Use poolmon to find memory leaks

Use poolmon to find memory leaks

Poolmon c: \ winddk \ 7600.16385.1 \ tools \ other \ i386 \ poolmon.exe
Gflags c: \ winddk \ 7600.16385.1 \ debuggers \ gflags.exe

[STEP]:
1). Modify the Registry
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ Session Manager

Globalflag 0x000400

22.16.gflags.exe

Select enable pool tagging

3). restart the system.

4) Open poolmon to view detailed memory allocation and release information.
P-switch paging non-Paging memory

D-sort by the difference between allocation and unreleased

5). Set the command line window
Right-click Properties, select options, and select "quick edit ".

You can also increase the buffer size.

6) Click the left mouse button to select all content and press Enter.

7) Open notepad, CTRL + V

 Memory: 3136424K Avail: 2672512K  PageFlts:  2504   InRam Krnl: 2864K P:58704 Commit: 305964K Limit:5065664K Peak: 598068K            Pool N:14872K P:63108 Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc NtFs Paged     22354 (   0)     16458 (   0)     5896  310656 (     0)     52 MmSt Paged      8892 (   3)      3049 (  25)     5843 11600216 (-17480)   198 CMVa Paged    497244 ( 243)    491734 ( 155)     5510  275648 (  3528)     50 Ntf0 Paged     39087 (  32)     33784 (  32)     5303  184280 (     0)     34 MmSm Paged      5049 (   0)       456 (   0)     4593  293952 (     0)     64 FSim Paged      3971 (   0)        61 (   0)     3910  500480 (     0)    128 IoNm Paged    400361 ( 645)    396911 ( 723)     3450  501632 ( -7424)    145 NtfF Paged      3430 (   0)       727 (   0)     2703 2551632 (     0)    944 Ntfo Paged     31970 (  64)     29291 (  64)     2679  267424 (     0)     99 Ntff Paged     10264 (   0)      7616 (   0)     2648 2203136 (     0)    832 CMNb Paged    565888 ( 224)    563791 ( 272)     2097  117432 ( -2024)     56 CMDa Paged     58237 (  27)     56171 (  45)     2066  259568 ( -1464)    125 Sect Paged     53359 ( 206)     51324 ( 229)     2035  177640 ( -2072)     87 CMVI Paged     69712 (  36)     68199 (  75)     1513   53048 (  -112)     35 NtFL Paged      1426 (   1)         0 (   0)     1426   57040 (    40)     40 Ntfc Paged      3789 (  73)      2384 (  97)     1405  101160 ( -1728)     72 SYSA Paged      6191 (   0)      4871 (   0)     1320  152056 (     0)    115......

In this way, you can find out programs with Memory leakage by recording the output information of poolmon multiple times and comparing their differences.

[References]:

Http://support.microsoft.com/kb/177415/zh-cn

Http://blog.csdn.net/moreorless/article/details/3369525