OK, a quick disclaimer right at the start. The steps we discuss in this post assume that you are very comfortable with kernel debugging, and in particular live debugging. This is a bit of a niche post, but it is a question that we get every so often, so we figured we’d share the information. The information in this post follows on from our post last Friday on Pool Tags. So without further ado, here we go … Let’s say that you have a server that is leaking Pool memory (either Paged or NonPaged). You’ve done troubleshooting and identified the leaking tag, but you want to examine the actual stack leading up to the allocation. Using Special Pool and the Debugger Tools you can find out exactly who is allocating the tag. Now, we’re not going to dive too deep into Special Pool itself, but in a nutshell, this feature configures Windows to request memory allocations from a reserved memory pool when the memory is allocated with a specific pool tag or is within a specified size range.
|