ExAllocatePoolWithTag

ExAllocatePoolWithTag allocates pool memory. 
PVOID 
  ExAllocatePoolWithTag(
    IN POOL_TYPE  PoolType,
    IN SIZE_T  NumberOfBytes,
    IN ULONG  Tag
    );
Parameters
PoolType
Specifies the type of pool memory to allocate. See POOL_TYPE for a de.ion of the available pool memory types.
NumberOfBytes
Specifies the number of bytes to allocate.
Tag
Specifies a string, delimited by single quote marks, with up to four characters. The string is usually specified in reversed order.
Include
wdm.h or ntddk.h
Return Value
ExAllocatePoolWithTag returns NULL if there is insufficient memory in the free pool to satisfy the request. Otherwise the routine returns a pointer to the allocated memory.
Comments
A call to this routine is equivalent to calling ExAllocatePool, except that ExAllocatePoolWithTag inserts a caller-supplied tag before the allocation. This tag appears in any crash dump of the system that occurs.
During driver development . a checked build of the system, this routine can be useful for debugging system crashes. Calling this routine, rather than ExAllocatePool, inserts the caller-supplied tag into a crash dump of pool memory.
The Tag passed to this routine is more readable if its bytes are reversed when this routine is called. For example, if a caller passes 'Fred' as a Tag, it would appear as 'derF' if pool is dumped or when tracking pool usage in the debugger.
Callers of ExAllocatePoolWithTag, like callers of ExAllocatePool, can be running at IRQL DISPATCH_LEVEL .ly if the requested PoolType is .e of the NonPaged Xxx. Otherwise, callers must be running at IRQL < DISPATCH_LEVEL.
 
 
 
 
ExAllocatePoolWithTag
调用ExAllocatePool是从内核模式堆中分配内存的标准方式。另一个函数ExAllocatePoolWithTag，与ExAllocatePool稍有不同，它提供了一个有用的额外特征。当使用ExAllocatePoolWithTag时，系统在你要求的内存外又额外地多分配了4个字节的标签。这个标签占用了开始的4个字节，位于返回指针所指向地址的前面。调试时，如果你查看分配的内存块会看到这个标签，它帮助你识别有问题的内存块。例如：
PVOID p = ExAllocatePoolWithTag(PagedPool, 42, ''KNUJ'');
 
在这里，我使用了一个32位整数常量作为标签值。在小结尾的计算机如x86上，组成这个标签的4个字节的顺序与正常拼写相反。
WDM.H中声明的内存分配函数受一个预处理宏POOL_TAGGING控制。WDM.H(NTDDK.H中也是)中无条件地定义了POOL_TAGGING，结果，无标签的函数实际上是宏，它真正执行的是有标签函数并加入标签‘ mdW’(指明为WDM的内存块)。如果在未来版本的DDK中没有定义POOL_TAGGING，那么带标签函数将成为无标签函数的宏。Microsoft现在还没打算改变POOL_TAGGING的设置。
由于POOL_TAGGING宏的存在，当你在程序中调用ExAllocatePool时，最终被调用的将是ExAllocatePoolWithTag。如果你关闭了该宏，自己去调用ExAllocatePool，但ExAllocatePool内部仍旧调用ExAllocatePoolWithTag并带一个‘enoN’(即None)的标签。因此你无法避免产生内存标签。所以你应该明确地调用ExAllocatePoolWithTag并加上一个你认为有意义的标签。实际上，Microsoft强烈鼓励你这样做。
 
 

POOL_TYPE

The POOL_TYPE enumeration type specifies the type of system memory to allocate. 
typedef enum _POOL_TYPE {
  NonPagedPool,
  PagedPool,
  NonPagedPoolMustSucceed,
  DontUseThisType,
  NonPagedPoolCacheAligned,
  PagedPoolCacheAligned,
  NonPagedPoolCacheAlignedMustS
} POOL_TYPE;
Enumerators
PagedPool
Paged pool, which is pageable system memory. Paged pool can .ly be allocated and accessed at IRQL < DISPATCH_LEVEL.
PagedPoolCacheAligned
Paged pool, aligned . processor cache boundaries.
NonPagedPool
Nonpaged pool, which is nonpageable system memory. Nonpaged pool can be accessed from any IRQL, but it is a scarce resource and drivers should allocate it .ly when necessary.
The system can .ly allocate buffers larger than PAGE_SIZE from nonpaged pool in multiples of PAGE_SIZE. Requests for buffers larger than PAGE_SIZE, but not a PAGE_SIZE multiple, waste nonpageable memory.
NonPagedPoolMustSucceed
This value is for internal use .ly, and is .ly allowed during system startup. Otherwise, drivers must not specify this value, because a "must succeed" request crashes the system if the requested memory size is unavailable.
NonPagedPoolCacheAligned
Nonpaged pool, aligned . processor cache boundaries.
NonPagedPoolCacheAlignedMustS
This value is for internal use .ly, and is .ly allowed during system startup. It is the cache-aligned equivalent of NonPagedPoolMustSucceed.
Comments
When the system allocates a buffer from pool memory bigger than PAGE_SIZE, it aligns the buffer . a page boundary. Memory requests smaller than or equal to PAGE_SIZE are not necessarily aligned . page boundaries, but always fit within a single page, and are aligned . an 8-byte boundary.