Locating memory leaks with poolmon

poolmon Integrated into the wdk in , Need to run wdksetup.exe Installation , and windbg Also need to run wdksetup.exe Installation , But notice wdksetup.exe Not included Windows Performance Toolkit, Don't confuse .

First, how to install poolmon, Then introduce how to use

open https://docs.microsoft.com/zh-cn/windows-hardware/drivers/download-the-wdk

1、 Download and install wdk

Pay attention to the direct steps 3 Link download in wdksetup.exe

https://go.microsoft.com/fwlink/?linkid=2166289

function wdksetup.exe Download the installation files to a directory

Close the interface after downloading

Then download the completed directory （ The installation files are retained for deployment on multiple machines , After compression, it can be copied to other machines , Instead of downloading it again ）, Find... In this directory wdksetup.exe Run the setup

2、cd /d "poolmon Absolute path directory of "

poolmon.exe The location of C:\Program Files (x86)\Windows Kits\10\Tools\x64\poolmon.exe

cd /d "C:\Program Files (x86)\Windows Kits\10\Tools\x64"

3、 perform poolmon -u -n c:\1.txt

use notepad++ open c:\1.txt（ Software writers are anti Chinese , The software itself works very well , Alignment ）

4、 Pay attention to page above 1 The article Bytes One column is in reverse order , Look at the first column of the previous articles Tag name

5、 perform cd /d c:\

findstr /m /l /s $tagname *.sys

Corresponding to the above figure, i.e

findstr /m /l /s MmSt *.sys

findstr /m /l /s Se *.sys

findstr /m /l /s FMfn *.sys

According to the keywords found, you can determine which software occupies the most memory , I have this case in , Mainly occupied by the operating system

6、 If Bytes A column of maximum values corresponds to Tag The name is DRPI, Then execute findstr /mls DRPI *.sys

explain DRPI This height is mainly 360 Occupy

Parameters /m /l /s It can be combined into /mls

Other Microsoft official information about the installation package ：https://docs.microsoft.com/zh-cn/windows-hardware/drivers/other-wdk-downloads