Windows Kernel Pool Tag Lookup
Identify the owner of a kernel pool allocation by its tag
The Windows kernel pool allocator lets drivers tag their allocations with a 4-byte ASCII identifier by passing a Tag parameter to ExAllocatePoolWithTag (or its successors ExAllocatePool2 / ExAllocatePool3). These tags are stored in the pool header and are visible in kernel debugger output from commands like !poolused, !poolfind, and !pool.
Use the search below to look up a tag observed in a debugger or a memory analysis tool. Tags are case-sensitive and may be up to 4 characters (shorter tags are space-padded). You can also search by component name or keyword to find tags associated with a particular subsystem. Data is sourced from pooltag.txt, which ships with the WDK and Debugging Tools for Windows.
Dealing with a kernel memory leak or pool corruption? Our team specializes in kernel debugging and crash dump analysis. Learn about our debugging services or get in touch for expert help.
What our customers say about us?
Read our customer testimonials to find out why our clients keep returning for their projects.
View Testimonials
Tip: In WinDbg use !pool <addr> or !poolfind <tag> to find allocations by tag. Pool tags are case-sensitive.
Start typing a tag name or keyword above to search 222 known pool tags.