Re: [ntdev] Finding pool tage in loaded images

Note that although likely, it is not assured that corruption was caused by a module that actually allocated with that tag. Any KM module can access any KM address and arbitrary bugs can access arbitrary data or addresses with spectacular effects.

In general, start by assuming that your own driver is responsible unless you have strong evidence to the contrary.

Sent from Surface Pro

From: Bedanto
Sent: ‎Thursday‎, ‎August‎ ‎21‎, ‎2014 ‎9‎:‎33‎ ‎AM
To: Windows System Software Devs Interest List

All,

I am trying to debug a memory corruption ase. I have been able to successfully identify the pool of memory which is corrupting the system. I am trying to run the debugger

!for_each_module s-a @#Base @#End “Tag1”

to search for the tag string literal. But the output is a lot of modules since the striang seems to be used in a lot of images (Tag1 is a placeholder string I gave, it is not he actual tag nme).

so how can I from this point, find out the exact binary (out of all these) which is probably causing the bad allocation?

also how do I print the module name *also* with the above command? I am unable to use teh #ModuleName properly here.

thanks

Bedanto
— NTDEV is sponsored by OSR Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev OSR is HIRING!! See http://www.osr.com/careers For our schedule of WDF, WDM, debugging and other seminars visit: http://www.osr.com/seminars To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer