Memory manager

!lookaside

List or decode GENERAL_LOOKASIDE caches.

!lookaside [address]

Also: lookaside

The no-argument form walks both exported nonpaged and paged lookaside lists with cycle detection. An address decodes one entry directly.

!memusage

Show bounded system and per-process memory-use counters.

!memusage [process-limit]

Uses validated memory-manager globals, KDBG fields, or recognized public getter code plus EPROCESS.Vm counters. It does not scan physical memory or walk every VAD.

!pfn

Decode an _MMPFN entry.

!pfn <pfn> | !pfn -a <physical-address>

Also: pfn

A plain value is a page-frame number. Use -a to force physical-address mode.

!pool

Inspect the pool page containing an address.

!pool <address-expression>

Also: pool

!poolfind

Find pool blocks with a matching tag.

!poolfind <tag> [0|1]

Also: poolfind

The optional type selects nonpaged (0) or paged (1). Only virtual pool ranges and the big-page table are read; page scans are bounded and interruptible.

!poolused

Aggregate pool tracker usage by tag.

!poolused [flags] [tag]

Also: poolused

Aggregates across every processor’s tag table. Flags follow WinDbg: bit 1 (2) sorts by nonpaged bytes, bit 2 (4) by paged bytes, and bit 0 (1) enables alloc/free columns. Tag matching is case-sensitive and supports * and ?.

!pte

Display page table entries for an address.

!pte <address>

Also: pte

!ptov

Find current-directory-base virtual mappings of a physical address.

!ptov <physical-address>

Also: ptov

The reverse page-table walk is bounded to 32 mappings and 65,536 table pages, with cycle detection.

!vm

Display system memory, pool, PTE, page-file, and process usage.

!vm [flags]

Also: vm

Flags follow WinDbg: bit 0 omits per-process rows; bits 1, 2, and 3 are accepted but ignored. Counters degrade independently.

!vtop

Translate a virtual address with an explicit directory base.

!vtop <directory-base> <virtual-address>

Also: vtop

A zero directory base uses the current context. Each AMD64 page-table level and the final physical address are shown; large pages stop at their leaf level.