!fpsearch
The !fpsearch extension searches the freed special pool for a specified address.
!fpsearch [Address] [Flag]
Parameters
Address
Specifies a virtual address.
Flag
If set, the debugger displays the raw content of each page on the free list as it searches the freed special pool.
DLL
Kdexts.dll
Remarks
The display for an address includes the virtual address, the page frame number (PFN), the pool tag, size, whether the data at the address is pageable, the thread ID, and the call stack at the time of deallocation.
If Address is set to -1, the debugger displays the entire freed special pool.
If the debugger cannot find the specified address in the freed special pool, it does not display anything.Here is an example of the output from this extension:
kd> !fpsearch -1 1
Searching the free page list (8 entries) for all freed special pool
1EC4000 04000200 e56b6f54 000001f4 0000059c ....Tok.........
1EC4000 00000800 00000000 00000000 00000000 ................
1EC4000 bad0b0b0 82100000 00000000 00000000 ................
1EC4000 72657355 20203233 0000bac5 00000000 User32 ........
1EC4000 00028b94 00000000 0000bac9 00000000 ................
1EC4000 00000000 00000000 ffffffff 7fffffff ................
1EC4000 8153b1b8 00028aff 00000000 00000000 ..S.............
1EC4000 0000001b 00000000 00000012 00000514 ................
26A2000 000a0008 00adecb0 000e000c 00adecba ................
26A2000 000a0008 00adecc8 000e000c 00adecd2 ................
26A2000 000e000c 00adece0 000e000c 00adecee ................
26A2000 00120010 00adecfc 000e000c 00aded0e ................
26A2000 000e000c 00aded1c 000e000c 00aded2a ............*...
26A2000 000e000c 00aded38 000e000c 00aded46 ....8.......F...
26A2000 000a0008 00aded54 000e000c 00aded5e ....T.......^...
26A2000 00120010 00aded6c 000e000c 00aded7e ....l.......~...
2161000 000a0008 00adeccc 000e000c 00adecd6 ................
2161000 000a0008 00adece4 000e000c 00adecee ................
2161000 000e000c 00adecfc 000e000c 00aded0a ................
2161000 00120010 00aded18 000e000c 00aded2a ............*...
2161000 000e000c 00aded38 000e000c 00aded46 ....8.......F...
2161000 000e000c 00aded54 000e000c 00aded62 ....T.......b...
2161000 000a0008 00aded70 000e000c 00aded7a ....p.......z...
2161000 00120010 00aded88 000e000c 00aded9a ................
...
CEC8000 0311ffa4 03120000 0311c000 00000000 ................
CEC8000 00001e00 00000000 7ff88000 00000000 ................
CEC8000 00000328 00000704 00000000 00000000 (...............
CEC8000 7ffdf000 00000000 00000000 00000000 ................
CEC8000 e18ba8c0 00000000 00000000 00000000 ................
CEC8000 00000000 00000000 00000000 00000000 ................
CEC8000 00000000 00000000 00000000 00000000 ................
CEC8000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
CEAD000 00000000 00000000 00000000 00000000 ................
You can stop execution at any point by pressing CTRL+BREAK (in WinDbg) or CTRL+C (in KD).
Feedback
https://aka.ms/ContentUserFeedback.
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see:Submit and view feedback for