JSI Tip 7102. How do I determine a driver name from a pool tag?

In tip 7101 How can I monitor my system for kernel mode memory leaks, we used Poolmon.exe to determine the pool tag of a leaking process.

To determine the driver name from a pool tag:

1. Open a CMD prompt.

2. Change to the drivers folder by typing cd /d %SystemRoot%System32Drivers

3. Type the following command:

findstr /m /l *.sys

4. If you receive multiple files, add an h to the . findstr /m /l hTCPt *.sys returns TCPIP.SYS.