Sometimes we have a value or a pointer or a handle and would like to know all memory addresses that reference it. This can be done by virtual memory search (s WinDbg command). If we look for references in code (for example, for pool tags please see this case study in Volume 1, page 206) we can combine search with !for_each_module WinDbg extension command. There is also !search command for physical pages. We cover this Value References pattern in Advanced Windows Memory Dump Analysis training12 with a step-by-step complete memory dump analysis exercise. For object references there is also recently added !obtrace command with good examples in WinDbg help.