You've probably used poolmon, the DOS-style console mode app that comes with the DDK to monitor your driver's pool usage.? PoolTag is a Win32 GUI version that improves on poolmon in several ways.? It easily lets you save output to a text file.? Also helps you find those nasty pool leaks by allowing you to take a snapshot of pool usage, and only show changes from that snapshot.? Check it out!

?What's new in PoolTag V2.9

Well, you've waited long enough here is the new PoolTag.?? We've added 2 new features that will work for X64 and X86 images.?? Under the Pooltag menu item, there are 2 new items: Parse a Driver for Memory Tags and Parse All Drivers in Driver Directory.?? In short these options will allow you to search a driver or all drivers for calls to ExAllocatePoolWithTag and if possible the code will extract the pool tags found in the driver.?? NOTICE we said if possible. If the driver passes the tag into a routine that calls ExAllocatePoolWithTag, we're not going to find, plain and simple.?? Hey look, you can't have everything, but we try....

We've also modified the filters dialog so that you can take the tags from a driver and add them as filters....