Windows: Finding a driver which leaks memory
View at Medium.com
On the affected system, this is task manager looks like. The Paged pool and non-paged pool values are very high. None of the processes listed under the Processes tab have very high memory usage, so it’s not a user mode process that’s causing the issue.
To track this down, you’ll need poolmon.exe. This can be obtained from the Windows Driver Kit, which claims to require Visual Studio, although some people say this isn’t necessary. I found it easier to download use the Windows Server 2003 support tools:
After installing, you can find it here: “C:\Program Files (x86)\Support Tools\poolmon.exe”
Run poolmon.exe /b from an admin command prompt. The /b flag sorts by bytes, i.e. putting the highest memory usage items at the top of the list.
The first entry, FMfn, is using 1,274,642,288 bytes of memory – or 1.27 GB. Ntff is using around 500 MB. Those two are of the Paged type, which explains why the Paged pool in Task Manager is so large at 3.8 GB. On my properly working system, FMfn is using only 84,776,224 bytes and Ntff is using 59,586,560 bytes (and the entire paged pool is only ~800MB).
To find out what those are, run these commands:
First, cd \Windows\System32\drivers
findstr /m /s /l FMfn *.sys (replacing FMfn with the Tag listed by poolmon)
In this case, FMfn is fltmgr.sys, which is a Windows file system filter driver. The culprit is probably a third party filter that’s leaking memory, but I haven’t tracked that down yet. The easiest way to (temporarily) resolve these problems is to reboot, but of course, the leak will probably come back over time.
–Here’s how to track down what’s happening more in-depth – inside Fmfn, for example: https://superuser.com/questions/949244/windows-10-high-memory-usage-unknown-reason/949246#949246