| Subject: Pool Memory Specifics |
| Group: microsoft.public.winternals |
| Date: 11/13/2007 8:07:16 AM |
| From: Megan Kielman [Email Address Protection] |
All - I have read several articles that discuss pool memory has a dynamically sized pool that the kernel-mode components use to allocate system memory. Can anyone be more specific as to what goes on in these pools? Do the pools contain a table with pointers? I essentially want to get a better understanding of when a process would use pool memory rather then memory allocated to application mode. |
| Back |
| Subject: Re: Pool Memory Specifics |
| Group: microsoft.public.winternals |
| Date: 11/14/2007 12:17:07 AM |
| From: "the_el_vez" [Email Address Protection] |
The "Windows Interals" book covers this topic in great detail. At a high level, kernel memory pools (non-paged pool, paged pool, etc.) are OS managed kernel memory pools. Applications can't directly allocate from them - only kernel mode components can. User mode components allocate memory from the user mode heap allocator or directly from their user VA space using the NT memory manager. The format of the kernel pools are generally an inline header followed directly by the allocated block - for the small block allocator. The large block allocators typically use a bitmap to manage page size and larger allocations. "Megan Kielman" <megan.kielman@gmail.com> wrote in message news:OIRxhbgJIHA.1020@TK2MSFTNGP05.phx.gbl... > All - > > I have read several articles that discuss pool memory has a dynamically > sized pool that the kernel-mode components use to allocate system memory. > Can anyone be more specific as to what goes on in these pools? Do the > pools contain a table with pointers? I essentially want to get a better > understanding of when a process would use pool memory rather then memory > allocated to application mode. |
| Back |
| Subject: Re: Pool Memory Specifics |
| Group: microsoft.public.winternals |
| Date: 11/19/2007 5:35:19 PM |
| From: Megan Kielman [Email Address Protection] |
Sorry for the late response. Yes, it does make sense! the_el_vez wrote: > It is only needed implicitly.Applications really can't allocate > non-paged pool directly. But when you create and event for instance - > the kernel allocates the real object from pool for you. In fact - your > process and thread objects, files, handles, etc. are all allocated from > kernel pool on your behalf. Does this make more sense? > > "Megan Kielman" <megan.kielman@gmail.com> wrote in message > news:Ool7KjGKIHA.748@TK2MSFTNGP04.phx.gbl... >> Thanks for the response but I still don't understand when a process >> would need memory from one of the pools. >> >> the_el_vez wrote: >>> The "Windows Interals" book covers this topic in great detail. At a >>> high level, kernel memory pools (non-paged pool, paged pool, etc.) >>> are OS managed kernel memory pools. Applications can't directly >>> allocate from them - only kernel mode components can. User mode >>> components allocate memory from the user mode heap allocator or >>> directly from their user VA space using the NT memory manager. The >>> format of the kernel pools are generally an inline header followed >>> directly by the allocated block - for the small block allocator. The >>> large block allocators typically use a bitmap to manage page size >>> and larger allocations. >>> >>> >>> "Megan Kielman" <megan.kielman@gmail.com> wrote in message >>> news:OIRxhbgJIHA.1020@TK2MSFTNGP05.phx.gbl... >>>> All - >>>> >>>> I have read several articles that discuss pool memory has a >>>> dynamically sized pool that the kernel-mode components use to >>>> allocate system memory. Can anyone be more specific as to what goes >>>> on in these pools? Do the pools contain a table with pointers? I >>>> essentially want to get a better understanding of when a process >>>> would use pool memory rather then memory allocated to application mode. >>> > |
| Back |