this is about Windows kernel driver and memory management.
I am really curious about if there is a function (or even any inconvinent approach) to get (or iterate) all memory allocations for a specific pool-tag ?? These are allocated using ExAllocatePoolWithTag(type, size, tag) ...
There are kernel functions using a specific Pool-Tag, now i need to find all allocations made using that Tag?
I am relatively sure that this is not possible (for security reasons), but still need the confirmation about that.
Update: (about the WinDbg comment below)
kd> !poolfind ObFl Scanning large pool allocation table for Tag: ObFl (fffffa8002290000 : fffffa8002350000) Searching NonPaged pool (fffffa8001772000 : ffffffe000000000) for Tag: ObFl
... So this means we have to find a generic way to find the "pool allocation table" or the bounds of the non-paged pool (if required). Sounds promising.
Update2: There are some ntoskrnl exports: nt!PoolBigPageTable nt!PoolBigPageTableSize nt!PoolBigPageTableHash that i need to check....
preguntado el 01 de febrero de 12 a las 22:02
Kernel allocations can be allocated and freed at any time. If you are iterating over the internal data structures, they may suddenly disappear out from under you and you will bugcheck.
The debugger can walk these structures since it freezes the system first.