[Autogenerated] what are the most common APIs used
by the kernel and device drivers.
So first we have X allocate pool with tag and ex allocated pool too.
And even a variant called X adequate pool three.
And the basic idea here is that you allocate a chunk of memory and
you can tag that chunk of memory with a four byte value typically
stored as a bunch of asking characters.
This allows tracking allocations by developers when debugging and
looking at what's going on within the system pools.
There is no other real meaning to the tax,
it has no effect at runtime,
but it is very useful to use the classic function is X allocate pull with tag.
The newer set of functions or X allocate pull two and three.
The X allocate pull tag function is currently considered deprecated So
developers should not be using it and only use the newer API Yes,
and that's because the newer APIs by default.
Zero out the memory chunk that is being allocated.
However, the functions essentially work in exactly the same way.
In order to free the chunk of memory,
you can use the X three pool function which works in any kind of pool.
Now,
the other thing that is worth mentioning at this point is that when
you call X allocate pool with tag or the other allocation functions
you need to specify which pool you'd like to use either their non
page pool or the page pool.
So that is important and a very important decision to
make when you're making the allocation.
And the basic rule is that if, you know,
you have to access that memory in high R Q L,
that is two or higher, you have to use the non paged pool.
Otherwise it's better to use the page pool because it is cheaper.
It's not always necessarily going to be in physical memory.
X free pool works on any kind of pool.
Now, this tank that I mentioned.
In fact,
there's a list of tasks that are known to Microsoft are provided
with debugging tools for Windows package and the county buggers
using these tax to provide some more meaningful information when
doing actual debugging.
And so this information is stored in a file called pull tax dot txt
in a directory called triads within the directory where the
debugging tools for Windows is installed.
We can look at that file and in fact, as I mentioned,
it's used automatically when you search for tanks within the
current debugger as we'll demonstrate next