rem rem Pooltag.txt rem rem This file lists the tags used for pool allocations by kernel mode components rem and drivers. rem rem The file has the following format: rem - - rem rem Pooltag.txt is installed with Debugging Tools for Windows (in %windbg%\triage) rem and with the Windows DDK (in %winddk%\tools\other\platform\poolmon, where rem platform is amd64, i386, or ia64). rem @GMM - - (Intel video driver) Memory manager @KCH - - (Intel video driver) Chipset specific service @MP - - (Intel video driver) Miniport related memory @SB - - (Intel video driver) Soft BIOS _ATI - - ATI video driver _LCD - monitor.sys - Monitor PDO name buffer 8042 - i8042prt.sys - PS/2 kb and mouse AdSv - vmsrvc.sys - Virtual Machines Additions Service ARPC - atmarpc.sys - ATM ARP Client ATMU - atmuni.sys - ATM UNI Call Manager Atom - - Atom Tables Abos - - Abiosdsk AcdM - - TDI AcdObjectInfoG AcdN - - TDI AcdObjectInfoG Acp* - acpi.sys - ACPI Pooltags ACPI - acpi.sys - ACPI Adap - - Adapter objects Adbe - - Adobe's font driver AECi - - filter object interface for MS acoustic echo canceller Afd? - afd.sys - AFD objects AfdA - afd.sys - Afd EA buffer AfdB - afd.sys - Afd data buffer AfdC - afd.sys - Afd connection structure AfdD - afd.sys - Afd debug data AfdE - afd.sys - Afd endpoint structure AfdF - afd.sys - Afd TransmitFile info AfdG - afd.sys - Afd group table AfdI - afd.sys - Afd TDI data AfdL - afd.sys - Afd local address buffer AfdP - afd.sys - Afd poll info AfdQ - afd.sys - Afd work queue item AfdR - afd.sys - Afd remote address buffer AfdS - afd.sys - Afd security info AfdT - afd.sys - Afd transport info AfdW - afd.sys - Afd work item AfdX - afd.sys - Afd context buffer Afda - afd.sys - Afd APC buffer (NT 3.51 only) Afdc - afd.sys - Afd connect data buffer Afdd - afd.sys - Afd disconnect data buffer Afdf - afd.sys - Afd TransmitFile debug data Afdh - afd.sys - Afd address list change buffer Afdi - afd.sys - Afd "set inline mode" buffer Afdl - afd.sys - Afd lookaside lists buffer Afdp - afd.sys - Afd transport IRP buffer Afdq - afd.sys - Afd routing query buffer Afdr - afd.sys - Afd ERESOURCE buffer Afdt - afd.sys - Afd transport address buffer Afp - - SFM File server AlCI - nt!alpc - ALPC communication info AlEv - nt!alpc - ALPC eventlog queue AlIn - nt!alpc - ALPC Internal allocation AlHa - nt!alpc - ALPC port handle table AlMs - nt!alpc - ALPC message ALPC - nt!alpc - ALPC port objects AlRe - nt!alpc - ALPC section region AlRr - nt!Alpc - ALPC resource reserves AlSc - nt!alpc - ALPC section AlSe - nt!alpc - ALPC client security AlVi - nt!alpc - ALPC view ATmp - AppTag mount point ATon - AppTag object name ATub - AppTag user buffer ATgb - AppTag guid buffer ATac - AppTag ATR command buffer ATdi - AppTag cliendata index buffer ATdt - AppTag cliendata temp buffer ATFb - AppTag file id buffer Aml* - - ACPI AMLI Pooltags APIC - pnpapic.sys - I/O APIC Driver ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG ArbM - nt!arb - ARBITER_MISC_TAG ArbR - nt!arb - ARBITER_RANGE_LIST_TAG Arp? - - ATM ARP server objects, atmarps.sys ArpA - - AtmArpS address ArpB - - AtmArpS buffer space ArpI - - AtmArpS Interface structure ArpK - - AtmArpS ARP block ArpM - - AtmArpS MARS structure ArpR - - AtmArpS NDIS request ArpS - - AtmArpS SAP structure Asy1 - - ndis / ASYNC_IOCTX_TAG Asy2 - - ndis / ASYNC_INFO_TAG Asy3 - - ndis / ASYNC_ADAPTER_TAG Asy4 - - ndis / ASYNC_FRAME_TAG AtC - - IDE disk configuration AtD - - atdisk.c ATIX - - WDM mini drivers for ATI tuner, xbar, etc. Atk - - Appletalk transport AtmA - - Atoms AtmT - - Atom tables AuxL - - EXIFS Auxlist Bat? - - Battery Class drivers BatC - - Composite battery driver BatM - - Control method battery driver BatS - - Smart battery driver Batt - - Battery class driver BCSP - bthbcsp.sys - Bluetooth BCSP minidriver BCDK - nt!init - Kernel boot configuration data. BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c) BlCc - blkcache.sys - Block Cache Driver Bmfd - - Font related stuff BT3C - bt3c.sys - Bluetooth 3COM minidriver BT8x - - WDM mini drivers for Brooktree 848,829, etc. BTHP - bthport.sys - Bluetooth port driver (generic) BthS - bthport.sys - Bluetooth port driver (security) BTME - bthenum.sys - Bluetooth enumerator BTMO - bthmodem.sys - Bluetooth modem BTPT - - Bluetooth transport protocol library BTSR - bthser.sys - Bluetooth serial minidriver BTUR - bthuart.sys - Bluetooth UART minidriver Bu* - - burneng.sys from adaptec Call - nt!ex - kernel callback object signature call - - debugging call tables CBRe - - CallbackRegistration Cc - nt!cc - Cache Manager allocations (catch-all) CcBc - nt!cc - Cache Manager Bcb from pool CcBm - nt!cc - Cache Manager Bitmap CcBn - nt!cc - Cache Manager Bcb trim notification entry CcBr - nt!cc - Cache Manager Bitmap range CcBz - nt!cc - Cache Manager Bcb Zone CcDw - nt!cc - Cache Manager Deferred Write CcEv - nt!cc - Cache Manager Event CcFn - nt!cc - Cache Manager File name for popups CcMb - nt!cc - Cache Manager Mbcb CcOb - nt!cc - Cache Manager Overlap Bcb CcPB - nt!ccpf - Prefetcher trace buffer CcPC - nt!ccpf - Prefetcher context CcPD - nt!ccpf - Prefetcher trace dump CcPF - nt!ccpf - Prefetcher file name CcPI - nt!ccpf - Prefetcher intermediate table CcPL - nt!ccpf - Prefetcher read list CcPM - nt!ccpf - Prefetcher metadata CcPS - nt!ccpf - Prefetcher scenario CcPT - nt!ccpf - Prefetcher trace CcPc - nt!cc - Cache Manager Private Cache Map CcPf - nt!ccpf - Prefetcher CcPh - nt!ccpf - Prefetcher header preallocation CcPp - nt!ccpf - Prefetcher instructions CcPq - nt!ccpf - Prefetcher query buffer CcPs - nt!ccpf - Prefetcher section table CcPv - nt!ccpf - Prefetcher volume info CcPw - nt!ccpf - Prefetcher boot worker CcSc - nt!cc - Cache Manager Shared Cache Map CcVa - nt!cc - Cache Manager Initial array of Vacbs CcVl - nt!cc - Cache Manager Vacb Level structures (large streams) CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream CctX - - EXIFX FCB Commit CTX CcWq - nt!cc - Cache Manager Work Queue Item CcWK - nt!cc - Kernel Cache Manager lookaside list CcWk - nt!cc - Kernel Cache Manager lookaside list CcZe - nt!cc - Cache Manager Buffer of Zeros CdA - - CdAudio filter driver Cdcc - cdfs.sys - CDFS Ccb Cddn - cdfs.sys - CDFS CdName in dirent Cdee - cdfs.sys - CDFS Search expression for enumeration Cdfd - cdfs.sys - CDFS Data Fcb Cdfi - cdfs.sys - CDFS Index Fcb Cdfl - cdfs.sys - CDFS Filelock CdFn - cdfs.sys - CDFS Filename buffer Cdfn - cdfs.sys - CDFS Nonpaged Fcb Cdfs - cdfs.sys - CDFS General Allocation Cdft - cdfs.sys - CDFS Fcb Table entry Cdgs - cdfs.sys - CDFS Generated short name Cdic - cdfs.sys - CDFS Irp Context Cdil - cdfs.sys - CDFS Irp Context lite Cdio - cdfs.sys - CDFS Io context for async reads Cdma - cdfs.sys - CDFS Mcb array Cdpe - cdfs.sys - CDFS Prefix Entry CdPn - cdfs.sys - CDFS CdName in path entry Cdpn - cdfs.sys - CDFS Prefix Entry name Cdsp - cdfs.sys - CDFS Buffer for spanning path table Cdtc - cdfs.sys - CDFS TOC Cdun - cdfs.sys - CDFS Buffer for upcased name Cdvd - cdfs.sys - CDFS Buffer for volume descriptor Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem CIcr - ci.dll - Code Integrity allocations for image integrity checking CIsc - ci.dll - Code Integrity core dll CIha - ci.dll - Code Integrity hashes ClfA - clfs.sys - CLFS_CONTAINER_TAG ClfB - clfs.sys - CLFS_BASEFILE_TAG ClfC - clfs.sys - CLFS_LOGFCBPHYSICAL_TAG ClfD - clfs.sys - CLFS_LOGFCBVIRTUAL_TAG ClfE - clfs.sys - CLFS_LOGCCB_TAG ClfF - clfs.sys - CLFS_FLUSHELT_TAG ClfG - clfs.sys - CLFS_REQUEST_TAG ClfH - clfs.sys - CLFS_IOCB_TAG ClfI - clfs.sys - CLFS_MARSHALBUFFER_TAG Clfs - clfs.sys - CLFS_TAG CM - nt!cm - Configuration Manager (registry) CmcD - hal.dll - HAL CMC Driver Log CmcK - hal.dll - HAL CMC Kernel Log CmcT - hal.dll - HAL CMC temporary Log CMCa - nt!cm - Configuration Manager Cache (registry) CMDc - nt!cm - Configuration Manager Cache (registry) CMkb - nt!cm - registry key control blocks CMpb - nt!cm - registry post blocks CMnb - nt!cm - registry notify blocks CMpe - nt!cm - registry post events CMpa - nt!cm - registry post apcs CMsb - nt!cm - registry stash buffer CmVn - nt!cm - captured value name CMVw - nt!cm - registry mapped view of file CMVa - nt!cm - value cache value tag CMVI - nt!cm - value index cache tag CMSc - nt!cm - security cache pooltag CMSb - nt!cm - internal stash buffer pool tag CMNb - nt!cm - notification block pool tag CMIn - nt!cm - index hint pool tag CM?? - nt!cm - Internal Configuration manager allocations CMDa - nt!cm - value data cache pool tag CMAl - nt!cm -internal registry memory allocator pool tag Cngb - ksecdd.sys - CNG kmode crypto pool tag COMX - serial.sys - serial driver allocations Cont - - Contiguous physical memory allocations for device drivers CopW - - EXIFS CopyOnWrite Covr - nt!cov - Code Coverage pool tag CpeD - hal.dll - HAL CPE Driver Log CpeK - hal.dll - HAL CMC Kernel Log CpeT - hal.dll - HAL CPE temporary Log CPnp - classpnp.sys - ClassPnP transfer packets Crsp - ksecdd.sys - CredSSP kernel mode client allocations CrtH - - EXIFS Create Header Cryp - ksecdd.sys - Crypto allocations CSdk - - Cluster Disk Filter driver CSnt - - Cluster Network driver CTE - - Common transport environment (ntos\inc\cxport.h, used by tdi) Cvli - - EXIFS Cached Volume Info D2d - - Device Object to DosName rtns (ntos\rtl\dev2dos.c) D3Dd - - DX D3D driver (embedded in a display driver like s3mvirge.dll) D851 - - 8514a video driver Dacl - - Temp allocations for object DACLs Dati - - ati video driver DbLo - - Debug logging dcam - - WDM mini driver for IEEE 1394 digital camera Dcdd - cdd.dll - Canonical display driver Dcl - - cirrus video driver Ddk - - Default for driver allocated memory (user's of ntddk.h) Devi - - Device objects Dh 0 - - DirectDraw/3D default object Dh 1 - - DirectDraw/3D DirectDraw object Dh 2 - - DirectDraw/3D Surface object Dh 3 - - DirectDraw/3D Direct3D context object Dh 4 - - DirectDraw/3D VideoPort object Dh 5 - - DirectDraw/3D MotionComp object Dfb - - framebuf video driver DfC? - dfsc.sys - DFS Client allocations DfCa - dfsc.sys - DFS Client PERUSERTABLE DfCb - dfsc.sys - DFS Client REFCONTEXT DfCc - dfsc.sys - DFS Client CONNECTION DfCd - dfsc.sys - DFS Client CURRENTDC DfCe - dfsc.sys - DFS Client CSCEA DfCf - dfsc.sys - DFS Client FILENAME DfCg - dfsc.sys - DFS Client PREFIXCACHE DfCh - dfsc.sys - DFS Client HASH DfCi - dfsc.sys - DFS Client INPUTBUFFER DfCj - dfsc.sys - DFS Client REFERRALNAME DfCj - dfsc.sys - DFS Client REWRITTENNAME DfCl - dfsc.sys - DFS Client DCLIST DfCm - dfsc.sys - DFS Client CMCONTEXT DfCn - dfsc.sys - DFS Client DOMAINNAME DfCp - dfsc.sys - DFS Client PATH DfCq - dfsc.sys - DFS Client REGSTRING DfCr - dfsc.sys - DFS Client REFERRAL DfCs - dfsc.sys - DFS Client SHARENAME DfCt - dfsc.sys - DFS Client TREECONNECT DfCu - dfsc.sys - DFS Client USETABLE DfCv - dfsc.sys - DFS Client SERVERNAME DfCw - dfsc.sys - DFS Client TARGETINFO DfCx - dfsc.sys - DFS Client CREDENTIALS DfCy - dfsc.sys - DFS Client REMOTEENTRY DfCz - dfsc.sys - DFS Client DOMAINREFERRAL Dfs - - Distributed File System dfsr - - RDBSS IRP allocation Dfsm - - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre dFVE - dumpfve.sys - Full Volume Encryption crash dump filter (Bitlocker Drive Encryption) Dire - - Directory objects Dlck - - deadlock verifier (part of driver verifier) structures Dlmp - - Video utility library for Vista display drivers Dmga - - mga (matrox) video driver DmH? - - DirectMusic hardware synthesizer DmpS - dumpsvc.sys - Crashdump Service Driver DmS? - - DirectMusic kernel software synthesizer Dndt - - Device node Dnod - - Device node structure DOPE - - Device Object Power Extension (po component) DPrf - - Disk performance filter driver DPwr - nt!pnp - PnP power management Dprt - dxgkrnl.sys - Video port for Vista display drivers Dps5 - - NT5 PostScript printer driver Dpsh - - Postcript driver heap memory Dpsi - - psidisp video driver Dpsm - - Postcript driver memory Dqv - - qv (qvision) video driver Driv - - Driver objects Drsd - - Rasdd Printer Driver Pool Tag. Dtga - - tga video driver Dump - - Bugcheck dump allocations Dun5 - - NT5 Universal printer driver DUQD - mpsdrv.sys - MPSDRV upcall user request DV?? - - RDR2 DAV MiniRedir Tags DVCx - - AsyncEngineContext, DAV MiniRedir DVEx - - Exchange, DAV MiniRedir DVFi - - FileInfo, DAV MiniRedir DVFn - - FileName, DAV MiniRedir DVRw - - ReadWrite, DAV MiniRedir DVSc - - SrvCall, DAV MiniRedir DVSh - - SharedHeap, DAV MiniRedir Dvga - - vga 16 color video driver Dvg2 - - vga 256 color video driver Dvg6 - - vga 64K color video driver Dvgr - - vga for risc video driver DW32 - - W32 video driver Dwd - - wd90c24a video driver Dwp9 - - weitekp9 video driver Dxga - - XGA video driver DxgK - dxgkrnl.sys - Vista display driver support Efsm - - EFS driver Efsc - - EFS driver Efst - - EXIFS FS Statistics Enli - nt!tm - KTM Transaction Enlistment Envr - - Environment strings Err - - Error strings EtwA - nt!etw - Etw APC EtwG - nt!etw - Etw Guid EtwD - nt!etw - Etw DataBlock EtwS - nt!etw - Etw DataSource EtwR - nt!etw - Etw Registration EtwC - nt!etw - Etw Realtime Consumer EtwB - nt!etw - Etw Buffer EtwP - nt!etw - Etw Pool EtwQ - nt!etw - Etw Queue Etwq - nt!etw - Etw ReplyQueue Etwr - nt!etw - Etw ReplyQueue Entry EtwL - nt!etw - ETW_LOGGER_CONTEXT Etwp - nt!etw - ETW per-processor block Evel - - EFS file system filter driver lookaside list Even - - Event objects Evid - - Rtl Event ID's ExWl - - Executive worker list entry Fat - fastfat.sys - Fat File System allocations FatB - fastfat.sys - Fat allocation bitmaps FatC - fastfat.sys - Fat Ccbs FatD - fastfat.sys - Fat pool dirents FatE - fastfat.sys - Fat EResources FatF - fastfat.sys - Fat Fcbs FatI - fastfat.sys - Fat IrpContexts FatL - fastfat.sys - Fat FAT entry lookup buffer on verify FatN - fastfat.sys - Fat Nonpaged Fcbs FatO - fastfat.sys - Fat I/O buffer FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees) FatQ - fastfat.sys - Fat buffered user buffer FatR - fastfat.sys - Fat repinned Bcb FatS - fastfat.sys - Fat stashed Bpb FatT - fastfat.sys - Fat directory allocation bitmaps FatV - fastfat.sys - Fat Vcb stat bucket Fatv - fastfat.sys - Fat events FatW - fastfat.sys - Fat FAT windowing structure FatX - fastfat.sys - Fat IO contexts Fatb - fastfat.sys - Fat Bcb arrays Fatd - fastfat.sys - Fat EA data Fate - fastfat.sys - Fat EA set headers Fatf - fastfat.sys - Fat deferred flush contexts Fati - fastfat.sys - Fat IO run descriptor Fatn - fastfat.sys - Fat filename buffer Fatr - fastfat.sys - Fat verification-time rootdir snapshot Fats - fastfat.sys - Fat verification-time boot sector Fatv - fastfat.sys - Fat backpocket Vpb Fatx - fastfat.sys - Fat delayed close contexts Fcbl - - EXIFS FCBlock fboX - - EXIFS FOBXVF List File - - File objects FIcn - fileinfo.sys - FileInfo FS-filter Create Retry Path FIcp - fileinfo.sys - FileInfo FS-filter Extra Create Parameter FIcs - fileinfo.sys - FileInfo FS-filter Stream Context FIcv - fileinfo.sys - FileInfo FS-filter Volume Context FIOc - fileinfo.sys - FileInfo FS-filter Prefetch Open Context FIou - fileinfo.sys - FileInfo FS-filter User Open Context FIof - fileinfo.sys - FileInfo FS-filter File Object Context FIPc - fileinfo.sys - FileInfo FS-filter Prefetch Context FIvn - fileinfo.sys - FileInfo FS-filter Volume Name FIvp - fileinfo.sys - FileInfo FS-filter Volume Properties Flop - - floppy driver Flst - - EXIFS Freelist FLex - - exclusive file lock FLfl - - exported (non-private) file lock FLli - - per-file lock information FLln - - shared lock tree node FLsh - - shared file lock FLwl - - waiting lock FM?? - fltmgr.sys - Unrecognized FltMgr tag (update pooltag.w) FMac - fltmgr.sys - ASCII String buffers FMas - fltmgr.sys - ASYNC_IO_COMPLETION_CONTEXT structure FMcb - fltmgr.sys - FLT_CCB structure FMcr - fltmgr.sys - Context registration structures FMct - fltmgr.sys - TRACK_COMPLETION_NODES structure FMdl - fltmgr.sys - Array of DEVICE_OBJECT pointers FMea - fltmgr.sys - EA buffer for create FMfc - fltmgr.sys - FLTMGR_FILE_OBJECT_CONTEXT structure FMfi - fltmgr.sys - Fast IO dispatch table FMfk - fltmgr.sys - Byte Range Lock structure FMfl - fltmgr.sys - FLT_FILTER structure FMfn - fltmgr.sys - NAME_CACHE_NODE structure FMfr - fltmgr.sys - FLT_FRAME structure FMfz - fltmgr.sys - FILE_LIST_CTRL structure FMib - fltmgr.sys - Irp SYSTEM buffers FMic - fltmgr.sys - IRP_CTRL structure FMin - fltmgr.sys - FLT_INSTANCE name FMil - fltmgr.sys - IRP_CTRL completion node stack FMis - fltmgr.sys - FLT_INSTANCE structure FMla - fltmgr.sys - Per-processor IRPCTRL lookaside lists FMnc - fltmgr.sys - NAME_CACHE_CREATE_CTRL structure FMng - fltmgr.sys - NAME_GENERATION_CONTEXT structure FMol - fltmgr.sys - OPLOCK_CONTEXT structure FMos - fltmgr.sys - Operation status ctrl structure FMpl - fltmgr.sys - Cache aware pushLock FMpr - fltmgr.sys - FLT_PRCB structure FMrl - fltmgr.sys - FLT_OBJECT rundown logs FMrp - fltmgr.sys - Reparse point data buffer FMrr - fltmgr.sys - Per-processor Cache-aware rundown ref structure FMsd - fltmgr.sys - Security descriptors FMsl - fltmgr.sys - STREAM_LIST_CTRL structure FMtn - fltmgr.sys - Temporary file names FMtr - fltmgr.sys - Temporary Registry information FMts - fltmgr.sys - Tree Stack FMus - fltmgr.sys - Unicode string FMvf - fltmgr.sys - FLT_VERIFIER_EXTENSION structure FMvj - fltmgr.sys - FLT_VERIFIER_OBJECT structure FMvo - fltmgr.sys - FLT_VOLUME structure FMwi - fltmgr.sys - Work item structures Fsrc - fsrec.sys - Filesystem recognizer (fsrec.sys) Fstb - - ntos\fstub FstB - - ntos\fstub FsVg - fsvga.sys - International VGA support flnk - - font link tag used in ntgdi\gre FS?? - nt!fsrtl - Unrecoginzed File System Run Time allocations (update pooltag.w) FSeh - nt!fsrtl - File System Run Time Extra Create Parameter Entry FSel - nt!fsrtl - File System Run Time Extra Create Parameter List FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!) FSmg - nt!fsrtl - File System Run Time FSrd - nt!fsrtl - File System Run Time FSrm - nt!fsrtl - File System Run Time FSrn - nt!fsrtl - File System Run Time FSrN - nt!fsrtl - File System Run Time FSro - nt!fsrtl - File System Run Time FSrs - nt!fsrtl - File System Run Time Work Item for low-stack posting FSun - nt!fsrtl - File System Run Time FOCX - nt!fsrtl - File System Run Time File Object Context structure FTrc - - Fault tolerance Slist tag. FtC - - Fault tolerance driver FtM - - Fault tolerance driver FtS - - Fault tolerance driver FtT - - Fault tolerance driver FtU - - Fault tolerance driver FtV - - Fault tolerance driver FtpA - mpsdrv.sys - MPSDRV FTP protocol analyzer FwfD - mpsdrv.sys - MPSDRV driver buffer for flattening NET_BUFFFER FVE? - fvevol.sys - Full Volume Encryption Filter Driver (Bitlocker Drive Encryption) FVE0 - fvevol.sys - General allocations FVEc - fvevol.sys - Cryptographic allocations FVEl - fvevol.sys - FVELIB allocations FVEp - fvevol.sys - Write buffers FVEr - fvevol.sys - Reserved mapping addresses FVEv - fvevol.sys - Conversion allocations FVEw - fvevol.sys - Worker threads FVEx - fvevol.sys - Read/write control structures FxDr - wdf01000.sys - KMDF driver globals/generic pool allocation tag. Fallback tag in case driver tag is unusable. FxLg - wdf01000.sys - KMDF IFR log tag FxL? - wdfldr.sys - KMDF Loader Pool allocation Fwpp - fwpkclnt.sys - Windows Filtering Platform export driver. G??? - - Gdi Objects G - - Gdi Generic allocations Gcac - - Gdi glyph cache Gcap - - Gdi capture buffer Gcsl - - Gdi string resource script names Gdbr - - Gdi driver brush realization Gdd - - Gdi ddraw PKEY_VALUE_FULL_INFORMATION Gdda - - Gdi ddraw attach list GddD - - Gdi ddraw dummy page Gdde - - Gdi ddraw event Gddf - - Gdi ddraw driver heaps Gddp - - Gdi ddraw driver caps Gddv - - Gdi ddraw driver video memory list Gdwd - win32k.sys - Gdi watchdog support objects Gdxd - - Gdi ddraw VPE directdraw object Gdxs - - Gdi ddraw VPE surface, videoport, capture object Gdxx - - Gdi ddraw VPE DXAPI object Gdev - - Gdi GDITAG_DEVMODE GDev - - Gdi pdev Gdrs - - Gdi GDITAG_DRVSUP Gebr - - Gdi ENGBRUSH gEdg - - Gdi gradient fill triangle Gffv - - Gdi FONTFILEVIEW gFil - - Gdi FILEVIEW GFil - - Gdi engine descriptor list Gfsb - - Gdi font sustitution list Gfsm - - Gdi Fast mutex Ggdv - - Gdi GDITAG_GDEVICE Gglb - - Gdi temp buffer Ggls - - Gdi glyphset Ggb - - Gdi glyph bits Ggbl - - Gdi look aside buffers Ghmg - - Gdi handle manager objects Gini - - Gdi fast mutex Gh ? - win32k.sys - Gdi Handle manager specific object types: defined in w32\ntgdi\inc\ntgdistr.h Gla? - win32k.sys - Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h Gldv - - Gdi Ldev Glnk - - Gdi PFELINK Gmap - - Gdi font map signature table Gpff - - Gdi physical font file Gpft - - Gdi font table Gsem - - Gdi Semaphores Gsp - - Gdi sprite Gspr - - Gdi sprite grow range Gtmp - - Gdi temporary allocations Gtmw - - Gdi TMW_INTERNAL Gxlt - - Gdi Xlate Gfcb - - EXIFS Grow FCB Hal - hal.dll - Hardware Abstraction Layer HalV - ntoskrnl.exe - Driver Verifier DMA checking Hpfs - - Pinball (aka Hpfs) allocations HisC - - histogram filter driver Hist - - histogram filter driver HidP - - HID Parser HidC - - HID Class HdCl - - HID Client Sample Driver HpMM - pnpmem.sys - HotPlug Memory Driver HCID - bthport.sys - Bluetooth port driver HCI debug HCIT - bthport.sys - Bluetooth port driver (HCI) HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST HcEv - hcaport.sys - HCAPORT_TAG_EVENT HcdI - hcaport.sys - HCAPORT_TAG_HWID HcEn - hcaport.sys - HCAPORT_TAG_ENUM HcMc - hcaport.sys - HCAPORT_TAG_MISC HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS HcBm - hcaport.sys - HCAPORT_TAG_BITMAP HcOb - hcaport.sys - HCAPORT_TAG_OBJECT HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE HcPr - hcaport.sys - HCAPORT_TAG_PROTD HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION HcMa - hcaport.sys - HCAPORT_TAG_MAD HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT HcCm - hcaport.sys - HCAPORT_TAG_CM HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE hSVD - mrxdav.sys - Shared Heap Tag HT01 - - GDI Halftone AddCachedDCI() for CurCDCIData HT02 - - GDI Halftone GetCachedDCI() for Threshold HT03 - - GDI Halftone FindCachedSMP() for CurCSMPData HT04 - - GDI Halftone FindCachedSMP() for CurCSMPBmp HT05 - - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI HT06 - - GDI Halftone pDCIAdjClr() for DEVCLRADJ HT07 - - GDI Halftone ComputeRGB555LUT() for RGBLUT HT08 - - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ HT09 - - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache HT10 - - GDI Halftone CreateDyesColorMappingTable() for DevPrims HT11 - - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable HT12 - - GDI Halftone ThresholdsFromYData() for pYData HT13 - - GDI Halftone ComputeHTCellRegress() for pThresholds HT14 - - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine HT15 - - GDI Halftone CalculateStretch() for PrimColorInfo Hvlm - nt!Hvl - Temporary MDL for the Hvl component. HvlP - nt!Hvl - Hypercall marshalling pages for the Hvl component. IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager CEP - wibcm.sys - CEP_INSTANCE_TAG CMSH - wibcm.sys - WIBCM_SHARED_TAG CMWK - wibcm.sys - WIBCM_WORK_TAG CMWT - wibcm.sys - WIBCM_TIMER_TAG IBm* - wibms.sys - Windows Infiniband Management Server pool tags IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager IbPS - wibpm.sys - WIBPM_SENT_TAG IbPI - wibpm.sys - WIBPM_ITEM_TAG IbPA - wibpm.sys - WIBPM_SAMPLE_TAG IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager IbW1 - wibwmi.sys - WIBWMI1_TAG IbW2 - wibwmi.sys - WIBWMI2_TAG IPX - - Nwlnkipx transport Icp - - I/O completion packets queue on a completion ports IcpP - - NPAGED_LOOKASIDE_LIST I/O completion per processor lookaside pointers IdeP - - atapi IDE IdeX - - PCI IDE idle - - Power Manager idle handler Ifs - - Default file system allocations (user's of ntifs.h) Info - - general system information allocations Io - nt!io - general IO allocations IoCc - nt!io - Io completion context IoEa - nt!io - Io extended attributes IoEr - nt!io - Io error log packets IoFc - nt!io - Io name transmogrify operation IoFs - nt!io - Io shutdown packet IoFu - nt!pnp - Io file utils IoKB - - Registry basic key block (temp allocation) IoNm - nt!io - Io parsing names IoRb - nt!io - Io remote boot related IoRN - nt!io - Registry key name (temp allocation) IoSe - nt!io - Io security related IoSh - nt!io - Io shutdown packet IoSt - nt!io - Io Stream Identifier Context IoTi - nt!io - Io timers IoTt - nt!vf - I/O verifier IRP tracking table Ioin - - Io interrupts IoOp - nt!io - I/O subsystem open packet IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet IoUs - nt!io - I/O SubSystem completion Context Allocation Irp - - Io, IRP packets Irp+ - nt!vf - I/O verifier allocated IRP packets IrpB - nt!vf - I/O verifier direct I/O double buffer allocation Irpd - nt!vf - I/O verifier deferred completion context Irps - nt!vf - I/O verifier per-IRP session tracking data Irpt - nt!vf - I/O verifier per-IRP tracking data IrpC - nt!vf - I/O verifier stack contexts Irpl - nt!io - system large IRP lookaside list Irps - nt!io - system small IRP lookaside list Isap - - Pnp Isa bus extender II?? - - IP in IP tunneling IIrf - - Free memory IIdt - - Data IITn - - Tunnel IIhd - - Header IIpk - - Packet IIsc - - Send Context IIts - - Transfer Context IIwc - - Work Context Im* - - Imapi.sys from adaptec INTC - - Intel video driver IPm? - - IP Multicasting IPmg - - Group IPms - - Source IPmo - - Outgoing Interface IPmm - - Message IPmf - - Free memory (only in checked builds) Ip?? - ipsec.sys - IP Security IpSI - ipsec.sys - initial allocations IpAT - ipsec.sys - AH headers in transport mode IpAU - ipsec.sys - AH headers in tunnel mode IpET - ipsec.sys - ESP headers in transport mode IpEU - ipsec.sys - ESP headers in tunnel mode IpHT - ipsec.sys - HUGHES headers in transport mode IpHU - ipsec.sys - HUGHES headers in tunnel mode IpAX - ipsec.sys - Key acquire contexts IpFI - ipsec.sys - Filter blocks IpSA - ipsec.sys - Security Associations IpKE - ipsec.sys - keys IpTI - ipsec.sys - timers IpSQ - ipsec.sys - stall queues IpLA - ipsec.sys - lookaside lists IpBP - ipsec.sys - buffer pools IpSC - ipsec.sys - send complete context IpEQ - ipsec.sys - event queue IpHW - ipsec.sys - hardware accleration items IpCO - ipsec.sys - IP compression IpFl - mpsdrv.sys - MPSDRV IP Flow IrD? - - IrDA TDI and RAS drivers IU?? - - IIS Utility Driver IUDl - - Lookaside list allocations IUcp - - completion port minipackets KAPC - nt!io - I/O SubSystem HardError APC KbdC - - Keyboard Class Driver KCfe - - Kernel COM factory entry Ke - - Kernel data structures KeIC - - Kernel Interrupt Object Chain Key - - Key objects KMIX - - Kmixer (wdm audio) KNMI - - Kernel NMI Callback object KrbC - ksecdd.sys - Kerberos Client package KSah - - Ks auxiliary stream headers KSAI - - allocator instance KSai - - default allocator instance header KSbi - - event buffered item KSCI - - clock instance KSce - - create item entry KSch - - create handler entry KSci - - default clock instance header KScp - - object creation parameters auxiliary copy KSda - - default allocator KSdc - - default clock KSdh - - device header Kse0 - ksecdd.sys - Security driver allocs for sec package 0 Kse1 - ksecdd.sys - Security driver allocs for sec package 1 Kse2 - ksecdd.sys - Security driver allocs for sec package 2 Kse3 - ksecdd.sys - Security driver allocs for sec package 3 Kse4 - ksecdd.sys - Security driver allocs for sec package 4 Kse5 - ksecdd.sys - Security driver allocs for sec package 5 Kse6 - ksecdd.sys - Security driver allocs for sec package 6 Kse7 - ksecdd.sys - Security driver allocs for sec package 7 Kse8 - ksecdd.sys - Security driver allocs for sec package 8 Kse9 - ksecdd.sys - Security driver allocs for sec package 9 Ksec - ksecdd.sys - Security device driver KSed - - event dpc item KSee - - event entry KSed - - oneshot event deletion dpc KSep - - irp system buffer event parameter KseS - ksecdd.sys - Security driver allocs for LSA proper KSew - - oneshot event deletion workitem KseZ - ksecdd.sys - Security driver allocs for default sec package KSqr - - QM quality report KSer - - QM error report KSfd - - filter cache data (MSKSSRV) KsFI - - filter instance KSns - - null security object KSnv - - registry name value KSoh - - object header KSop - - object creation parameters KSpc - - port driver instance FsContext KSPI - - pin instance KSpp - - irp system buffer property/method/event parameter KSpt - - pin type list (MSKSSRV) KSqf - - query information file buffer KSsc - - port driver stream FsContext KSsf - - set information file buffer KSsh - - stream headers KSsi - - software bus interface KSsl - - symbolic link buffer (MSKSSRV) KSsp - - serialized property set KsoO - - WDM audio stuff L2CA - bthport.sys - Bluetooth port driver (L2CAP) L2T0 - - ndis\l2tp / MTAG_FREED L2T1 - - ndis\l2tp / MTAG_ADAPTERCB L2T2 - - ndis\l2tp / MTAG_TUNNELCB L2T3 - - ndis\l2tp / MTAG_VCCB L2T4 - - ndis\l2tp / MTAG_VCTABLE L2T5 - - ndis\l2tp / MTAG_WORKITEM L2T6 - - ndis\l2tp / MTAG_TIMERQ L2T7 - - ndis\l2tp / MTAG_TIMERQITEM L2T8 - - ndis\l2tp / MTAG_PACKETPOOL L2T9 - - ndis\l2tp / MTAG_FBUFPOOL L2Ta - - ndis\l2tp / MTAG_HBUFPOOL L2Tb - - ndis\l2tp / MTAG_TDIXRDG L2Tc - - ndis\l2tp / MTAG_TDIXSDG L2Td - - ndis\l2tp / MTAG_CTRLRECD L2Te - - ndis\l2tp / MTAG_CTRLSENT L2Tf - - ndis\l2tp / MTAG_PAYLRECD L2Tg - - ndis\l2tp / MTAG_PAYLSENT L2Th - - ndis\l2tp / MTAG_INCALL L2Ti - - ndis\l2tp / MTAG_UTIL L2Tj - - ndis\l2tp / MTAG_ROUTEQUERY L2Tk - - ndis\l2tp / MTAG_ROUTESET L2Tl - - ndis\l2tp / MTAG_L2TPPARAMS L2Tm - - ndis\l2tp / MTAG_TUNNELWORK L2Tn - - ndis\l2tp / MTAG_TDIXROUTE LANE - atmlane.sys - LAN Emulation Client for ATM LB?? - - LM Datagram receiver allocations LBan - - Server announcement LBvb - - View buffer LBma - - Master announce context LBxp - - Transport LBxn - - TransportName LBxm - - Master name LBtn - - Transport name LBea - - Ea buffer LBdi - - POOL_DOMAIN_INFO LBds - - Send datagram context LBci - - Connection info LBmh - - Mailslot header LBbl - - Backup List LBsl - - Browser server list LBbs - - Browser server LBgb - - GetBackupList request LBbr - - GetBackupList response LBmb - - Mailslot Buffer LBid - - Illegal datagram context LBbn - - Name LBnn - - Name name LBic - - IRP context LBwi - - Work item LBel - - Election context LBbb - - Become backup context LBbr - - Become backup request LBpn - - Paged Name LBpt - - Paged transport LBse - - Browser security Lbuf - - EXIFS Large Buffer LeoC - - Symantec/Norton AntiVirus filter driver List - - kernel utilities list allocation LCam - - WDM mini video capture driver for Logitech camera Lfs - - Lfs allocations LfsI - - Lfs allocations LogA - clfs.sys - CLFS_APITEST_TAG LpcZ - - LPC Zone LpcM - - Local procedure call message blocks Lr?? - - LM redirector allocations Lr - - Generic allocations Lrcx - - Context blocks of various types Lrcl - - ConnectListEntries Lrsl - - ServerListEntries Lrse - - Security entry Lrsc - - Search Control Blocks Lrea - - EA related allocations Lric - - Instance Control Blocks Lrfc - - File Control Blocks Lrfl - - Fcb Locks Lrfp - - Fcb Paging locks Lrcn - - Computer Name Lrdn - - Domain Name Lr?? - - Buffers used for FsControlFile APIs Lrlc - - Lock Control Blocks Lrlb - - Lock Control Block buffers Lrnf - - Non paged FCB Lrnt - - Non paged transport Lrps - - Paged security entry Lrte - - Transport event. Lrxx - - Transceive context blocks Lr!! - - Cancel request context blocks Lrmt - - MPX table Lrme - - MPX table entries Lrsx - - Send contexts Lraw - - Async write context Lrwb - - Write behind buffer header Lrbb - - Write behind buffer Lrwq - - Work queue item Lrac - - ACL for redirector Lrds - - Security Descriptor for redirector Lrsm - - SMB buffer Lrds - - Duplicated ansi string Lrdu - - Duplicated unicode string Lxpt - - Transport Lrtc - - Transport connection Lrna - - Netbios Addresses Lrca - - Temporary storage used in name canonicalization Lr2x - - Transact SMB context Lrpt - - Primary transport server list Lrso - - Operating system name Lref - - Reference history (debug only) LS?? - - LM server allocations LSac - - BlockTypeAdminCheck LSas - - BlockTypeAdapterStatus LSbf - - buffer descriptor LScd - - comm device LScn - - connection LSdb - - data buffer LSdc - - BlockTypeDirCache LSdi - - BlockTypeDirectoryInfo LSep - - endpoint LSfn - - BlockTypeFSName LSlf - - LFCB LSlr - - BlockTypeLargeReadX LSmf - - MFCB LSmi - - BlockTypeMisc LSnh - - nonpaged block header LSni - - BlockTypeNameInfo LSop - - oplock break wait LSpc - - paged connection LSpm - - paged MFCB LSpr - - paged RFCB LSrf - - RFCB LSsc - - search(core) LSsd - - BlockTypeShareSecurityDescriptor LSsf - - BlockTypeDfs LSsh - - share LSsp - - search(core complete) LSsr - - search LSss - - session LStb - - table LStc - - tree connect LSti - - timer LStr - - transaction LSvi - - BlockTypeVolumeInformation LSwi - - initial work context LSwn - - normal work context LSwq - - BlockTypeWorkQueue LSwr - - raw work context LSws - - BlockTypeWorkContextSpecial LSnd - - WDM mini sound driver for Logitech video camera Luaf - luafv.sys - LUA File Virtualization LXMK - - kernel mixer line driver (KMXL - looks like they got their tag backwards) MXF - - DirectMusic (MIDI Transform Filter) MapP - - PNP map Mapr - - arc firmware registry routines McaC - hal.dll - HAL MCA corrected Log McaD - hal.dll - HAL MCA Driver Log McaK - hal.dll - HAL MCA Kernel Log McaP - hal.dll - HAL MCA Log from previous boot McaT - hal.dll - HAL MCA temporary Log MCAM - - WDM mini driver for Intel USB camera MCDx - - OpenGL MCD server (mcdsrv32.dll) allocations MCDd - - OpenGL MCD driver (embedded in a display driver like s3mvirge.dll) Mdl - - Io, Mdls MdlP - - MDL per processor lookaside list pointers MePr - - In-memory print buffer mkup - mpsdrv.sys - MPSDRV upcall request Mm - nt!mm - general Mm Allocations MmAc - nt!mm - Mm access log buffers MmBk - nt!mm - Mm banked sections MmCa - nt!mm - Mm control areas for mapped files MmCd - nt!mm - Mm fork clone descriptors MmCh - nt!mm - Mm fork clone headers MmCi - nt!mm - Mm control areas for images MmCl - nt!mm - Mm fork clone prototype PTEs MmCm - nt!mm - Calls made to MmAllocateContiguousMemory MmCr - nt!mm - Mm fork clone roots MmCt - nt!mm - Mm debug tracing MmDb - nt!mm - NtMapViewOfSection service MmDT - nt!mm - Mm debug MmEx - nt!mm - Mm events MmHi - nt!mm - Mm image entry - allocated per session MmHn - nt!mm - Mm sessionwide address name string entry MmHv - nt!mm - Mm sessionwide address entry MmIn - nt!mm - Mm inpaged io structures MmLd - nt!mm - Mm load module database MmPd - nt!mm - Mm page table commitment bitmaps MmPg - nt!mm - Mm page table pages at init time MmRp - nt!mm - Mm repurpose logging MmRw - nt!mm - Mm read write virtual memory buffers MmSb - nt!mm - Mm subsections MmSe - nt!mm - Mm secured VAD allocation MmSg - nt!mm - Mm segments MmSt - nt!mm - Mm section object prototype ptes MmSy - nt!mm - Mm PTE and IO tracking logs Mmdl - nt!mm - Mm Mdls for flushes Mmpp - nt!mm - Mm prototype PTEs for pool Mmpr - nt!mm - Mm physical VAD roots MmVd - nt!mm - Mm virtual address descriptors for mapped views MmVs - nt!mm - Mm virtual address descriptors short form (private views) Mmxx - nt!mm - Mm temporary allocations MmCx - nt!mm - info for dynamic section extension MmDm - nt!mm - deferred MmUnlock entries MmHt - nt!mm - session space PTE data MmLn - nt!mm - temporary name buffer for driver loads MmMl - nt!mm - physical memory range information MmPa - nt!mm - pagefile space deletion slist entries MmRl - nt!mm - temporary readlists for file prefetch MmSP - nt!mm - SLIST entries for system PTE NB queues MmSi - nt!mm - Control area security image stubs MmSc - nt!mm - subsections used to map data files MmSd - nt!mm - extended subsections used to map data files MmSm - nt!mm - segments used to map data files MmWe - nt!mm - Work entries for writing out modified filesystem pages. MmWw - nt!mm - Write watch VAD info Mmpv - nt!mm - Physical view VAD info Mmww - nt!mm - Write watch bitmap VAD info Mn01 - monitor.sys - ACPI method evaluation output buffer Mn02 - monitor.sys - Unused Mn03 - monitor.sys - Raw E-EDID v.1.x byte stream including base block + extension blocks (if any) Mn04 - monitor.sys - Cached monitor ID WMI data block Mn05 - monitor.sys - Cached monitor basic display parameters WMI data block Mn06 - monitor.sys - Cached monitor analog video input parameters WMI data block Mn07 - monitor.sys - Cached monitor digitial video input parameters WMI data block Mn08 - monitor.sys - Cached monitor color characteristics WMI data block Mn09 - monitor.sys - Cached supported monitor source modes WMI data block Mn0A - monitor.sys - Registry subkey info buffer Mn0B - monitor.sys - Registry value buffer Mn0C - monitor.sys - Cached supported monitor frequency ranges WMI data block (overrides from registry) Mn0D - monitor.sys - Cached supported monitor frequency ranges WMI data block (from E-EDID v.1.x base block) Mn0E - monitor.sys - Buffer for E-EDID v.1.x base block, if any, populated by miniport Mn0F - monitor.sys - Buffer for E-EDID v.1.x extension block(s), if any, populated by miniport MNFf - msnfsflt.sys - NFS FS Filter, filename buffer MNFi - msnfsflt.sys - NFS FS Filter, instance name buffer MNFr - msnfsflt.sys - NFS FS Filter, registry access buffer MNFs - msnfsflt.sys - NFS FS Filter, general string buffer MNFv - msnfsflt.sys - NFS FS Filter, volume name buffer MNFC - msnfsflt.sys - NFS FS Filter, callback context MNFF - msnfsflt.sys - NFS FS Filter, file context MNFI - msnfsflt.sys - NFS FS Filter, instance context MNFS - msnfsflt.sys - NFS FS Filter, stream context MNFT - msnfsflt.sys - NFS FS Filter, thread array MQAA - mqac.sys - MSMQ driver, AVL allocations MQAB - mqac.sys - MSMQ driver, CCursor allocations MQAC - mqac.sys - MSMQ driver, generic allocations MQAD - mqac.sys - MSMQ driver, CDistribution allocations MQAG - mqac.sys - MSMQ driver, CGroup allocations MQAH - mqac.sys - MSMQ driver, Heap allocations MQAP - mqac.sys - MSMQ driver, CPacket allocations MQAQ - mqac.sys - MSMQ driver, CQueue allocations MQAT - mqac.sys - MSMQ driver, CTransaction allocations MRXx - - Client side caching for SMB Msdv - - WDM mini driver for IEEE 1394 DV Camera and VCR MST? - - MSTEE (mstee.sys) MSTa - - associated stream header MSTc - - filer connection MSTd - - data format MSTf - - filter instance MSTp - - pin instance MSTs - - stream header MuoC - - MOUSE_POOL_TAG Mouse Class Driver MsFc - - Mailslot CCB, Client control block. Each client with an opened mailslot has one of these MsFC - - Mailslot root CCB, A client control block for the top level mailslot directory MsFd - - Mailslot data entry write buffer, This is writes buffered inside mailslots MsFD - - Mailslot root DCB and its name buffer MsFf - - Mailslot FCB, File control block, Service side block for each created mailslot. MsFg - - Mailslot global resource MsFn - - Mailslot temporary name buffer MsFN - - Mailslot FCB name buffer, name for each created mailslot MsFr - - Mailslot read buffer, buffer created for pended reads issued. MsFt - - Mailslot query template, used for directory queries. MsFw - - Mailslot work context block, blocks create when we need to timeout reads. MsvC - ksecdd.sys - Msv/Ntlm client package Mup - mup.sys - Multiple UNC provider allocations, generic MupI - mup.sys - Windows Server 2003 and prior versions: DFS Irp Context allocation MuDn - mup.sys - Device name MuFc - mup.sys - File Context MuFn - mup.sys - File name rewrite MuIc - mup.sys - IRP Context MuMc - mup.sys - Master context MuQc - mup.sys - Query context MuSi - mup.sys - Surrogate info MuSf - mup.sys - Surrogate file info MuSr - mup.sys - Surrogate IRP info MuPe - mup.sys - Known prefix entry MuPi - mup.sys - Provider info MuUn - mup.sys - UNC provider Muta - - Mutant objects NBF - - general NBF allocations NBFa - - NBF address object NBFb - - NBF receive buffer NBFc - - NBF connection object NBFd - - NBF packet pool descriptor NBFe - - NBF bind & export names NBFf - - NBF address file object NBFg - - NBF registry path name NBFi - - NBF tdi connection info NBFk - - NBF loopback buffer NBFl - - NBF link object NBFn - - NBF netbios name NBFo - - NBF config data NBFp - - NBF packet NBFq - - NBF query buffer NBFr - - NBF request NBFs - - NBF provider stats NBFt - - NBF connection table NBFu - - NBF UI frame NBFw - - NBF work item NBI - - NwlnkNb transport NBS - - general NetBIOS allocations NBSa - - address block NBSc - - connection block NBSe - - EA buffer NBSf - - FCB NBSl - - LANA block NBSn - - copy of user NCB NBSr - - registry allocations NBSx - - XNS NETONE address (connect block) NBSy - - NetBIOS address (connect block) NBSz - - NetBIOS address (listen block) NBqh - - Non-blocking queue entries used to carry the real data in the queue. NCSt - - EXIFS NC ND - ndis.sys - general NDIS allocations NDDl - ndis.sys - NDIS_TAG_DBG_LOG NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK NDPX - ndis.sys - NDIS Proxy allocations NDPa - ndis.sys - Apple Talk NDPb - ndis.sys - NBF NDPi - ndis.sys - NWLNKIPX NDPn - ndis.sys - NWLNKNB NDPp - ndis.sys - Packet Scheduler. NDPs - ndis.sys - NWLNKSPX NDPt - ndis.sys - TCPIP NDPw - ndis.sys - WAN_PACKET_TAG NDam - ndis.sys - NdisAllocateMemory NDan - ndis.sys - adapter name NDco - ndis.sys - NDIS_TAG_CO NDd - ndis.sys - NDIS_TAG_DBG NDdb - ndis.sys - DMA block NDdl - ndis.sys - NDIS_TAG_DBG_L NDdp - ndis.sys - NDIS_TAG_DBG_P NDds - ndis.sys - NDIS_TAG_DBG_S NDdt - ndis.sys - NDIS_TAG_DFRD_TMR NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR NDlb - ndis.sys - lookahead buffer NDlp - ndis.sys - NDIS_TAG_LOOP_PKT NDmb - ndis.sys - MAC block NDmr - ndis.sys - map register entry array NDoa - ndis.sys - NDIS_TAG_OID_ARRAY NDob - ndis.sys - open block NDpb - ndis.sys - protocol block NDpf - ndis.sys - NDIS_TAG_FILTER NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN NDpp - ndis.sys - packet pool NDrl - ndis.sys - resource list NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH NDrq - ndis.sys - NDIS_TAG_Q_REQ NDsi - ndis.sys - EISA slot information NDsm - ndis.sys - Cached shared memory descriptor NDst - ndis.sys - NDIS_TAG_STRING NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM NDwi - ndis.sys - NDIS_TAG_WORK_ITEM Nb?? - - NetBT allocations Nf?? - nfssvr.sys - NFS (Network File System) allocations NfR? - nfsrdr.sys - NFS (Network File System) client re-director Nls - - Nls strings NlsK - nt!ex - Nls data Nmdd - - NetMeeting display driver miniport 1 MB block None - - call to ExAllocatePool Npf* - npfs.sys - Npfs Allocations NpFc - npfs.sys - CCB, client control block NpFC - npfs.sys - ROOT_DCB CCB NpFD - npfs.sys - DCB, directory block NpFg - npfs.sys - Global storage NpFi - npfs.sys - NPFS client info buffer. NpFn - npfs.sys - Name block NpFq - npfs.sys - Query template buffer used for directory query NpFr - npfs.sys - DATA_ENTRY records (read/write buffers) NpFs - npfs.sys - Client security context NpFw - npfs.sys - Write block NpFW - npfs.sys - Write block NS?? - - Netware server allocations Ntf? - ntfs.sys - NTFS Specific allocation tags Ntf0 - ntfs.sys - general pool allocation Ntf9 - ntfs.sys - Large Temporary Buffer NtfC - ntfs.sys - CCB Ntfc - ntfs.sys - CCB_DATA NtfD - ntfs.sys - DEALLOCATED_RECORDS NtfE - ntfs.sys - INDEX_CONTEXT NtfF - ntfs.sys - FCB_INDEX Ntff - ntfs.sys - FCB_DATA NtfI - ntfs.sys - NTFS_IO_CONTEXT Ntfi - ntfs.sys - IRP_CONTEXT NtfK - ntfs.sys - KEVENT Ntfk - ntfs.sys - FILE_LOCK Ntfl - ntfs.sys - LCB NtfM - ntfs.sys - NTFS_MCB_ENTRY Ntfm - ntfs.sys - NTFS_MCB_ARRAY NtfN - ntfs.sys - NUKEM Ntfn - ntfs.sys - SCB_NONPAGED Ntfo - ntfs.sys - SCB_INDEX normalized named buffer NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK Ntfq - ntfs.sys - General Allocation with Quota NtfR - ntfs.sys - READ_AHEAD_THREAD Ntfr - ntfs.sys - ERESOURCE NtfS - ntfs.sys - SCB_INDEX Ntfs - ntfs.sys - SCB_DATA NtfT - ntfs.sys - SCB_SNAPSHOT Ntft - ntfs.sys - SCB (Prerestart) NtfV - ntfs.sys - VPB Ntfv - ntfs.sys - COMPRESSION_SYNC Ntfw - ntfs.sys - Workspace Ntfx - ntfs.sys - General Allocation NtF? - ntfs.sys - NTFS tags based on source module NtFa - ntfs.sys - AllocSup.c NtFA - ntfs.sys - AttrSup.c NtFB - ntfs.sys - BitmpSup.c NtFC - ntfs.sys - Create.c NtFD - ntfs.sys - DevioSup.c NtFd - ntfs.sys - DirCtrl.c NtFE - ntfs.sys - Ea.c NtFF - ntfs.sys - FileInfo.c NtFf - ntfs.sys - FsCtrl.c NtFH - ntfs.sys - SelfHeal.c NtFI - ntfs.sys - IndexSup.c NtFL - ntfs.sys - LogSup.c NtFM - ntfs.sys - McbSup.c NtFN - ntfs.sys - NtfsData.c NtFO - ntfs.sys - ObjIdSup.c NtFQ - ntfs.sys - QuotaSup.c NtFR - ntfs.sys - RestrSup.c NtFS - ntfs.sys - SecurSup.c NtFs - ntfs.sys - StrucSup.c NtFU - ntfs.sys - usnsup.c NtFV - ntfs.sys - VerfySup.c NtFv - ntfs.sys - ViewSup.c NtFW - ntfs.sys - Write.c NV - - (nVidia video driver) Resource manager data NvLA - - (nVidia video driver) Adapter data NvLa - - (nVidia video driver) Allocation data NvLC - - (nVidia video driver) Channel data NvLc - - (nVidia video driver) Class data NvLD - - (nVidia video driver) Device data NvLd - - (nVidia video driver) DMA data NvLE - - (nVidia video driver) Event data NvLH - - (nVidia video driver) Generic data NvLm - - (nVidia video driver) Mode data NvLP - - (nVidia video driver) Profile data NvLp - - (nVidia video driver) Pusher data NvLR - - (nVidia video driver) Registry data NvLr - - (nVidia video driver) Resource data NvLS - - (nVidia video driver) Statistics data NvLs - - (nVidia video driver) Semaphore data NvLT - - (nVidia video driver) Context data Nwcs - - Client Services for NetWare NwFw - - ntos\tdi\fwd ObSq - nt!ob - object security descriptors (query) ObCi - nt!ob - captured information for ObCreateObject ObCI - nt!ob - object creation lookaside list ObDi - nt!ob - object directory ObHd - nt!ob - object handle count data base ObNm - nt!ob - object names ObNM - nt!ob - name buffer per processor lookaside pointers ObRt - nt!ob - object reference stack tracing ObZn - nt!ob - object zone ObjT - nt!ob - object type objects Obtb - nt!ob - object tables via EX handle.c ObTR - nt!ob - object table ERESOURCEs Obeb - nt!ob - object tables extra bit tables via EX handle.c ObDm - nt!ob - object device map ObSc - nt!ob - Object security descriptor cache block ObSt - nt!ob - Object Manager temporary storage OHCI - - Open Host Controller Interface for USB ohci - - 1394 OHCI host controller driver Ovfl - - The internal pool tag table has overflowed - usually this is a result of nontagged allocations being made OvfL - - EXIFS FCBOVF List PaeD - - PAE top level directory allocation blocks ParC - - Parallel class driver ParL - - Parallel link driver ParP - - Parallel port driver ParV - - ParVdm driver for vdm<->parallel port communciation PciB - pci.sys - PnP pci bus enumerator PcCi - - WDM audio port class adapter device object stuff PcCr - - WDM audio stuff PcDi - - WDM audio stuff PcDm - - DirectMusic MXF objects (WDM audio) PcFM - - WDM audio FM synthesizer PcFp - - WDM audio stuff PcIc - - WDM audio stuff PcIl - - WDM audio stuff PcNw - - WDM audio stuff PcPc - - WDM audio stuff PcPr - - WDM audio stuff PcSX - - WDM audio stuff PcSl - - WDM audio stuff PcSt - - WDM audio stuff PcSx - - WDM audio stuff PcUs - - WDM audio stuff Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures Pcic - - Pcmcia bus enumerator, PCIC/Cardbus controller specific structures Pcdb - - Pcmcia bus enumerator, Databook controller specific structures Pf?? - nt!pf - Pf Allocations PfAL - nt!pf - Pf Application launch event data PfAS - nt!pf - Pf Prefetch support array PfDq - nt!pf - Pf Directory query buffers PfED - nt!pf - Pf Generic event data PfEL - nt!pf - Pf Event logging buffers PfET - nt!pf - Pf Entry info tables PfFH - nt!pf - Pf RpContext FileKeyHash buckets PfFK - nt!pf - Pf RpContext FileKeyHashEntry PfLB - nt!pf - Pf Log buffers PfMP - nt!pf - Pf Prefetch metadata buffers PfNL - nt!pf - Pf Name logging buffers PfOB - nt!pf - Pf Oplock buffers PfPB - nt!pf - Pf Pfn query buffers PfRL - nt!pf - Pf Prefetch read list PfRQ - nt!pf - Pf Prefetch request buffers PfSA - nt!pf - Pf Prefetch support array PfTD - nt!pf - Pf Trace Dump PfTt - nt!pf - Pf Translation tables PfVA - nt!pf - Pf VA prefetching buffers PfVH - nt!pf - Pf Prefetch volume handles Pgm? - - Pgm (Pragmatic General Multicast) protocol: RMCast.sys Plcp - - Cache aware pushlock list (array of puchlock addresses) Plcl - - Cache aware pushlock entry. One per processor PmpA - portmap.sys - Portmap address list PmpC - portmap.sys - Portmap device context PmpM - portmap.sys - Portmap mapping PmpR - portmap.sys - Portmap RPCB PNCH - - Power Notify Channel PNCL - - Power Notify channel list PNDP - - Power Abort Dpc Routine PNI - - Power Notify Instance Pool - - Pool tables, etc. PooL - - Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures Port - - Port objects PoSL - - Power shutdown event list PPMd - - Processor Drivers (Processor Power Management). PPMi - nt!po - Kernel Processor Power Management Idle States. PPMp - nt!po - Kernel Processor Power Management Perf States. PPMw - nt!po - Kernel Processor Power Management WMI interface. Prof - - Profile objects POWI - nt!po - Power Work Item (executive worker thread work item entry) PSwt - nt!po - Power switch structure PSTA - nt!po - Po registered system state PDss - nt!po - Po device system state PpTg - mpsdrv.sys - MPSDRV PPTP GRE analyzer PpTt - mpsdrv.sys - MPSDRV PPTP TCP analyzer Prcr - processr.sys - Processr driver allocations Proc - nt!ps - Process objects Ps - nt!ps - general ps allocations Psap - nt!ps - Block used to hold a user mode APC while its queued to a thread PsAp - nt!ps - Process APC queued by user mode process PsCa - nt!ps - APC queued at thread create time. PsCr - nt!ps - Working set change record (temporary allocation) PsEx - nt!ps - Process exit APC PsFn - nt!ps - Captured image file name buffer (temporary allocation) PsHl - nt!ps - Captured list of handles to inherit in child process (temporary allocation) PsIm - nt!ps - Thread impersonation (PS_IMPERSONATE_INFORMATION, pre-Vista) PsJa - nt!ps - Job access control state Psjb - nt!ps - Job set array (temporary allocation) PsLd - nt!ps - Process LDT information blocks PsPb - nt!ps - Captured process parameter block (temporary allocation) PsQb - nt!ps - Process quota block PsRl - nt!ps - Captured memory reserve list (temporary allocation) PsSb - nt!ps - Initial process parameter block (temporary allocation) PsSd - nt!ps - Augmented thread security descriptor (temporary allocation) PsTf - nt!ps - Job object token filter Pstb - nt!ps - Process tables via EX handle.c Psta - nt!ps - Power management system state PsTp - nt!ps - Thread termination port block PsWs - nt!ps - Process working set watch array PSE3 - pse36.sys - Physical Size Extension driver Pnp0 - nt!pnp - PNPMGR rebalance resource request table Pnp1 - nt!pnp - PNPMGR IRP completion context Pnp2 - nt!pnp - PNPMGR device action request Pnp3 - nt!pnp - PNPMGR dock serial numbers Pnp4 - nt!pnp - PNPMGR dock state Pnp5 - nt!pnp - PNPMGR assign resources context Pnp6 - nt!pnp - PNPMGR resource request Pnp7 - nt!pnp - PNPMGR deferred notify entry Pnp8 - nt!pnp - PNPMGR async target device change notify Pnp9 - nt!pnp - PNPMGR HW profile notify PnpA - nt!pnp - PNPMGR HW profile event PnpB - nt!pnp - PNPMGR setup notify PnpC - nt!pnp - PNPMGR target device notify PnpD - nt!pnp - PNPMGR device class notify PnpE - nt!pnp - PNPMGR veto name PnpF - nt!pnp - PNPMGR eject data PnpG - nt!pnp - PNPMGR generic PnpH - nt!pnp - PNPMGR service name PnpI - nt!pnp - PNPMGR instance path PnPb - nt!pnp - PnP BIOS resource manipulation PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG PpLg - nt!pnp - PnP last good. PpUB - nt!pnp - PNP_USER_BLOCK_TAG PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG Ppcd - nt!pnp - PnP critical device database Ppcr - nt!pnp - plug-and-play critical allocations Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs Ppde - nt!pnp - routines to perform device removal Ppei - nt!pnp - Eisa related code Ppen - nt!pnp - routines to perform device enumeration Ppin - nt!pnp - plug-and-play initialization Ppio - nt!pnp - plug-and-play IO system APIs PPMi - nt!po - Processor Power Manager Idle States PPMp - nt!po - Processor Power Manager Perf States PPMw - nt!po - Processor Power Manager WMI Interface Ppre - nt!pnp - resource allocation and translation Pprl - nt!pnp - routines to manipulate relations list Ppsu - nt!pnp - plug-and-play subroutines for the I/O system PPTP - - PPTP_MEMORYPOOL_TAG PPT0 - - PPTP_TDIADDR_TAG PPT1 - - PPTP_TDICONN_TAG PPT2 - - PPTP_CONNINFO_TAG PPT3 - - PPTP_ADDRINFO_TAG PPT4 - - PPTP_TIMEOUT_TAG PPT5 - - PPTP_TIMER_TAG PPT6 - - PPTP_TDICOTS_TAG PPT7 - - PPTP_WRKQUEUE_TAG PPT8 - - PPTP_SEND_CTRLDATA_TAG PPT9 - - PPTP_SEND_ACKDATA_TAG PPTa - - PPTP_SEND_DGRAMDESC_TAG PPTb - - PPTP_TDICLTS_TAG PPTc - - PPTP_RECV_CTRLDESC_TAG PPTd - - PPTP_RECV_CTRLDATA_TAG PPTe - - PPTP_RECV_DGRAMDESC_TAG PPTf - - PPTP_RECV_DGRAMDATA_TAG PPTg - - PPTP_RECVDESC_TAG PPTh - - PPTP_ENGINE_TAG PPTi - - PPTP_RECVDATA_TAG PRF? - nt!wdi - Performance Allocations PRFd - nt!wdi - Performance Diagnostics Structures PSC? - - Packet Scheduler (PSCHED) Tags PSC0 - - NDIS Request PSC1 - - GPC Client Vc PSC2 - - WanLink PSC3 - - Miscellaneous allocations PSC4 - - WMI PSCa - - Adapter PSCb - - CallParameters PSCc - - PipeContext PSCd - - FlowContext PSCe - - ClassMapContext PSCf - - Adapter Profile PSCg - - Component PX1 - - ndis ProviderEventLookaside p2?? - perm2dll.dll - Permedia2 display driver p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c p2de - perm2dll.dll - Permedia2 display driver - debug.c p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c p2en - perm2dll.dll - Permedia2 display driver - enable.c p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c p2he - perm2dll.dll - Permedia2 display driver - heap.c p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c p2pa - perm2dll.dll - Permedia2 display driver - palette.c p2pe - perm2dll.dll - Permedia2 display driver - permedia.c p2tx - perm2dll.dll - Permedia2 display driver - textout.c P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D P3G? - perm3dd.dll - Permedia3 display driver Qnam - - EXIFS Query Name Qp?? - - Generic Packet Classifier (MSGPC) Qppn - - Queued Notifications Qppi - - Pending Irp structures Qpci - - CfInfo Qpct - - Client blocks Qppa - - Pattern blocks Qphf - - HandleFactory Qpph - - PathHash Qprz - - Rhizome Qppd - - GenPatternDb Qpfd - - FragmentDb Qpcf - - ClassificationFamily Qpcd - - CfInfoData Qpcb - - ClassificationBlock Qppt - - Protocol Qpdg - - Debug QuU2 - mpsdrv.sys - MPSDRV upcall response RB?? - - RedBook Filter Driver, static allocations RBEv - - RedBook - Thread Events RBRl - - RedBook - Remove lock RBRg - - RedBook - driverExtension->RegistryPath RBSe - - RedBook - Serialization tracking for checked builds RBWa - - RedBook - Wait block for system thread rb?? - - RedBook Filter Driver, dynamic allocations rbBu - - RedBook - Buffer for read/stream rbIr - - RedBook - Irp for read/stream rbIp - - RedBook - Irp pointer block rbMd - - RedBook - Mdl for read/stream rbMp - - RedBook - Mdl pointer block rbRc - - RedBook - Read completion context rbRx - - RedBook - Read Xtra info rbSc - - RedBook - Stream completion context rbSx - - RedBook - Stream Xtra info rbTo - - RedBook - Cached table of contents Rcp? - sacdrv.sys - SAC Driver (Headless) RcpA - sacdrv.sys - Internal memory mgr alloc block RcpI - sacdrv.sys - Internal memory mgr initial heap block RcpS - sacdrv.sys - Security related block ReEv - - Resource Event ReSe - - Resource Semaphore Reso - nt!tm - KTM Transactional ResourceManager ReTa - - Resource Extended Table RefT - - Bluetooth reference tracking Rf?? - - Bluetooth RFCOMM TDI driver RfAD - rfcomm.sys - RFCOMM Address RfBB - rfcomm.sys - RFCOMM BRB RfBT - rfcomm.sys - RFCOMM (bthport) RfCB - rfcomm.sys - RCOMMM RfCH - rfcomm.sys - RFCOMM channel RfCN - rfcomm.sys - RFCOMM connect RfDA - rfcomm.sys - RFCOMM data RfFR - rfcomm.sys - RFCOMM frame RfRX - rfcomm.sys - RFCOMM receive RfPP - rfcomm.sys - RFCOMM pnp RfWR - rfcomm.sys - RFCOMM worker RKRW - mpsdrv.sys - MPSDRV work item RTLF - mpsdrv.sys - MPSDRV filter RpcL - msrpc.sys - debugging log data - present on checked builds only RpcM - msrpc.sys - all msrpc.sys allocations not covered elsewhere Rpcr - msrpc.sys - not currently used RRle - - RTL_RANGE_LIST_ENTRY_TAG RRlm - - RTL_RANGE_LIST_MISC_TAG RtPi - - Temp allocation for product type key Rpcl - msrpc.sys - MSRpc memory logging - checked build only Rpcm - msrpc.sys - MSRpc memory allocations Rpcr - msrpc.sys - MSRpc resources Rpcs - msrpc.sys - Memory shared b/n MSRpc and caller RPrt - rstorprt.sys - Remote Storage Port Driver Rqrv - - Registry query buffer RS?? - - Remote Storage RSFS - - Recall Queue RSFN - - File Name RSSE - - Security info RSWQ - - Work Queue RSQI - - Queue info RSLT - - Long term data RSIO - - Ioctl Queue RSFO - - File Obj queue RSVO - - Validate Queue RSER - - Error log data RtlT - nt!rtl - Temporary RTL allocation RWan - rawwan.sys - Raw WAN driver R300 - - ATI video driver RX00 - - ATI video driver Rx?? - - Rdr2 rdbss.sys stuff RxSc - - SrvCall RxNr - - NetRoot RxVn - - VNetRoot RxFc - - FCB RxSo - - SrvOpen RxFx - - Fobx RxNf - - nonpaged FCB RxWq - - work queue RxBm - - buffering manager RxMs - - misc. RxIr - - RxContext (IrpContext) RxMx - - minirdr dispatch table RxNc - - NameCache (not currently used) RxCt - - connection engine transport RxCa - - connection engine address RxCc - - connection engine connection RxCv - - connection engine VC RxCd - - connection engine TDI RxSp - - srvcall calldown params (special build only) RxVp - - vnetroot calldown params (special build only) RxTm - - timer context (special build only) RxDc - - querydirectory pattern (special build only) RxCx - - connection engine misc. (special build only) S3 - - S3 video driver SBad - - bad block simulator - simbad.c sbp2 - - Sbp2 1394 storage port driver SC?? - - Smart card driver tags SCLb - - Smart card driver library SCB8 - - Bull CP8 Transac serial reader SCB3 - - Bull SmarTlp PnP SCS4 - - SCM Microsystems pcmcia reader SCl0 - - Litronic 220 Sc?? - - Mass storage driver tags ScB? - classpnp.sys - ClassPnP misc allocations ScC? - classpnp.sys - ClassPnP misc allocations ScC? - - CdRom ScCE - - device control synch event ScCG - - disk geometry buffer ScCH - - hitachi error buffer ScCI - - sense info buffers ScCS - - srb allocation ScCM - - mode data buffer ScCP - - read capacity buffer ScCp - - play active checks ScCQ - - read sub q buffer ScCR - - raw mode read buffer ScCT - - read toc buffer ScCt - - toshiba error buffer ScCU - - update capacity path ScCV - - volume control buffer ScCv - - volume control buffer ScD? - - Disk ScD - - generic tag ScDa - - SMART ScDA - - Info Exceptions ScDC - - disable cache paths ScDb - classpnp.sys - ClassPnP debug globals buffer ScDc - - disk allocated completion c ScDG - - disk geometry buffer ScDg - - update disk geometry paths ScDI - - sense info buffers ScDp - - pnp ids ScDM - - mode data buffer ScDM - - mbr checksum code ScDN - - disk name code ScDP - - read capacity buffer ScDp - - disk partition lists ScDS - - srb allocation ScDs - - start device paths ScDU - - update capacity path ScDW - - work-item context ScMC - - medium changer allocations ScIO - classpnp.sys - ClassPnP device control ScL? - classpnp.sys - Classpnp ScLA - classpnp.sys - allocation to check for autorun disable ScLF - classpnp.sys - File Object Extension ScLc - classpnp.sys - Cache filters ScLf - classpnp.sys - Fault prediction ScLm - classpnp.sys - Mount ScLM - classpnp.sys - Media Change Detection ScLq - classpnp.sys - Release queue ScLw - classpnp.sys - WMI ScLW - classpnp.sys - Power ScNo - classpnp.sys - ClassPnP notification ScP? - - Scsiport ScPa - - Hold registry data ScPA - - Access Ranges ScPb - - Get Bus Dat Holder ScPB - - Queuetag BitMap ScPc - - Fake common buffer ScPC - - reset bus code ScPd - - Pnp id strings ScPD - - SRB_DATA allocations ScPE - - Scatter gather lists ScPG - - Global memory ScPh - - HwDevice Ext ScPi - - Sense Info ScPI - - Init data chain ScPl - - remove lock tracking ScPL - - scatter gather lists ScPm - - address mapping lists ScPM - - scatter gather lists ScPp - - device & adapter enable ScpP - - scsi PortConfig copies ScPq - - inquiry data ScPQ - - request sense ScPr - - resource list copy ScPS - - registry allocations ScPt - - legacy request rerouting ScPT - - interface mapping ScPu - - device relation structs ScPv - - KEVENT ScPV - - Device map allocations ScPw - - Wmi Events ScPW - - Wmi Requests ScPx - - Report Luns ScPY - - Report Targets ScPZ - - Device name buffer ScR? - - Partition Manager ScRi - - IOCTL buffer ScRp - - Partition entry ScRr - - Remove lock ScRt - - Table entry ScRv - - Dependant volume relations lists ScRV - - Volume entry ScRw - - Power mgmt private work item ScsC - - non-pnp SCSI CdRom ScsD - - non-pnp SCSI Disk ScsH - - non-pnp SCSI from class.h (class2) ScsI - - non-pnp SCSI port internal ScsL - - non-pnp SCSI class.c driver allocations ScsP - - non-pnp SCSI port.c Scs$ - - Tag for pnp class driver's SRB lookaside list ScUn - - Default Tag for pnp class driver allocations ScV? - - Dvd functionality in cdrom.sys ScVk - - read buffer for DVD keys ScVK - - write buffer for DVD keys ScVS - - buffer for reads of DVD on-disk structures SdCc - - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES Sdba - - Application compatibility Sdb* allocations Sdp? - - Bluetooth SDP functionality in BTHPORT.sys SdpC - bthport.sys - Bluetooth SDP client connection SdpD - bthport.sys - Bluetooth SDP database SdpI - bthport.sys - Bluetooth port driver (SDP) Se - nt!se - General security allocations SeAc - nt!se - Security ACL SeAi - nt!se - Security Audit Work Item SeAp - nt!se - Security Audit Parameter Record SeCL - nt!se - Security CONTEXT_TAG SeDb - nt!se - Temp directory query buffer to delete logon session symbolic links. SeFS - nt!se - SEP_FILE_SYSTEM_NOTIFY_CONTEXT SeHa - nt!se - Temp directory query buffer to delete logon session symbolic links. SeLs - nt!se - Security Logon Session SeLu - nt!se - Security LUID and Attributes array SeLS - nt!se - Security Logon Session tracking array SeLw - nt!se - Security LSA Work Item SeOn - nt!se - Security Captured Object Name information SeOt - nt!se - Captured object type array. Used by access check code SePa - nt!se - Process audit image names and captured polity structures SePh - nt!se - Dummy image page hash structure. Used when CI is disabled. SePr - nt!se - Security Privilege Set SeSa - nt!se - Security SID and Attributes SeSc - nt!se - Captured Security Descriptor SeSd - nt!se - Security Descriptor SeSi - nt!se - Security SID SeTa - nt!se - Security Temporary Array SeTd - nt!se - Security Token dynamic part SeTI - ksecdd.sys - Security TargetInfo SeTn - nt!se - Security Captured Type Name information SeUs - nt!se - Security Captured Unicode string Sect - - Section objects Sema - - Semaphore objects Senm - - Serenum (RS-232 serial bus enumerator) SimB - - Simbad (bad sector simulation driver) allocations SIfs - - Default tag for user's of ntsrv.h sidg - - GDI spooler events Sis - - Single Instance Store (dd\sis\filter) SisB - - SIS per file object break event SisC - - SIS common store file object SisF - - SIS per file object SisL - - SIS per link object SisS - - SIS SCB Setp - - SETUPDD SpMemAlloc calls SRdm - scsirdma.sys - Infiniband SRP driver SW?? - - Software Bus Enumerator SWbi - - bus ID SWbr - - bus reference SWda - - POOLTAG_DEVICE_ASSOCIATION SWdn - - device name SWdr - - device reference SWdr - - POOLTAG_DEVICE_DRIVER_REGISTRY SWfd - - POOLTAG_DEVICE_FDOEXTENSION SWid - - device ID SWii - - instance ID SWip - - POOLTAG_DEVICE_INTERFACEPATH SWki - - key information SWpd - - POOLTAG_DEVICE_PDOEXTENSION SWre - - relations SWrp - - reparse string SWrs - - reference string Sm?? - - rdr2 smb mini SmCe - - smbmini connection engine SmMm - - smbmini managed datastructures SmAd - - session setup/admin exchange SmRw - - read/write path SmTr - - transact exchange SmMs - - misc. SmTp - - server transport tag SmRb - - remote boot SmFc - - fsctl structures (special build only) SmDc - - dir query buffer (special build only) SmPi - - pipeinfo buffer (special build only) SmDO - - deferred open context (special build only) SmQP - - params for directory query transact (special build only) SmRx - - minirdr generated RxContext (special build only) SmVr - - VNetroot (special build only) SmSr - - Server (special build only) SmSe - - Session (special build only) SmNr - - NetRoot (special build only) SmMa - - mid atlas (special build only) SmMt - - mailslot buffer (special build only) SmVc - - smbmini connectionengine VC (special build only) SmEc - - echo buffer (special build only) SmKs - - Kerberos blob (special build only) SPX - - Nwlnkspx transport SQOS - - Security quality of service in IO Sr?? - sr.sys - System Restore file system filter driver SrCo - sr.sys - SR's control object SrSC - sr.sys - Stream contexts SrDB - sr.sys - Debug information for lookup blob SrDL - sr.sys - Device list SrFE - sr.sys - File information buffer SrFN - sr.sys - File name SrHB - sr.sys - Hash bucket SrHH - sr.sys - Hash header SrHK - sr.sys - Hash key SrLB - sr.sys - Log buffer SrLC - sr.sys - Logging context SrLE - sr.sys - Log entry SrLT - sr.sys - Lookup blob SrMP - sr.sys - Mount point information SrOI - sr.sys - Overwrite information SrPC - sr.sys - Persistant configuration information SrRB - sr.sys - Rename buffer SrRG - sr.sys - Logger context SrRH - sr.sys - Reparse data size SrRR - sr.sys - Registry information SrSD - sr.sys - Security data information SrST - sr.sys - Stream data information SrTI - sr.sys - Directory delete information SrWI - sr.sys - Work queue item SslC - ksecdd.sys - SSL kernel mode client allocations ST* - - New MMC compliant storage drivers Stac - - Stack Trace Database - i386 checked and built with NTNOFPO=1 only Strg - - Dynamic Translated strings Strm - - Streams and streams transports allocations SwMi - - SWMidi KS filter (WDM Audio) Symb - - Symbolic link objects Symt - - Symbolic link target strings SYPK - syspart.lib - Kernel mode system partition detection allocations SYSA - - Sysaudio (wdm audio) TAPI - - ntos\ndis\ndistapi TC?? - TCP - TCP/IP network protocol TCh? - - TCP/IP header pools TCPC - - TCP connection pool TCPT - - TCB pool TCPY - - SYN-TCB pool TCPr - - TCP request pool TDIc - - TDI resource TDId - - TDI resource TDIe - - TDI resource TDIf - - TDI resource TDIg - - TDI resource TDIk - - TDI resource TDIu - - TDI resource TDIv - - TDI resource thdd - - DirectDraw/3D handle manager table Thre - nt!ps - Thread objects Time - nt!ke - Timer objects TmDn - nt!tm - Tm Dynamic Name TmLo - nt!tm - Tm Log Entries TmNo - nt!tm - Tm Notification TmPa - nt!tm - Tm Propagate Argument TmPb - nt!tm - Tm Propagation Buffer TmPe - nt!tm - Tm Enlistment Pointers TmPi - nt!tm - Tm Protocol Information TmPo - nt!tm - Tm Propagation Output TmPp - nt!tm - Tm Protocol Pointers TmPr - nt!tm - Tm Protocol TmPx - nt!tm - Tm Protocol Array TmRi - nt!tm - Tm Recovery Information TmRq - nt!tm - Tm Propagation Request Toke - nt!se - Token objects TpWc - nt!ex - Threadpool minipacket context TpWo - nt!ex - Threadpool worker factory objects Tran - - EXIFS Translate TSBV - - WDM mini driver for Toshiba 750 capture TSdd - rdpdd.sys - RDPDD - Hydra Display Driver TSch - rdpwd.sys - RDPWD - Hydra char conversion TSic - termdd.sys - Terminal Services - ICA_POOL_TAG TSlc - rdpwd.sys - RDPWD - Hydra Licensing TSmc - - PDMCS - Hydra MCS Protocol Driver Tspk - ksecdd.sys - TS Package kernel mode client allocations TSq - - Terminal Services - Queue - TSQ_TAG TSrp - termdd.sys - Terminal Services - RP_ALLOC_TAG TSwd - rdpwd.sys - RDPWD - Hydra Winstation Driver TTFC - - Font file cache Ttfd - - TrueType Font driver Thrm - - Thermal zone structure Tun4 - - Tunnel cache allocation for long file name TunL - - Tunnel cache lookaside-allocated elements TunP - - Tunnel cache oddsized pool-allocated elements TunK - - Tunnel cache temporary key value Txcl - ntfs.sys - TXF_CLR_RESERVATION_CHUNK Txdl - ntfs.sys - TXF_DELETED_LINK Txdr - ntfs.sys - TXF_DEFAULT_READER_SECTION Txfc - ntfs.sys - TXF_FCB Txfe - ntfs.sys - TXF_FCB_EXTENSION Txfi - ntfs.sys - TXF_FCB_INFO Txfl - ntfs.sys - TXF_FCB_CLEANUP Txfo - ntfs.sys - TXF_FO Txfq - ntfs.sys - Txf quota block Txgd - ntfs.sys - TxfData global structure Txis - ntfs.sys - TXF_ISO_SNAPSHOT Txlf - ntfs.sys - TXF_FCB (large) Txls - ntfs.sys - TXF_CANCEL_LSN Txre - ntfs.sys - TXF_TOPS_RANGE_ENTRY Txsc - ntfs.sys - TXF_SCB Txsp - ntfs.sys - TXF_SAVEPOINT Txsp - ntfs.sys - TXF_SCB_PTR Txtc - ntfs.sys - TXF_TRANS_CANCEL_LIST Txtr - ntfs.sys - TXF_TRANS (Txf transaction context) Txvc - ntfs.sys - TXF_VCB Txvd - ntfs.sys - TXF_VSCB_TO_DEREF Txvf - ntfs.sys - TXF_VSCB_FILE_SIZES Txvl - ntfs.sys - TXF_VSCB Type - - Type objects UCAM - - USB digital camera library UDFV - - Udfs volume descriptor sequence descriptor buffer Udf1 - - Udfs file set descriptor buffer Udf2 - - Udfs volmume recognition sequence descriptor buffer Udf2 - - Udfs volume descriptor sequence descriptor buffer UdfC - - Udfs CRC table UdfD - - Udfs FID buffer for view spanning UdfF - - Udfs nonpaged Fcb errata UdfI - - Udfs IO context UdfL - - Udfs IRP context lite (delayed close) UdfS - - Udfs short file name UdfT - - Udfs generic table entry Udfb - - Udfs IO buffer Udfc - - Udfs IRP context Udfd - - Udfs file Fcb Udfe - - Udfs enumeration match expression Udff - - Udfs normalized full filename Udfi - - Udfs directory Fcb Udfl - - Udfs Lcb Udfp - - Udfs Pcb Udfs - - Udfs Sparing Mcb Udft - - Udfs CDROM TOC Udfv - - Udfs Vpb Udfx - - Udfs Ccb Udp - - Udp protocol (TCP/IP driver) Ufsc - - User FULLSCREEN UHCD - - Universal Host Controller (USB - Intel Controller) UHUB - - Universal Serial Bus Hub Ul?? - http.sys - tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; Uc?? - http.sys - i.e., the case of the leading "Ul" or "Uc" has been reversed. Ucac - http.sys - Auth Cache Pool UcCO - http.sys - Client Connection Ucmp - http.sys - Multipart String Buffer Ucre - http.sys - Receive Response Ucrp - http.sys - Response App Buffer Ucrq - http.sys - Request Pool UcSc - http.sys - Common Server Information UcSN - http.sys - Server name UcSP - http.sys - Process Server Information UcSp - http.sys - Sspi Pool UcST - http.sys - Server info table Uctd - http.sys - Response Tdi Buffer Ucte - http.sys - Entity Pool Ucto - http.sys - Tdi Objects Pool UlAB - http.sys - Auxiliary Buffer UlAO - http.sys - App Pool Object UlAP - http.sys - App Pool Process UlBL - http.sys - Binary Log File Entry UlBO - http.sys - Outstanding i/o UlCC - http.sys - Control Channel UlCE - http.sys - Config Group Tree Entry UlCH - http.sys - Config Group Tree Header UlCI - http.sys - Config Group URL Info UlCJ - http.sys - Config Group Object Pool UlCK - http.sys - Chunk Tracker UlCL - http.sys - Config Group LogDir UlCl - http.sys - Connection RefTraceLog UlCO - http.sys - Connection UlCT - http.sys - Config Group Timestamp UlCY - http.sys - Connection Count Entry UlDB - http.sys - Debug UlDC - http.sys - Data Chunks array UlDO - http.sys - Disconnect Object UlDR - http.sys - Deferred Remove Item UlDT - http.sys - Debug Thread Pool UlEP - http.sys - Endpoint UlFA - http.sys - Force Abort Work Item UlFC - http.sys - File Cache Entry Ulfc - http.sys - Uri Filter Context UlFD - http.sys - Noncached File Data UlFP - http.sys - Filter Process UlFR - http.sys - Dummy Filter Receive Buffer UlFT - http.sys - Filter Channel UlFU - http.sys - Full Tracker UlFW - http.sys - Filter Write Tracker UlHC - http.sys - Http Connection UlHc - http.sys - Http Connection RefTraceLog UlHL - http.sys - Internal Request RefTraceLog UlHR - http.sys - Internal Request UlHT - http.sys - Hash Table UlHV - http.sys - Header Value UlIC - http.sys - Irp Context UlID - http.sys - Conn ID Table UlIR - http.sys - Internal Response UlLD - http.sys - Log Field UlLF - http.sys - Log File Entry UlLG - http.sys - Log Generic UlLH - http.sys - Log File Handle UlLL - http.sys - Log File Buffer UlLS - http.sys - Ansi Log Data Buffer UlLT - http.sys - Binary Log Data Buffer UlNO - http.sys - NSGO Pool UlNP - http.sys - Non-Paged Data UlOE - http.sys - Endpoint OwnerRefTraceLog PoolTag UlOR - http.sys - Owner RefTrace Signature UlOT - http.sys - Opaque ID Table UlPB - http.sys - APool Proc Binding UlPL - http.sys - Pipeline UlQF - http.sys - TCI Filter UlQG - http.sys - TCI Generic UlQI - http.sys - TCI Interface UlQL - http.sys - TCI Flow UlQT - http.sys - TCI Tracker UlQW - http.sys - TCI WMI UlRB - http.sys - Receive Buffer UlRD - http.sys - Registry Data UlRE - http.sys - Request Body Buffer UlRP - http.sys - Request Buffer UlRR - http.sys - Request Buffer References UlRS - http.sys - Non-Paged Resource UlRT - http.sys - RefTraceLog PoolTag UlSC - http.sys - SSL Cert Data UlSD - http.sys - Security Data UlSl - http.sys - StringLog Buffer PoolTag UlSL - http.sys - StringLog PoolTag UlSO - http.sys - Site Counter Entry UlSS - http.sys - Simple Status Item UlTA - http.sys - Address Pool UlTD - http.sys - UL_TRANSPORT_ADDRESS UlTT - http.sys - Thread Tracker UlUB - http.sys - URL Buffer UlUC - http.sys - Uri Cache Entry UlUH - http.sys - HTTP Unknown Header UlUL - http.sys - URL UlUM - http.sys - URL Map UlVH - http.sys - Virtual Host UlWC - http.sys - Work Context UlWI - http.sys - Work Item UndP - - EXIFS Underlying Path Urdr - win32k!SetRedirectionBitmap - REDIRECT Usac - win32k!_CreateAcceleratorTable - ACCEL Usai - win32k!zzzAttachThreadInput - ATTACHINFO Usal - win32k!InitSwitchWndInfo - ALTTAB USBB - bthusb.sys - Bluetooth USB minidriver USBD - - Universal Serial Bus Class Driver Usbg - win32k!xxxLogClipData - DEBUG Uscb - win32k!_ConvertMemHandle - CLIPBOARD Uscc - win32k!AllocCallbackMessage - CALLBACK Usci - win32k!InitSystemThread - CLIENTTHREADINFO Uscl - win32k!ClassAlloc - CLASS Uscm - win32k!InitScancodeMap - SCANCODEMAP Uscp - win32k!CreateDIBPalette - CLIPBOARDPALETTE Uscr - win32k!NtUserSetSysColors - COLORS Usct - win32k!CkptRestore - CHECKPT Uscu - win32k!_CreateEmptyCursorObject - CURSOR Uscv - win32k!NtUserSetSysColors - COLORVALUES Usd1 - win32k!FreeListAdd - DDE1 Usd2 - win32k!_DdeSetQualityOfService - DDE2 Usd4 - win32k!AddPublicObject - DDE4 Usd5 - win32k!xxxCsEvent - DDE5 Usd6 - win32k!xxxCsEvent - DDE6 Usd7 - win32k!xxxCsEvent - DDE7 Usd8 - win32k!xxxMessageEvent - DDE8 Usd9 - win32k!xxxCsDdeInitialize - DDE9 UsdA - win32k!NewConversation - DDEa UsdB - win32k!Createpxs - DDEb UsdD - win32k!NtUserfnDDEINIT - DDEd UsdE - win32k!xxxClientCopyDDEIn1 - DDE Usdc - win32k!CreateCacheDC - DCE Usdi - win32k!CreateMonitor - DISPLAYINFO UsDI - win32k!CreateDeviceInfo - DEVICEINFO Usds - win32k!xxxDragObject - DRAGDROP Usdv - win32k!NtUserfnINDEVICECHANGE - DEVICECHANGE User - win32k!InitCreateUserCrit - ERESOURCE Usev - win32k!xxxPollAndWaitForSingleObject - EVENT Usgh - win32k!NtUserUserHandleGrantAccess - GRANTEDHANDLES Usgl - win32k!CreateShadowTL - GLOBALTHREADLOCK Usgt - win32k!AddGhost - GHOST Usha - win32k!AllocateHidData - HIDDATA UshD - Win32k!AllocateHidDesc - HIDDESC Ushk - win32k!_RegisterHotKey - HOTKEY Usih - win32k!SetImeHotKey - IMEHOTKEY Usim - win32k!CreateInputContext - IME Usjb - win32k!CreateW32Job - W32JOB Usjx - win32k!JobCalloutAddProcess - W32JOBEXTRA Uskb - win32k!xxxLoadKeyboardLayoutEx - KBDLAYOUT Uske - win32k!GetKbdExId - KBDEXID Uskf - win32k!LoadKeyboardLayoutFile - KBDFILE Usks - win32k!PostUpdateKeyStateEvent - KBDSTATE Uskt - win32k!ReadLayoutFile - KBDTABLE Usla - win32k!InitLockRecordLookaside - LOOKASIDE Usld - win32k!GrowLogIfNecessary - LOGDESKTOP Uslr - win32k!InitLockRecordLookaside - LOCKRECORD Usmi - win32k!MirrorRegion - MIRROR Usml - win32k!MsgLookupTableAlloc - MESSAGE FILTER TABLE Usmr - win32k!SnapshotMonitorRects - MONITORRECTS Usms - win32k!xxxMoveSize - MOVESIZE Usmt - win32k!xxxMNAllocMenuState - MENUSTATE Usno - win32k!zzz - NONE - don't use Usny - win32k!CreateNotify - NOTIFY Uspi - win32k!MapDesktop - PROCESSINFO Uspm - win32k!MNAllocPopup - POPUPMENU Uspn - win32k!CreateProfileUserName - PROFILEUSERNAME Uspo - win32k!QueuePowerRequest - POWER Uspp - win32k!AllocateAndLinkHidTLCInfo - PNP Uspr - win32k!GetPrivateProfileStruct - PROFILE Usqm - win32k!InitQEntryLookaside - QMSG Usqu - win32k!InitQEntryLookaside - Q Usrt - win32k!xxxDrawMenuItemText - RTL Ussa - win32k!xxxBroadcastMessage - SMS_ASYNC Ussb - win32k!CreateSpb - SPB Ussd - win32k!xxxAddShadow - SHADOW Ussc - win32k!xxxInterSendMsgEx - SMS_CAPTURE Usse - win32k!SetDisconnectDesktopSecurity - SECURITY Ussi - win32k!NtUserSendInput - SENDINPUT Ussm - win32k!InitSMSLookaside - SMS Usss - win32k!xxxBroadcastMessage - SMS_STRING Usst - win32k!xxxSBTrackInit - SCROLLTRACK Ussw - win32k!_BeginDeferWindowPos - SWP Ussy - win32k!xxxDesktopThread - SYSTEM Ustd - win32k!TrackAddDesktop - TRACKDESKTOP Usti - win32k!AllocateW32Thread - THREADINFO Ustk - win32k!HeavyAllocPool - STACK Ustm - win32k!InternalSetTimer - TIMER Usto - win32k!xxxConnectService - TOKEN Usts - win32k!_Win32CreateSection - SECTION Ustx - win32k!NtUserDrawCaptionTemp - TEXT Usty - win32k!NtUserResolveDesktopForWOW - TEXT2 Usub - win32k!NtUserToUnicodeEx - UNICODEBUFFER Usvi - win32k!ResizeVisExcludeMemory - VISRGN Usvl - win32k!VWPLAdd - VWPL Uswd - win32k!xxxCreateWindowEx - WINDOW Uswe - win32k!_SetWinEventHook - WINEVENT Uswl - win32k!BuildHwndList - WINDOWLIST Uswo - win32k!zzzInitTask - WOWTDB Uswp - win32k!xxxRegisterUserHungAppHandlers - WOWPROCESSINFO Uswt - win32k!xxxUserNotifyProcessCreate - WOWTHREADINFO Vad - nt!mm - Mm virtual address descriptors VadF - nt!mm - VADs created by a FreeVM splitting Vadl - nt!mm - Mm virtual address descriptors (long) VadS - nt!mm - Mm virtual address descriptors (short) VBus - vmbus.sys - Virtual Machine Bus Driver VDM - nt!vdm - ntos\vdm VdPN - dxgkrnl.sys - Video display mode management VfIT - nt!Vf - Verifier Import Address Table information VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION) VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport ViMm - dxgkrnl.sys - Video memory manager virt - vmm.sys - Virtual Machine Manager (VPC/VS) ViSh - dxgkrnl.sys - Video scheduler VM?? - volmgr.sys - Volume Manager VM - volmgr.sys - General allocations Vm?? - volmgrx.sys - Volume Manager Extension Vm - volmgrx.sys - General allocations VmBl - volmgrx.sys - Raw configuration blocks VmBu - volmgrx.sys - I/O buffers VmCc - volmgrx.sys - Configuration copies VmCo - volmgrx.sys - Configurations VmCp - volmgrx.sys - Copies VmCr - volmgrx.sys - Completion routine contexts VmDc - volmgrx.sys - Device changes VmDd - volmgrx.sys - Disk devices VmDh - volmgrx.sys - Disk headers VmLa - volmgrx.sys - Drive layouts VmLb - volmgrx.sys - Log blocks VmLc - volmgrx.sys - Log copies VmLo - volmgrx.sys - Logs VmLr - volmgrx.sys - Log raw content VmMm - volmgrx.sys - Mirror emergency mappings VmNe - volmgrx.sys - Notification entries VmOb - volmgrx.sys - I/O objects VmP0 - volmgrx.sys - Packets VmP1 - volmgrx.sys - Small packets VmP2 - volmgrx.sys - Large packets VmP3 - volmgrx.sys - Huge packets VmPa - volmgrx.sys - Packs VmPd - volmgrx.sys - Physical disks VmPs - volmgrx.sys - Arrays of packets VmRb - volmgrx.sys - Raw record buffers VmRc - volmgrx.sys - Raw configurations VmRe - volmgrx.sys - Records VmRi - volmgrx.sys - Record information VmRm - volmgrx.sys - RAID-5 emergency mappings VmRr - volmgrx.sys - Raw records VmTa - volmgrx.sys - I/O tasks VmTc - volmgrx.sys - Table of contents VmTe - volmgrx.sys - Table of contents entries VmTx - volmgrx.sys - Transactions VmUe - volmgrx.sys - User entries VmVd - volmgrx.sys - Volume devices VmWi - volmgrx.sys - Work items VoS? - volsnap.sys - VolSnap (Volume Snapshot Driver) VoSa - volsnap.sys - Application information allocations VoSb - volsnap.sys - Buffer allocations VoSc - volsnap.sys - Snapshot context allocations VoSd - volsnap.sys - Diff area volume allocations VoSf - volsnap.sys - Diff area file allocations VoSh - volsnap.sys - Bit history allocations VoSi - volsnap.sys - Io status block allocations VoSm - volsnap.sys - Bitmap allocations VoSo - volsnap.sys - Old heap entry allocations VoSp - volsnap.sys - Pnp id allocations VoSr - volsnap.sys - Device relations allocations VoSs - volsnap.sys - Short term allocations VoSt - volsnap.sys - Temp table allocations VoSw - volsnap.sys - Work queue allocations VoSx - volsnap.sys - Dispatch context allocations Vpb - - Io, vpb's Vprt - videoprt.sys - Video port for legacy (pre-Vista) display drivers VraP - - parallel class driver Vtfd - - Font file/context vTDR - dxgkrnl.sys - Video timeout detection/recovery Wait - - NtWaitForMultipleObjects Wan? - - NdisWan Tags (PPP Framing module for Remote Access) WanA - - BundleCB WanB - - ProtocolCB/LinkCB WanC - - DataDesc WanD - - WanRequest WanE - - LoopbackDesc WanG - - MiniportCB WanH - - OpenCB WanI - - IoPacket WanJ - - LineUpInfo WanK - - Unicode String Buffer WanL - - Protocol Table WanM - - Connection Table WanN - - NdisPacketPool Desc WanQ - - DataBuffer WanR - - WanPacket WanS - - AfCB/SapCB/VcCB WanT - - Transform Driver WanV - - RC4 Encryption Context WanW - - SHA Encryption WanX - - Send Compression Context WanY - - Recv Compression Context WanZ - - Protocol Specific Info Wdm - - WDM WDMA - - WDM Audio Wdog - watchdog.sys - Watchdog object/context allocation werk - - WER kernel mode reporting allocation WimF - wimfsf.sys - WIM Boot Filter Wmii - - Wmi InstId chunks Wmij - - Wmi GuidMaps Wmim - - Wmi KM to UM Notification Buffers Wmin - - Wmi Notification Slot Chunks Wmip - - Wmi General purpose allocation Wmiq - - Wmi NBQ Blocks Wmis - - Wmi SysId allocations Wmit - - Wmi Trace Wmiw - - Wmi Notification Waiting Buffers, in paged queue waiting for IOCTL Wmiz - - Wmi MCA Insertions debug code WmiA - - Wmi ACPI mapper WmiC - - Wmi Create Pump Thread Work Item WmiD - - Wmi Registration DataSouce WmiG - - Allocation of WMIGUID WmiI - - Wmi Instance Names WmiL - - WmiLIb WmiN - - Wmi Notification Notification Packet WmiR - - Wmi Registration info blocks WmDS - - Wmi DataSource chunks WmGE - - Wmi GuidEntry chunks WmIS - - Wmi InstanceSet chunks WmMR - - Wmi MofResouce chunks WMca - - WMI MCA Handling WMsG - win32k.sys - Winlogon kernel mode IPC interface Wrp? - - WanArp Tags (ARP module for Remote Access) Wrpa - - WAN_ADAPTER_TAG Wrpi - - WAN_INTERFACE_TAG Wrpr - - WAN_REQUEST_TAG Wrps - - WAN_STRING_TAG Wrpc - - WAN_CONN_TAG Wrpw - - WAN_PACKET_TAG Wrpf - - FREE_TAG (checked builds only) Wrpd - - WAN_DATA_TAG Wrph - - WAN_HEADER_TAG Wrpn - - WAN_NOTIFICATION_TAG WvCy - - WDM Audio WaveCyc port WvPc - - WDM Audio WavePCI port xCVD - mrxdav.sys - AsyncEngineContext Tag XDR? - rpcxdr.sys - NFS (Network File System) XDR driver xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector XWan - - ndis\usrwan allocations Xtra - - EXIFS Extra Create ysd8 - win32k.sys - User DDE8 ysd9 - win32k.sys - User DDE9 ysda - win32k.sys - User DDEa ysdb - win32k.sys - User DDEb ysdc - win32k.sys - User DDEc ysdd - win32k.sys - User DDEd ZsaB - - EXIFS ZeroBlock