A long list of non-paged pool reference IDs which is handy when searching for memory leaks

Click below for a list of 4 character non-paged pool reference IDs, which helps you track and trace memory leaks in Windows.

Can you tell I've been memory leak hunting on some of our hosted servers lately?

8042 - i8042prt.sys - PS/2 kb and mouse
ARPC - atmarpc.sys - ATM ARP Client
ATMU - atmuni.sys - ATM UNI Call Manager
Atom - - Atom Tables
Abos - - Abiosdsk
AcdM - - TDI AcdObjectInfoG
AcdN - - TDI AcdObjectInfoG
Acp* - acpi.sys - ACPI Pooltags
ACPI - acpi.sys - ACPI
Adap - - Adapter objects
Adbe - - Adobe's font driver
AECi - - filter object interface for MS acoustic echo canceller
Afd? - afd.sys - AFD objects
AfdA - afd.sys - Afd EA buffer
AfdB - afd.sys - Afd data buffer
AfdC - afd.sys - Afd connection structure
AfdD - afd.sys - Afd debug data
AfdE - afd.sys - Afd endpoint structure
AfdF - afd.sys - Afd TransmitFile info
AfdG - afd.sys - Afd group table
AfdI - afd.sys - Afd TDI data
AfdL - afd.sys - Afd local address buffer
AfdP - afd.sys - Afd poll info
AfdQ - afd.sys - Afd work queue item
AfdR - afd.sys - Afd remote address buffer
AfdS - afd.sys - Afd security info
AfdT - afd.sys - Afd transport info
AfdW - afd.sys - Afd work item
AfdX - afd.sys - Afd context buffer
Afda - afd.sys - Afd APC buffer (NT 3.51 only)
Afdc - afd.sys - Afd connect data buffer
Afdd - afd.sys - Afd disconnect data buffer
Afdf - afd.sys - Afd TransmitFile debug data
Afdh - afd.sys - Afd address list change buffer
Afdi - afd.sys - Afd "set inline mode" buffer
Afdl - afd.sys - Afd lookaside lists buffer
Afdp - afd.sys - Afd transport IRP buffer
Afdq - afd.sys - Afd routing query buffer
Afdr - afd.sys - Afd ERESOURCE buffer
Afdt - afd.sys - Afd transport address buffer
Afp - - SFM File server
Aml* - - ACPI AMLI Pooltags
APIC - pnpapic.sys - I/O APIC Driver
ArbA - nt!arb - ARBITER_ALLOCATION_STATE_TAG
ArbL - nt!arb - ARBITER_ORDERING_LIST_TAG
ArbM - nt!arb - ARBITER_MISC_TAG
ArbR - nt!arb - ARBITER_RANGE_LIST_TAG
Arp? - - ATM ARP server objects, atmarps.sys
ArpA - - AtmArpS address
ArpB - - AtmArpS buffer space
ArpI - - AtmArpS Interface structure
ArpK - - AtmArpS ARP block
ArpM - - AtmArpS MARS structure
ArpR - - AtmArpS NDIS request
ArpS - - AtmArpS SAP structure
Asy1 - - ndis / ASYNC_IOCTX_TAG
Asy2 - - ndis / ASYNC_INFO_TAG
Asy3 - - ndis / ASYNC_ADAPTER_TAG
Asy4 - - ndis / ASYNC_FRAME_TAG
AtC - - IDE disk configuration
AtD - - atdisk.c
ATIX - - WDM mini drivers for ATI tuner, xbar, etc.
Atk - - Appletalk transport
AtmA - - Atoms
AtmT - - Atom tables
AuxL - - EXIFS Auxlist

Bat? - - Battery Class drivers
BatC - - Composite battery driver
BatM - - Control method battery driver
BatS - - Smart battery driver
Batt - - Battery class driver
BCSP - bthbcsp.sys - Bluetooth BCSP minidriver
BIG - nt!mm - Large session pool allocations (ntos\ex\pool.c)
Bmfd - - Font related stuff
BT3C - bt3c.sys - Bluetooth 3COM minidriver
BT8x - - WDM mini drivers for Brooktree 848,829, etc.
BTHP - bthport.sys - Bluetooth port driver (generic)
BthS - bthport.sys - Bluetooth port driver (security)
BTME - bthenum.sys - Bluetooth enumerator
BTMO - bthmodem.sys - Bluetooth modem
BTPT - - Bluetooth transport protocol library
BTSR - bthser.sys - Bluetooth serial minidriver
BTUR - bthuart.sys - Bluetooth UART minidriver
Bu* - - burneng.sys from adaptec

Call - nt!ex - kernel callback object signature
call - - debugging call tables
CBRe - - CallbackRegistration
Cc - nt!cc - Cache Manager allocations (catch-all)
CcBc - nt!cc - Cache Manager Bcb from pool
CcBr - nt!cc - Cache Manager Bitmap range
CcBz - nt!cc - Cache Manager Bcb Zone
CcDw - nt!cc - Cache Manager Deferred Write
CcEv - nt!cc - Cache Manager Event
CcFn - nt!cc - Cache Manager File name for popups
CcOb - nt!cc - Cache Manager Overlap Bcb
CcPB - nt!ccpf - Prefetcher trace buffer
CcPC - nt!ccpf - Prefetcher context
CcPD - nt!ccpf - Prefetcher trace dump
CcPF - nt!ccpf - Prefetcher file name
CcPI - nt!ccpf - Prefetcher intermediate table
CcPL - nt!ccpf - Prefetcher read list
CcPM - nt!ccpf - Prefetcher metadata
CcPS - nt!ccpf - Prefetcher scenario
CcPT - nt!ccpf - Prefetcher trace
CcPc - nt!cc - Cache Manager Private Cache Map
CcPf - nt!ccpf - Prefetcher
CcPp - nt!ccpf - Prefetcher instructions
CcPq - nt!ccpf - Prefetcher query buffer
CcPs - nt!ccpf - Prefetcher section table
CcPv - nt!ccpf - Prefetcher volume info
CcPw - nt!ccpf - Prefetcher boot worker
CcSc - nt!cc - Cache Manager Shared Cache Map
CcVa - nt!cc - Cache Manager Initial array of Vacbs
CcVl - nt!cc - Cache Manager Vacb Level structures (large streams)
CcVp - nt!cc - Cache Manager Array of Vacb pointers for a cached stream
CctX - - EXIFX FCB Commit CTX
CcWq - nt!cc - Cache Manager Work Queue Item
CcWK - nt!cc - Kernel Cache Manager lookaside list
CcWk - nt!cc - Kernel Cache Manager lookaside list
CcZe - nt!cc - Cache Manager Buffer of Zeros
CdA - - CdAudio filter driver
Cdcc - cdfs.sys - CDFS Ccb
Cddn - cdfs.sys - CDFS CdName in dirent
Cdee - cdfs.sys - CDFS Search expression for enumeration
Cdfd - cdfs.sys - CDFS Data Fcb
Cdfi - cdfs.sys - CDFS Index Fcb
Cdfl - cdfs.sys - CDFS Filelock
CdFn - cdfs.sys - CDFS Filename buffer
Cdfn - cdfs.sys - CDFS Nonpaged Fcb
Cdfs - cdfs.sys - CDFS General Allocation
Cdft - cdfs.sys - CDFS Fcb Table entry
Cdgs - cdfs.sys - CDFS Generated short name
Cdic - cdfs.sys - CDFS Irp Context
Cdil - cdfs.sys - CDFS Irp Context lite
Cdio - cdfs.sys - CDFS Io context for async reads
Cdma - cdfs.sys - CDFS Mcb array
Cdpe - cdfs.sys - CDFS Prefix Entry
CdPn - cdfs.sys - CDFS CdName in path entry
Cdpn - cdfs.sys - CDFS Prefix Entry name
Cdsp - cdfs.sys - CDFS Buffer for spanning path table
Cdtc - cdfs.sys - CDFS TOC
Cdun - cdfs.sys - CDFS Buffer for upcased name
Cdvd - cdfs.sys - CDFS Buffer for volume descriptor
Cdvp - cdfs.sys - CDFS Vpb allocated in filesystem
CM - nt!cm - Configuration Manager (registry)
CmcD - hal.dll - HAL CMC Driver Log
CmcK - hal.dll - HAL CMC Kernel Log
CmcT - hal.dll - HAL CMC temporary Log
CMCa - nt!cm - Configuration Manager Cache (registry)
CMDc - nt!cm - Configuration Manager Cache (registry)
CMkb - nt!cm - registry key control blocks
CMpb - nt!cm - registry post blocks
CMnb - nt!cm - registry notify blocks
CMpe - nt!cm - registry post events
CMpa - nt!cm - registry post apcs
CMsb - nt!cm - registry stash buffer
CmVn - nt!cm - captured value name
CMVw - nt!cm - registry mapped view of file
CMVa - nt!cm - value cache value tag
CMVI - nt!cm - value index cache tag
CMSc - nt!cm - security cache pooltag
CMSb - nt!cm - internal stash buffer pool tag
CMNb - nt!cm - notification block pool tag
CMIn - nt!cm - index hint pool tag
CM?? - nt!cm - Internal Configuration manager allocations
CMDa - nt!cm - value data cache pool tag
CMAl - nt!cm -internal registry memory allocator pool tag
COMX - serial.sys - serial driver allocations
Cont - - Contiguous physical memory allocations for device drivers
CopW - - EXIFS CopyOnWrite
CpeD - hal.dll - HAL CPE Driver Log
CpeK - hal.dll - HAL CMC Kernel Log
CpeT - hal.dll - HAL CPE temporary Log
CPnp - classpnp.sys - ClassPnP transfer packets
CrtH - - EXIFS Create Header
CSdk - - Cluster Disk Filter driver
CSnt - - Cluster Network driver
CTE - - Common transport environment (ntos\inc\cxport.h, used by tdi)
Cvli - - EXIFS Cached Volume Info

D2d - - Device Object to DosName rtns (ntos\rtl\dev2dos.c)
D3Dd - - DX D3D driver (embedded in a display driver like s3mvirge.dll)
D851 - - 8514a video driver
Dacl - - Temp allocations for object DACLs
Dati - - ati video driver
DbLo - - Debug logging
dcam - - WDM mini driver for IEEE 1394 digital camera
Dcl - - cirrus video driver
Ddk - - Default for driver allocated memory (user's of ntddk.h)
Devi - - Device objects

Dh 0 - - DirectDraw/3D default object
Dh 1 - - DirectDraw/3D DirectDraw object
Dh 2 - - DirectDraw/3D Surface object
Dh 3 - - DirectDraw/3D Direct3D context object
Dh 4 - - DirectDraw/3D VideoPort object
Dh 5 - - DirectDraw/3D MotionComp object

Dfb - - framebuf video driver
Dfs - - Distributed File System
dfsr - - RDBSS IRP allocation
Dfsm - - Eng event allocation (ENG_KEVENTALLOC,ENG_ALLOC) in ntgdi\gre
Dire - - Directory objects
Dlck - - deadlock verifier (part of driver verifier) structures
Dmga - - mga (matrox) video driver
DmH? - - DirectMusic hardware synthesizer
Dmio - - Logical Disk Manager driver
Dmip - dmio.sys - Logical Disk Manager driver
Dmiq - dmio.sys - Logical Disk Manager driver
Dmld - - Logical Disk Manager loader
DmS? - - DirectMusic kernel software synthesizer
Dmst - - Logical Disk Manager driver static initialization
Dndt - - Device node
Dnod - - Device node structure
DOPE - - Device Object Power Extension (po component)
DPrf - - Disk performance filter driver
DPwr - nt!pnp - PnP power management
Dps5 - - NT5 PostScript printer driver
Dpsh - - Postcript driver heap memory
Dpsi - - psidisp video driver
Dpsm - - Postcript driver memory
Dqv - - qv (qvision) video driver
Driv - - Driver objects
Drsd - - Rasdd Printer Driver Pool Tag.
Dtga - - tga video driver
Dump - - Bugcheck dump allocations
Dun5 - - NT5 Universal printer driver

DV?? - - RDR2 DAV MiniRedir Tags
DVCx - - AsyncEngineContext, DAV MiniRedir
DVEx - - Exchange, DAV MiniRedir
DVFi - - FileInfo, DAV MiniRedir
DVFn - - FileName, DAV MiniRedir
DVRw - - ReadWrite, DAV MiniRedir
DVSc - - SrvCall, DAV MiniRedir
DVSh - - SharedHeap, DAV MiniRedir

Dvga - - vga 16 color video driver
Dvg2 - - vga 256 color video driver
Dvg6 - - vga 64K color video driver
Dvgr - - vga for risc video driver
DW32 - - W32 video driver
Dwd - - wd90c24a video driver
Dwp9 - - weitekp9 video driver
Dxga - - XGA video driver

Efsm - - EFS driver
Efsc - - EFS driver

Efst - - EXIFS FS Statistics

Envr - - Environment strings
Err - - Error strings
Evel - - EFS file system filter driver lookaside list
Even - - Event objects
Evid - - Rtl Event ID's
ExWl - - Executive worker list entry

Fat - fastfat.sys - Fat File System allocations
FatB - fastfat.sys - Fat allocation bitmaps
FatC - fastfat.sys - Fat Ccbs
FatD - fastfat.sys - Fat pool dirents
FatE - fastfat.sys - Fat EResources
FatF - fastfat.sys - Fat Fcbs
FatI - fastfat.sys - Fat IrpContexts
FatL - fastfat.sys - Fat FAT entry lookup buffer on verify
FatN - fastfat.sys - Fat Nonpaged Fcbs
FatO - fastfat.sys - Fat I/O buffer
FatP - fastfat.sys - Fat output for query retrieval pointers (caller frees)
FatQ - fastfat.sys - Fat buffered user buffer
FatR - fastfat.sys - Fat repinned Bcb
FatS - fastfat.sys - Fat stashed Bpb
FatT - fastfat.sys - Fat directory allocation bitmaps
FatV - fastfat.sys - Fat Vcb stat bucket
Fatv - fastfat.sys - Fat events
FatW - fastfat.sys - Fat FAT windowing structure
FatX - fastfat.sys - Fat IO contexts
Fatb - fastfat.sys - Fat Bcb arrays
Fatd - fastfat.sys - Fat EA data
Fate - fastfat.sys - Fat EA set headers
Fatf - fastfat.sys - Fat deferred flush contexts
Fati - fastfat.sys - Fat IO run descriptor
Fatn - fastfat.sys - Fat filename buffer
Fatr - fastfat.sys - Fat verification-time rootdir snapshot
Fats - fastfat.sys - Fat verification-time boot sector
Fatv - fastfat.sys - Fat backpocket Vpb
Fatx - fastfat.sys - Fat delayed close contexts

Fcbl - - EXIFS FCBlock
fboX - - EXIFS FOBXVF List

File - - File objects
Flop - - floppy driver

Flst - - EXIFS Freelist

FLex - - exclusive file lock
FLfl - - exported (non-private) file lock
FLli - - per-file lock information
FLln - - shared lock tree node
FLsh - - shared file lock
FLwl - - waiting lock

Fsrc - - Filesystem recognizer (fsrec.sys)

Fstb - - ntos\fstub
FstB - - ntos\fstub

flnk - - font link tag used in ntgdi\gre

FS?? - nt!fsrtl - File System Run Time allocations
FSfm - nt!fsrtl - File System Run Time Fast Mutex Lookaside List
FSim - nt!fsrtl - File System Run Time Mcb Initial Mapping Lookaside List
FSrt - nt!fsrtl - File System Run Time allocations (DO NOT USE!)
FSmg - nt!fsrtl - File System Run Time
FSrd - nt!fsrtl - File System Run Time
FSrm - nt!fsrtl - File System Run Time
FSrn - nt!fsrtl - File System Run Time
FSrN - nt!fsrtl - File System Run Time
FSro - nt!fsrtl - File System Run Time
FSrs - nt!fsrtl - File System Run Time
FSun - nt!fsrtl - File System Run Time

FTrc - - Fault tolerance Slist tag.
FtC - - Fault tolerance driver
FtM - - Fault tolerance driver
FtS - - Fault tolerance driver
FtT - - Fault tolerance driver
FtU - - Fault tolerance driver
FtV - - Fault tolerance driver
G??? - - Gdi Objects
G - - Gdi Generic allocations
Gcac - - Gdi glyph cache
Gcap - - Gdi capture buffer
Gcsl - - Gdi string resource script names
Gdbr - - Gdi driver brush realization
Gdd - - Gdi ddraw PKEY_VALUE_FULL_INFORMATION
Gdda - - Gdi ddraw attach list
GddD - - Gdi ddraw dummy page
Gdde - - Gdi ddraw event
Gddf - - Gdi ddraw driver heaps
Gddp - - Gdi ddraw driver caps
Gddv - - Gdi ddraw driver video memory list
Gdwd - win32k.sys - Gdi watchdog support objects
Gdxd - - Gdi ddraw VPE directdraw object
Gdxs - - Gdi ddraw VPE surface, videoport, capture object
Gdxx - - Gdi ddraw VPE DXAPI object
Gdev - - Gdi GDITAG_DEVMODE
GDev - - Gdi pdev
Gdrs - - Gdi GDITAG_DRVSUP
Gebr - - Gdi ENGBRUSH
gEdg - - Gdi gradient fill triangle
Gffv - - Gdi FONTFILEVIEW
gFil - - Gdi FILEVIEW
GFil - - Gdi engine descriptor list
Gfsb - - Gdi font sustitution list
Gfsm - - Gdi Fast mutex
Ggdv - - Gdi GDITAG_GDEVICE
Gglb - - Gdi temp buffer
Ggls - - Gdi glyphset
Ggb - - Gdi glyph bits
Ggbl - - Gdi look aside buffers
Ghmg - - Gdi handle manager objects
Gini - - Gdi fast mutex
Gh ? - win32k.sys - Gdi Handle manager specific object types:
defined in w32\ntgdi\inc\ntgdistr.h
Gla? - win32k.sys - Gdi handle manager specific object types allocated
from lookaside memory: defined in
w32\ntgdi\inc\ntgdistr.h
Gldv - - Gdi Ldev
Glnk - - Gdi PFELINK
Gmap - - Gdi font map signature table
Gpff - - Gdi physical font file
Gpft - - Gdi font table
Gsem - - Gdi Semaphores
Gsp - - Gdi sprite
Gspr - - Gdi sprite grow range
Gtmp - - Gdi temporary allocations
Gtmw - - Gdi TMW_INTERNAL
Gxlt - - Gdi Xlate

Gfcb - - EXIFS Grow FCB

Hal - hal.dll - Hardware Abstraction Layer
Hpfs - - Pinball (aka Hpfs) allocations
HisC - - histogram filter driver
Hist - - histogram filter driver
HidP - - HID Parser
HidC - - HID Class
HdCl - - HID Client Sample Driver
HpMM - pnpmem.sys - HotPlug Memory Driver

HCID - bthport.sys - Bluetooth port driver HCI debug
HCIT - bthport.sys - Bluetooth port driver (HCI)

HcRs - hcaport.sys - HCAPORT_TAG_RESOURCE_LIST
HcEv - hcaport.sys - HCAPORT_TAG_EVENT
HcdI - hcaport.sys - HCAPORT_TAG_HWID
HcEn - hcaport.sys - HCAPORT_TAG_ENUM
HcMc - hcaport.sys - HCAPORT_TAG_MISC
HcDr - hcaport.sys - HCAPORT_TAG_DEVICE_RELATIONS
HcBm - hcaport.sys - HCAPORT_TAG_BITMAP
HcOb - hcaport.sys - HCAPORT_TAG_OBJECT
HcCq - hcaport.sys - HCAPORT_TAG_CQUEUE
HcPr - hcaport.sys - HCAPORT_TAG_PROTD
HPmi - hcaport.sys - HCAPORT_TAG_PMI_EXTENSION
HcMa - hcaport.sys - HCAPORT_TAG_MAD
HcMp - hcaport.sys - HCAPORT_TAG_MINIPORT
HcCm - hcaport.sys - HCAPORT_TAG_CM
HcUc - hcaport.sys - HCAPORT_TAG_UCONTEXT
HcMr - hcaport.sys - HCAPORT_TAG_REMOVE_LOCK
Hmgo - hcaport.sys - HCAPORT_TAG_WQ_MG_INFO
Hioc - hcaport.sys - HCAPORT_TAG_IOC_SERVICE_TABLE

hSVD - mrxdav.sys - Shared Heap Tag

HT01 - - GDI Halftone AddCachedDCI() for CurCDCIData
HT02 - - GDI Halftone GetCachedDCI() for Threshold
HT03 - - GDI Halftone FindCachedSMP() for CurCSMPData
HT04 - - GDI Halftone FindCachedSMP() for CurCSMPBmp
HT05 - - GDI Halftone HT_CreateDeviceHalftoneInfo() for HT_DHI
HT06 - - GDI Halftone pDCIAdjClr() for DEVCLRADJ
HT07 - - GDI Halftone ComputeRGB555LUT() for RGBLUT
HT08 - - GDI Halftone ColorTriadSrcToDev() for RGB-XYZ
HT09 - - GDI Halftone ColorTriadSrcToDev() for CRTX-FD6XYZ Cache
HT10 - - GDI Halftone CreateDyesColorMappingTable() for DevPrims
HT11 - - GDI Halftone CreateDyesColorMappingTable() for DyeMappingTable
HT12 - - GDI Halftone ThresholdsFromYData() for pYData
HT13 - - GDI Halftone ComputeHTCellRegress() for pThresholds
HT14 - - GDI Halftone CalculateStretch() for InputSI/pSrcMaskLine
HT15 - - GDI Halftone CalculateStretch() for PrimColorInfo

IBCM - wibcm.sys - CM_INSTANCE_TAG Windows Infiniband Communications Manager
CEP - wibcm.sys - CEP_INSTANCE_TAG
CMSH - wibcm.sys - WIBCM_SHARED_TAG
CMWK - wibcm.sys - WIBCM_WORK_TAG
CMWT - wibcm.sys - WIBCM_TIMER_TAG

IBm* - wibms.sys - Windows Infiniband Management Server pool tags

IbPm - wibpm.sys - WIBPM_TAG Windows Infiniband Performance Manager
IbPS - wibpm.sys - WIBPM_SENT_TAG
IbPI - wibpm.sys - WIBPM_ITEM_TAG
IbPA - wibpm.sys - WIBPM_SAMPLE_TAG

IbW0 - wibwmi.sys - WIBWMI0_TAG Windows Infiniband WMI Manager
IbW1 - wibwmi.sys - WIBWMI1_TAG
IbW2 - wibwmi.sys - WIBWMI2_TAG

IPX - - Nwlnkipx transport
Icp - - I/O completion packets queue on a completion ports
IcpP - - NPAGED_LOOKASIDE_LIST I/O completion per
processor lookaside pointers
IdeP - - atapi IDE
IdeX - - PCI IDE
idle - - Power Manager idle handler
Ifs - - Default file system allocations (user's of ntifs.h)
Info - - general system information allocations
Io - nt!io - general IO allocations
IoCc - nt!io - Io completion context
IoEa - nt!io - Io extended attributes
IoEr - nt!io - Io error log packets
IoFc - nt!io - Io name transmogrify operation
IoFs - nt!io - Io shutdown packet
IoFu - nt!pnp - Io file utils
IoKB - - Registry basic key block (temp allocation)
IoNm - nt!io - Io parsing names
IoRb - nt!io - Io remote boot related
IoRN - nt!io - Registry key name (temp allocation)
IoSe - nt!io - Io security related
IoSh - nt!io - Io shutdown packet
IoTi - nt!io - Io timers
IoTt - nt!vf - I/O verifier IRP tracking table
Ioin - - Io interrupts
IoOp - nt!io - I/O subsystem open packet
IoRi - nt!io - I/O SubSystem Driver Reinitialization Callback Packet
IoUs - nt!io - I/O SubSystem completion Context Allocation
Irp - - Io, IRP packets
Irp+ - nt!vf - I/O verifier allocated IRP packets
IrpB - nt!vf - I/O verifier direct I/O double buffer allocation
Irpd - nt!vf - I/O verifier deferred completion context
Irps - nt!vf - I/O verifier per-IRP session tracking data
Irpt - nt!vf - I/O verifier per-IRP tracking data
IrpC - nt!vf - I/O verifier stack contexts
Irpl - nt!io - system large IRP lookaside list
Irps - nt!io - system small IRP lookaside list
Isap - - Pnp Isa bus extender
II?? - - IP in IP tunneling
IIrf - - Free memory
IIdt - - Data
IITn - - Tunnel
IIhd - - Header
IIpk - - Packet
IIsc - - Send Context
IIts - - Transfer Context
IIwc - - Work Context

Im* - - Imapi.sys from adaptec

IPm? - - IP Multicasting
IPmg - - Group
IPms - - Source
IPmo - - Outgoing Interface
IPmm - - Message
IPmf - - Free memory (only in checked builds)

Ip?? - ipsec.sys - IP Security
IpSI - ipsec.sys - initial allcoations
IpAT - ipsec.sys - AH headers in transport mode
IpAU - ipsec.sys - AH headers in tunnel mode
IpET - ipsec.sys - ESP headers in transport mode
IpEU - ipsec.sys - ESP headers in tunnel mode
IpHT - ipsec.sys - HUGHES headers in transport mode
IpHU - ipsec.sys - HUGHES headers in tunnel mode
IpAX - ipsec.sys - Key acquire contexts
IpFI - ipsec.sys - Filter blocks
IpSA - ipsec.sys - Security Associations
IpKE - ipsec.sys - keys
IpTI - ipsec.sys - timers
IpSQ - ipsec.sys - stall queues
IpLA - ipsec.sys - lookaside lists
IpBP - ipsec.sys - buffer pools
IpSC - ipsec.sys - send complete context
IpEQ - ipsec.sys - event queue
IpHW - ipsec.sys - hardware accleration items
IpCO - ipsec.sys - IP compression

IrD? - - IrDA TDI and RAS drivers

IU?? - - IIS Utility Driver
IUDl - - Lookaside list allocations
IUcp - - completion port minipackets

KAPC - nt!io - I/O SubSystem HardError APC
KbdC - - Keyboard Class Driver
KCfe - - Kernel COM factory entry
Ke - - Kernel data structures
KeIC - - Kernel Interrupt Object Chain
Key - - Key objects
KMIX - - Kmixer (wdm audio)
KNMI - - Kernel NMI Callback object
KrbC - - Kerberos Client package
KSah - - Ks auxiliary stream headers
KSAI - - allocator instance
KSai - - default allocator instance header
KSbi - - event buffered item
KSCI - - clock instance
KSce - - create item entry
KSch - - create handler entry
KSci - - default clock instance header
KScp - - object creation parameters auxiliary copy
KSda - - default allocator
KSdc - - default clock
KSdh - - device header
Ksec - - security device driver
KSed - - event dpc item
KSee - - event entry
KSed - - oneshot event deletion dpc
KSep - - irp system buffer event parameter
KSew - - oneshot event deletion workitem
KSqr - - QM quality report
KSer - - QM error report
KSfd - - filter cache data (MSKSSRV)
KsFI - - filter instance
KSns - - null security object
KSnv - - registry name value
KSoh - - object header
KSop - - object creation parameters
KSpc - - port driver instance FsContext
KSPI - - pin instance
KSpp - - irp system buffer property/method/event parameter
KSpt - - pin type list (MSKSSRV)
KSqf - - query information file buffer
KSsc - - port driver stream FsContext
KSsf - - set information file buffer
KSsh - - stream headers
KSsi - - software bus interface
KSsl - - symbolic link buffer (MSKSSRV)
KSsp - - serialized property set
KsoO - - WDM audio stuff
L2CA - bthport.sys - Bluetooth port driver (L2CAP)
L2T0 - - ndis\l2tp / MTAG_FREED
L2T1 - - ndis\l2tp / MTAG_ADAPTERCB
L2T2 - - ndis\l2tp / MTAG_TUNNELCB
L2T3 - - ndis\l2tp / MTAG_VCCB
L2T4 - - ndis\l2tp / MTAG_VCTABLE
L2T5 - - ndis\l2tp / MTAG_WORKITEM
L2T6 - - ndis\l2tp / MTAG_TIMERQ
L2T7 - - ndis\l2tp / MTAG_TIMERQITEM
L2T8 - - ndis\l2tp / MTAG_PACKETPOOL
L2T9 - - ndis\l2tp / MTAG_FBUFPOOL
L2Ta - - ndis\l2tp / MTAG_HBUFPOOL
L2Tb - - ndis\l2tp / MTAG_TDIXRDG
L2Tc - - ndis\l2tp / MTAG_TDIXSDG
L2Td - - ndis\l2tp / MTAG_CTRLRECD
L2Te - - ndis\l2tp / MTAG_CTRLSENT
L2Tf - - ndis\l2tp / MTAG_PAYLRECD
L2Tg - - ndis\l2tp / MTAG_PAYLSENT
L2Th - - ndis\l2tp / MTAG_INCALL
L2Ti - - ndis\l2tp / MTAG_UTIL
L2Tj - - ndis\l2tp / MTAG_ROUTEQUERY
L2Tk - - ndis\l2tp / MTAG_ROUTESET
L2Tl - - ndis\l2tp / MTAG_L2TPPARAMS
L2Tm - - ndis\l2tp / MTAG_TUNNELWORK
L2Tn - - ndis\l2tp / MTAG_TDIXROUTE
LANE - atmlane.sys - LAN Emulation Client for ATM
LB?? - - LM Datagram receiver allocations
LBan - - Server announcement
LBvb - - View buffer
LBma - - Master announce context
LBxp - - Transport
LBxn - - TransportName
LBxm - - Master name
LBtn - - Transport name
LBea - - Ea buffer
LBdi - - POOL_DOMAIN_INFO
LBds - - Send datagram context
LBci - - Connection info
LBmh - - Mailslot header
LBbl - - Backup List
LBsl - - Browser server list
LBbs - - Browser server
LBgb - - GetBackupList request
LBbr - - GetBackupList response
LBmb - - Mailslot Buffer
LBid - - Illegal datagram context
LBbn - - Name
LBnn - - Name name
LBic - - IRP context
LBwi - - Work item
LBel - - Election context
LBbb - - Become backup context
LBbr - - Become backup request
LBpn - - Paged Name
LBpt - - Paged transport
LBse - - Browser security

Lbuf - - EXIFS Large Buffer

LeoC - - Symantec/Norton AntiVirus filter driver
List - - kernel utilities list allocation
LCam - - WDM mini video capture driver for Logitech camera
Lfs - - Lfs allocations
LfsI - - Lfs allocations
LpcZ - - LPC Zone
LpcM - - Local procedure call message blocks
Lr?? - - LM redirector allocations
Lr - - Generic allocations
Lrcx - - Context blocks of various types
Lrcl - - ConnectListEntries
Lrsl - - ServerListEntries
Lrse - - Security entry
Lrsc - - Search Control Blocks
Lrea - - EA related allocations
Lric - - Instance Control Blocks
Lrfc - - File Control Blocks
Lrfl - - Fcb Locks
Lrfp - - Fcb Paging locks
Lrcn - - Computer Name
Lrdn - - Domain Name
Lr?? - - Buffers used for FsControlFile APIs
Lrlc - - Lock Control Blocks
Lrlb - - Lock Control Block buffers
Lrnf - - Non paged FCB
Lrnt - - Non paged transport
Lrps - - Paged security entry
Lrte - - Transport event.
Lrxx - - Transceive context blocks
Lr!! - - Cancel request context blocks
Lrmt - - MPX table
Lrme - - MPX table entries
Lrsx - - Send contexts
Lraw - - Async write context
Lrwb - - Write behind buffer header
Lrbb - - Write behind buffer
Lrwq - - Work queue item
Lrac - - ACL for redirector
Lrds - - Security Descriptor for redirector
Lrsm - - SMB buffer
Lrds - - Duplicated ansi string
Lrdu - - Duplicated unicode string
Lxpt - - Transport
Lrtc - - Transport connection
Lrna - - Netbios Addresses
Lrca - - Temporary storage used in name canonicalization
Lr2x - - Transact SMB context
Lrpt - - Primary transport server list
Lrso - - Operating system name
Lref - - Reference history (debug only)
LS?? - - LM server allocations
LSac - - BlockTypeAdminCheck
LSas - - BlockTypeAdapterStatus
LSbf - - buffer descriptor
LScd - - comm device
LScn - - connection
LSdb - - data buffer
LSdc - - BlockTypeDirCache
LSdi - - BlockTypeDirectoryInfo
LSep - - endpoint
LSfn - - BlockTypeFSName
LSlf - - LFCB
LSlr - - BlockTypeLargeReadX
LSmf - - MFCB
LSmi - - BlockTypeMisc
LSnh - - nonpaged block header
LSni - - BlockTypeNameInfo
LSop - - oplock break wait
LSpc - - paged connection
LSpm - - paged MFCB
LSpr - - paged RFCB
LSrf - - RFCB
LSsc - - search(core)
LSsd - - BlockTypeShareSecurityDescriptor
LSsf - - BlockTypeDfs
LSsh - - share
LSsp - - search(core complete)
LSsr - - search
LSss - - session
LStb - - table
LStc - - tree connect
LSti - - timer
LStr - - transaction
LSvi - - BlockTypeVolumeInformation
LSwi - - initial work context
LSwn - - normal work context
LSwq - - BlockTypeWorkQueue
LSwr - - raw work context
LSws - - BlockTypeWorkContextSpecial
LSnd - - WDM mini sound driver for Logitech video camera
LXMK - - kernel mixer line driver (KMXL - looks like
they got their tag backwards)

MXF - - DirectMusic (MIDI Transform Filter)

MapP - - PNP map
Mapr - - arc firmware registry routines

McaC - hal.dll - HAL MCA corrected Log
McaD - hal.dll - HAL MCA Driver Log
McaK - hal.dll - HAL MCA Kernel Log
McaP - hal.dll - HAL MCA Log from previous boot
McaT - hal.dll - HAL MCA temporary Log

MCAM - - WDM mini driver for Intel USB camera
MCDx - - OpenGL MCD server (mcdsrv32.dll) allocations
MCDd - - OpenGL MCD driver (embedded in a display driver like
s3mvirge.dll)
Mdl - - Io, Mdls
MdlP - - MDL per processor lookaside list pointers
MePr - - In-memory print buffer
Mm - nt!mm - general Mm Allocations
MmBk - nt!mm - Mm banked sections
MmCa - nt!mm - Mm control areas for mapped files
MmCd - nt!mm - Mm fork clone descriptors
MmCh - nt!mm - Mm fork clone headers
MmCi - nt!mm - Mm control areas for images
MmCm - nt!mm - Calls made to MmAllocateContiguousMemory
MmDb - nt!mm - NtMapViewOfSection service
MmDT - nt!mm - Mm debug
MmEx - nt!mm - Mm events
MmHi - nt!mm - Mm image entry - allocated per session
MmHn - nt!mm - Mm sessionwide address name string entry
MmHv - nt!mm - Mm sessionwide address entry
MmIn - nt!mm - Mm inpaged io structures
MmLd - nt!mm - Mm load module database
MmPg - nt!mm - Mm page table pages at init time
MmRw - nt!mm - Mm read write virtual memory buffers
MmSb - nt!mm - Mm subsections
MmSe - nt!mm - Mm secured VAD allocation
MmSg - nt!mm - Mm segments
MmSt - nt!mm - Mm section object prototype ptes
Mmdl - nt!mm - Mm Mdls for flushes
Mmpp - nt!mm - Mm prototype PTEs for pool
MmVd - nt!mm - Mm virtual address descriptors for mapped views
MmVs - nt!mm - Mm virtual address descriptors short form (private views)
Mmxx - nt!mm - Mm temporary allocations
MmCx - nt!mm - info for dynamic section extension
MmDm - nt!mm - deferred MmUnlock entries
MmHt - nt!mm - session space PTE data
MmLn - nt!mm - temporary name buffer for driver loads
MmMl - nt!mm - physical memory range information
MmRl - nt!mm - temporary readlists for file prefetch
MmSP - nt!mm - SLIST entries for system PTE NB queues
MmSc - nt!mm - subsections used to map data files
MmSd - nt!mm - extended subsections used to map data files
MmSm - nt!mm - segments used to map data files
MmWe - nt!mm - Work entries for writing out modified filesystem pages.
MmWw - nt!mm - Write watch VAD info
Mmpv - nt!mm - Physical view VAD info
Mmww - nt!mm - Write watch bitmap VAD info

MRXx - - Client side caching for SMB

Msdv - - WDM mini driver for IEEE 1394 DV Camera and VCR
MST? - - MSTEE (mstee.sys)
MSTa - - associated stream header
MSTc - - filer connection
MSTd - - data format
MSTf - - filter instance
MSTp - - pin instance
MSTs - - stream header

MuoC - - MOUSE_POOL_TAG Mouse Class Driver
MupI - - DFS file system driver IRP context allocation
MsFc - - Mailslot CCB, Client control block. Each client with
an opened mailslot has one of these
MsFC - - Mailslot root CCB, A client control block for
the top level mailslot directory
MsFd - - Mailslot data entry write buffer, This is writes buffered
inside mailslots
MsFD - - Mailslot root DCB and its name buffer
MsFf - - Mailslot FCB, File control block, Service side block for
each created mailslot.
MsFg - - Mailslot global resource
MsFn - - Mailslot temporary name buffer
MsFN - - Mailslot FCB name buffer, name for each created mailslot
MsFr - - Mailslot read buffer, buffer created for pended reads issued.
MsFt - - Mailslot query template, used for directory queries.
MsFw - - Mailslot work context block, blocks create when
we need to timeout reads.

MsvC - - Msv/Ntlm client package
Mup - - Multiple UNC provider allocations
Muta - - Mutant objects
NBF - - general NBF allocations
NBFa - - NBF address object
NBFb - - NBF receive buffer
NBFc - - NBF connection object
NBFd - - NBF packet pool descriptor
NBFe - - NBF bind & export names
NBFf - - NBF address file object
NBFg - - NBF registry path name
NBFi - - NBF tdi connection info
NBFk - - NBF loopback buffer
NBFl - - NBF link object
NBFn - - NBF netbios name
NBFo - - NBF config data
NBFp - - NBF packet
NBFq - - NBF query buffer
NBFr - - NBF request
NBFs - - NBF provider stats
NBFt - - NBF connection table
NBFu - - NBF UI frame
NBFw - - NBF work item
NBI - - NwlnkNb transport
NBS - - general NetBIOS allocations
NBSa - - address block
NBSc - - connection block
NBSe - - EA buffer
NBSf - - FCB
NBSl - - LANA block
NBSn - - copy of user NCB
NBSr - - registry allocations
NBSx - - XNS NETONE address (connect block)
NBSy - - NetBIOS address (connect block)
NBSz - - NetBIOS address (listen block)
NBqh - - Non-blocking queue entries used to carry
the real data in the queue.

NCSt - - EXIFS NC

ND - ndis.sys - general NDIS allocations
NDDl - ndis.sys - NDIS_TAG_DBG_LOG
NDMb - ndis.sys - NDIS_TAG_MAC_BLOCK
NDPX - ndis.sys - NDIS Proxy allocations
NDPa - ndis.sys - Apple Talk
NDPb - ndis.sys - NBF
NDPi - ndis.sys - NWLNKIPX
NDPn - ndis.sys - NWLNKNB
NDPp - ndis.sys - Packet Scheduler.
NDPs - ndis.sys - NWLNKSPX
NDPt - ndis.sys - TCPIP
NDPw - ndis.sys - WAN_PACKET_TAG
NDam - ndis.sys - NdisAllocateMemory
NDan - ndis.sys - adapter name
NDco - ndis.sys - NDIS_TAG_CO
NDd - ndis.sys - NDIS_TAG_DBG
NDdb - ndis.sys - DMA block
NDdl - ndis.sys - NDIS_TAG_DBG_L
NDdp - ndis.sys - NDIS_TAG_DBG_P
NDds - ndis.sys - NDIS_TAG_DBG_S
NDdt - ndis.sys - NDIS_TAG_DFRD_TMR
NDfa - ndis.sys - NDIS_TAG_FILTER_ADDR
NDlb - ndis.sys - lookahead buffer
NDlp - ndis.sys - NDIS_TAG_LOOP_PKT
NDmb - ndis.sys - MAC block
NDmr - ndis.sys - map register entry array
NDoa - ndis.sys - NDIS_TAG_OID_ARRAY
NDob - ndis.sys - open block
NDpb - ndis.sys - protocol block
NDpf - ndis.sys - NDIS_TAG_FILTER
NDpk - ndis.sys - NDIS_TAG_PKT_PATTERN
NDpp - ndis.sys - packet pool
NDrl - ndis.sys - resource list
NDrp - ndis.sys - NDIS_TAG_REGISTRY_PATH
NDrq - ndis.sys - NDIS_TAG_Q_REQ
NDsi - ndis.sys - EISA slot information
NDsm - ndis.sys - Cached shared memory descriptor
NDst - ndis.sys - NDIS_TAG_STRING
NDw0 - ndis.sys - NDIS_TAG_WMI_REG_INFO
NDw1 - ndis.sys - NDIS_TAG_WMI_GUID_TO_OID
NDw2 - ndis.sys - NDIS_TAG_WMI_OID_SUPPORTED_LIST
NDw3 - ndis.sys - NDIS_TAG_WMI_EVENT_ITEM
NDwi - ndis.sys - NDIS_TAG_WORK_ITEM

Nb?? - - NetBT allocations
Nls - - Nls strings
Nmdd - - NetMeeting display driver miniport 1 MB block
None - - call to ExAllocatePool

Npf* - npfs.sys - Npfs Allocations
NpFc - npfs.sys - CCB, client control block
NpFC - npfs.sys - ROOT_DCB CCB
NpFD - npfs.sys - DCB, directory block
NpFg - npfs.sys - Global storage
NpFi - npfs.sys - NPFS client info buffer.
NpFn - npfs.sys - Name block
NpFq - npfs.sys - Query template buffer used for directory query
NpFr - npfs.sys - DATA_ENTRY records (read/write buffers)
NpFs - npfs.sys - Client security context
NpFw - npfs.sys - Write block
NpFW - npfs.sys - Write block

NS?? - - Netware server allocations

Ntf? - ntfs.sys - NTFS Specific allocation tags
Ntf0 - ntfs.sys - general pool allocation
Ntf9 - ntfs.sys - Large Temporary Buffer
NtfC - ntfs.sys - CCB
Ntfc - ntfs.sys - CCB_DATA
NtfD - ntfs.sys - DEALLOCATED_RECORDS
NtfE - ntfs.sys - INDEX_CONTEXT
NtfF - ntfs.sys - FCB_INDEX
Ntff - ntfs.sys - FCB_DATA
NtfI - ntfs.sys - NTFS_IO_CONTEXT
Ntfi - ntfs.sys - IRP_CONTEXT
NtfK - ntfs.sys - KEVENT
Ntfk - ntfs.sys - FILE_LOCK
Ntfl - ntfs.sys - LCB
NtfM - ntfs.sys - NTFS_MCB_ENTRY
Ntfm - ntfs.sys - NTFS_MCB_ARRAY
NtfN - ntfs.sys - NUKEM
Ntfn - ntfs.sys - SCB_NONPAGED
Ntfo - ntfs.sys - SCB_INDEX normalized named buffer
NtfQ - ntfs.sys - QUOTA_CONTROL_BLOCK
Ntfq - ntfs.sys - General Allocation with Quota
NtfR - ntfs.sys - READ_AHEAD_THREAD
Ntfr - ntfs.sys - ERESOURCE
NtfS - ntfs.sys - SCB_INDEX
Ntfs - ntfs.sys - SCB_DATA
NtfT - ntfs.sys - SCB_SNAPSHOT
Ntft - ntfs.sys - SCB (Prerestart)
NtfV - ntfs.sys - VPB
Ntfv - ntfs.sys - COMPRESSION_SYNC
Ntfw - ntfs.sys - Workspace
Ntfx - ntfs.sys - General Allocation
NtF? - ntfs.sys - NTFS tags based on source module
NtFa - ntfs.sys - AllocSup.c
NtFA - ntfs.sys - AttrSup.c
NtFB - ntfs.sys - BitmpSup.c
NtFC - ntfs.sys - Create.c
NtFD - ntfs.sys - DevioSup.c
NtFd - ntfs.sys - DirCtrl.c
NtFE - ntfs.sys - Ea.c
NtFF - ntfs.sys - FileInfo.c
NtFf - ntfs.sys - FsCtrl.c
NtFI - ntfs.sys - IndexSup.c
NtFL - ntfs.sys - LogSup.c
NtFM - ntfs.sys - McbSup.c
NtFN - ntfs.sys - NtfsData.c
NtFO - ntfs.sys - ObjIdSup.c
NtFQ - ntfs.sys - QuotaSup.c
NtFR - ntfs.sys - RestrSup.c
NtFS - ntfs.sys - SecurSup.c
NtFs - ntfs.sys - StrucSup.c
NtFU - ntfs.sys - usnsup.c
NtFV - ntfs.sys - VerfySup.c
NtFv - ntfs.sys - ViewSup.c
NtFW - ntfs.sys - Write.c

Nwcs - - Client Services for NetWare
NwFw - - ntos\tdi\fwd

ObSq - nt!ob - object security descriptors (query)
ObCi - nt!ob - captured information for ObCreateObject
ObCI - nt!ob - object creation lookaside list
ObDi - nt!ob - object directory
ObHd - nt!ob - object handle count data base
ObNm - nt!ob - object names
ObNM - nt!ob - name buffer per processor lookaside pointers
ObZn - nt!ob - object zone
ObjT - nt!ob - object type objects
Obtb - nt!ob - object tables via EX handle.c
ObTR - nt!ob - object table ERESOURCEs
Obeb - nt!ob - object tables extra bit tables via EX handle.c
ObDm - nt!ob - object device map
ObSc - nt!ob - Object security descriptor cache block
ObSt - nt!ob - Object Manager temporary storage

OHCI - - Open Host Controller Interface for USB
ohci - - 1394 OHCI host controller driver

Ovfl - - The internal pool tag table has overflowed -
usually this is a result of nontagged allocations being made

OvfL - - EXIFS FCBOVF List

PaeD - - PAE top level directory allocation blocks

ParC - - Parallel class driver
ParL - - Parallel link driver
ParP - - Parallel port driver
ParV - - ParVdm driver for vdm<->parallel port communciation

PciB - pci.sys - PnP pci bus enumerator

PcCi - - WDM audio port class adapter device object stuff
PcCr - - WDM audio stuff
PcDi - - WDM audio stuff
PcDm - - DirectMusic MXF objects (WDM audio)
PcFM - - WDM audio FM synthesizer
PcFp - - WDM audio stuff
PcIc - - WDM audio stuff
PcIl - - WDM audio stuff
PcNw - - WDM audio stuff
PcPc - - WDM audio stuff
PcPr - - WDM audio stuff
PcSX - - WDM audio stuff
PcSl - - WDM audio stuff
PcSt - - WDM audio stuff
PcSx - - WDM audio stuff
PcUs - - WDM audio stuff

Pcmc - pcmcia.sys - Pcmcia bus enumerator, general structures
Pcic - - Pcmcia bus enumerator, PCIC/Cardbus controller
specific structures
Pcdb - - Pcmcia bus enumerator, Databook controller
specific structures

Pgm? - - Pgm (Pragmatic General Multicast) protocol: RMCast.sys

Plcp - - Cache aware pushlock list (array of puchlock addresses)
Plcl - - Cache aware pushlock entry. One per processor
PNCH - - Power Notify Channel
PNCL - - Power Notify channel list
PNDP - - Power Abort Dpc Routine
PNI - - Power Notify Instance

Pool - - Pool tables, etc.
PooL - - Phase 0 initialization of the executive component,
paged and nonpaged small pool lookaside structures
Port - - Port objects

PoSL - - Power shutdown event list

Prof - - Profile objects

POWI - nt!po - Power Work Item (executive worker thread work item entry)
PSwt - nt!po - Power switch structure
PSTA - nt!po - Po registered system state
PDss - nt!po - Po device system state

Prcr - processr.sys - Processr hal driver allocations
Proc - - Process objects
Ps - - general ps allocations
Psap - - Block used to hold a user mode APC while its
queued to a thread
PsAp - - Process APC queued by user mode process
PsCa - - APC queued at thread create time.
PsCr - - Working set change record, should be a temporary allocation
PsEx - - Process exit APC
PsIm - - Thread impersonation (PS_IMPERSONATE_INFORMATION)
Psjb - - Job set array, should be a temporary allocation
PsLd - - Process LDT information blocks
PsQb - - Process quota block
PsTf - - Job object token filter
Pstb - - Process tables via EX handle.c
Psta - - Power management system state
PsTp - - Thread termination port block
PsWs - - Process working set watch array

PSE3 - pse36.sys - Physical Size Extension driver

PnPb - nt!pnp - PnP BIOS resource manipulation
PpEB - nt!pnp - PNP_POOL_EVENT_BUFFER
PpEE - nt!pnp - PNP_DEVICE_EVENT_ENTRY_TAG
PpEL - nt!pnp - PNP_DEVICE_EVENT_LIST_TAG
PpLg - nt!pnp - PnP last good.
PpUB - nt!pnp - PNP_USER_BLOCK_TAG
PpWI - nt!pnp - PNP_DEVICE_WORK_ITEM_TAG
Ppcd - nt!pnp - PnP critical device database
Ppcr - nt!pnp - plug-and-play critical allocations
Ppdd - nt!pnp - new Plug-And-Play driver entries and IRPs
Ppde - nt!pnp - routines to perform device removal
Ppei - nt!pnp - Eisa related code
Ppen - nt!pnp - routines to perform device enumeration
Ppin - nt!pnp - plug-and-play initialization
Ppio - nt!pnp - plug-and-play IO system APIs
Ppre - nt!pnp - resource allocation and translation
Pprl - nt!pnp - routines to manipulate relations list
Ppsu - nt!pnp - plug-and-play subroutines for the I/O system

PPTP - - PPTP_MEMORYPOOL_TAG
PPT0 - - PPTP_TDIADDR_TAG
PPT1 - - PPTP_TDICONN_TAG
PPT2 - - PPTP_CONNINFO_TAG
PPT3 - - PPTP_ADDRINFO_TAG
PPT4 - - PPTP_TIMEOUT_TAG
PPT5 - - PPTP_TIMER_TAG
PPT6 - - PPTP_TDICOTS_TAG
PPT7 - - PPTP_WRKQUEUE_TAG
PPT8 - - PPTP_SEND_CTRLDATA_TAG
PPT9 - - PPTP_SEND_ACKDATA_TAG
PPTa - - PPTP_SEND_DGRAMDESC_TAG
PPTb - - PPTP_TDICLTS_TAG
PPTc - - PPTP_RECV_CTRLDESC_TAG
PPTd - - PPTP_RECV_CTRLDATA_TAG
PPTe - - PPTP_RECV_DGRAMDESC_TAG
PPTf - - PPTP_RECV_DGRAMDATA_TAG
PPTg - - PPTP_RECVDESC_TAG
PPTh - - PPTP_ENGINE_TAG
PPTi - - PPTP_RECVDATA_TAG

PSC? - - Packet Scheduler (PSCHED) Tags

PSC0 - - NDIS Request
PSC1 - - GPC Client Vc
PSC2 - - WanLink
PSC3 - - Miscellaneous allocations
PSC4 - - WMI
PSCa - - Adapter
PSCb - - CallParameters
PSCc - - PipeContext
PSCd - - FlowContext
PSCe - - ClassMapContext
PSCf - - Adapter Profile
PSCg - - Component

PX1 - - ndis ProviderEventLookaside

p2?? - perm2dll.dll - Permedia2 display driver
p2d3 - perm2dll.dll - Permedia2 display driver - d3d.c
p2d6 - perm2dll.dll - Permedia2 display driver - d3ddx6.c
p2de - perm2dll.dll - Permedia2 display driver - debug.c
p2ds - perm2dll.dll - Permedia2 display driver - d3dstate.c
p2dt - perm2dll.dll - Permedia2 display driver - d3dtxman.c
p2su - perm2dll.dll - Permedia2 display driver - ddsurf.c
p2en - perm2dll.dll - Permedia2 display driver - enable.c
p2fi - perm2dll.dll - Permedia2 display driver - fillpath.c
p2he - perm2dll.dll - Permedia2 display driver - heap.c
p2hw - perm2dll.dll - Permedia2 display driver - hwinit.c
p2cx - perm2dll.dll - Permedia2 display driver - p2ctxt.c
p2pa - perm2dll.dll - Permedia2 display driver - palette.c
p2pe - perm2dll.dll - Permedia2 display driver - permedia.c
p2tx - perm2dll.dll - Permedia2 display driver - textout.c

P3D? - perm3dd.dll - Permedia3 display driver - DirectDraw/3D
P3G? - perm3dd.dll - Permedia3 display driver

Qnam - - EXIFS Query Name

Qp?? - - Generic Packet Classifier (MSGPC)
Qppn - - Queued Notifications
Qppi - - Pending Irp structures
Qpci - - CfInfo
Qpct - - Client blocks
Qppa - - Pattern blocks
Qphf - - HandleFactory
Qpph - - PathHash
Qprz - - Rhizome
Qppd - - GenPatternDb
Qpfd - - FragmentDb
Qpcf - - ClassificationFamily
Qpcd - - CfInfoData
Qpcb - - ClassificationBlock
Qppt - - Protocol
Qpdg - - Debug

RB?? - - RedBook Filter Driver, static allocations
RBEv - - RedBook - Thread Events
RBRl - - RedBook - Remove lock
RBRg - - RedBook - driverExtension->RegistryPath
RBSe - - RedBook - Serialization tracking for checked builds
RBWa - - RedBook - Wait block for system thread

rb?? - - RedBook Filter Driver, dynamic allocations
rbBu - - RedBook - Buffer for read/stream
rbIr - - RedBook - Irp for read/stream
rbIp - - RedBook - Irp pointer block
rbMd - - RedBook - Mdl for read/stream
rbMp - - RedBook - Mdl pointer block
rbRc - - RedBook - Read completion context
rbRx - - RedBook - Read Xtra info
rbSc - - RedBook - Stream completion context
rbSx - - RedBook - Stream Xtra info
rbTo - - RedBook - Cached table of contents

Rcp? - sacdrv.sys - SAC Driver (Headless)
RcpA - sacdrv.sys - Internal memory mgr alloc block
RcpI - sacdrv.sys - Internal memory mgr initial heap block
RcpS - sacdrv.sys - Security related block

ReEv - - Resource Event
ReSe - - Resource Semaphore
ReTa - - Resource Extended Table

RefT - - Bluetooth reference tracking
Rf?? - - Bluetooth RFCOMM TDI driver
RfAD - rfcomm.sys - RFCOMM Address
RfBB - rfcomm.sys - RFCOMM BRB
RfBT - rfcomm.sys - RFCOMM (bthport)
RfCB - rfcomm.sys - RCOMMM
RfCH - rfcomm.sys - RFCOMM channel
RfCN - rfcomm.sys - RFCOMM connect
RfDA - rfcomm.sys - RFCOMM data
RfFR - rfcomm.sys - RFCOMM frame
RfRX - rfcomm.sys - RFCOMM receive
RfPP - rfcomm.sys - RFCOMM pnp
RfWR - rfcomm.sys - RFCOMM worker

RRle - - RTL_RANGE_LIST_ENTRY_TAG
RRlm - - RTL_RANGE_LIST_MISC_TAG

RtPi - - Temp allocation for product type key

RPrt - rstorprt.sys - Remote Storage Port Driver

Rqrv - - Registry query buffer
RS?? - - Remote Storage
RSFS - - Recall Queue
RSFN - - File Name
RSSE - - Security info
RSWQ - - Work Queue
RSQI - - Queue info
RSLT - - Long term data
RSIO - - Ioctl Queue
RSFO - - File Obj queue
RSVO - - Validate Queue
RSER - - Error log data
RWan - rawwan.sys - Raw WAN driver

Rx?? - - Rdr2 rdbss.sys stuff
RxSc - - SrvCall
RxNr - - NetRoot
RxVn - - VNetRoot
RxFc - - FCB
RxSo - - SrvOpen
RxFx - - Fobx
RxNf - - nonpaged FCB
RxWq - - work queue
RxBm - - buffering manager
RxMs - - misc.
RxIr - - RxContext (IrpContext)
RxMx - - minirdr dispatch table
RxNc - - NameCache (not currently used)

RxCt - - connection engine transport
RxCa - - connection engine address
RxCc - - connection engine connection
RxCv - - connection engine VC
RxCd - - connection engine TDI

RxSp - - srvcall calldown params (special build only)
RxVp - - vnetroot calldown params (special build only)
RxTm - - timer context (special build only)
RxDc - - querydirectory pattern (special build only)
RxCx - - connection engine misc. (special build only)

S3 - - S3 video driver
SBad - - bad block simulator - simbad.c

sbp2 - - Sbp2 1394 storage port driver

SC?? - - Smart card driver tags
SCLb - - Smart card driver library
SCB8 - - Bull CP8 Transac serial reader
SCB3 - - Bull SmarTlp PnP
SCS4 - - SCM Microsystems pcmcia reader
SCl0 - - Litronic 220

Sc?? - - Mass storage driver tags

ScB? - classpnp.sys - ClassPnP misc allocations
ScC? - classpnp.sys - ClassPnP misc allocations

ScC? - - CdRom
ScCE - - device control synch event
ScCG - - disk geometry buffer
ScCH - - hitachi error buffer
ScCI - - sense info buffers
ScCS - - srb allocation
ScCM - - mode data buffer
ScCP - - read capacity buffer
ScCp - - play active checks
ScCQ - - read sub q buffer
ScCR - - raw mode read buffer
ScCT - - read toc buffer
ScCt - - toshiba error buffer
ScCU - - update capacity path
ScCV - - volume control buffer
ScCv - - volume control buffer

ScD? - - Disk
ScD - - generic tag
ScDa - - SMART
ScDA - - Info Exceptions
ScDC - - disable cache paths
ScDb - classpnp.sys - ClassPnP debug globals buffer
ScDc - - disk allocated completion c
ScDG - - disk geometry buffer
ScDg - - update disk geometry paths
ScDI - - sense info buffers
ScDp - - pnp ids
ScDM - - mode data buffer
ScDM - - mbr checksum code
ScDN - - disk name code
ScDP - - read capacity buffer
ScDp - - disk partition lists
ScDS - - srb allocation
ScDs - - start device paths
ScDU - - update capacity path
ScDW - - work-item context
ScMC - - medium changer allocations

ScF? - - FtDisk
ScFt - - FtDisk allocations

ScIO - classpnp.sys - ClassPnP device control
ScL? - classpnp.sys - Classpnp
ScLA - classpnp.sys - allocation to check for autorun disable
ScLF - classpnp.sys - File Object Extension
ScLc - classpnp.sys - Cache filters
ScLf - classpnp.sys - Fault prediction
ScLm - classpnp.sys - Mount
ScLM - classpnp.sys - Media Change Detection
ScLq - classpnp.sys - Release queue
ScLw - classpnp.sys - WMI
ScLW - classpnp.sys - Power

ScNo - classpnp.sys - ClassPnP notification

ScP? - - Scsiport
ScPa - - Hold registry data
ScPA - - Access Ranges
ScPb - - Get Bus Dat Holder
ScPB - - Queuetag BitMap
ScPc - - Fake common buffer
ScPC - - reset bus code
ScPd - - Pnp id strings
ScPD - - S

Posted by Aaron Tiensivu in Windows OS at 18:36 | Comments (2) | Trackbacks (0)

40214 hits

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

This was useful to me. You might mention that this info comes from the file "pooltag.txt", which is installed as part of Debugging Tools for Windows.

In my case, I already had a copy of pooltag.txt on my computer, but wasn't aware of its existence until today.

#1 Mark Riordan (Homepage) on 2006-06-02 17:43 (Reply)

Don't forget the infamous pooltag of:

SavE - Symantec AntiVirus

The above is most likely why you are googling for this information in the middle of the night because Symantec Antivirus has yet again used up too much pool memory causing your Server to become unresponsive yet again.

#2 Anonymous on 2009-01-03 07:57 (Reply)

Add Comment