A clever way to find who owns a pool
Scott Noone pointed out this technique on NTDEV for finding a mysterious pool tag owner:
If you have a debugger hooked up try: ed nt!PoolHitTag 'REVD' You'll break in when someone allocates memory using that tag.
This little tip is a new one on me. I’m sure the rest of you already know this, and I’m even surer that my co-workers (a couple of ‘em anyway) are going to make fun of me for not knowing this. But, hey, I’m arrogant enough to not care what they think. 
Anyway, I thought it was neato.
April 28th, 2008 at 8:15 pm
You should note that in ed nt!PoolHitTag ‘REVD’ the tag is DVER, meaning that you have to spell it backwards.
April 28th, 2008 at 8:16 pm
Well, assuming you’re on a little-endian box, but who has one of those?