Module Memory Usage

WINDBG
1

Hi All,

I need a help to analyze a crash dump file received from our customer site. Our customer have reported a memory leak issue in the driver we delivered, along with a forcefully generated (through keyboard) dump file. After an initial set of analysis we have seen that the paged pool is almost fully consumed.

Unfortunately we didn’t have ourown pool tag for the allocations. So I cannot identify the memory usage of my drivers. Actually I have two driver modules, hence it is needed to find the exact location from the memory dump itself and report to the customer.

Is there any method in windbg to identify the per module paged pool usage from the memory dump? If we see an allocated memory location, is it possible to identify the location from where this allocation was made?

Best Regards
Praveen

Do you Yahoo!?
Yahoo! Hotjobs: Enter the “Signing Bonus” Sweepstakes

2

Praveen,

Unfortunately, if you are using the obsolete ExAllocatePool interface,
the default tag (’ kdD’ which displays as Ddk) will be used. There is
no simple way to find your allocations.

Can you have your client run with driver verifier enabled on your
drivers? If so it will tell you where the allocations are in your
driver.

Regards,

Tony

Tony Mason
Consulting Partner
OSR Open Systems Resources, Inc.
http://www.osr.com

From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of prvn ns
Sent: Saturday, January 17, 2004 8:44 AM
To: Kernel Debugging Interest List
Subject: [windbg] Module Memory Usage

Hi All,

I need a help to analyze a crash dump file received from our customer
site. Our customer have reported a memory leak issue in the driver we
delivered, along with a forcefully generated (through keyboard) dump
file. After an initial set of analysis we have seen that the paged pool
is almost fully consumed.

Unfortunately we didn’t have ourown pool tag for the allocations. So I
cannot identify the memory usage of my drivers. Actually I have two
driver modules, hence it is needed to find the exact location from the
memory dump itself and report to the customer.

Is there any method in windbg to identify the per module paged pool
usage from the memory dump? If we see an allocated memory location, is
it possible to identify the location from where this allocation was
made?

Best Regards
Praveen

Do you Yahoo!?
Yahoo! Hotjobs: Enter the “Signing Bonus” Sweepstakes
http:vt=21482/*http://hotjobs.sweepstakes.yahoo.com/signingbonus> — You
are currently subscribed to windbg as: xxxxx@osr.com To unsubscribe send
a blank email to xxxxx@lists.osr.com</http:>

3

I know of no “magic” way to recover this information (and I doubt it exists,
at least by default).

What I’ve done in the past is to look at the exact logical size of the
allocation, and look at my code to find locations that allocate of that
specific size. For fixed-size structures, it’s sometimes surprisingly quick
to find.

If you can modify the code and make it happen again, you can wrap the
allocation functions and tag each block with file/line information, which
will waste memory, but allow very easy diagnostics. Wouldn’t recommend
shipping something like that in release mode, though. But it sounds like
this may be hard for you to do.

Cheers,

/ h+

Is there any method in windbg to identify the per module paged pool usage
from the memory dump? If we see an allocated memory location, is it possible
to identify the location from where this allocation was made?