Finding Memory Leaks with PoolMon

Clint Colding
Jun 2 · 2 min read
Memory Usage
Insane Non-paged pool size


A good indicator of a driver that’s leaking memory is when its allocating memory faster than its freeing it.

Set-Location "C:\Windows\System32\drivers"
Select-String -Path *.sys -Pattern "MFeS" -CaseSensitive | Select-Object FileName -Unique

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade