S – Sort tags with the difference of allocs and freesĭownload the binaries by following below link and follow the instructions to download Poolmon.exe P- Sorts tags list by Paged, non-paged and mixedĮ – Displays Total Non paged and paged pool allocation at the bottom of the poolmon.exe window Poolmon.exe dynamically updates the output for every few seconds and users who are familiar with the commands still valid with Windows Server 2012 R2 There are several memory debugging tools which can be used in adjacent with Poolmon such as Windbg, Perfmon etc. Non paged pool and Paged pool memory usage can be viewed using Poolmon.exe.

To track the pool usage using the tags, you need to enable pool tagging using gflags The tag is used to identify the block memory / blocks allocated by the driver. At a high level ExAllocatePoolwithTag is similar to heapalloc or malloc at user mode programming. The most common function to use is ExAllocatePool (which is obsolete) and should use ExAllocatePoolwithTaginstead. Paged Pool: Virtual memory available to the driver routines running below DISPATCH_LEVEL IRQL such as driver cleanup, driver initialization, dispatch routines and kernel mode threads. Non paged pool memory is always physically resident. Non Paged Pool: Driver routines running at elevated IRQL’s need to allocate temporary memory called as Non Paged pool.

There are 3 different types of temporary storage that can be used by a driver such as

Poolmon.exe for windows 10