Alter.Org.UA
 << Back Home EN en   Donate Donate

Windows NT Kernel memory pool tags

Все компоненты Windows NT помечают выделяемые блоки памяти уникальным Tag'ом - 4-байтным словом, имеющим текстовое представление в ASCII. Это используется для контроля выделяемой памяти, выяснения кто же вылез за границы выделенной области, и т.п. В принципе, эта информация доступна на сайте Microsoft'а (http://support.microsoft.com, поиск файла pooltag.txt). Здесь находится копия.


8042 - i8042prt.sys - PS/2 kb and mouse
ARPC - atmarpc.sys  - ATM ARP Client
ATMU - atmuni.sys   - ATM UNI Call Manager
Atom - <unknown>    - Atom Tables
Abos - <unknown>    - Abiosdsk
AcdM - <unknown>    - TDI AcdObjectInfoG
AcdN - <unknown>    - TDI AcdObjectInfoG
Acp* - acpi.sys     - ACPI Pooltags
ACPI - acpi.sys     - ACPI
Adap - <unknown>    - Adapter objects
Adbe - <unknown>    - Adobe's font driver
AECi - <unknown>    - filter object interface for MS acoustic echo canceller
Afd? - afd.sys      - AFD objects
AfdA - afd.sys      -     Afd EA buffer
AfdB - afd.sys      -     Afd data buffer
AfdC - afd.sys      -     Afd connection structure
AfdD - afd.sys      -     Afd debug data
AfdE - afd.sys      -     Afd endpoint structure
AfdF - afd.sys      -     Afd TransmitFile info
AfdG - afd.sys      -     Afd group table
AfdI - afd.sys      -     Afd TDI data
AfdL - afd.sys      -     Afd local address buffer
AfdP - afd.sys      -     Afd poll info
AfdQ - afd.sys      -     Afd work queue item
AfdR - afd.sys      -     Afd remote address buffer
AfdS - afd.sys      -     Afd security info
AfdT - afd.sys      -     Afd transport info
AfdW - afd.sys      -     Afd work item
AfdX - afd.sys      -     Afd context buffer
Afda - afd.sys      -     Afd APC buffer (NT 3.51 only)
Afdc - afd.sys      -     Afd connect data buffer
Afdd - afd.sys      -     Afd disconnect data buffer
Afdf - afd.sys      -     Afd TransmitFile debug data
Afdh - afd.sys      -     Afd address list change buffer
Afdi - afd.sys      -     Afd "set inline mode" buffer
Afdl - afd.sys      -     Afd lookaside lists buffer
Afdp - afd.sys      -     Afd transport IRP buffer
Afdq - afd.sys      -     Afd routing query buffer
Afdr - afd.sys      -     Afd ERESOURCE buffer
Afdt - afd.sys      -     Afd transport address buffer
Afp  - <unknown>    - SFM File server
Aml* - <unknown>    - ACPI AMLI Pooltags
APIC - pnpapic.sys  - I/O APIC Driver
ArbA - nt!arb       - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb       - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb       - ARBITER_MISC_TAG
ArbR - nt!arb       - ARBITER_RANGE_LIST_TAG
Arp? - <unknown>    - ATM ARP server objects, atmarps.sys
ArpA - <unknown>    -     AtmArpS address
ArpB - <unknown>    -     AtmArpS buffer space
ArpI - <unknown>    -     AtmArpS Interface structure
ArpK - <unknown>    -     AtmArpS ARP block
ArpM - <unknown>    -     AtmArpS MARS structure
ArpR - <unknown>    -     AtmArpS NDIS request
ArpS - <unknown>    -     AtmArpS SAP structure
Asy1 - <unknown>    - ndis / ASYNC_IOCTX_TAG
Asy2 - <unknown>    - ndis / ASYNC_INFO_TAG
Asy3 - <unknown>    - ndis / ASYNC_ADAPTER_TAG
Asy4 - <unknown>    - ndis / ASYNC_FRAME_TAG
AtC  - <unknown>    - IDE disk configuration
AtD  - <unknown>    - atdisk.c
ATIX - <unknown>    - WDM mini drivers for ATI tuner, xbar, etc.
Atk  - <unknown>    - Appletalk transport
AtmA - <unknown>    - Atoms
AtmT - <unknown>    - Atom tables
AuxL - <unknown>    - EXIFS Auxlist

Bat? - <unknown>    - Battery Class drivers
BatC - <unknown>    -     Composite battery driver
BatM - <unknown>    -     Control method battery driver
BatS - <unknown>    -     Smart battery driver
Batt - <unknown>    -     Battery class driver
BCSP - bthbcsp.sys  - Bluetooth BCSP minidriver
BIG  - nt!mm        - Large session pool allocations (ntos\ex\pool.c)
Bmfd - <unknown>    - Font related stuff
BT3C - bt3c.sys     - Bluetooth 3COM minidriver
BT8x - <unknown>    - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys  - Bluetooth port driver (generic)
BthS - bthport.sys  - Bluetooth port driver (security)
BTME - bthenum.sys  - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - <unknown>    - Bluetooth transport protocol library
BTSR - bthser.sys   - Bluetooth serial minidriver
BTUR - bthuart.sys  - Bluetooth UART minidriver
Bu*  - <unknown>    - burneng.sys from adaptec

Call - nt!ex        - kernel callback object signature
call - <unknown>    - debugging call tables
CBRe - <unknown>    - CallbackRegistration
Cc   - nt!cc        - Cache Manager allocations (catch-all)
CcBc - nt!cc        - Cache Manager Bcb from pool
CcBr - nt!cc        - Cache Manager Bitmap range
CcBz - nt!cc        - Cache Manager Bcb Zone
CcDw - nt!cc        - Cache Manager Deferred Write
CcEv - nt!cc        - Cache Manager Event
CcFn - nt!cc        - Cache Manager File name for popups
CcOb - nt!cc        - Cache Manager Overlap Bcb
CcPB - nt!ccpf      - Prefetcher trace buffer
CcPC - nt!ccpf      - Prefetcher context
CcPD - nt!ccpf      - Prefetcher trace dump
CcPF - nt!ccpf      - Prefetcher file name
CcPI - nt!ccpf      - Prefetcher intermediate table
CcPL - nt!ccpf      - Prefetcher read list
CcPM - nt!ccpf      - Prefetcher metadata
CcPS - nt!ccpf      - Prefetcher scenario
CcPT - nt!ccpf      - Prefetcher trace
CcPc - nt!cc        - Cache Manager Private Cache Map
CcPf - nt!ccpf      - Prefetcher
CcPp - nt!ccpf      - Prefetcher instructions
CcPq - nt!ccpf      - Prefetcher query buffer
CcPs - nt!ccpf      - Prefetcher section table
CcPv - nt!ccpf      - Prefetcher volume info
CcPw - nt!ccpf      - Prefetcher boot worker
CcSc - nt!cc        - Cache Manager Shared Cache Map
CcVa - nt!cc        - Cache Manager Initial array of Vacbs
CcVl - nt!cc        - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc        - Cache Manager Array of Vacb pointers for a cached stream
CctX - <unknown>    - EXIFX FCB Commit CTX
CcWq - nt!cc        - Cache Manager Work Queue Item
CcWK - nt!cc        - Kernel Cache Manager lookaside list
CcWk - nt!cc        - Kernel Cache Manager lookaside list
CcZe - nt!cc        - Cache Manager Buffer of Zeros
CdA  - <unknown>    - CdAudio filter driver
Cdcc - cdfs.sys     - CDFS Ccb
Cddn - cdfs.sys     - CDFS CdName in dirent
Cdee - cdfs.sys     - CDFS Search expression for enumeration
Cdfd - cdfs.sys     - CDFS Data Fcb
Cdfi - cdfs.sys     - CDFS Index Fcb
Cdfl - cdfs.sys     - CDFS Filelock
CdFn - cdfs.sys     - CDFS Filename buffer
Cdfn - cdfs.sys     - CDFS Nonpaged Fcb
Cdfs - cdfs.sys     - CDFS General Allocation
Cdft - cdfs.sys     - CDFS Fcb Table entry
Cdgs - cdfs.sys     - CDFS Generated short name
Cdic - cdfs.sys     - CDFS Irp Context
Cdil - cdfs.sys     - CDFS Irp Context lite
Cdio - cdfs.sys     - CDFS Io context for async reads
Cdma - cdfs.sys     - CDFS Mcb array
Cdpe - cdfs.sys     - CDFS Prefix Entry
CdPn - cdfs.sys     - CDFS CdName in path entry
Cdpn - cdfs.sys     - CDFS Prefix Entry name
Cdsp - cdfs.sys     - CDFS Buffer for spanning path table
Cdtc - cdfs.sys     - CDFS TOC
Cdun - cdfs.sys     - CDFS Buffer for upcased name
Cdvd - cdfs.sys     - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys     - CDFS Vpb allocated in filesystem
CM   - nt!cm        - Configuration Manager (registry)
CmcD - hal.dll      - HAL CMC Driver Log
CmcK - hal.dll      - HAL CMC Kernel Log
CmcT - hal.dll      - HAL CMC temporary Log
CMCa - nt!cm        - Configuration Manager Cache (registry)
CMDc - nt!cm        - Configuration Manager Cache (registry)
CMkb - nt!cm        - registry key control blocks
CMpb - nt!cm        - registry post blocks
CMnb - nt!cm        - registry notify blocks
CMpe - nt!cm        - registry post events
CMpa - nt!cm        - registry post apcs
CMsb - nt!cm        - registry stash buffer
CmVn - nt!cm        - captured value name
CMVw - nt!cm        - registry mapped view of file
CMVa - nt!cm        - value cache value tag
CMVI - nt!cm        - value index cache tag
CMSc - nt!cm        - security cache pooltag
CMSb - nt!cm        - internal stash buffer pool tag
CMNb - nt!cm        - notification block pool tag
CMIn - nt!cm        - index hint pool tag
CM?? - nt!cm        - Internal Configuration manager allocations
CMDa - nt!cm        - value data cache pool tag
CMAl - nt!cm        -internal registry memory allocator pool tag
COMX - serial.sys   - serial driver allocations
Cont - <unknown>    - Contiguous physical memory allocations for device drivers
CopW - <unknown>    - EXIFS CopyOnWrite
CpeD - hal.dll      - HAL CPE Driver Log
CpeK - hal.dll      - HAL CMC Kernel Log
CpeT - hal.dll      - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
CrtH - <unknown>    - EXIFS Create Header
CSdk - <unknown>    - Cluster Disk Filter driver
CSnt - <unknown>    - Cluster Network driver
CTE  - <unknown>    - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - <unknown>    - EXIFS Cached Volume Info

D2d  - <unknown>    - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - <unknown>    - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - <unknown>    - 8514a video driver
Dacl - <unknown>    - Temp allocations for object DACLs
Dati - <unknown>    - ati video driver
DbLo - <unknown>    - Debug logging
dcam - <unknown>    - WDM mini driver for IEEE 1394 digital camera
Dcl  - <unknown>    - cirrus video driver
Ddk  - <unknown>    - Default for driver allocated memory (user's of ntddk.h)
Devi - <unknown>    - Device objects

Dh 0 - <unknown>    - DirectDraw/3D default object
Dh 1 - <unknown>    - DirectDraw/3D DirectDraw object
Dh 2 - <unknown>    - DirectDraw/3D Surface object
Dh 3 - <unknown>    - DirectDraw/3D Direct3D context object
Dh 4 - <unknown>    - DirectDraw/3D VideoPort object
Dh 5 - <unknown>    - DirectDraw/3D MotionComp object

Dfb  - <unknown>    - framebuf video driver
Dfs  - <unknown>    - Distributed File System
dfsr - <unknown>    - RDBSS IRP allocation
Dfsm - <unknown>    - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
Dire - <unknown>    - Directory objects
Dlck - <unknown>    - deadlock verifier (part of driver verifier) structures
Dmga - <unknown>    - mga (matrox) video driver
DmH? - <unknown>    - DirectMusic hardware synthesizer
Dmio - <unknown>    - Logical Disk Manager driver
Dmip - dmio.sys     - Logical Disk Manager driver
Dmiq - dmio.sys     - Logical Disk Manager driver
Dmld - <unknown>    - Logical Disk Manager loader
DmS? - <unknown>    - DirectMusic kernel software synthesizer
Dmst - <unknown>    - Logical Disk Manager driver static initialization
Dndt - <unknown>    - Device node
Dnod - <unknown>    - Device node structure
DOPE - <unknown>    - Device Object Power Extension (po component)
DPrf - <unknown>    - Disk performance filter driver
DPwr - nt!pnp       - PnP power management
Dps5 - <unknown>    - NT5 PostScript printer driver
Dpsh - <unknown>    - Postcript driver heap memory
Dpsi - <unknown>    - psidisp video driver
Dpsm - <unknown>    - Postcript driver memory
Dqv  - <unknown>    - qv (qvision) video driver
Driv - <unknown>    - Driver objects
Drsd - <unknown>    - Rasdd Printer Driver Pool Tag.
Dtga - <unknown>    - tga video driver
Dump - <unknown>    - Bugcheck dump allocations
Dun5 - <unknown>    - NT5 Universal printer driver

DV?? - <unknown>    - RDR2 DAV MiniRedir Tags
DVCx - <unknown>    - AsyncEngineContext, DAV MiniRedir
DVEx - <unknown>    - Exchange, DAV MiniRedir
DVFi - <unknown>    - FileInfo, DAV MiniRedir
DVFn - <unknown>    - FileName, DAV MiniRedir
DVRw - <unknown>    - ReadWrite, DAV MiniRedir
DVSc - <unknown>    - SrvCall, DAV MiniRedir
DVSh - <unknown>    - SharedHeap, DAV MiniRedir

Dvga - <unknown>    - vga 16 color video driver
Dvg2 - <unknown>    - vga 256 color video driver
Dvg6 - <unknown>    - vga 64K color video driver
Dvgr - <unknown>    - vga for risc video driver
DW32 - <unknown>    - W32 video driver
Dwd  - <unknown>    - wd90c24a video driver
Dwp9 - <unknown>    - weitekp9 video driver
Dxga - <unknown>    - XGA video driver

Efsm - <unknown>    - EFS driver
Efsc - <unknown>    - EFS driver

Efst - <unknown>    -  EXIFS FS Statistics

Envr - <unknown>    - Environment strings
Err  - <unknown>    - Error strings
Evel - <unknown>    - EFS file system filter driver lookaside list
Even - <unknown>    - Event objects
Evid - <unknown>    - Rtl Event ID's
ExWl - <unknown>    - Executive worker list entry

Fat  - fastfat.sys  - Fat File System allocations
FatB - fastfat.sys  - Fat allocation bitmaps
FatC - fastfat.sys  - Fat Ccbs
FatD - fastfat.sys  - Fat pool dirents
FatE - fastfat.sys  - Fat EResources
FatF - fastfat.sys  - Fat Fcbs
FatI - fastfat.sys  - Fat IrpContexts
FatL - fastfat.sys  - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys  - Fat Nonpaged Fcbs
FatO - fastfat.sys  - Fat I/O buffer
FatP - fastfat.sys  - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys  - Fat buffered user buffer
FatR - fastfat.sys  - Fat repinned Bcb
FatS - fastfat.sys  - Fat stashed Bpb
FatT - fastfat.sys  - Fat directory allocation bitmaps
FatV - fastfat.sys  - Fat Vcb stat bucket
Fatv - fastfat.sys  - Fat events
FatW - fastfat.sys  - Fat FAT windowing structure
FatX - fastfat.sys  - Fat IO contexts
Fatb - fastfat.sys  - Fat Bcb arrays
Fatd - fastfat.sys  - Fat EA data
Fate - fastfat.sys  - Fat EA set headers
Fatf - fastfat.sys  - Fat deferred flush contexts
Fati - fastfat.sys  - Fat IO run descriptor
Fatn - fastfat.sys  - Fat filename buffer
Fatr - fastfat.sys  - Fat verification-time rootdir snapshot
Fats - fastfat.sys  - Fat verification-time boot sector
Fatv - fastfat.sys  - Fat backpocket Vpb
Fatx - fastfat.sys  - Fat delayed close contexts

Fcbl - <unknown>    - EXIFS FCBlock
fboX - <unknown>    - EXIFS FOBXVF List

File - <unknown>    - File objects
Flop - <unknown>    - floppy driver

Flst - <unknown>    - EXIFS Freelist

FLex - <unknown>    - exclusive file lock
FLfl - <unknown>    - exported (non-private) file lock
FLli - <unknown>    - per-file lock information
FLln - <unknown>    - shared lock tree node
FLsh - <unknown>    - shared file lock
FLwl - <unknown>    - waiting lock

Fsrc - <unknown>    - Filesystem recognizer (fsrec.sys)

Fstb - <unknown>    - ntos\fstub
FstB - <unknown>    - ntos\fstub

flnk - <unknown>    - font link tag used in ntgdi\gre

FS?? - nt!fsrtl     - File System Run Time allocations
FSfm - nt!fsrtl     - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl     - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl     - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl     - File System Run Time
FSrd - nt!fsrtl     - File System Run Time
FSrm - nt!fsrtl     - File System Run Time
FSrn - nt!fsrtl     - File System Run Time
FSrN - nt!fsrtl     - File System Run Time
FSro - nt!fsrtl     - File System Run Time
FSrs - nt!fsrtl     - File System Run Time
FSun - nt!fsrtl     - File System Run Time

FTrc - <unknown>    - Fault tolerance Slist tag.
FtC  - <unknown>    - Fault tolerance driver
FtM  - <unknown>    - Fault tolerance driver
FtS  - <unknown>    - Fault tolerance driver
FtT  - <unknown>    - Fault tolerance driver
FtU  - <unknown>    - Fault tolerance driver
FtV  - <unknown>    - Fault tolerance driver
       <unknown>G??? - <unknown>    - Gdi Objects
G    - <unknown>    -     Gdi Generic allocations
Gcac - <unknown>    -     Gdi glyph cache
Gcap - <unknown>    -     Gdi capture buffer
Gcsl - <unknown>    -     Gdi string resource script names
Gdbr - <unknown>    -     Gdi driver brush realization
Gdd  - <unknown>    -     Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - <unknown>    -     Gdi ddraw attach list
GddD - <unknown>    -     Gdi ddraw dummy page
Gdde - <unknown>    -     Gdi ddraw event
Gddf - <unknown>    -     Gdi ddraw driver heaps
Gddp - <unknown>    -     Gdi ddraw driver caps
Gddv - <unknown>    -     Gdi ddraw driver video memory list
Gdwd - win32k.sys   -     Gdi watchdog support objects
Gdxd - <unknown>    -     Gdi ddraw VPE directdraw object
Gdxs - <unknown>    -     Gdi ddraw VPE surface, videoport, capture object
Gdxx - <unknown>    -     Gdi ddraw VPE DXAPI object
Gdev - <unknown>    -     Gdi GDITAG_DEVMODE
GDev - <unknown>    -     Gdi pdev
Gdrs - <unknown>    -     Gdi GDITAG_DRVSUP
Gebr - <unknown>    -     Gdi ENGBRUSH
gEdg - <unknown>    -     Gdi gradient fill triangle
Gffv - <unknown>    -     Gdi FONTFILEVIEW
gFil - <unknown>    -     Gdi FILEVIEW
GFil - <unknown>    -     Gdi engine descriptor list
Gfsb - <unknown>    -     Gdi font sustitution list
Gfsm - <unknown>    -     Gdi Fast mutex
Ggdv - <unknown>    -     Gdi GDITAG_GDEVICE
Gglb - <unknown>    -     Gdi temp buffer
Ggls - <unknown>    -     Gdi glyphset
Ggb  - <unknown>    -     Gdi glyph bits
Ggbl - <unknown>    -     Gdi look aside buffers
Ghmg - <unknown>    -     Gdi handle manager objects
Gini - <unknown>    -     Gdi fast mutex
Gh ? - win32k.sys   -     Gdi Handle manager specific object types:
                              defined in w32\ntgdi\inc\ntgdistr.h
Gla? - win32k.sys   -     Gdi handle manager specific object types allocated
                              from lookaside memory: defined in
                              w32\ntgdi\inc\ntgdistr.h
Gldv - <unknown>    -     Gdi Ldev
Glnk - <unknown>    -     Gdi PFELINK
Gmap - <unknown>    -     Gdi font map signature table
Gpff - <unknown>    -     Gdi physical font file
Gpft - <unknown>    -     Gdi font table
Gsem - <unknown>    -     Gdi Semaphores
Gsp  - <unknown>    -     Gdi sprite
Gspr - <unknown>    -     Gdi sprite grow range
Gtmp - <unknown>    -     Gdi temporary allocations
Gtmw - <unknown>    -     Gdi TMW_INTERNAL
Gxlt - <unknown>    -     Gdi Xlate

Gfcb - <unknown>    - EXIFS Grow FCB


Hal  - hal.dll      - Hardware Abstraction Layer
Hpfs - <unknown>    - Pinball (aka Hpfs) allocations
HisC - <unknown>    - histogram filter driver
Hist - <unknown>    - histogram filter driver
HidP - <unknown>    - HID Parser
HidC - <unknown>    - HID Class
HdCl - <unknown>    - HID Client Sample Driver
HpMM - pnpmem.sys   - HotPlug Memory Driver

HCID - bthport.sys  - Bluetooth port driver HCI debug
HCIT - bthport.sys  - Bluetooth port driver (HCI)

HcRs - hcaport.sys  - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys  - HCAPORT_TAG_EVENT
HcdI - hcaport.sys  - HCAPORT_TAG_HWID
HcEn - hcaport.sys  - HCAPORT_TAG_ENUM
HcMc - hcaport.sys  - HCAPORT_TAG_MISC
HcDr - hcaport.sys  - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys  - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys  - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys  - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys  - HCAPORT_TAG_PROTD
HPmi - hcaport.sys  - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys  - HCAPORT_TAG_MAD
HcMp - hcaport.sys  - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys  - HCAPORT_TAG_CM
HcUc - hcaport.sys  - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys  - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys  - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys  - HCAPORT_TAG_IOC_SERVICE_TABLE

hSVD - mrxdav.sys   - Shared Heap Tag

HT01 - <unknown>    - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - <unknown>    - GDI Halftone GetCachedDCI() for Threshold
HT03 - <unknown>    - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - <unknown>    - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - <unknown>    - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - <unknown>    - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - <unknown>    - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - <unknown>    - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - <unknown>    - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - <unknown>    - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - <unknown>    - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - <unknown>    - GDI Halftone ThresholdsFromYData() for pYData
HT13 - <unknown>    - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - <unknown>    - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - <unknown>    - GDI Halftone CalculateStretch() for PrimColorInfo

IBCM - wibcm.sys    - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP  - wibcm.sys    - CEP_INSTANCE_TAG
CMSH - wibcm.sys    - WIBCM_SHARED_TAG
CMWK - wibcm.sys    - WIBCM_WORK_TAG
CMWT - wibcm.sys    - WIBCM_TIMER_TAG

IBm* - wibms.sys    - Windows Infiniband Management Server pool tags

IbPm - wibpm.sys    - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys    - WIBPM_SENT_TAG
IbPI - wibpm.sys    - WIBPM_ITEM_TAG
IbPA - wibpm.sys    - WIBPM_SAMPLE_TAG

IbW0 - wibwmi.sys   - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys   - WIBWMI1_TAG
IbW2 - wibwmi.sys   - WIBWMI2_TAG

IPX  - <unknown>    - Nwlnkipx transport
Icp  - <unknown>    - I/O completion packets queue on a completion ports
IcpP - <unknown>    - NPAGED_LOOKASIDE_LIST I/O completion per
                      processor lookaside pointers
IdeP - <unknown>    - atapi IDE
IdeX - <unknown>    - PCI IDE
idle - <unknown>    - Power Manager idle handler
Ifs  - <unknown>    - Default file system allocations (user's of ntifs.h)
Info - <unknown>    - general system information allocations
Io   - nt!io        - general IO allocations
IoCc - nt!io        - Io completion context
IoEa - nt!io        - Io extended attributes
IoEr - nt!io        - Io error log packets
IoFc - nt!io        - Io name transmogrify operation
IoFs - nt!io        - Io shutdown packet
IoFu - nt!pnp       - Io file utils
IoKB - <unknown>    - Registry basic key block (temp allocation)
IoNm - nt!io        - Io parsing names
IoRb - nt!io        - Io remote boot related
IoRN - nt!io        - Registry key name (temp allocation)
IoSe - nt!io        - Io security related
IoSh - nt!io        - Io shutdown packet
IoTi - nt!io        - Io timers
IoTt - nt!vf        - I/O verifier IRP tracking table
Ioin - <unknown>    - Io interrupts
IoOp - nt!io        - I/O subsystem open packet
IoRi - nt!io        - I/O SubSystem Driver Reinitialization Callback Packet
IoUs - nt!io        - I/O SubSystem completion Context Allocation
Irp  - <unknown>    - Io, IRP packets
Irp+ - nt!vf        - I/O verifier allocated IRP packets
IrpB - nt!vf        - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf        - I/O verifier deferred completion context
Irps - nt!vf        - I/O verifier per-IRP session tracking data
Irpt - nt!vf        - I/O verifier per-IRP tracking data
IrpC - nt!vf        - I/O verifier stack contexts
Irpl - nt!io        - system large IRP lookaside list
Irps - nt!io        - system small IRP lookaside list
Isap - <unknown>    - Pnp Isa bus extender
II?? - <unknown>    - IP in IP tunneling
IIrf - <unknown>    - Free memory
IIdt - <unknown>    - Data
IITn - <unknown>    - Tunnel
IIhd - <unknown>    - Header
IIpk - <unknown>    - Packet
IIsc - <unknown>    - Send Context
IIts - <unknown>    - Transfer Context
IIwc - <unknown>    - Work Context

Im*  - <unknown>    - Imapi.sys from adaptec

IPm? - <unknown>    - IP Multicasting
IPmg - <unknown>    - Group
IPms - <unknown>    - Source
IPmo - <unknown>    - Outgoing Interface
IPmm - <unknown>    - Message
IPmf - <unknown>    - Free memory (only in checked builds)

Ip?? - ipsec.sys    - IP Security
IpSI - ipsec.sys    - initial allcoations
IpAT - ipsec.sys    -  AH headers in transport mode
IpAU - ipsec.sys    -  AH headers in tunnel mode
IpET - ipsec.sys    -  ESP headers in transport mode
IpEU - ipsec.sys    -  ESP headers in tunnel mode
IpHT - ipsec.sys    -  HUGHES headers in transport mode
IpHU - ipsec.sys    -  HUGHES headers in tunnel mode
IpAX - ipsec.sys    -  Key acquire contexts
IpFI - ipsec.sys    -  Filter blocks
IpSA - ipsec.sys    -  Security Associations
IpKE - ipsec.sys    -  keys
IpTI - ipsec.sys    -  timers
IpSQ - ipsec.sys    -  stall queues
IpLA - ipsec.sys    -  lookaside lists
IpBP - ipsec.sys    -  buffer pools
IpSC - ipsec.sys    -  send complete context
IpEQ - ipsec.sys    -  event queue
IpHW - ipsec.sys    -  hardware accleration items
IpCO - ipsec.sys    -  IP compression

IrD? - <unknown>    - IrDA TDI and RAS drivers

IU?? - <unknown>    - IIS Utility Driver
IUDl - <unknown>    -     Lookaside list allocations
IUcp - <unknown>    -     completion port minipackets

KAPC - nt!io              - I/O SubSystem HardError APC
KbdC - <unknown>    - Keyboard Class Driver
KCfe - <unknown>    - Kernel COM factory entry
Ke   - <unknown>    - Kernel data structures
KeIC - <unknown>    - Kernel Interrupt Object Chain
Key  - <unknown>    - Key objects
KMIX - <unknown>    - Kmixer (wdm audio)
KNMI - <unknown>    - Kernel NMI Callback object
KrbC - <unknown>    - Kerberos Client package
KSah - <unknown>    - Ks auxiliary stream headers
KSAI - <unknown>    -    allocator instance
KSai - <unknown>    -    default allocator instance header
KSbi - <unknown>    -    event buffered item
KSCI - <unknown>    -    clock instance
KSce - <unknown>    -    create item entry
KSch - <unknown>    -    create handler entry
KSci - <unknown>    -    default clock instance header
KScp - <unknown>    -    object creation parameters auxiliary copy
KSda - <unknown>    -    default allocator
KSdc - <unknown>    -    default clock
KSdh - <unknown>    -    device header
Ksec - <unknown>    -    security device driver
KSed - <unknown>    -    event dpc item
KSee - <unknown>    -    event entry
KSed - <unknown>    -    oneshot event deletion dpc
KSep - <unknown>    -    irp system buffer event parameter
KSew - <unknown>    -    oneshot event deletion workitem
KSqr - <unknown>    -    QM quality report
KSer - <unknown>    -    QM error report
KSfd - <unknown>    -    filter cache data (MSKSSRV)
KsFI - <unknown>    -    filter instance
KSns - <unknown>    -    null security object
KSnv - <unknown>    -    registry name value
KSoh - <unknown>    -    object header
KSop - <unknown>    -    object creation parameters
KSpc - <unknown>    -    port driver instance FsContext
KSPI - <unknown>    -    pin instance
KSpp - <unknown>    -    irp system buffer property/method/event parameter
KSpt - <unknown>    -    pin type list (MSKSSRV)
KSqf - <unknown>    -    query information file buffer
KSsc - <unknown>    -    port driver stream FsContext
KSsf - <unknown>    -    set information file buffer
KSsh - <unknown>    -    stream headers
KSsi - <unknown>    -    software bus interface
KSsl - <unknown>    -    symbolic link buffer (MSKSSRV)
KSsp - <unknown>    -    serialized property set
KsoO - <unknown>    -    WDM audio stuff
L2CA - bthport.sys  - Bluetooth port driver (L2CAP)
L2T0 - <unknown>    -    ndis\l2tp / MTAG_FREED
L2T1 - <unknown>    -    ndis\l2tp / MTAG_ADAPTERCB
L2T2 - <unknown>    -    ndis\l2tp / MTAG_TUNNELCB
L2T3 - <unknown>    -    ndis\l2tp / MTAG_VCCB
L2T4 - <unknown>    -    ndis\l2tp / MTAG_VCTABLE
L2T5 - <unknown>    -    ndis\l2tp / MTAG_WORKITEM
L2T6 - <unknown>    -    ndis\l2tp / MTAG_TIMERQ
L2T7 - <unknown>    -    ndis\l2tp / MTAG_TIMERQITEM
L2T8 - <unknown>    -    ndis\l2tp / MTAG_PACKETPOOL
L2T9 - <unknown>    -    ndis\l2tp / MTAG_FBUFPOOL
L2Ta - <unknown>    -    ndis\l2tp / MTAG_HBUFPOOL
L2Tb - <unknown>    -    ndis\l2tp / MTAG_TDIXRDG
L2Tc - <unknown>    -    ndis\l2tp / MTAG_TDIXSDG
L2Td - <unknown>    -    ndis\l2tp / MTAG_CTRLRECD
L2Te - <unknown>    -    ndis\l2tp / MTAG_CTRLSENT
L2Tf - <unknown>    -    ndis\l2tp / MTAG_PAYLRECD
L2Tg - <unknown>    -    ndis\l2tp / MTAG_PAYLSENT
L2Th - <unknown>    -    ndis\l2tp / MTAG_INCALL
L2Ti - <unknown>    -    ndis\l2tp / MTAG_UTIL
L2Tj - <unknown>    -    ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - <unknown>    -    ndis\l2tp / MTAG_ROUTESET
L2Tl - <unknown>    -    ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - <unknown>    -    ndis\l2tp / MTAG_TUNNELWORK
L2Tn - <unknown>    -    ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys  - LAN Emulation Client for ATM
LB?? - <unknown>    - LM Datagram receiver allocations
LBan - <unknown>    -     Server announcement
LBvb - <unknown>    -     View buffer
LBma - <unknown>    -     Master announce context
LBxp - <unknown>    -     Transport
LBxn - <unknown>    -     TransportName
LBxm - <unknown>    -     Master name
LBtn - <unknown>    -     Transport name
LBea - <unknown>    -     Ea buffer
LBdi - <unknown>    -     POOL_DOMAIN_INFO
LBds - <unknown>    -     Send datagram context
LBci - <unknown>    -     Connection info
LBmh - <unknown>    -     Mailslot header
LBbl - <unknown>    -     Backup List
LBsl - <unknown>    -     Browser server list
LBbs - <unknown>    -     Browser server
LBgb - <unknown>    -     GetBackupList request
LBbr - <unknown>    -     GetBackupList response
LBmb - <unknown>    -     Mailslot Buffer
LBid - <unknown>    -     Illegal datagram context
LBbn - <unknown>    -     Name
LBnn - <unknown>    -     Name name
LBic - <unknown>    -     IRP context
LBwi - <unknown>    -     Work item
LBel - <unknown>    -     Election context
LBbb - <unknown>    -     Become backup context
LBbr - <unknown>    -     Become backup request
LBpn - <unknown>    -     Paged Name
LBpt - <unknown>    -     Paged transport
LBse - <unknown>    -     Browser security

Lbuf - <unknown>    - EXIFS Large Buffer

LeoC - <unknown>    -     Symantec/Norton AntiVirus filter driver
List - <unknown>    -     kernel utilities list allocation
LCam - <unknown>    - WDM mini video capture driver for Logitech camera
Lfs  - <unknown>    - Lfs allocations
LfsI - <unknown>    - Lfs allocations
LpcZ - <unknown>    - LPC Zone
LpcM - <unknown>    - Local procedure call message blocks
Lr?? - <unknown>    - LM redirector allocations
Lr   - <unknown>    -     Generic allocations
Lrcx - <unknown>    -     Context blocks of various types
Lrcl - <unknown>    -     ConnectListEntries
Lrsl - <unknown>    -     ServerListEntries
Lrse - <unknown>    -     Security entry
Lrsc - <unknown>    -     Search Control Blocks
Lrea - <unknown>    -     EA related allocations
Lric - <unknown>    -     Instance Control Blocks
Lrfc - <unknown>    -     File Control Blocks
Lrfl - <unknown>    -     Fcb Locks
Lrfp - <unknown>    -     Fcb Paging locks
Lrcn - <unknown>    -     Computer Name
Lrdn - <unknown>    -     Domain Name
Lr?? - <unknown>    -     Buffers used for FsControlFile APIs
Lrlc - <unknown>    -     Lock Control Blocks
Lrlb - <unknown>    -     Lock Control Block buffers
Lrnf - <unknown>    -     Non paged FCB
Lrnt - <unknown>    -     Non paged transport
Lrps - <unknown>    -     Paged security entry
Lrte - <unknown>    -     Transport event.
Lrxx - <unknown>    -     Transceive context blocks
Lr!! - <unknown>    -     Cancel request context blocks
Lrmt - <unknown>    -     MPX table
Lrme - <unknown>    -     MPX table entries
Lrsx - <unknown>    -     Send contexts
Lraw - <unknown>    -     Async write context
Lrwb - <unknown>    -     Write behind buffer header
Lrbb - <unknown>    -     Write behind buffer
Lrwq - <unknown>    -     Work queue item
Lrac - <unknown>    -     ACL for redirector
Lrds - <unknown>    -     Security Descriptor for redirector
Lrsm - <unknown>    -     SMB buffer
Lrds - <unknown>    -     Duplicated ansi string
Lrdu - <unknown>    -     Duplicated unicode string
Lxpt - <unknown>    -     Transport
Lrtc - <unknown>    -     Transport connection
Lrna - <unknown>    -     Netbios Addresses
Lrca - <unknown>    -     Temporary storage used in name canonicalization
Lr2x - <unknown>    -     Transact SMB context
Lrpt - <unknown>    -     Primary transport server list
Lrso - <unknown>    -     Operating system name
Lref - <unknown>    -     Reference history (debug only)
LS?? - <unknown>    - LM server allocations
LSac - <unknown>    -     BlockTypeAdminCheck
LSas - <unknown>    -     BlockTypeAdapterStatus
LSbf - <unknown>    -     buffer descriptor
LScd - <unknown>    -     comm device
LScn - <unknown>    -     connection
LSdb - <unknown>    -     data buffer
LSdc - <unknown>    -     BlockTypeDirCache
LSdi - <unknown>    -     BlockTypeDirectoryInfo
LSep - <unknown>    -     endpoint
LSfn - <unknown>    -     BlockTypeFSName
LSlf - <unknown>    -     LFCB
LSlr - <unknown>    -     BlockTypeLargeReadX
LSmf - <unknown>    -     MFCB
LSmi - <unknown>    -     BlockTypeMisc
LSnh - <unknown>    -     nonpaged block header
LSni - <unknown>    -     BlockTypeNameInfo
LSop - <unknown>    -     oplock break wait
LSpc - <unknown>    -     paged connection
LSpm - <unknown>    -     paged MFCB
LSpr - <unknown>    -     paged RFCB
LSrf - <unknown>    -     RFCB
LSsc - <unknown>    -     search(core)
LSsd - <unknown>    -     BlockTypeShareSecurityDescriptor
LSsf - <unknown>    -     BlockTypeDfs
LSsh - <unknown>    -     share
LSsp - <unknown>    -     search(core complete)
LSsr - <unknown>    -     search
LSss - <unknown>    -     session
LStb - <unknown>    -     table
LStc - <unknown>    -     tree connect
LSti - <unknown>    -     timer
LStr - <unknown>    -     transaction
LSvi - <unknown>    -     BlockTypeVolumeInformation
LSwi - <unknown>    -     initial work context
LSwn - <unknown>    -     normal work context
LSwq - <unknown>    -     BlockTypeWorkQueue
LSwr - <unknown>    -     raw work context
LSws - <unknown>    -     BlockTypeWorkContextSpecial
LSnd - <unknown>    - WDM mini sound driver for Logitech video camera
LXMK - <unknown>    - kernel mixer line driver (KMXL - looks like
                      they got their tag backwards)

MXF  - <unknown>    - DirectMusic (MIDI Transform Filter)

MapP - <unknown>    - PNP map
Mapr - <unknown>    - arc firmware registry routines

McaC - hal.dll      - HAL MCA corrected Log
McaD - hal.dll      - HAL MCA Driver Log
McaK - hal.dll      - HAL MCA Kernel Log
McaP - hal.dll      - HAL MCA Log from previous boot
McaT - hal.dll      - HAL MCA temporary Log

MCAM - <unknown>    - WDM mini driver for Intel USB camera
MCDx - <unknown>    - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - <unknown>    - OpenGL MCD driver (embedded in a display driver like
                      s3mvirge.dll)
Mdl  - <unknown>    - Io, Mdls
MdlP - <unknown>    - MDL per processor lookaside list pointers
MePr - <unknown>    - In-memory print buffer
Mm   - nt!mm        - general Mm Allocations
MmBk - nt!mm        - Mm banked sections
MmCa - nt!mm        - Mm control areas for mapped files
MmCd - nt!mm        - Mm fork clone descriptors
MmCh - nt!mm        - Mm fork clone headers
MmCi - nt!mm        - Mm control areas for images
MmCm - nt!mm        - Calls made to MmAllocateContiguousMemory
MmDb - nt!mm        - NtMapViewOfSection service
MmDT - nt!mm        - Mm debug
MmEx - nt!mm        - Mm events
MmHi - nt!mm        - Mm image entry - allocated per session
MmHn - nt!mm        - Mm sessionwide address name string entry
MmHv - nt!mm        - Mm sessionwide address entry
MmIn - nt!mm        - Mm inpaged io structures
MmLd - nt!mm        - Mm load module database
MmPg - nt!mm        - Mm page table pages at init time
MmRw - nt!mm        - Mm read write virtual memory buffers
MmSb - nt!mm        - Mm subsections
MmSe - nt!mm        - Mm secured VAD allocation
MmSg - nt!mm        - Mm segments
MmSt - nt!mm        - Mm section object prototype ptes
Mmdl - nt!mm        - Mm Mdls for flushes
Mmpp - nt!mm        - Mm prototype PTEs for pool
MmVd - nt!mm        - Mm virtual address descriptors for mapped views
MmVs - nt!mm        - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm        - Mm temporary allocations
MmCx - nt!mm        - info for dynamic section extension
MmDm - nt!mm        - deferred MmUnlock entries
MmHt - nt!mm        -  session space PTE data
MmLn - nt!mm        -  temporary name buffer for driver loads
MmMl - nt!mm        -  physical memory range information
MmRl - nt!mm        -  temporary readlists for file prefetch
MmSP - nt!mm        -  SLIST entries for system PTE NB queues
MmSc - nt!mm        -   subsections used to map data files
MmSd - nt!mm        -  extended subsections used to map data files
MmSm - nt!mm        -  segments used to map data files
MmWe - nt!mm        - Work entries for writing out modified filesystem pages.
MmWw - nt!mm        - Write watch VAD info
Mmpv  - nt!mm       - Physical view VAD info
Mmww - nt!mm        - Write watch bitmap VAD info

MRXx - <unknown>    - Client side caching for SMB

Msdv - <unknown>    - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - <unknown>    - MSTEE (mstee.sys)
MSTa - <unknown>    -    associated stream header
MSTc - <unknown>    -    filer connection
MSTd - <unknown>    -    data format
MSTf - <unknown>    -    filter instance
MSTp - <unknown>    -    pin instance
MSTs - <unknown>    -    stream header

MuoC - <unknown>    - MOUSE_POOL_TAG Mouse Class Driver
MupI - <unknown>    - DFS file system driver IRP context allocation
MsFc - <unknown>    - Mailslot CCB, Client control block. Each client with
                      an opened mailslot has one of these
MsFC - <unknown>    - Mailslot root CCB, A client control block for
                      the top level mailslot directory
MsFd - <unknown>    - Mailslot data entry write buffer, This is writes buffered
                      inside mailslots
MsFD - <unknown>    - Mailslot root DCB and its name buffer
MsFf - <unknown>    - Mailslot FCB, File control block, Service side block for
                      each created mailslot.
MsFg - <unknown>    - Mailslot global resource
MsFn - <unknown>    - Mailslot temporary name buffer
MsFN - <unknown>    - Mailslot FCB name buffer, name for each created mailslot
MsFr - <unknown>    - Mailslot read buffer, buffer created for pended reads issued.
MsFt - <unknown>    - Mailslot query template, used for directory queries.
MsFw - <unknown>    - Mailslot work context block, blocks create when
                      we need to timeout reads.

MsvC - <unknown>    - Msv/Ntlm client package
Mup  - <unknown>    - Multiple UNC provider allocations
Muta - <unknown>    - Mutant objects
NBF  - <unknown>    - general NBF allocations
NBFa - <unknown>    - NBF address object
NBFb - <unknown>    - NBF receive buffer
NBFc - <unknown>    - NBF connection object
NBFd - <unknown>    - NBF packet pool descriptor
NBFe - <unknown>    - NBF bind & export names
NBFf - <unknown>    - NBF address file object
NBFg - <unknown>    - NBF registry path name
NBFi - <unknown>    - NBF tdi connection info
NBFk - <unknown>    - NBF loopback buffer
NBFl - <unknown>    - NBF link object
NBFn - <unknown>    - NBF netbios name
NBFo - <unknown>    - NBF config data
NBFp - <unknown>    - NBF packet
NBFq - <unknown>    - NBF query buffer
NBFr - <unknown>    - NBF request
NBFs - <unknown>    - NBF provider stats
NBFt - <unknown>    - NBF connection table
NBFu - <unknown>    - NBF UI frame
NBFw - <unknown>    - NBF work item
NBI  - <unknown>    - NwlnkNb transport
NBS  - <unknown>    - general NetBIOS allocations
NBSa - <unknown>    -     address block
NBSc - <unknown>    -     connection block
NBSe - <unknown>    -     EA buffer
NBSf - <unknown>    -     FCB
NBSl - <unknown>    -     LANA block
NBSn - <unknown>    -     copy of user NCB
NBSr - <unknown>    -     registry allocations
NBSx - <unknown>    -     XNS NETONE address (connect block)
NBSy - <unknown>    -     NetBIOS address (connect block)
NBSz - <unknown>    -     NetBIOS address (listen block)
NBqh - <unknown>    -     Non-blocking queue entries used to carry
                          the real data in the queue.

NCSt - <unknown>    - EXIFS NC

ND   - ndis.sys     - general NDIS allocations
NDDl - ndis.sys     - NDIS_TAG_DBG_LOG
NDMb - ndis.sys     - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys     -     NDIS Proxy allocations
NDPa - ndis.sys     - Apple Talk
NDPb - ndis.sys     - NBF
NDPi - ndis.sys     - NWLNKIPX
NDPn - ndis.sys     - NWLNKNB
NDPp - ndis.sys     - Packet Scheduler.
NDPs - ndis.sys     - NWLNKSPX
NDPt - ndis.sys     - TCPIP
NDPw - ndis.sys     - WAN_PACKET_TAG
NDam - ndis.sys     -     NdisAllocateMemory
NDan - ndis.sys     -     adapter name
NDco - ndis.sys     - NDIS_TAG_CO
NDd  - ndis.sys     - NDIS_TAG_DBG
NDdb - ndis.sys     -     DMA block
NDdl - ndis.sys     - NDIS_TAG_DBG_L
NDdp - ndis.sys     - NDIS_TAG_DBG_P
NDds - ndis.sys     - NDIS_TAG_DBG_S
NDdt - ndis.sys     - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys     - NDIS_TAG_FILTER_ADDR
NDlb - ndis.sys     -     lookahead buffer
NDlp - ndis.sys     - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys     -     MAC block
NDmr - ndis.sys     -     map register entry array
NDoa - ndis.sys     - NDIS_TAG_OID_ARRAY
NDob - ndis.sys     -     open block
NDpb - ndis.sys     -     protocol block
NDpf - ndis.sys     - NDIS_TAG_FILTER
NDpk - ndis.sys     - NDIS_TAG_PKT_PATTERN
NDpp - ndis.sys     -     packet pool
NDrl - ndis.sys     -     resource list
NDrp - ndis.sys     - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys     - NDIS_TAG_Q_REQ
NDsi - ndis.sys     -     EISA slot information
NDsm - ndis.sys     -     Cached shared memory descriptor
NDst - ndis.sys     - NDIS_TAG_STRING
NDw0 - ndis.sys     - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys     - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys     - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys     - NDIS_TAG_WMI_EVENT_ITEM
NDwi - ndis.sys     - NDIS_TAG_WORK_ITEM

Nb?? - <unknown>    -  NetBT allocations
Nls  - <unknown>    - Nls strings
Nmdd - <unknown>    - NetMeeting display driver miniport 1 MB block
None - <unknown>    - call to ExAllocatePool

Npf* - npfs.sys     - Npfs Allocations
NpFc - npfs.sys     - CCB, client control block
NpFC - npfs.sys     - ROOT_DCB CCB
NpFD - npfs.sys     - DCB, directory block
NpFg - npfs.sys     - Global storage
NpFi - npfs.sys     - NPFS client info buffer.
NpFn - npfs.sys     - Name block
NpFq - npfs.sys     - Query template buffer used for directory query
NpFr - npfs.sys     - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys     - Client security context
NpFw - npfs.sys     - Write block
NpFW - npfs.sys     - Write block


NS?? - <unknown>    - Netware server allocations

Ntf? - ntfs.sys     - NTFS Specific allocation tags
Ntf0 - ntfs.sys     -     general pool allocation
Ntf9 - ntfs.sys     -     Large Temporary Buffer
NtfC - ntfs.sys     -     CCB
Ntfc - ntfs.sys     -     CCB_DATA
NtfD - ntfs.sys     -     DEALLOCATED_RECORDS
NtfE - ntfs.sys     -     INDEX_CONTEXT
NtfF - ntfs.sys     -     FCB_INDEX
Ntff - ntfs.sys     -     FCB_DATA
NtfI - ntfs.sys     -     NTFS_IO_CONTEXT
Ntfi - ntfs.sys     -     IRP_CONTEXT
NtfK - ntfs.sys     -     KEVENT
Ntfk - ntfs.sys     -     FILE_LOCK
Ntfl - ntfs.sys     -     LCB
NtfM - ntfs.sys     -     NTFS_MCB_ENTRY
Ntfm - ntfs.sys     -     NTFS_MCB_ARRAY
NtfN - ntfs.sys     -     NUKEM
Ntfn - ntfs.sys     -     SCB_NONPAGED
Ntfo - ntfs.sys     -     SCB_INDEX normalized named buffer
NtfQ - ntfs.sys     -     QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys     -     General Allocation with Quota
NtfR - ntfs.sys     -     READ_AHEAD_THREAD
Ntfr - ntfs.sys     -     ERESOURCE
NtfS - ntfs.sys     -     SCB_INDEX
Ntfs - ntfs.sys     -     SCB_DATA
NtfT - ntfs.sys     -     SCB_SNAPSHOT
Ntft - ntfs.sys     -     SCB (Prerestart)
NtfV - ntfs.sys     -     VPB
Ntfv - ntfs.sys     -     COMPRESSION_SYNC
Ntfw - ntfs.sys     -     Workspace
Ntfx - ntfs.sys     -     General Allocation
NtF? - ntfs.sys     - NTFS tags based on source module
NtFa - ntfs.sys     -     AllocSup.c
NtFA - ntfs.sys     -     AttrSup.c
NtFB - ntfs.sys     -     BitmpSup.c
NtFC - ntfs.sys     -     Create.c
NtFD - ntfs.sys     -     DevioSup.c
NtFd - ntfs.sys     -     DirCtrl.c
NtFE - ntfs.sys     -     Ea.c
NtFF - ntfs.sys     -     FileInfo.c
NtFf - ntfs.sys     -     FsCtrl.c
NtFI - ntfs.sys     -     IndexSup.c
NtFL - ntfs.sys     -     LogSup.c
NtFM - ntfs.sys     -     McbSup.c
NtFN - ntfs.sys     -     NtfsData.c
NtFO - ntfs.sys     -     ObjIdSup.c
NtFQ - ntfs.sys     -     QuotaSup.c
NtFR - ntfs.sys     -     RestrSup.c
NtFS - ntfs.sys     -     SecurSup.c
NtFs - ntfs.sys     -     StrucSup.c
NtFU - ntfs.sys     -     usnsup.c
NtFV - ntfs.sys     -     VerfySup.c
NtFv - ntfs.sys     -     ViewSup.c
NtFW - ntfs.sys     -     Write.c

Nwcs - <unknown>    - Client Services for NetWare
NwFw - <unknown>    - ntos\tdi\fwd


ObSq - nt!ob        - object security descriptors (query)
ObCi - nt!ob        - captured information for ObCreateObject
ObCI - nt!ob        - object creation lookaside list
ObDi - nt!ob        - object directory
ObHd - nt!ob        - object handle count data base
ObNm - nt!ob        - object names
ObNM - nt!ob        - name buffer per processor lookaside pointers
ObZn - nt!ob        - object zone
ObjT - nt!ob        - object type objects
Obtb - nt!ob        - object tables via EX handle.c
ObTR - nt!ob        - object table ERESOURCEs
Obeb - nt!ob        - object tables extra bit tables via EX handle.c
ObDm - nt!ob        - object device map
ObSc - nt!ob        - Object security descriptor cache block
ObSt - nt!ob        - Object Manager temporary storage

OHCI - <unknown>    - Open Host Controller Interface for USB
ohci - <unknown>    - 1394 OHCI host controller driver

Ovfl - <unknown>    - The internal pool tag table has overflowed -
                      usually this is a result of nontagged allocations being made

OvfL - <unknown>    - EXIFS FCBOVF List

PaeD - <unknown>    - PAE top level directory allocation blocks

ParC - <unknown>    - Parallel class driver
ParL - <unknown>    - Parallel link driver
ParP - <unknown>    - Parallel port driver
ParV - <unknown>    - ParVdm driver for vdm<->parallel port communciation

PciB - pci.sys      - PnP pci bus enumerator

PcCi - <unknown>    - WDM audio port class adapter device object stuff
PcCr - <unknown>    - WDM audio stuff
PcDi - <unknown>    - WDM audio stuff
PcDm - <unknown>    - DirectMusic MXF objects (WDM audio)
PcFM - <unknown>    - WDM audio FM synthesizer
PcFp - <unknown>    - WDM audio stuff
PcIc - <unknown>    - WDM audio stuff
PcIl - <unknown>    - WDM audio stuff
PcNw - <unknown>    - WDM audio stuff
PcPc - <unknown>    - WDM audio stuff
PcPr - <unknown>    - WDM audio stuff
PcSX - <unknown>    - WDM audio stuff
PcSl - <unknown>    - WDM audio stuff
PcSt - <unknown>    - WDM audio stuff
PcSx - <unknown>    - WDM audio stuff
PcUs - <unknown>    - WDM audio stuff

Pcmc - pcmcia.sys   - Pcmcia bus enumerator, general structures
Pcic - <unknown>    - Pcmcia bus enumerator, PCIC/Cardbus controller
                      specific structures
Pcdb - <unknown>    - Pcmcia bus enumerator, Databook controller
                      specific structures

Pgm? - <unknown>    - Pgm (Pragmatic General Multicast) protocol: RMCast.sys

Plcp - <unknown>    - Cache aware pushlock list (array of puchlock addresses)
Plcl - <unknown>    - Cache aware pushlock entry. One per processor
PNCH - <unknown>    - Power Notify Channel
PNCL - <unknown>    - Power Notify channel list
PNDP - <unknown>    - Power Abort Dpc Routine
PNI  - <unknown>    - Power Notify Instance

Pool - <unknown>    - Pool tables, etc.
PooL - <unknown>    - Phase 0 initialization of the executive component,
                      paged and nonpaged small pool lookaside structures
Port - <unknown>    - Port objects

PoSL - <unknown>    - Power shutdown event list

Prof - <unknown>    - Profile objects

POWI - nt!po        - Power Work Item (executive worker thread work item entry)
PSwt - nt!po        - Power switch structure
PSTA - nt!po        - Po registered system state
PDss - nt!po        - Po device system state

Prcr - processr.sys - Processr hal driver allocations
Proc - <unknown>    - Process objects
Ps   - <unknown>    - general ps allocations
Psap - <unknown>    - Block used to hold a user mode APC while its
                      queued to a thread
PsAp - <unknown>    - Process APC queued by user mode process
PsCa - <unknown>    - APC queued at thread create time.
PsCr - <unknown>    - Working set change record, should be a temporary allocation
PsEx - <unknown>    - Process exit APC
PsIm - <unknown>    - Thread impersonation (PS_IMPERSONATE_INFORMATION)
Psjb - <unknown>    - Job set array, should be a temporary allocation
PsLd - <unknown>    - Process LDT information blocks
PsQb - <unknown>    - Process quota block
PsTf - <unknown>    - Job object token filter
Pstb - <unknown>    - Process tables via EX handle.c
Psta - <unknown>    - Power management system state
PsTp - <unknown>    - Thread termination port block
PsWs - <unknown>    - Process working set watch array

PSE3 - pse36.sys    - Physical Size Extension driver

PnPb - nt!pnp       - PnP BIOS resource manipulation
PpEB - nt!pnp       - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp       - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp       - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp       - PnP last good.
PpUB - nt!pnp       - PNP_USER_BLOCK_TAG
PpWI - nt!pnp       - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp       - PnP critical device database
Ppcr - nt!pnp       - plug-and-play critical allocations
Ppdd - nt!pnp       - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp       - routines to perform device removal
Ppei - nt!pnp       - Eisa related code
Ppen - nt!pnp       - routines to perform device enumeration
Ppin - nt!pnp       - plug-and-play initialization
Ppio - nt!pnp       - plug-and-play IO system APIs
Ppre - nt!pnp       - resource allocation and translation
Pprl - nt!pnp       - routines to manipulate relations list
Ppsu - nt!pnp       - plug-and-play subroutines for the I/O system

PPTP - <unknown>    - PPTP_MEMORYPOOL_TAG
PPT0 - <unknown>    - PPTP_TDIADDR_TAG
PPT1 - <unknown>    - PPTP_TDICONN_TAG
PPT2 - <unknown>    - PPTP_CONNINFO_TAG
PPT3 - <unknown>    - PPTP_ADDRINFO_TAG
PPT4 - <unknown>    - PPTP_TIMEOUT_TAG
PPT5 - <unknown>    - PPTP_TIMER_TAG
PPT6 - <unknown>    - PPTP_TDICOTS_TAG
PPT7 - <unknown>    - PPTP_WRKQUEUE_TAG
PPT8 - <unknown>    - PPTP_SEND_CTRLDATA_TAG
PPT9 - <unknown>    - PPTP_SEND_ACKDATA_TAG
PPTa - <unknown>    - PPTP_SEND_DGRAMDESC_TAG
PPTb - <unknown>    - PPTP_TDICLTS_TAG
PPTc - <unknown>    - PPTP_RECV_CTRLDESC_TAG
PPTd - <unknown>    - PPTP_RECV_CTRLDATA_TAG
PPTe - <unknown>    - PPTP_RECV_DGRAMDESC_TAG
PPTf - <unknown>    - PPTP_RECV_DGRAMDATA_TAG
PPTg - <unknown>    - PPTP_RECVDESC_TAG
PPTh - <unknown>    - PPTP_ENGINE_TAG
PPTi - <unknown>    - PPTP_RECVDATA_TAG

PSC? - <unknown>    - Packet Scheduler (PSCHED) Tags

PSC0 - <unknown>    - NDIS Request
PSC1 - <unknown>    - GPC Client Vc
PSC2 - <unknown>    - WanLink
PSC3 - <unknown>    - Miscellaneous allocations
PSC4 - <unknown>    - WMI
PSCa - <unknown>    - Adapter
PSCb - <unknown>    - CallParameters
PSCc - <unknown>    - PipeContext
PSCd - <unknown>    - FlowContext
PSCe - <unknown>    - ClassMapContext
PSCf - <unknown>    - Adapter Profile
PSCg - <unknown>    - Component

PX1  - <unknown>    - ndis ProviderEventLookaside

p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c

P3D? - perm3dd.dll  - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll  - Permedia3 display driver

Qnam - <unknown>    - EXIFS Query Name

Qp?? - <unknown>    - Generic Packet Classifier (MSGPC)
Qppn - <unknown>    -      Queued Notifications
Qppi - <unknown>    -      Pending Irp structures
Qpci - <unknown>    -      CfInfo
Qpct - <unknown>    -      Client blocks
Qppa - <unknown>    -      Pattern blocks
Qphf - <unknown>    -      HandleFactory
Qpph - <unknown>    -      PathHash
Qprz - <unknown>    -      Rhizome
Qppd - <unknown>    -      GenPatternDb
Qpfd - <unknown>    -      FragmentDb
Qpcf - <unknown>    -      ClassificationFamily
Qpcd - <unknown>    -      CfInfoData
Qpcb - <unknown>    -      ClassificationBlock
Qppt - <unknown>    -      Protocol
Qpdg - <unknown>    -      Debug

RB?? - <unknown>    - RedBook Filter Driver, static allocations
RBEv - <unknown>    - RedBook - Thread Events
RBRl - <unknown>    - RedBook - Remove lock
RBRg - <unknown>    - RedBook - driverExtension->RegistryPath
RBSe - <unknown>    - RedBook - Serialization tracking for checked builds
RBWa - <unknown>    - RedBook - Wait block for system thread

rb?? - <unknown>    - RedBook Filter Driver, dynamic allocations
rbBu - <unknown>    - RedBook - Buffer for read/stream
rbIr - <unknown>    - RedBook - Irp for read/stream
rbIp - <unknown>    - RedBook - Irp pointer block
rbMd - <unknown>    - RedBook - Mdl for read/stream
rbMp - <unknown>    - RedBook - Mdl pointer block
rbRc - <unknown>    - RedBook - Read completion context
rbRx - <unknown>    - RedBook - Read Xtra info
rbSc - <unknown>    - RedBook - Stream completion context
rbSx - <unknown>    - RedBook - Stream Xtra info
rbTo - <unknown>    - RedBook - Cached table of contents

Rcp? - sacdrv.sys   - SAC Driver (Headless)
RcpA - sacdrv.sys   -     Internal memory mgr alloc block
RcpI - sacdrv.sys   -     Internal memory mgr initial heap block
RcpS - sacdrv.sys   -     Security related block

ReEv - <unknown>    - Resource Event
ReSe - <unknown>    - Resource Semaphore
ReTa - <unknown>    - Resource Extended Table

RefT - <unknown>    - Bluetooth reference tracking
Rf?? - <unknown>    - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys   -   RFCOMM Address
RfBB - rfcomm.sys   -   RFCOMM BRB
RfBT - rfcomm.sys   -   RFCOMM (bthport)
RfCB - rfcomm.sys   -   RCOMMM
RfCH - rfcomm.sys   -   RFCOMM channel
RfCN - rfcomm.sys   -   RFCOMM connect
RfDA - rfcomm.sys   -   RFCOMM data
RfFR - rfcomm.sys   -   RFCOMM frame
RfRX - rfcomm.sys   -   RFCOMM receive
RfPP - rfcomm.sys   -   RFCOMM pnp
RfWR - rfcomm.sys   -   RFCOMM worker

RRle - <unknown>    - RTL_RANGE_LIST_ENTRY_TAG
RRlm - <unknown>    - RTL_RANGE_LIST_MISC_TAG

RtPi - <unknown>    - Temp allocation for product type key

RPrt - rstorprt.sys - Remote Storage Port Driver

Rqrv - <unknown>    - Registry query buffer
RS?? - <unknown>    - Remote Storage
RSFS - <unknown>    -      Recall Queue
RSFN - <unknown>    -      File Name
RSSE - <unknown>    -      Security info
RSWQ - <unknown>    -      Work Queue
RSQI - <unknown>    -      Queue info
RSLT - <unknown>    -      Long term data
RSIO - <unknown>    -      Ioctl Queue
RSFO - <unknown>    -      File Obj queue
RSVO - <unknown>    -      Validate Queue
RSER - <unknown>    -      Error log data
RWan - rawwan.sys   - Raw WAN driver

Rx?? - <unknown>    - Rdr2 rdbss.sys stuff
RxSc - <unknown>    -         SrvCall
RxNr - <unknown>    -         NetRoot
RxVn - <unknown>    -         VNetRoot
RxFc - <unknown>    -         FCB
RxSo - <unknown>    -         SrvOpen
RxFx - <unknown>    -         Fobx
RxNf - <unknown>    -         nonpaged FCB
RxWq - <unknown>    -         work queue
RxBm - <unknown>    -         buffering manager
RxMs - <unknown>    -         misc.
RxIr - <unknown>    -         RxContext (IrpContext)
RxMx - <unknown>    -         minirdr dispatch table
RxNc - <unknown>    -         NameCache (not currently used)

RxCt - <unknown>    -         connection engine transport
RxCa - <unknown>    -         connection engine address
RxCc - <unknown>    -         connection engine connection
RxCv - <unknown>    -         connection engine VC
RxCd - <unknown>    -         connection engine TDI

RxSp - <unknown>    -         srvcall calldown params (special build only)
RxVp - <unknown>    -         vnetroot calldown params (special build only)
RxTm - <unknown>    -         timer context (special build only)
RxDc - <unknown>    -         querydirectory pattern (special build only)
RxCx - <unknown>    -         connection engine misc. (special build only)

S3   - <unknown>    - S3 video driver
SBad - <unknown>    - bad block simulator - simbad.c

sbp2 - <unknown>    - Sbp2 1394 storage port driver

SC?? - <unknown>    - Smart card driver tags
SCLb - <unknown>    -  Smart card driver library
SCB8 - <unknown>    -  Bull CP8 Transac serial reader
SCB3 - <unknown>    -  Bull SmarTlp PnP
SCS4 - <unknown>    -  SCM Microsystems pcmcia reader
SCl0 - <unknown>    -  Litronic 220

Sc?? - <unknown>    - Mass storage driver tags

ScB? - classpnp.sys - ClassPnP misc allocations
ScC? - classpnp.sys - ClassPnP misc allocations

ScC? - <unknown>    -   CdRom
ScCE - <unknown>    -      device control synch event
ScCG - <unknown>    -      disk geometry buffer
ScCH - <unknown>    -      hitachi error buffer
ScCI - <unknown>    -      sense info buffers
ScCS - <unknown>    -      srb allocation
ScCM - <unknown>    -      mode data buffer
ScCP - <unknown>    -      read capacity buffer
ScCp - <unknown>    -      play active checks
ScCQ - <unknown>    -      read sub q buffer
ScCR - <unknown>    -      raw mode read buffer
ScCT - <unknown>    -      read toc buffer
ScCt - <unknown>    -      toshiba error buffer
ScCU - <unknown>    -      update capacity path
ScCV - <unknown>    -      volume control buffer
ScCv - <unknown>    -      volume control buffer

ScD? - <unknown>    -   Disk
ScD  - <unknown>    -      generic tag
ScDa - <unknown>    -      SMART
ScDA - <unknown>    -      Info Exceptions
ScDC - <unknown>    -      disable cache paths
ScDb - classpnp.sys -      ClassPnP debug globals buffer
ScDc - <unknown>    -      disk allocated completion c
ScDG - <unknown>    -      disk geometry buffer
ScDg - <unknown>    -      update disk geometry paths
ScDI - <unknown>    -      sense info buffers
ScDp - <unknown>    -      pnp ids
ScDM - <unknown>    -      mode data buffer
ScDM - <unknown>    -      mbr checksum code
ScDN - <unknown>    -      disk name code
ScDP - <unknown>    -      read capacity buffer
ScDp - <unknown>    -      disk partition lists
ScDS - <unknown>    -      srb allocation
ScDs - <unknown>    -      start device paths
ScDU - <unknown>    -      update capacity path
ScDW - <unknown>    -      work-item context
ScMC - <unknown>    -      medium changer allocations

ScF? - <unknown>    -   FtDisk
ScFt - <unknown>    -      FtDisk allocations

ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys -   Classpnp
ScLA - classpnp.sys -      allocation to check for autorun disable
ScLF - classpnp.sys -      File Object Extension
ScLc - classpnp.sys -      Cache filters
ScLf - classpnp.sys -      Fault prediction
ScLm - classpnp.sys -      Mount
ScLM - classpnp.sys -      Media Change Detection
ScLq - classpnp.sys -      Release queue
ScLw - classpnp.sys -      WMI
ScLW - classpnp.sys -      Power

ScNo - classpnp.sys - ClassPnP notification

ScP? - <unknown>    -   Scsiport
ScPa - <unknown>    -      Hold registry data
ScPA - <unknown>    -      Access Ranges
ScPb - <unknown>    -      Get Bus Dat Holder
ScPB - <unknown>    -      Queuetag BitMap
ScPc - <unknown>    -      Fake common buffer
ScPC - <unknown>    -      reset bus code
ScPd - <unknown>    -      Pnp id strings
ScPD - <unknown>    -      SRB_DATA allocations
ScPE - <unknown>    -      Scatter gather lists
ScPG - <unknown>    -      Global memory
ScPh - <unknown>    -      HwDevice Ext
ScPi - <unknown>    -      Sense Info
ScPI - <unknown>    -      Init data chain
ScPl - <unknown>    -      remove lock tracking
ScPL - <unknown>    -      scatter gather lists
ScPm - <unknown>    -      address mapping lists
ScPM - <unknown>    -      scatter gather lists
ScPp - <unknown>    -      device & adapter enable
ScpP - <unknown>    -      scsi PortConfig copies
ScPq - <unknown>    -      inquiry data
ScPQ - <unknown>    -      request sense
ScPr - <unknown>    -      resource list copy
ScPS - <unknown>    -      registry allocations
ScPt - <unknown>    -      legacy request rerouting
ScPT - <unknown>    -      interface mapping
ScPu - <unknown>    -      device relation structs
ScPv - <unknown>    -      KEVENT
ScPV - <unknown>    -      Device map allocations
ScPw - <unknown>    -      Wmi Events
ScPW - <unknown>    -      Wmi Requests
ScPx - <unknown>    -      Report Luns
ScPY - <unknown>    -      Report Targets
ScPZ - <unknown>    -      Device name buffer

ScR? - <unknown>    -   Partition Manager
ScRi - <unknown>    -      IOCTL buffer
ScRp - <unknown>    -      Partition entry
ScRr - <unknown>    -      Remove lock
ScRt - <unknown>    -      Table entry
ScRv - <unknown>    -      Dependant volume relations lists
ScRV - <unknown>    -      Volume entry
ScRw - <unknown>    -      Power mgmt private work item

ScsC - <unknown>    - non-pnp SCSI CdRom
ScsD - <unknown>    - non-pnp SCSI Disk
ScsH - <unknown>    - non-pnp SCSI from class.h (class2)
ScsI - <unknown>    - non-pnp SCSI port internal
ScsL - <unknown>    - non-pnp SCSI class.c driver allocations
ScsP - <unknown>    - non-pnp SCSI port.c
Scs$ - <unknown>    - Tag for pnp class driver's SRB lookaside list

ScUn - <unknown>    - Default Tag for pnp class driver allocations

ScV? - <unknown>    -  Dvd functionality in cdrom.sys
ScVk - <unknown>    -      read buffer for DVD keys
ScVK - <unknown>    -      write buffer for DVD keys
ScVS - <unknown>    -      buffer for reads of DVD on-disk structures

SdCc - <unknown>    - ObsSecurityDescriptorCache / SECURITY_DESCRIPTOR_CACHE_ENTRIES

Sdba - <unknown>    - Application compatibility Sdb* allocations

Sdp? - <unknown>    - Bluetooth SDP functionality in BTHPORT.sys
SdpC - bthport.sys  -     Bluetooth SDP client connection
SdpD - bthport.sys  -     Bluetooth SDP database
SdpI - bthport.sys  -     Bluetooth port driver (SDP)

Se   - nt!se        - General security allocations
SeAc - nt!se        - Security ACL
SeAi - nt!se        - Security Audit Work Item
SeAp - nt!se        - Security Audit Parameter Record
SeCL - nt!se        - Security CONTEXT_TAG
SeDb - nt!se        - Temp directory query buffer to delete logon
                      session symbolic links. 
SeFS - nt!se        - SEP_FILE_SYSTEM_NOTIFY_CONTEXT
SeHa - nt!se        - Temp directory query buffer to delete logon
                      session symbolic links. 
SeLs - nt!se        - Security Logon Session
SeLu - nt!se        - Security LUID and Attributes array
SeLS - nt!se        - Security Logon Session tracking array
SeLw - nt!se        - Security LSA Work Item
SeOn - nt!se        - Security Captured Object Name information
SeOt - nt!se        - Captured object type array. Used by access check code
SePa - nt!se        - Process audit image names and captured polity structures
SePr - nt!se        - Security Privilege Set
SeSa - nt!se        - Security SID and Attributes
SeSc - nt!se        - Captured Security Descriptor
SeSd - nt!se        - Security Descriptor
SeSi - nt!se        - Security SID
SeTa - nt!se        - Security Temporary Array
SeTd - nt!se        - Security Token dynamic part
SeTn - nt!se        - Security Captured Type Name information
SeUs - nt!se        - Security Captured Unicode string

Sect - <unknown>    - Section objects
Sema - <unknown>    - Semaphore objects
Senm - <unknown>    - Serenum (RS-232 serial bus enumerator)
SimB - <unknown>    - Simbad (bad sector simulation driver) allocations
SIfs - <unknown>    - Default tag for user's of ntsrv.h
sidg - <unknown>    - GDI spooler events
Sis  - <unknown>    - Single Instance Store (dd\sis\filter)
SisB - <unknown>    -         SIS per file object break event
SisC - <unknown>    -         SIS common store file object
SisF - <unknown>    -         SIS per file object
SisL - <unknown>    -         SIS per link object
SisS - <unknown>    -         SIS SCB
Setp - <unknown>    - SETUPDD SpMemAlloc calls

SRdm - scsirdma.sys - Infiniband SRP driver

SW?? - <unknown>    - Software Bus Enumerator
SWbi - <unknown>    -         bus ID
SWbr - <unknown>    -         bus reference
SWda - <unknown>    -         POOLTAG_DEVICE_ASSOCIATION
SWdn - <unknown>    -         device name
SWdr - <unknown>    -         device reference
SWdr - <unknown>    -         POOLTAG_DEVICE_DRIVER_REGISTRY
SWfd - <unknown>    -         POOLTAG_DEVICE_FDOEXTENSION
SWid - <unknown>    -         device ID
SWii - <unknown>    -         instance ID
SWip - <unknown>    -         POOLTAG_DEVICE_INTERFACEPATH
SWki - <unknown>    -         key information
SWpd - <unknown>    -         POOLTAG_DEVICE_PDOEXTENSION
SWre - <unknown>    -         relations
SWrp - <unknown>    -         reparse string
SWrs - <unknown>    -         reference string

Sm?? - <unknown>    - rdr2 smb mini
SmCe - <unknown>    -         smbmini connection engine
SmMm - <unknown>    -         smbmini managed datastructures
SmAd - <unknown>    -         session setup/admin exchange
SmRw - <unknown>    -         read/write path
SmTr - <unknown>    -         transact exchange
SmMs - <unknown>    -         misc.
SmTp - <unknown>    -         server transport tag
SmRb - <unknown>    -         remote boot

SmFc - <unknown>    -         fsctl structures  (special build only)
SmDc - <unknown>    -         dir query buffer (special build only)
SmPi - <unknown>    -         pipeinfo buffer (special build only)
SmDO - <unknown>    -         deferred open context  (special build only)
SmQP - <unknown>    -         params for directory query transact
                              (special build only)
SmRx - <unknown>    -         minirdr generated RxContext  (special build only)

SmVr - <unknown>    -         VNetroot  (special build only)
SmSr - <unknown>    -         Server  (special build only)
SmSe - <unknown>    -         Session  (special build only)
SmNr - <unknown>    -         NetRoot  (special build only)
SmMa - <unknown>    -         mid atlas  (special build only)
SmMt - <unknown>    -         mailslot buffer  (special build only)
SmVc - <unknown>    -         smbmini connectionengine VC  (special build only)
SmEc - <unknown>    -         echo buffer  (special build only)
SmKs - <unknown>    -         Kerberos blob  (special build only)

SPX  - <unknown>    - Nwlnkspx transport
SQOS - <unknown>    - Security quality of service in IO

Sr?? - sr.sys       - System Restore file system filter driver
SrCo - <unknown>    -         SR's control object
SrSC - <unknown>    -         Stream contexts
SrDB - <unknown>    -         Debug information for lookup blob
SrDL - <unknown>    -         Device list
SrFE - <unknown>    -         File information buffer
SrFN - <unknown>    -         File name
SrHB - <unknown>    -         Hash bucket
SrHH - <unknown>    -         Hash header
SrHK - <unknown>    -         Hash key
SrLB - <unknown>    -         Log buffer
SrLC - <unknown>    -         Logging context
SrLE - <unknown>    -         Log entry
SrLT - <unknown>    -         Lookup blob
SrMP - <unknown>    -         Mount point information
SrOI - <unknown>    -         Overwrite information
SrPC - <unknown>    -         Persistant configuration information
SrRB - <unknown>    -         Rename buffer
SrRG - <unknown>    -         Logger context
SrRH - <unknown>    -         Reparse data size
SrRR - <unknown>    -         Registry information
SrSD - <unknown>    -         Security data information
SrST - <unknown>    -         Stream data information
SrTI - <unknown>    -         Directory delete information
SrWI - <unknown>    -         Work queue item

ST*  - <unknown>    - New MMC compliant storage drivers

Stac - <unknown>    - Stack Trace Database - i386 checked and
                      built with NTNOFPO=1 only
Strg - <unknown>    - Dynamic Translated strings
Strm - <unknown>    - Streams and streams transports allocations
SwMi - <unknown>    - SWMidi KS filter (WDM Audio)
Symb - <unknown>    - Symbolic link objects
Symt - <unknown>    - Symbolic link target strings

SYSA - <unknown>    - Sysaudio (wdm audio)

TAPI - <unknown>    - ntos\ndis\ndistapi

TC?? - TCP          - TCP/IP network protocol
TCh? - <unknown>    -     TCP/IP header pools
TCPC - <unknown>    -     TCP connection pool
TCPT - <unknown>    -     TCB pool
TCPY - <unknown>    -     SYN-TCB pool
TCPr - <unknown>    -     TCP request pool

TDIc - <unknown>    - TDI resource
TDId - <unknown>    - TDI resource
TDIe - <unknown>    - TDI resource
TDIf - <unknown>    - TDI resource
TDIg - <unknown>    - TDI resource
TDIk - <unknown>    - TDI resource
TDIu - <unknown>    - TDI resource
TDIv - <unknown>    - TDI resource

thdd - <unknown>    - DirectDraw/3D handle manager table

Thre - nt!ps        - Thread objects
Time - nt!ke        - Timer objects
Toke - nt!se        - Token objects

Tran - <unknown>    - EXIFS Translate

TSBV - <unknown>    - WDM mini driver for Toshiba 750 capture
TSdd - <unknown>    - RDPDD - Hydra Display Driver
TSmc - <unknown>    - PDMCS - Hydra MCS Protocol Driver
TSwd - <unknown>    - RDPWD - Hydra Winstation Driver

TTFC - <unknown>    - Font file cache
Ttfd - <unknown>    - TrueType Font driver

Thrm - <unknown>    - Thermal zone structure
Tun4  - <unknown>   - Tunnel cache allocation for long file name
TunL - <unknown>    - Tunnel cache lookaside-allocated elements
TunP - <unknown>    - Tunnel cache oddsized pool-allocated elements
TunK - <unknown>    - Tunnel cache temporary key value

Type - <unknown>    - Type objects

UCAM - <unknown>    - USB digital camera library
UDFV - <unknown>    - Udfs volume descriptor sequence descriptor buffer

Udf1 - <unknown>    - Udfs file set descriptor buffer
Udf2 - <unknown>    - Udfs volmume recognition sequence descriptor buffer
Udf2 - <unknown>    - Udfs volume descriptor sequence descriptor buffer
UdfC - <unknown>    - Udfs CRC table
UdfD - <unknown>    - Udfs FID buffer for view spanning
UdfF - <unknown>    - Udfs nonpaged Fcb errata
UdfI - <unknown>    - Udfs IO context
UdfL - <unknown>    - Udfs IRP context lite (delayed close)
UdfS - <unknown>    - Udfs short file name
UdfT - <unknown>    - Udfs generic table entry
Udfb - <unknown>    - Udfs IO buffer
Udfc - <unknown>    - Udfs IRP context
Udfd - <unknown>    - Udfs file Fcb
Udfe - <unknown>    - Udfs enumeration match expression
Udff - <unknown>    - Udfs normalized full filename
Udfi - <unknown>    - Udfs directory Fcb
Udfl - <unknown>    - Udfs Lcb
Udfp - <unknown>    - Udfs Pcb
Udfs - <unknown>    - Udfs Sparing Mcb
Udft - <unknown>    - Udfs CDROM TOC
Udfv - <unknown>    - Udfs Vpb
Udfx - <unknown>    - Udfs Ccb

Udp  - <unknown>    - Udp protocol (TCP/IP driver)
Ufsc - <unknown>    - User FULLSCREEN
UHCD - <unknown>    - Universal Host Controller (USB - Intel Controller)
UHUB - <unknown>    - Universal Serial Bus Hub

Ul?? - http.sys     - tags. Note: In-use tags are of the form "Ul??" or "Uc??".
                      and Free tags are of the form "uL??" or "uC??";
Uc?? - http.sys     - i.e., the case of the leading "Ul" or "Uc" has been reversed.

Ucac - http.sys     - Auth Cache Pool
UcCO - http.sys     - Client Connection
Ucmp - http.sys     - Multipart String Buffer
Ucre - http.sys     - Receive Response
Ucrp - http.sys     - Response App Buffer
Ucrq - http.sys     - Request Pool
UcSc - http.sys     - Common Server Information
UcSN - http.sys     - Server name
UcSP - http.sys     - Process Server Information
UcSp - http.sys     - Sspi Pool
UcST - http.sys     - Server info table
Uctd - http.sys     - Response Tdi Buffer
Ucte - http.sys     - Entity Pool
Ucto - http.sys     - Tdi Objects Pool
UlAB - http.sys     - Auxiliary Buffer
UlAO - http.sys     - App Pool Object
UlAP - http.sys     - App Pool Process
UlBL - http.sys     - Binary Log File Entry
UlBO - http.sys     - Outstanding i/o
UlCC - http.sys     - Control Channel
UlCE - http.sys     - Config Group Tree Entry
UlCH - http.sys     - Config Group Tree Header
UlCI - http.sys     - Config Group URL Info
UlCJ - http.sys     - Config Group Object Pool
UlCK - http.sys     - Chunk Tracker
UlCL - http.sys     - Config Group LogDir
UlCl - http.sys     - Connection RefTraceLog
UlCO - http.sys     - Connection
UlCT - http.sys     - Config Group Timestamp
UlCY - http.sys     - Connection Count Entry
UlDB - http.sys     - Debug
UlDC - http.sys     - Data Chunks array
UlDO - http.sys     - Disconnect Object
UlDR - http.sys     - Deferred Remove Item
UlDT - http.sys     - Debug Thread Pool
UlEP - http.sys     - Endpoint
UlFA - http.sys     - Force Abort Work Item
UlFC - http.sys     - File Cache Entry
Ulfc - http.sys     - Uri Filter Context
UlFD - http.sys     - Noncached File Data
UlFP - http.sys     - Filter Process
UlFR - http.sys     - Dummy Filter Receive Buffer
UlFT - http.sys     - Filter Channel
UlFU - http.sys     - Full Tracker
UlFW - http.sys     - Filter Write Tracker
UlHC - http.sys     - Http Connection
UlHc - http.sys     - Http Connection RefTraceLog
UlHL - http.sys     - Internal Request RefTraceLog
UlHR - http.sys     - Internal Request
UlHT - http.sys     - Hash Table
UlHV - http.sys     - Header Value
UlIC - http.sys     - Irp Context
UlID - http.sys     - Conn ID Table
UlIR - http.sys     - Internal Response
UlLD - http.sys     - Log Field
UlLF - http.sys     - Log File Entry
UlLG - http.sys     - Log Generic
UlLH - http.sys     - Log File Handle
UlLL - http.sys     - Log File Buffer
UlLS - http.sys     - Ansi Log Data Buffer
UlLT - http.sys     - Binary Log Data Buffer
UlNO - http.sys     - NSGO Pool
UlNP - http.sys     - Non-Paged Data
UlOE - http.sys     - Endpoint OwnerRefTraceLog PoolTag
UlOR - http.sys     - Owner RefTrace Signature
UlOT - http.sys     - Opaque ID Table
UlPB - http.sys     - APool Proc Binding
UlPL - http.sys     - Pipeline
UlQF - http.sys     - TCI Filter
UlQG - http.sys     - TCI Generic
UlQI - http.sys     - TCI Interface
UlQL - http.sys     - TCI Flow
UlQT - http.sys     - TCI Tracker
UlQW - http.sys     - TCI WMI
UlRB - http.sys     - Receive Buffer
UlRD - http.sys     - Registry Data
UlRE - http.sys     - Request Body Buffer
UlRP - http.sys     - Request Buffer
UlRR - http.sys     - Request Buffer References
UlRS - http.sys     - Non-Paged Resource
UlRT - http.sys     - RefTraceLog PoolTag
UlSC - http.sys     - SSL Cert Data
UlSD - http.sys     - Security Data
UlSl - http.sys     - StringLog Buffer PoolTag
UlSL - http.sys     - StringLog PoolTag
UlSO - http.sys     - Site Counter Entry
UlSS - http.sys     - Simple Status Item
UlTA - http.sys     - Address Pool
UlTD - http.sys     - UL_TRANSPORT_ADDRESS
UlTT - http.sys     - Thread Tracker
UlUB - http.sys     - URL Buffer
UlUC - http.sys     - Uri Cache Entry
UlUH - http.sys     - HTTP Unknown Header
UlUL - http.sys     - URL
UlUM - http.sys     - URL Map
UlVH - http.sys     - Virtual Host
UlWC - http.sys     - Work Context
UlWI - http.sys     - Work Item

UndP - <unknown>    - EXIFS Underlying Path

Urdr - win32k!SetRedirectionBitmap          - REDIRECT
Usac - win32k!_CreateAcceleratorTable       - ACCEL
Usai - win32k!zzzAttachThreadInput          - ATTACHINFO
Usal - win32k!InitSwitchWndInfo             - ALTTAB
USBB - bthusb.sys                           - Bluetooth USB minidriver
USBD - <unknown>                            - Universal Serial Bus Class Driver
Usbg - win32k!xxxLogClipData                - DEBUG
Uscb - win32k!_ConvertMemHandle             - CLIPBOARD
Uscc - win32k!AllocCallbackMessage          - CALLBACK
Usci - win32k!InitSystemThread              - CLIENTTHREADINFO
Uscl - win32k!ClassAlloc                    - CLASS
Uscm - win32k!InitScancodeMap               - SCANCODEMAP
Uscp - win32k!CreateDIBPalette              - CLIPBOARDPALETTE
Uscr - win32k!NtUserSetSysColors            - COLORS
Usct - win32k!CkptRestore                   - CHECKPT
Uscu - win32k!_CreateEmptyCursorObject      - CURSOR
Uscv - win32k!NtUserSetSysColors            - COLORVALUES
Usd1 - win32k!FreeListAdd                   - DDE1
Usd2 - win32k!_DdeSetQualityOfService       - DDE2
Usd4 - win32k!AddPublicObject               - DDE4
Usd5 - win32k!xxxCsEvent                    - DDE5
Usd6 - win32k!xxxCsEvent                    - DDE6
Usd7 - win32k!xxxCsEvent                    - DDE7
Usd8 - win32k!xxxMessageEvent               - DDE8
Usd9 - win32k!xxxCsDdeInitialize            - DDE9
UsdA - win32k!NewConversation               - DDEa
UsdB - win32k!Createpxs                     - DDEb
UsdD - win32k!NtUserfnDDEINIT               - DDEd
UsdE - win32k!xxxClientCopyDDEIn1           - DDE
Usdc - win32k!CreateCacheDC                 - DCE
Usdi - win32k!CreateMonitor                 - DISPLAYINFO
UsDI - win32k!CreateDeviceInfo              - DEVICEINFO
Usds - win32k!xxxDragObject                 - DRAGDROP
Usdv - win32k!NtUserfnINDEVICECHANGE        - DEVICECHANGE
User - win32k!InitCreateUserCrit            - ERESOURCE
Usev - win32k!xxxPollAndWaitForSingleObject - EVENT
Usgh - win32k!NtUserUserHandleGrantAccess   - GRANTEDHANDLES
Usgl - win32k!CreateShadowTL                - GLOBALTHREADLOCK
Usgt - win32k!AddGhost                      - GHOST
Usha - win32k!AllocateHidData               - HIDDATA
UshD - Win32k!AllocateHidDesc               - HIDDESC
Ushk - win32k!_RegisterHotKey               - HOTKEY
Usih - win32k!SetImeHotKey                  - IMEHOTKEY
Usim - win32k!CreateInputContext            - IME
Usjb - win32k!CreateW32Job                  - W32JOB
Usjx - win32k!JobCalloutAddProcess          - W32JOBEXTRA
Uskb - win32k!xxxLoadKeyboardLayoutEx       - KBDLAYOUT
Uske - win32k!GetKbdExId                    - KBDEXID
Uskf - win32k!LoadKeyboardLayoutFile        - KBDFILE
Usks - win32k!PostUpdateKeyStateEvent       - KBDSTATE
Uskt - win32k!ReadLayoutFile                - KBDTABLE
Usla - win32k!InitLockRecordLookaside       - LOOKASIDE
Usld - win32k!GrowLogIfNecessary            - LOGDESKTOP
Uslr - win32k!InitLockRecordLookaside       - LOCKRECORD
Usmi - win32k!MirrorRegion                  - MIRROR
Usmr - win32k!SnapshotMonitorRects          - MONITORRECTS
Usms - win32k!xxxMoveSize                   - MOVESIZE
Usmt - win32k!xxxMNAllocMenuState           - MENUSTATE
Usno - win32k!zzz                           - NONE - don't use
Usny - win32k!CreateNotify                  - NOTIFY
Uspi - win32k!MapDesktop                    - PROCESSINFO
Uspm - win32k!MNAllocPopup                  - POPUPMENU
Uspn - win32k!CreateProfileUserName         - PROFILEUSERNAME
Uspo - win32k!QueuePowerRequest             - POWER
Uspp - win32k!AllocateAndLinkHidTLCInfo     - PNP
Uspr - win32k!GetPrivateProfileStruct       - PROFILE
Usqm - win32k!InitQEntryLookaside           - QMSG
Usqu - win32k!InitQEntryLookaside           - Q
Usrt - win32k!xxxDrawMenuItemText           - RTL
Ussa - win32k!xxxBroadcastMessage           - SMS_ASYNC
Ussb - win32k!CreateSpb                     - SPB
Ussd - win32k!xxxAddShadow                  - SHADOW
Ussc - win32k!xxxInterSendMsgEx             - SMS_CAPTURE
Usse - win32k!SetDisconnectDesktopSecurity  - SECURITY
Ussi - win32k!NtUserSendInput               - SENDINPUT
Ussm - win32k!InitSMSLookaside              - SMS
Usss - win32k!xxxBroadcastMessage           - SMS_STRING
Usst - win32k!xxxSBTrackInit                - SCROLLTRACK
Ussw - win32k!_BeginDeferWindowPos          - SWP
Ussy - win32k!xxxDesktopThread              - SYSTEM
Ustd - win32k!TrackAddDesktop               - TRACKDESKTOP
Usti - win32k!AllocateW32Thread             - THREADINFO
Ustk - win32k!HeavyAllocPool                - STACK
Ustm - win32k!InternalSetTimer              - TIMER
Usto - win32k!xxxConnectService             - TOKEN
Usts - win32k!_Win32CreateSection           - SECTION
Ustx - win32k!NtUserDrawCaptionTemp         - TEXT
Usty - win32k!NtUserResolveDesktopForWOW    - TEXT2
Usub - win32k!NtUserToUnicodeEx             - UNICODEBUFFER
Usvi - win32k!ResizeVisExcludeMemory        - VISRGN
Usvl - win32k!VWPLAdd                       - VWPL
Uswd - win32k!xxxCreateWindowEx             - WINDOW
Uswe - win32k!_SetWinEventHook              - WINEVENT
Uswl - win32k!BuildHwndList                 - WINDOWLIST
Uswo - win32k!zzzInitTask                   - WOWTDB
Uswp - win32k!xxxRegisterUserHungAppHandlers - WOWPROCESSINFO
Uswt - win32k!xxxUserNotifyProcessCreate    - WOWTHREADINFO

Vad  - nt!mm        - Mm virtual address descriptors
VadF - nt!mm        - VADs created by a FreeVM splitting
Vadl - nt!mm        - Mm virtual address descriptors (long)
VadS - nt!mm        - Mm virtual address descriptors (short)
VidL - videoprt.sys - VideoPort Allocation List (FDO_EXTENSION)
VidR - videoprt.sys - VideoPort Allocation on behalf of Miniport
VDM  - nt!vdm       - ntos\vdm

VoS? - volsnap.sys  -  VolSnap (Volume Snapshot Driver)
VoSa - volsnap.sys  -      Application information allocations
VoSb - volsnap.sys  -      Buffer allocations
VoSc - volsnap.sys  -      Snapshot context allocations
VoSd - volsnap.sys  -      Diff area volume allocations
VoSf - volsnap.sys  -      Diff area file allocations
VoSh - volsnap.sys  -      Bit history allocations
VoSi - volsnap.sys  -      Io status block allocations
VoSm - volsnap.sys  -      Bitmap allocations
VoSo - volsnap.sys  -      Old heap entry allocations
VoSp - volsnap.sys  -      Pnp id allocations
VoSr - volsnap.sys  -      Device relations allocations
VoSs - volsnap.sys  -      Short term allocations
VoSt - volsnap.sys  -      Temp table allocations
VoSw - volsnap.sys  -      Work queue allocations
VoSx - volsnap.sys  -      Dispatch context allocations

Vpb  - <unknown>    - Io, vpb's

Vprt - <unknown>    - ntos\video\port
VraP - <unknown>    - parallel class driver
Vtfd - <unknown>    - Font file/context

Wait - <unknown>    - NtWaitForMultipleObjects

Wan? - <unknown>    - NdisWan Tags (PPP Framing module for Remote Access)
WanA - <unknown>    - BundleCB
WanB - <unknown>    - ProtocolCB/LinkCB
WanC - <unknown>    - DataDesc
WanD - <unknown>    - WanRequest
WanE - <unknown>    - LoopbackDesc
WanG - <unknown>    - MiniportCB
WanH - <unknown>    - OpenCB
WanI - <unknown>    - IoPacket
WanJ - <unknown>    - LineUpInfo
WanK - <unknown>    - Unicode String Buffer
WanL - <unknown>    - Protocol Table
WanM - <unknown>    - Connection Table
WanN - <unknown>    - NdisPacketPool Desc
WanQ - <unknown>    - DataBuffer
WanR - <unknown>    - WanPacket
WanS - <unknown>    - AfCB/SapCB/VcCB
WanT - <unknown>    - Transform Driver
WanV - <unknown>    - RC4 Encryption Context
WanW - <unknown>    - SHA Encryption
WanX - <unknown>    - Send Compression Context
WanY - <unknown>    - Recv Compression Context
WanZ - <unknown>    - Protocol Specific Info

Wdm  - <unknown>    - WDM
WDMA - <unknown>    - WDM Audio

Wdog - watchdog.sys - Watchdog object/context allocation

Wmii - <unknown>    - Wmi InstId chunks
Wmij - <unknown>    - Wmi GuidMaps
Wmim - <unknown>    - Wmi KM to UM Notification Buffers
Wmin - <unknown>    - Wmi Notification Slot Chunks
Wmip - <unknown>    - Wmi General purpose allocation
Wmis - <unknown>    - Wmi SysId allocations
Wmit - <unknown>    - Wmi Trace
Wmiw - <unknown>    - Wmi Notification Waiting Buffers, in paged queue
                      waiting for IOCTL
Wmiz - <unknown>    - Wmi MCA Insertions debug code

WmiA - <unknown>    - Wmi ACPI mapper
WmiC - <unknown>    - Wmi Create Pump Thread Work Item
WmiD - <unknown>    - Wmi Registration DataSouce
WmiG - <unknown>    - Allocation of WMIGUID
WmiI - <unknown>    - Wmi Instance Names
WmiL - <unknown>    - WmiLIb
WmiN - <unknown>    - Wmi Notification Notification Packet
WmiR - <unknown>    - Wmi Registration info blocks

WmDS - <unknown>    - Wmi DataSource chunks
WmGE - <unknown>    - Wmi GuidEntry chunks
WmIS - <unknown>    - Wmi InstanceSet chunks
WmMR - <unknown>    - Wmi MofResouce chunks

WMca - <unknown>    - WMI MCA Handling

Wrp? - <unknown>    - WanArp Tags (ARP module for Remote Access)

Wrpa - <unknown>    - WAN_ADAPTER_TAG
Wrpi - <unknown>    - WAN_INTERFACE_TAG
Wrpr - <unknown>    - WAN_REQUEST_TAG
Wrps - <unknown>    - WAN_STRING_TAG
Wrpc - <unknown>    - WAN_CONN_TAG
Wrpw - <unknown>    - WAN_PACKET_TAG
Wrpf - <unknown>    - FREE_TAG (checked builds only)
Wrpd - <unknown>    - WAN_DATA_TAG
Wrph - <unknown>    - WAN_HEADER_TAG
Wrpn - <unknown>    - WAN_NOTIFICATION_TAG

WvCy - <unknown>    - WDM Audio WaveCyc port
WvPc - <unknown>    - WDM Audio WavePCI port

xCVD - mrxdav.sys - AsyncEngineContext Tag
xSMB - smbmrx.sys - IFSKIT sample SMB mini-redirector

XWan - <unknown>    - ndis\usrwan allocations

Xtra - <unknown>    - EXIFS Extra Create

ysd8 - win32k.sys   - User DDE8
ysd9 - win32k.sys   - User DDE9
ysda - win32k.sys   - User DDEa
ysdb - win32k.sys   - User DDEb
ysdc - win32k.sys   - User DDEc
ysdd - win32k.sys   - User DDEd

ZsaB - <unknown>    - EXIFS ZeroBlock
<< Back Автор: Alter (Александр А. Телятников) Сервер: Apache+PHP под FBSD © 2002-2024