Lookaside Lists

this structure is used for optimization, when fixed-size allocations are needed

we all know that allocate and free memory is expensive, so for this kind of fixed-size allocation, we just don't really free the memory we allocated, we just mark it as available

so when the next time a same size memory is requested to be allocated, we just return this memory block instead of allocating a new fresh memory

this is the purpose of lookaside lists

to use this structure, you need to call windows API to initialize it

NTSTATUS ExInitializeLookasideListEx(
  [out]          PLOOKASIDE_LIST_EX    Lookaside,
  [in, optional] PALLOCATE_FUNCTION_EX Allocate,
  [in, optional] PFREE_FUNCTION_EX     Free,
  [in]           POOL_TYPE             PoolType,
  [in]           ULONG                 Flags,
  [in]           SIZE_T                Size,
  [in]           ULONG                 Tag,
  [in]           USHORT                Depth
);

after that, you can call this API to get a memory block who will have the size and tag you specified in initialization function:

PVOID ExAllocateFromPagedLookasideList(
  [in, out] PPAGED_LOOKASIDE_LIST Lookaside
);

free with this API:

void ExFreeToPagedLookasideList(
  [in, out] PPAGED_LOOKASIDE_LIST Lookaside,
  [in]      PVOID                 Entry
);

destroy lookaside lists with this API:

void ExDeletePagedLookasideList(
  [in, out] PPAGED_LOOKASIDE_LIST Lookaside
);