HW profile notify |
PnpA (0) |
nt!pnp | PNPMGR HW profile event |
PnPb (0) |
nt!pnp | PnP BIOS resource manipulation |
PnpB (0) |
nt!pnp | PNPMGR setup notify |
PnpC (0) |
nt!pnp | PNPMGR target device notify |
PnpD (0) |
nt!pnp | PNPMGR device class notify |
PnpE (0) |
nt!pnp | PNPMGR veto name |
PnpF (0) |
nt!pnp | PNPMGR eject data |
PnpG (0) |
nt!pnp | PNPMGR generic |
PnpH (0) |
nt!pnp | PNPMGR service name |
PnpI (0) |
nt!pnp | PNPMGR instance path |
PooL (0) |
| Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures |
Pool (0) |
| Pool tables, etc. |
Port (0) |
| Port objects |
PoSL (0) |
| Power shutdown event list |
POWI (0) |
nt!po | Power Work Item (executive worker thread work item entry) |
Ppcd (0) |
nt!pnp | PnP critical device database |
Ppcr (0) |
nt!pnp | plug |
Ppdd (0) |
nt!pnp | new Plug |
Ppde (0) |
nt!pnp | routines to perform device removal |
PpEB (0) |
nt!pnp | PNP_POOL_EVENT_BUFFER |
PpEE (0) |
nt!pnp | PNP_DEVICE_EVENT_ENTRY_TAG |
Ppei (0) |
nt!pnp | Eisa related code |
PpEL (0) |
nt!pnp | PNP_DEVICE_EVENT_LIST_TAG |
Ppen (0) |
nt!pnp | routines to perform device enumeration |
Ppin (0) |
nt!pnp | plug |
Ppio (0) |
nt!pnp | plug |
PpLg (0) |
nt!pnp | PnP last good. |
PPMd (0) |
| Processor Drivers (Processor Power Management). |
PPMi (0) |
nt!po | Processor Power Manager Idle States |
PPMp (0) |
nt!po | Processor Power Manager Perf States |
PPMw (0) |
nt!po | Processor Power Manager WMI Interface |
Ppre (0) |
nt!pnp | resource allocation and translation |
Pprl (0) |
nt!pnp | routines to manipulate relations list |
Ppsu (0) |
nt!pnp | plug |
PPT0 (0) |
| PPTP_TDIADDR_TAG |
PPT1 (0) |
| PPTP_TDICONN_TAG |
PPT2 (0) |
| PPTP_CONNINFO_TAG |
PPT3 (0) |
| PPTP_ADDRINFO_TAG |
PPT4 (0) |
| PPTP_TIMEOUT_TAG |
PPT5 (0) |
| PPTP_TIMER_TAG |
PPT6 (0) |
| PPTP_TDICOTS_TAG |
PPT7 (0) |
| PPTP_WRKQUEUE_TAG |
PPT8 (0) |
| PPTP_SEND_CTRLDATA_TAG |
PPT9 (0) |
| PPTP_SEND_ACKDATA_TAG |
PPTa (0) |
| PPTP_SEND_DGRAMDESC_TAG |
PPTb (0) |
| PPTP_TDICLTS_TAG |
PPTc (0) |
| PPTP_RECV_CTRLDESC_TAG |
PPTd (0) |
| PPTP_RECV_CTRLDATA_TAG |
PPTe (0) |
| PPTP_RECV_DGRAMDESC_TAG |
PPTf (0) |
| PPTP_RECV_DGRAMDATA_TAG |
PPTg (0) |
| PPTP_RECVDESC_TAG |
PpTg (0) |
mpsdrv.sys | MPSDRV PPTP GRE analyzer |
PPTh (0) |
| PPTP_ENGINE_TAG |
PPTi (0) |
| PPTP_RECVDATA_TAG |
PPTP (0) |
| PPTP_MEMORYPOOL_TAG |
PpTt (0) |
mpsdrv.sys | MPSDRV PPTP TCP analyzer |
PpUB (0) |
nt!pnp | PNP_USER_BLOCK_TAG |
PpWI (0) |
nt!pnp | PNP_DEVICE_WORK_ITEM_TAG |
Prcr (0) |
processr.sys | Processr driver allocations |
PRF? (0) |
nt!wdi | Performance Allocations |
PRFd (0) |
nt!wdi | Performance Diagnostics Structures |
Proc (0) |
nt!ps | Process objects |
Prof (0) |
| Profile objects |
Ps (0) |
nt!ps | general ps allocations |
PSAC (0) |
pspactld.sys | Windows Share access control tool. |
PsAp (0) |
nt!ps | Process APC queued by user mode process |
Psap (0) |
nt!ps | Block used to hold a user mode APC while its queued to a thread |
PSC0 (0) |
| NDIS Request |
PSC1 (0) |
| GPC Client Vc |
PSC2 (0) |
| WanLink |
PSC3 (0) |
| Miscellaneous allocations |
PSC4 (0) |
| WMI |
PSC? (0) |
| Packet Scheduler (PSCHED) Tags |
PSCa (0) |
| Adapter |
PsCa (0) |
nt!ps | APC queued at thread create time. |
PSCb (0) |
| CallParameters |
PSCc (0) |
| PipeContext |
PSCd (0) |
| FlowContext |
PSCe (0) |
| ClassMapContext |
PSCf (0) |
| Adapter Profile |
PSCg (0) |
| Component |
PsCr (0) |
nt!ps | Working set change record (temporary allocation) |
PSE3 (0) |
pse36.sys | Physical Size Extension driver |
PsEx (0) |
nt!ps | Process exit APC |
PsFn (0) |
nt!ps | Captured image file name buffer (temporary allocation) |
PsHl (0) |
nt!ps | Captured list of handles to inherit in child process (temporary allocation) |
PsIm (0) |
nt!ps | Thread impersonation (PS_IMPERSONATE_INFORMATION, pre |
PsJa (0) |
nt!ps | Job access control state |
Psjb (0) |
nt!ps | Job set array (temporary allocation) |
PsLd (0) |
nt!ps | Process LDT information blocks |
PsPb (0) |
nt!ps | Captured process parameter block (temporary allocation) |
PsQb (0) |
nt!ps | Process quota block |
PsRl (0) |
nt!ps | Captured memory reserve list (temporary allocation) |
PsSb (0) |
nt!ps | Initial process parameter block (temporary allocation) |
PsSd (0) |
nt!ps | Augmented thread security descriptor (temporary allocation) |
PSTA (0) |
nt!po | Po registered system state |
Psta (0) |
nt!ps | Power management system state |
Pstb (0) |
nt!ps | Process tables via EX handle.c |
PsTf (0) |
nt!ps | Job object token filter |
PsTp (0) |
nt!ps | Thread termination port block |
PsWs (0) |
nt!ps | Process working set watch array |
PSwt (0) |
nt!po | Power switch structure |
PX1 (0) |
| ndis ProviderEventLookaside |
Qnam (0) |
| EXIFS Query Name |
Qp?? (0) |
| Generic Packet Classifier (MSGPC) |
Qpcb (0) |
| ClassificationBlock |
Qpcd (0) |
| CfInfoData |
Qpcf (0) |
| ClassificationFamily |
Qpci (0) |
| CfInfo |
Qpct (0) |
| Client blocks |
Qpdg (0) |
| Debug |
Qpfd (0) |
| FragmentDb |
Qphf (0) |
| HandleFactory |
Qppa (0) |
| Pattern blocks |
Qppd (0) |
| GenPatternDb |
Qpph (0) |
| PathHash |
Qppi (0) |
| Pending Irp structures |
Qppn (0) |
| Queued Notifications |
Qppt (0) |
| Protocol |
Qprz (0) |
| Rhizome |
QuU2 (0) |
mpsdrv.sys | MPSDRV upcall response |
R300 (0) |
| ATI video driver |
R600 (0) |
ati2mtag.sys | ATI Radeon WindowsNT Miniport Driver |
RB?? (0) |
| RedBook Filter Driver, static allocations |
rb?? (0) |
| RedBook Filter Driver, dynamic allocations |
rbBu (0) |
| RedBook |
RBEv (0) |
| RedBook |
rbIp (0) |
| RedBook |
rbIr (0) |
| RedBook |
rbMd (0) |
| RedBook |
rbMp (0) |
| RedBook |
rbRc (0) |
| RedBook |
RBRg (0) |
| RedBook |
RBRl (0) |
| RedBook |
rbRx (0) |
| RedBook |
rbSc (0) |
| RedBook |
RBSe (0) |
| RedBook |
rbSx (0) |
| RedBook |
rbTo (0) |
| RedBook |
RBWa (0) |
| RedBook |
Rcp? (0) |
sacdrv.sys | SAC Driver (Headless) |
RcpA (0) |
sacdrv.sys | Internal memory mgr alloc block |
RcpI (0) |
sacdrv.sys | Internal memory mgr initial heap block |
RcpS (0) |
sacdrv.sys | Security related block |
ReEv (0) |
| Resource Event |
RefT (0) |
| Bluetooth reference tracking |
ReSe (0) |
| Resource Semaphore |
Reso (0) |
nt!tm | KTM Transactional ResourceManager |
ReTa (0) |
| Resource Extended Table |
Rf?? (0) |
| Bluetooth RFCOMM TDI driver |
RfAD (0) |
rfcomm.sys | RFCOMM Address |
RfBB (0) |
rfcomm.sys | RFCOMM BRB |
RfBT (0) |
rfcomm.sys | RFCOMM (bthport) |
RfCB (0) |
rfcomm.sys | RCOMMM |
RfCH (0) |
rfcomm.sys | RFCOMM channel |
RfCN (0) |
rfcomm.sys | RFCOMM connect |
RfDA (0) |
rfcomm.sys | RFCOMM data |
RfFR (0) |
rfcomm.sys | RFCOMM frame |
RfPP (0) |
rfcomm.sys | RFCOMM pnp |
RfRX (0) |
rfcomm.sys | RFCOMM receive |
RfWR (0) |
rfcomm.sys | RFCOMM worker |
RKRW (0) |
mpsdrv.sys | MPSDRV work item |
RpcL (0) |
msrpc.sys | debugging log data |
Rpcl (0) |
msrpc.sys | MSRpc memory logging |
RpcM (0) |
msrpc.sys | all msrpc.sys allocations not covered elsewhere |
Rpcm (0) |
msrpc.sys | MSRpc memory allocations |
Rpcr (0) |
msrpc.sys | MSRpc resources |
Rpcs (0) |
msrpc.sys | Memory shared b/n MSRpc and caller |
RPrt (0) |
rstorprt.sys | Remote Storage Port Driver |
Rqrv (0) |
| Registry query buffer |
RRle (0) |
| RTL_RANGE_LIST_ENTRY_TAG |
RRlm (0) |
| RTL_RANGE_LIST_MISC_TAG |
RS?? (0) |
| Remote Storage |
RSER (0) |
| Error log data |
RSFN (0) |
| File Name |
RSFO (0) |
| File Obj queue |
RSFS (0) |
| Recall Queue |
RSIO (0) |
| Ioctl Queue |
RSLT (0) |
| Long term data |
RSQI (0) |
| Queue info |
RSSE (0) |
| Security info |
RSVO (0) |
| Validate Queue |
RSWQ (0) |
| Work Queue |
RTLF (0) |
mpsdrv.sys | MPSDRV filter |
RtlT (0) |
nt!rtl | Temporary RTL allocation |
RtPi (0) |
| Temp allocation for product type key |
RWan (0) |
rawwan.sys | Raw WAN driver |
RX00 (0) |
| ATI video driver |
Rx?? (0) |
| Rdr2 rdbss.sys stuff |
RxBm (0) |
| buffering manager |
RxCa (0) |
| connection engine address |
RxCc (0) |
| connection engine connection |
RxCd (0) |
| connection engine TDI |
RxCt (0) |
| connection engine transport |
RxCv (0) |
| connection engine VC |
RxCx (0) |
| connection engine misc. (special build only) |
RxDc (0) |
| querydirectory pattern (special build only) |
RxFc (0) |
| FCB |
RxFx (0) |
| Fobx |
RxIr (0) |
| RxContext (IrpContext) |
RxMs (0) |
| misc. |
RxMx (0) |
| minirdr dispatch table |
RxNc (0) |
| NameCache (not currently used) |
RxNf (0) |
| nonpaged FCB |
RxNr (0) |
| NetRoot |
RxSc (0) |
| SrvCall |
RxSo (0) |
| SrvOpen |
RxSp (0) |
| srvcall calldown params (special build only) |
RxTm (0) |
| timer context (special build only) |
RxVn (0) |
| VNetRoot |
RxVp (0) |
| vnetroot calldown params (special build only) |
RxWq (0) |
| work queue |
S3 (0) |
| S3 video driver |
SBad (0) |
| bad block simulator |
SbAp (0) |
SandBox.sys | Agnitum Outpost Firewall's Host Protection Component |
sbp2 (0) |
| Sbp2 1394 storage port driver |
SbVo (0) |
substvol.sys | (AllenPort Virtual Volume) default tag |
Sc?? (0) |
| Mass storage driver tags |
SCB3 (0) |
| Bull SmarTlp PnP |
SCB8 (0) |
| Bull CP8 Transac serial reader |
ScB? (0) |
classpnp.sys | ClassPnP misc allocations |
ScC? (0) |
| CdRom |
ScCE (0) |
| device control synch event |
ScCG (0) |
| disk geometry buffer |
ScCH (0) |
| hitachi error buffer |
ScCI (0) |
| sense info buffers |
ScCM (0) |
| mode data buffer |
ScCP (0) |
| read capacity buffer |
ScCp (0) |
| play active checks |
ScCQ (0) |
| read sub q buffer |
ScCR (0) |
| raw mode read buffer |
ScCS (0) |
| srb allocation |
ScCT (0) |
| read toc buffer |
ScCt (0) |
| toshiba error buffer |
ScCU (0) |
| update capacity path |
ScCV (0) |
| volume control buffer |
ScCv (0) |
| volume control buffer |
ScD (0) |
| generic tag |
ScD? (0) |
| Disk |
ScDA (0) |
| Info Exceptions |
ScDa (0) |
| SMART |
ScDb (0) |
classpnp.sys | ClassPnP debug globals buffer |
ScDC (0) |
| disable cache paths |
ScDc (0) |
| disk allocated completion c |
ScDG (0) |
| disk geometry buffer |
ScDg (0) |
| update disk geometry paths |
ScDI (0) |
| sense info buffers |
ScDM (0) |
| mbr checksum code |
ScDN (0) |
| disk name code |
ScDP (0) |
| read capacity buffer |
ScDp (0) |
| disk partition lists |
ScDS (0) |
| srb allocation |
ScDs (0) |
| start device paths |
ScDU (0) |
| update capacity path |
ScDW (0) |
| work |
ScF? (0) |
| FtDisk |
ScFt (0) |
| FtDisk allocations |
ScIO (0) |
classpnp.sys | ClassPnP device control |
SCl0 (0) |
| Litronic 220 |
ScL? (0) |
classpnp.sys | Classpnp |
ScLA (0) |
classpnp.sys | allocation to check for autorun disable |
SCLb (0) |
| Smart card driver library |
ScLc (0) |
classpnp.sys | Cache filters |
ScLF (0) |
classpnp.sys | File Object Extension |
ScLf (0) |
classpnp.sys | Fault prediction |
ScLM (0) |
classpnp.sys | Media Change Detection |
ScLm (0) |
classpnp.sys | Mount |
ScLq (0) |
classpnp.sys | Release queue |
ScLW (0) |
classpnp.sys | Power |
ScLw (0) |
classpnp.sys | WMI |
ScMC (0) |
| medium changer allocations |
ScNo (0) |
classpnp.sys | ClassPnP notification |
ScP? (0) |
| Scsiport |
ScPA (0) |
| Access Ranges |
ScPa (0) |
| Hold registry data |
ScPB (0) |
| Queuetag BitMap |
ScPb (0) |
| Get Bus Dat Holder |
ScPC (0) |
| reset bus code |
ScPc (0) |
| Fake common buffer |
ScPD (0) |
| SRB_DATA allocations |
ScPd (0) |
| Pnp id strings |
ScPE (0) |
| Scatter gather lists |
ScPG (0) |
| Global memory |
ScPh (0) |
| HwDevice Ext |
ScPI (0) |
| Init data chain |
ScPi (0) |
| Sense Info |
ScPL (0) |
| scatter gather lists |
ScPl (0) |
| remove lock tracking |
ScPM (0) |
| scatter gather lists |
ScPm (0) |
| address mapping lists |
ScPp (0) |
| device & adapter enable |
ScpP (0) |
| scsi PortConfig copies |
ScPQ (0) |
| request sense |
ScPq (0) |
| inquiry data |
ScPr (0) |
| resource list copy |
ScPS (0) |
| registry allocations |
ScPT (0) |
| interface mapping |
ScPt (0) |
| legacy request rerouting |
ScPu (0) |
| device relation structs |
ScPV (0) |
| Device map allocations |
ScPv (0) |
| KEVENT |
ScPW (0) |
| Wmi Requests |
ScPw (0) |
| Wmi Events |
ScPx (0) |
| Report Luns |
ScPY (0) |
| Report Targets |
ScPZ (0) |
| Device name buffer |
ScR? (0) |
| Partition Manager |
ScRi (0) |
| IOCTL buffer |
ScRp (0) |
| Partition entry |
ScRr (0) |
| Remove lock |
ScRt (0) |
| Table entry |
ScRV (0) |
| Volume entry |
ScRv (0) |
| Dependant volume relations lists |
ScRw (0) |
| Power mgmt private work item |
Scs$ (0) |
| Tag for pnp class driver's SRB lookaside list |
SCS4 (0) |
| SCM Microsystems pcmcia reader |
ScsC (0) |
| non |
ScsD (0) |
| non |
ScsH (0) |
| non |
ScsI (0) |
| non |
ScsL (0) |
| non |
ScsP (0) |
| non |
ScUn (0) |
| Default Tag for pnp class driver allocations |
ScV? (0) |
| Dvd functionality in cdrom.sys |
ScVK (0) |
| write buffer for DVD keys |
ScVk (0) |
| read buffer for DVD keys |
ScVS (0) |
| buffer for reads of DVD on |
Sdba (0) |
| Application compatibility Sdb* allocations |
SdCc (0) |
| ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES |
Sdp? (0) |
| Bluetooth SDP functionality in BTHPORT.sys |
SdpC (0) |
bthport.sys | Bluetooth SDP client connection |
SdpD (0) |
bthport.sys | Bluetooth SDP database |
SdpI (0) |
bthport.sys | Bluetooth port driver (SDP) |
Se (0) |
nt!se | General security allocations |
SeAc (0) |
nt!se | Security ACL |
SeAi (0) |
nt!se | Security Audit Work Item |
SeAp (0) |
nt!se | Security Audit Parameter Record |
SeCL (0) |
nt!se | Security CONTEXT_TAG |
Sect (0) |
| Section objects |
SeDb (0) |
nt!se | Temp directory query buffer to delete logon session symbolic links. |
SeFS (0) |
nt!se | SEP_FILE_SYSTEM_NOTIFY_CONTEXT |
SeHa (0) |
nt!se | Temp directory query buffer to delete logon session symbolic links. |
SeLS (0) |
nt!se | Security Logon Session tracking array |
SeLs (0) |
nt!se | Security Logon Session |
SeLu (0) |
nt!se | Security LUID and Attributes array |
SeLw (0) |
nt!se | Security LSA Work Item |
Sema (0) |
| Semaphore objects |
Senm (0) |
| Serenum (RS |
SeOn (0) |
nt!se | Security Captured Object Name information |
SeOt (0) |
nt!se | Captured object type array. Used by access check code |
SePa (0) |
nt!se | Process audit image names and captured polity structures |
SePh (0) |
nt!se | Dummy image page hash structure. Used when CI is disabled. |
SePr (0) |
nt!se | Security Privilege Set |
SeSa (0) |
nt!se | Security SID and Attributes |
SeSc (0) |
nt!se | Captured Security Descriptor |
SeSd (0) |
nt!se | Security Descriptor |
SeSi (0) |
nt!se | Security SID |
SeTa (0) |
nt!se | Security Temporary Array |
SeTd (0) |
nt!se | Security Token dynamic part |
SeTI (0) |
ksecdd.sys | Security TargetInfo |
SeTn (0) |
nt!se | Security Captured Type Name information |
Setp (0) |
| SETUPDD SpMemAlloc calls |
SeUs (0) |
nt!se | Security Captured Unicode string |
sidg (0) |
| GDI spooler events |
SIfs (0) |
| Default tag for user's of ntsrv.h |
SimB (0) |
| Simbad (bad sector simulation driver) allocations |
Sis (0) |
| Single Instance Store (ddsisfilter) |
SisB (0) |
| SIS per file object break event |
SisC (0) |
| SIS common store file object |
SisF (0) |
| SIS per file object |
SisL (0) |
| SIS per link object |
SisS (0) |
| SIS SCB |
Sm?? (0) |
| rdr2 smb mini |
SmAd (0) |
| session setup/admin exchange |
SmCe (0) |
| smbmini connection engine |
SmDc (0) |
| dir query buffer (special build only) |
SmDO (0) |
| deferred open context (special build only) |
SmEc (0) |
| echo buffer (special build only) |
SmFc (0) |
| fsctl structures (special build only) |
SmKs (0) |
| Kerberos blob (special build only) |
SmMa (0) |
| mid atlas (special build only) |
SmMm (0) |
| smbmini managed datastructures |
SmMs (0) |
| misc. |
SmMt (0) |
| mailslot buffer (special build only) |
SmNr (0) |
| NetRoot (special build only) |
SmPi (0) |
| pipeinfo buffer (special build only) |
SmQP (0) |
| params for directory query transact (special build only) |
SmRb (0) |
| remote boot |
SmRw (0) |
| read/write path |
SmRx (0) |
| minirdr generated RxContext (special build only) |
SmSe (0) |
| Session (special build only) |
SmSr (0) |
| Server (special build only) |
SmTp (0) |
| server transport tag |
SmTr (0) |
| transact exchange |
SmVc (0) |
| smbmini connectionengine VC (special build only) |
SmVr (0) |
| VNetroot (special build only) |
SNBX (0) |
SandBox.sys | Agnitum Outpost Firewall's Host Protection Component |
SPX (0) |
| Nwlnkspx transport |
SQOS (0) |
| Security quality of service in IO |
Sr?? (0) |
sr.sys | System Restore file system filter driver |
SrCo (0) |
sr.sys | SR's control object |
SrDB (0) |
sr.sys | Debug information for lookup blob |
SrDL (0) |
sr.sys | Device list |
SRdm (0) |
scsirdma.sys | Infiniband SRP driver |
SrFE (0) |
sr.sys | File information buffer |
SrFN (0) |
sr.sys | File name |
SrHB (0) |
sr.sys | Hash bucket |
SrHH (0) |
sr.sys | Hash header |
SrHK (0) |
sr.sys | Hash key |
SrLB (0) |
sr.sys | Log buffer |
SrLC (0) |
sr.sys | Logging context |
SrLE (0) |
sr.sys | Log entry |
SrLT (0) |
sr.sys | Lookup blob |
SrMP (0) |
sr.sys | Mount point information |
SrOI (0) |
sr.sys | Overwrite information |
SrPC (0) |
sr.sys | Persistant configuration information |
SrRB (0) |
sr.sys | Rename buffer |
SrRG (0) |
sr.sys | Logger context |
SrRH (0) |
sr.sys | Reparse data size |
SrRR (0) |
sr.sys | Registry information |
SrSC (0) |
sr.sys | Stream contexts |
SrSD (0) |
sr.sys | Security data information |
SrST (0) |
sr.sys | Stream data information |
SrTI (0) |
sr.sys | Directory delete information |
SrWI (0) |
sr.sys | Work queue item |
SslC (0) |
ksecdd.sys | SSL kernel mode client allocations |
ST* (0) |
| New MMC compliant storage drivers |
Stac (0) |
| Stack Trace Database |
STli (0) |
| Alter's NT kernel string manipulation library |
Strg (0) |
| Dynamic Translated strings |
Strm (0) |
| Streams and streams transports allocations |
SW?? (0) |
| Software Bus Enumerator |
SWbi (0) |
| bus ID |
SWbr (0) |
| bus reference |
SWda (0) |
| POOLTAG_DEVICE_ASSOCIATION |
SWdn (0) |
| device name |
SWdr (0) |
| POOLTAG_DEVICE_DRIVER_REGISTRY |
SWfd (0) |
| POOLTAG_DEVICE_FDOEXTENSION |
SWid (0) |
| device ID |
SWii (0) |
| instance ID |
SWip (0) |
| POOLTAG_DEVICE_INTERFACEPATH |
SWki (0) |
| key information |
SwMi (0) |
| SWMidi KS filter (WDM Audio) |
SWpd (0) |
| POOLTAG_DEVICE_PDOEXTENSION |
SWre (0) |
| relations |
SWrp (0) |
| reparse string |
SWrs (0) |
| reference string |
Symb (0) |
| Symbolic link objects |
Symt (0) |
| Symbolic link target strings |
SYPK (0) |
syspart.lib | Kernel mode system partition detection allocations |
SYSA (0) |
| Sysaudio (wdm audio) |
TAPI (0) |
| ntos
dis
distapi |
TC?? (0) |
TCP | TCP/IP network protocol |
TCh? (0) |
| TCP/IP header pools |
TCPC (0) |
| TCP connection pool |
TCPr (0) |
| TCP request pool |
TCPT (0) |
| TCB pool |
TCPY (0) |
| SYN |
TDIc (0) |
| TDI resource |
TDId (0) |
| TDI resource |
TDIe (0) |
| TDI resource |
TDIf (0) |
| TDI resource |
TDIg (0) |
| TDI resource |
TDIk (0) |
| TDI resource |
TDIu (0) |
| TDI resource |
TDIv (0) |
| TDI resource |
thdd (0) |
| DirectDraw/3D handle manager table |
Thre (0) |
nt!ps | Thread objects |
Thrm (0) |
| Thermal zone structure |
Time (0) |
nt!ke | Timer objects |
TmDn (0) |
nt!tm | Tm Dynamic Name |
TmLo (0) |
nt!tm | Tm Log Entries |
TmNo (0) |
nt!tm | Tm Notification |
TmPa (0) |
nt!tm | Tm Propagate Argument |
TmPb (0) |
nt!tm | Tm Propagation Buffer |
TmPe (0) |
nt!tm | Tm Enlistment Pointers |
TmPi (0) |
nt!tm | Tm Protocol Information |
TmPo (0) |
nt!tm | Tm Propagation Output |
TmPp (0) |
nt!tm | Tm Protocol Pointers |
TmPr (0) |
nt!tm | Tm Protocol |
TmPx (0) |
nt!tm | Tm Protocol Array |
TmRi (0) |
nt!tm | Tm Recovery Information |
TmRq (0) |
nt!tm | Tm Propagation Request |
Toke (0) |
nt!se | Token objects |
TpWc (0) |
nt!ex | Threadpool minipacket context |
TpWo (0) |
nt!ex | Threadpool worker factory objects |
Tran (0) |
| EXIFS Translate |
TSBV (0) |
| WDM mini driver for Toshiba 750 capture |
TSch (0) |
rdpwd.sys | RDPWD |
TSdd (0) |
rdpdd.sys | RDPDD |
TSic (0) |
termdd.sys | Terminal Services |
TSlc (0) |
rdpwd.sys | RDPWD |
TSmc (0) |
| PDMCS |
Tspk (0) |
ksecdd.sys | TS Package kernel mode client allocations |
TSq (0) |
| Terminal Services |
TSrp (0) |
termdd.sys | Terminal Services |
TSwd (0) |
rdpwd.sys | RDPWD |
TTFC (0) |
| Font file cache |
Ttfd (0) |
| TrueType Font driver |
Tun4 (0) |
| Tunnel cache allocation for long file name |
TunK (0) |
| Tunnel cache temporary key value |
TunL (0) |
| Tunnel cache lookaside |
TunP (0) |
| Tunnel cache oddsized pool |
Txcl (0) |
ntfs.sys | TXF_CLR_RESERVATION_CHUNK |
Txdl (0) |
ntfs.sys | TXF_DELETED_LINK |
Txdr (0) |
ntfs.sys | TXF_DEFAULT_READER_SECTION |
Txfc (0) |
ntfs.sys | TXF_FCB |
Txfe (0) |
ntfs.sys | TXF_FCB_EXTENSION |
Txfi (0) |
ntfs.sys | TXF_FCB_INFO |
Txfl (0) |
ntfs.sys | TXF_FCB_CLEANUP |
Txfo (0) |
ntfs.sys | TXF_FO |
Txfq (0) |
ntfs.sys | Txf quota block |
Txgd (0) |
ntfs.sys | TxfData global structure |
Txis (0) |
ntfs.sys | TXF_ISO_SNAPSHOT |
Txlf (0) |
ntfs.sys | TXF_FCB (large) |
Txls (0) |
ntfs.sys | TXF_CANCEL_LSN |
Txre (0) |
ntfs.sys | TXF_TOPS_RANGE_ENTRY |
Txsc (0) |
ntfs.sys | TXF_SCB |
Txsp (0) |
ntfs.sys | TXF_SCB_PTR |
Txtc (0) |
ntfs.sys | TXF_TRANS_CANCEL_LIST |
Txtr (0) |
ntfs.sys | TXF_TRANS (Txf transaction context) |
Txvc (0) |
ntfs.sys | TXF_VCB |
Txvd (0) |
ntfs.sys | TXF_VSCB_TO_DEREF |
Txvf (0) |
ntfs.sys | TXF_VSCB_FILE_SIZES |
Txvl (0) |
ntfs.sys | TXF_VSCB |
Type (0) |
| Type objects |
Uata (0) |
uniata.sys | Alter's UniATA driver allocations |
Uc?? (0) |
http.sys | i.e., the case of the leading "Ul" or "Uc" has been reversed. |
Ucac (0) |
http.sys | Auth Cache Pool |
UCAM (0) |
| USB digital camera library |
UcCO (0) |
http.sys | Client Connection |
Ucmp (0) |
http.sys | Multipart String Buffer |
Ucre (0) |
http.sys | Receive Response |
Ucrp (0) |
http.sys | Response App Buffer |
Ucrq (0) |
http.sys | Request Pool |
UcSc (0) |
http.sys | Common Server Information |
UcSN (0) |
http.sys | Server name |
UcSP (0) |
http.sys | Process Server Information |
UcSp (0) |
http.sys | Sspi Pool |
UcST (0) |
http.sys | Server info table |
Uctd (0) |
http.sys | Response Tdi Buffer |
Ucte (0) |
http.sys | Entity Pool |
Ucto (0) |
http.sys | Tdi Objects Pool |
Udf1 (0) |
| Udfs file set descriptor buffer |
Udf2 (0) |
| Udfs volume descriptor sequence descriptor buffer |
Udfb (0) |
| Udfs IO buffer |
UdfC (0) |
| Udfs CRC table |
Udfc (0) |
| Udfs IRP context |
UdfD (0) |
| Udfs FID buffer for view spanning |
Udfd (0) |
| Udfs file Fcb |
Udfe (0) |
| Udfs enumeration match expression |
UdfF (0) |
| Udfs nonpaged Fcb errata |
Udff (0) |
| Udfs normalized full filename |
UdfI (0) |
| Udfs IO context |
Udfi (0) |
| Udfs directory Fcb |
UdfL (0) |
| Udfs IRP context lite (delayed close) |
Udfl (0) |
| Udfs Lcb |
Udfp (0) |
| Udfs Pcb |
UdfS (0) |
| Udfs short file name |
Udfs (0) |
| Udfs Sparing Mcb |
UdfT (0) |
| Udfs generic table entry |
Udft (0) |
| Udfs CDROM TOC |
UDFV (0) |
| Udfs volume descriptor sequence descriptor buffer |
Udfv (0) |
| Udfs Vpb |
Udfx (0) |
| Udfs Ccb |
Udp (0) |
| Udp protocol (TCP/IP driver) |
Ufsc (0) |
| User FULLSCREEN |
UHCD (0) |
| Universal Host Controller (USB |
UHUB (0) |
| Universal Serial Bus Hub |
Ul?? (0) |
http.sys | tags. Note: In |
UlAB (0) |
http.sys | Auxiliary Buffer |
UlAO (0) |
http.sys | App Pool Object |
UlAP (0) |
http.sys | App Pool Process |
UlBL (0) |
http.sys | Binary Log File Entry |
UlBO (0) |
http.sys | Outstanding i/o |
UlCC (0) |
http.sys | Control Channel |
UlCE (0) |
http.sys | Config Group Tree Entry |
UlCH (0) |
http.sys | Config Group Tree Header |
UlCI (0) |
http.sys | Config Group URL Info |
UlCJ (0) |
http.sys | Config Group Object Pool |
UlCK (0) |
http.sys | Chunk Tracker |
UlCL (0) |
http.sys | Config Group LogDir |
UlCl (0) |
http.sys | Connection RefTraceLog |
UlCO (0) |
http.sys | Connection |
UlCT (0) |
http.sys | Config Group Timestamp |
UlCY (0) |
http.sys | Connection Count Entry |
UlDB (0) |
http.sys | Debug |
UlDC (0) |
http.sys | Data Chunks array |
UlDO (0) |
http.sys | Disconnect Object |
UlDR (0) |
http.sys | Deferred Remove Item |
UlDT (0) |
http.sys | Debug Thread Pool |
UlEP (0) |
http.sys | Endpoint |
UlFA (0) |
http.sys | Force Abort Work Item |
UlFC (0) |
http.sys | File Cache Entry |
Ulfc (0) |
http.sys | Uri Filter Context |
UlFD (0) |
http.sys | Noncached File Data |
UlFP (0) |
http.sys | Filter Process |
UlFR (0) |
http.sys | Dummy Filter Receive Buffer |
UlFT (0) |
http.sys | Filter Channel |
UlFU (0) |
http.sys | Full Tracker |
UlFW (0) |
http.sys | Filter Write Tracker |
UlHC (0) |
http.sys | Http Connection |
UlHc (0) |
http.sys | Http Connection RefTraceLog |
UlHL (0) |
http.sys | Internal Request RefTraceLog |
UlHR (0) |
http.sys | Internal Request |
UlHT (0) |
http.sys | Hash Table |
UlHV (0) |
http.sys | Header Value |
UlIC (0) |
http.sys | Irp Context |
UlID (0) |
http.sys | Conn ID Table |
UlIR (0) |
http.sys | Internal Response |
UlLD (0) |
http.sys | Log Field |
UlLF (0) |
http.sys | Log File Entry |
UlLG (0) |
http.sys | Log Generic |
UlLH (0) |
http.sys | Log File Handle |
UlLL (0) |
http.sys | Log File Buffer |
UlLS (0) |
http.sys | Ansi Log Data Buffer |
UlLT (0) |
http.sys | Binary Log Data Buffer |
UlNO (0) |
http.sys | NSGO Pool |
UlNP (0) |
http.sys | Non |
UlOE (0) |
http.sys | Endpoint OwnerRefTraceLog PoolTag |
UlOR (0) |
http.sys | Owner RefTrace Signature |
UlOT (0) |
http.sys | Opaque ID Table |
UlPB (0) |
http.sys | APool Proc Binding |
UlPL (0) |
http.sys | Pipeline |
UlQF (0) |
http.sys | TCI Filter |
UlQG (0) |
http.sys | TCI Generic |
UlQI (0) |
http.sys | TCI Interface |
UlQL (0) |
http.sys | TCI Flow |
UlQT (0) |
http.sys | TCI Tracker |
UlQW (0) |
http.sys | TCI WMI |
UlRB (0) |
http.sys | Receive Buffer |
UlRD (0) |
http.sys | Registry Data |
UlRE (0) |
http.sys | Request Body Buffer |
UlRP (0) |
http.sys | Request Buffer |
UlRR (0) |
http.sys | Request Buffer References |
UlRS (0) |
http.sys | Non |
UlRT (0) |
http.sys | RefTraceLog PoolTag |
UlSC (0) |
http.sys | SSL Cert Data |
UlSD (0) |
http.sys | Security Data |
UlSL (0) |
http.sys | StringLog PoolTag |
UlSl (0) |
http.sys | StringLog Buffer PoolTag |
UlSO (0) |
http.sys | Site Counter Entry |
UlSS (0) |
http.sys | Simple Status Item |
UlTA (0) |
http.sys | Address Pool |
UlTD (0) |
http.sys | UL_TRANSPORT_ADDRESS |
UlTT (0) |
http.sys | Thread Tracker |
UlUB (0) |
http.sys | URL Buffer |
UlUC (0) |
http.sys | Uri Cache Entry |
UlUH (0) |
http.sys | HTTP Unknown Header |
UlUL (0) |
http.sys | URL |
UlUM (0) |
http.sys | URL Map |
UlVH (0) |
http.sys | Virtual Host |
UlWC (0) |
http.sys | Work Context |
UlWI (0) |
http.sys | Work Item |
UndP (0) |
| EXIFS Underlying Path |
Urdr (0) |
win32k!SetRedirectionBitmap | REDIRECT |
Usac (0) |
win32k!_CreateAcceleratorTable | ACCEL |
Usai (0) |
win32k!zzzAttachThreadInput | ATTACHINFO |
Usal (0) |
win32k!InitSwitchWndInfo | ALTTAB |
USBB (0) |
bthusb.sys | Bluetooth USB minidriver |
USBD (0) |
| Universal Serial Bus Class Driver |
Usbg (0) |
win32k!xxxLogClipData | DEBUG |
Uscb (0) |
win32k!_ConvertMemHandle | CLIPBOARD |
Uscc (0) |
win32k!AllocCallbackMessage | CALLBACK |
Usci (0) |
win32k!InitSystemThread | CLIENTTHREADINFO |
Uscl (0) |
win32k!ClassAlloc | CLASS |
Uscm (0) |
win32k!InitScancodeMap | SCANCODEMAP |
Uscp (0) |
win32k!CreateDIBPalette | CLIPBOARDPALETTE |
Uscr (0) |
win32k!NtUserSetSysColors | COLORS |
Usct (0) |
win32k!CkptRestore | CHECKPT |
Uscu (0) |
win32k!_CreateEmptyCursorObject | CURSOR |
Uscv (0) |
win32k!NtUserSetSysColors | COLORVALUES |
Usd1 (0) |
win32k!FreeListAdd | DDE1 |
Usd2 (0) |
win32k!_DdeSetQualityOfService | DDE2 |
Usd4 (0) |
win32k!AddPublicObject | DDE4 |
Usd5 (0) |
win32k!xxxCsEvent | DDE5 |
Usd6 (0) |
win32k!xxxCsEvent | DDE6 |
Usd7 (0) |
win32k!xxxCsEvent | DDE7 |
Usd8 (0) |
win32k!xxxMessageEvent | DDE8 |
Usd9 (0) |
win32k!xxxCsDdeInitialize | DDE9 |
UsdA (0) |
win32k!NewConversation | DDEa |
UsdB (0) |
win32k!Createpxs | DDEb |
Usdc (0) |
win32k!CreateCacheDC | DCE |
UsdD (0) |
win32k!NtUserfnDDEINIT | DDEd |
UsdE (0) |
win32k!xxxClientCopyDDEIn1 | DDE |
UsDI (0) |
win32k!CreateDeviceInfo | DEVICEINFO |
Usdi (0) |
win32k!CreateMonitor | DISPLAYINFO |
Usds (0) |
win32k!xxxDragObject | DRAGDROP |
Usdv (0) |
win32k!NtUserfnINDEVICECHANGE | DEVICECHANGE |
User (0) |
win32k!InitCreateUserCrit | ERESOURCE |
Usev (0) |
win32k!xxxPollAndWaitForSingleObject | EVENT |
Usgh (0) |
win32k!NtUserUserHandleGrantAccess | GRANTEDHANDLES |
Usgl (0) |
win32k!CreateShadowTL | GLOBALTHREADLOCK |
Usgt (0) |
win32k!AddGhost | GHOST |
Usha (0) |
win32k!AllocateHidData | HIDDATA |
UshD (0) |
Win32k!AllocateHidDesc | HIDDESC |
Ushk (0) |
win32k!_RegisterHotKey | HOTKEY |
Usih (0) |
win32k!SetImeHotKey | IMEHOTKEY |
Usim (0) |
win32k!CreateInputContext | IME |
Usjb (0) |
win32k!CreateW32Job | W32JOB |
Usjx (0) |
win32k!JobCalloutAddProcess | W32JOBEXTRA |
Uskb (0) |
win32k!xxxLoadKeyboardLayoutEx | KBDLAYOUT |
Uske (0) |
win32k!GetKbdExId | KBDEXID |
Uskf (0) |
win32k!LoadKeyboardLayoutFile | KBDFILE |
Usks (0) |
win32k!PostUpdateKeyStateEvent | KBDSTATE |
Uskt (0) |
win32k!ReadLayoutFile | KBDTABLE |
Usla (0) |
win32k!InitLockRecordLookaside | LOOKASIDE |
Usld (0) |
win32k!GrowLogIfNecessary | LOGDESKTOP |
Uslr (0) |
win32k!InitLockRecordLookaside | LOCKRECORD |
Usmi (0) |
win32k!MirrorRegion | MIRROR |
Usml (0) |
win32k!MsgLookupTableAlloc | MESSAGE FILTER TABLE |
Usmr (0) |
win32k!SnapshotMonitorRects | MONITORRECTS |
Usms (0) |
win32k!xxxMoveSize | MOVESIZE |
Usmt (0) |
win32k!xxxMNAllocMenuState | MENUSTATE |
Usno (0) |
win32k!zzz | NONE |
Usny (0) |
win32k!CreateNotify | NOTIFY |
Uspi (0) |
win32k!MapDesktop | PROCESSINFO |
Uspm (0) |
win32k!MNAllocPopup | POPUPMENU |
Uspn (0) |
win32k!CreateProfileUserName | PROFILEUSERNAME |
Uspo (0) |
win32k!QueuePowerRequest | POWER |
Uspp (0) |
win32k!AllocateAndLinkHidTLCInfo | PNP |
Uspr (0) |
win32k!GetPrivateProfileStruct | PROFILE |
Usqm (0) |
win32k!InitQEntryLookaside | QMSG |
Usqu (0) |
win32k!InitQEntryLookaside | Q |
Usrt (0) |
win32k!xxxDrawMenuItemText | RTL |
Ussa (0) |
win32k!xxxBroadcastMessage | SMS_ASYNC |
Ussb (0) |
win32k!CreateSpb | SPB |
Ussc (0) |
win32k!xxxInterSendMsgEx | SMS_CAPTURE |
Ussd (0) |
win32k!xxxAddShadow | SHADOW |
Usse (0) |
win32k!SetDisconnectDesktopSecurity | SECURITY |
Ussi (0) |
win32k!NtUserSendInput | SENDINPUT |
Ussm (0) |
win32k!InitSMSLookaside | SMS |
Usss (0) |
win32k!xxxBroadcastMessage | SMS_STRING |
Usst (0) |
win32k!xxxSBTrackInit | SCROLLTRACK |
Ussw (0) |
win32k!_BeginDeferWindowPos | SWP |
Ussy (0) |
win32k!xxxDesktopThread | SYSTEM |
Ustd (0) |
win32k!TrackAddDesktop | TRACKDESKTOP |
Usti (0) |
win32k!AllocateW32Thread | THREADINFO |
Ustk (0) |
win32k!HeavyAllocPool | STACK |
Ustm (0) |
win32k!InternalSetTimer | TIMER |
Usto (0) |
win32k!xxxConnectService | TOKEN |
Usts (0) |
win32k!_Win32CreateSection | SECTION |
Ustx (0) |
win32k!NtUserDrawCaptionTemp | TEXT |
Usty (0) |
win32k!NtUserResolveDesktopForWOW | TEXT2 |
Usub (0) |
win32k!NtUserToUnicodeEx | UNICODEBUFFER |
Usvi (0) |
win32k!ResizeVisExcludeMemory | VISRGN |
Usvl (0) |
win32k!VWPLAdd | VWPL |
Uswd (0) |
win32k!xxxCreateWindowEx | WINDOW |
Uswe (0) |
win32k!_SetWinEventHook | WINEVENT |
Uswl (0) |
win32k!BuildHwndList | WINDOWLIST |
Uswo (0) |
win32k!zzzInitTask | WOWTDB |
Uswp (0) |
win32k!xxxRegisterUserHungAppHandlers | WOWPROCESSINFO |
Uswt (0) |
win32k!xxxUserNotifyProcessCreate | WOWTHREADINFO |
Uvpb (0) |
dwudf.sys | (DVD Write Now) VPB |
Vad (0) |
nt!mm | Mm virtual address descriptors |
VadF (0) |
nt!mm | VADs created by a FreeVM splitting |
Vadl (0) |
nt!mm | Mm virtual address descriptors (long) |
VadS (0) |
nt!mm | Mm virtual address descriptors (short) |
VBus (0) |
vmbus.sys | Virtual Machine Bus Driver |
VDM (0) |
nt!vdm | ntosvdm |
VdPN (0) |
dxgkrnl.sys | Video display mode management |
VfIT (0) |
nt!Vf | Verifier Import Address Table information |
VidL (0) |
videoprt.sys | VideoPort Allocation List (FDO_EXTENSION) |
VidR (0) |
videoprt.sys | VideoPort Allocation on behalf of Miniport |
ViMm (0) |
dxgkrnl.sys | Video memory manager |
virt (0) |
vmm.sys | Virtual Machine Manager (VPC/VS) |
ViSh (0) |
dxgkrnl.sys | Video scheduler |
VM (0) |
volmgr.sys | General allocations |
Vm (0) |
volmgrx.sys | General allocations |
VM?? (0) |
volmgr.sys | Volume Manager |
Vm?? (0) |
volmgrx.sys | Volume Manager Extension |
VmBl (0) |
volmgrx.sys | Raw configuration blocks |
VmBu (0) |
volmgrx.sys | I/O buffers |
VmCc (0) |
volmgrx.sys | Configuration copies |
VmCo (0) |
volmgrx.sys | Configurations |
VmCp (0) |
volmgrx.sys | Copies |
VmCr (0) |
volmgrx.sys | Completion routine contexts |
VmDc (0) |
volmgrx.sys | Device changes |
VmDd (0) |
volmgrx.sys | Disk devices |
VmDh (0) |
volmgrx.sys | Disk headers |
VmLa (0) |
volmgrx.sys | Drive layouts |
VmLb (0) |
volmgrx.sys | Log blocks |
VmLc (0) |
volmgrx.sys | Log copies |
VmLo (0) |
volmgrx.sys | Logs |
VmLr (0) |
volmgrx.sys | Log raw content |
VmMm (0) |
volmgrx.sys | Mirror emergency mappings |
VmNe (0) |
volmgrx.sys | Notification entries |
VmOb (0) |
volmgrx.sys | I/O objects |
VmP0 (0) |
volmgrx.sys | Packets |
VmP1 (0) |
volmgrx.sys | Small packets |
VmP2 (0) |
volmgrx.sys | Large packets |
VmP3 (0) |
volmgrx.sys | Huge packets |
VmPa (0) |
volmgrx.sys | Packs |
VmPd (0) |
volmgrx.sys | Physical disks |
VmPs (0) |
volmgrx.sys | Arrays of packets |
VmRb (0) |
volmgrx.sys | Raw record buffers |
VmRc (0) |
volmgrx.sys | Raw configurations |
VmRe (0) |
volmgrx.sys | Records |
VmRi (0) |
volmgrx.sys | Record information |
VmRm (0) |
volmgrx.sys | RAID |
VmRr (0) |
volmgrx.sys | Raw records |
VmTa (0) |
volmgrx.sys | I/O tasks |
VmTc (0) |
volmgrx.sys | Table of contents |
VmTe (0) |
volmgrx.sys | Table of contents entries |
VmTx (0) |
volmgrx.sys | Transactions |
VmUe (0) |
volmgrx.sys | User entries |
VmVd (0) |
volmgrx.sys | Volume devices |
VmWi (0) |
volmgrx.sys | Work items |
VoS? (0) |
volsnap.sys | VolSnap (Volume Snapshot Driver) |
VoSa (0) |
volsnap.sys | Application information allocations |
VoSb (0) |
volsnap.sys | Buffer allocations |
VoSc (0) |
volsnap.sys | Snapshot context allocations |
VoSd (0) |
volsnap.sys | Diff area volume allocations |
VoSf (0) |
volsnap.sys | Diff area file allocations |
VoSh (0) |
volsnap.sys | Bit history allocations |
VoSi (0) |
volsnap.sys | Io status block allocations |
VoSm (0) |
volsnap.sys | Bitmap allocations |
VoSo (0) |
volsnap.sys | Old heap entry allocations |
VoSp (0) |
volsnap.sys | Pnp id allocations |
VoSr (0) |
volsnap.sys | Device relations allocations |
VoSs (0) |
volsnap.sys | Short term allocations |
VoSt (0) |
volsnap.sys | Temp table allocations |
VoSw (0) |
volsnap.sys | Work queue allocations |
VoSx (0) |
volsnap.sys | Dispatch context allocations |
Vpb (0) |
| Io, vpb's |
Vprt (0) |
videoprt.sys | Video port for legacy (pre |
VraP (0) |
| parallel class driver |
vTDR (0) |
dxgkrnl.sys | Video timeout detection/recovery |
Vtfd (0) |
| Font file/context |
Wait (0) |
| NtWaitForMultipleObjects |
Wan? (0) |
| NdisWan Tags (PPP Framing module for Remote Access) |
WanA (0) |
| BundleCB |
WanB (0) |
| ProtocolCB/LinkCB |
WanC (0) |
| DataDesc |
WanD (0) |
| WanRequest |
WanE (0) |
| LoopbackDesc |
WanG (0) |
| MiniportCB |
WanH (0) |
| OpenCB |
WanI (0) |
| IoPacket |
WanJ (0) |
| LineUpInfo |
WanK (0) |
| Unicode String Buffer |
WanL (0) |
| Protocol Table |
WanM (0) |
| Connection Table |
WanN (0) |
| NdisPacketPool Desc |
WanQ (0) |
| DataBuffer |
WanR (0) |
| WanPacket |
WanS (0) |
| AfCB/SapCB/VcCB |
WanT (0) |
| Transform Driver |
WanV (0) |
| RC4 Encryption Context |
WanW (0) |
| SHA Encryption |
WanX (0) |
| Send Compression Context |
WanY (0) |
| Recv Compression Context |
WanZ (0) |
| Protocol Specific Info |
WCbf (0) |
dwudf.sys | (DVD Write Now) Cache storage buffer |
WCrf (0) |
dwudf.sys | (DVD Write Now) Cache frame list |
WCtx (0) |
dwudf.sys | (DVD Write Now) Cache context block |
Wdm (0) |
| WDM |
WDMA (0) |
| WDM Audio |
Wdog (0) |
watchdog.sys | Watchdog object/context allocation |
werk (0) |
| WER kernel mode reporting allocation |
WimF (0) |
wimfsf.sys | WIM Boot Filter |
WMca (0) |
| WMI MCA Handling |
WmDS (0) |
| Wmi DataSource chunks |
WmGE (0) |
| Wmi GuidEntry chunks |
WmiA (0) |
| Wmi ACPI mapper |
WmiC (0) |
| Wmi Create Pump Thread Work Item |
WmiD (0) |
| Wmi Registration DataSouce |
WmiG (0) |
| Allocation of WMIGUID |
WmiI (0) |
| Wmi Instance Names |
Wmii (0) |
| Wmi InstId chunks |
Wmij (0) |
| Wmi GuidMaps |
WmiL (0) |
| WmiLIb |
Wmim (0) |
| Wmi KM to UM Notification Buffers |
WmiN (0) |
| Wmi Notification Notification Packet |
Wmin (0) |
| Wmi Notification Slot Chunks |
Wmip (0) |
| Wmi General purpose allocation |
Wmiq (0) |
| Wmi NBQ Blocks |
WmiR (0) |
| Wmi Registration info blocks |
WmIS (0) |
| Wmi InstanceSet chunks |
Wmis (0) |
| Wmi SysId allocations |
Wmit (0) |
| Wmi Trace |
Wmiw (0) |
| Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL |
Wmiz (0) |
| Wmi MCA Insertions debug code |
WmMR (0) |
| Wmi MofResouce chunks |
WMsG (0) |
win32k.sys | Winlogon kernel mode IPC interface |
Wrp? (0) |
| WanArp Tags (ARP module for Remote Access) |
Wrpa (0) |
| WAN_ADAPTER_TAG |
Wrpc (0) |
| WAN_CONN_TAG |
Wrpd (0) |
| WAN_DATA_TAG |
Wrpf (0) |
| FREE_TAG (checked builds only) |
Wrph (0) |
| WAN_HEADER_TAG |
Wrpi (0) |
| WAN_INTERFACE_TAG |
Wrpn (0) |
| WAN_NOTIFICATION_TAG |
Wrpr (0) |
| WAN_REQUEST_TAG |
Wrps (0) |
| WAN_STRING_TAG |
Wrpw (0) |
| WAN_PACKET_TAG |
WvCy (0) |
| WDM Audio WaveCyc port |
WvPc (0) |
| WDM Audio WavePCI port |
xCVD (0) |
mrxdav.sys | AsyncEngineContext Tag |
XDR? (0) |
rpcxdr.sys | NFS (Network File System) XDR driver |
xSMB (0) |
smbmrx.sys | IFSKIT sample SMB mini |
Xtra (0) |
| EXIFS Extra Create |
XWan (0) |
| ndisusrwan allocations |
ysd8 (0) |
win32k.sys | User DDE8 |
ysd9 (0) |
win32k.sys | User DDE9 |
ysda (0) |
win32k.sys | User DDEa |
ysdb (0) |
win32k.sys | User DDEb |
ysdc (0) |
win32k.sys | User DDEc |
ysdd (0) |
win32k.sys | User DDEd |
ZsaB (0) |
| EXIFS ZeroBlock |
_ATI (0) |
| ATI video driver |
_LCD (0) |
monitor.sys | Monitor PDO name buffer |
