Geoff Chappell, Software Analyst
The MI_PAGING_FILE_SPACE_BITMAPS structure holds the state of two bitmaps that the Memory Manager uses to track pages in a paging file. The structure was introduced for Windows 8 to tidy some changes that started with Windows 7. Since ancient times the MMPAGING_FILE structure had one RTL_BITMAP, named simply Bitmap, which tracked the allocated pages. Windows 7 gave it a second, the EvictStoreBitmap. When Windows 8 added a third, the ReservationBitmap, it collected the lot as the MI_PAGING_FILE_SPACE_BITMAPS.
As an internal structure, it varies between versions. Time will tell how much. So far, there has been just the one change, for Windows 10.
Version | Size (x86) | Size (x64) |
---|---|---|
6.2 to 6.3 | 0x18 | 0x30 |
10.0 | 0x14 | 0x28 |
Offset (x86) | Offset (x64) | Definition | Versions |
---|---|---|---|
0x00 | 0x00 |
union { ULONG RefCount; MI_PAGING_FILE_SPACE_BITMAPS *Anchor; }; |
6.2 and higher |
0x04 | 0x08 |
RTL_BITMAP AllocationBitmap; |
6.2 and higher |
0x0C | 0x18 |
RTL_BITMAP ReservationBitmap; |
6.2 to 6.3 |
union { RTL_BITMAP ReservationBitmap; RTL_BITMAP EvictedBitmap; }; |
10.0 and higher | ||
0x14 (6.2 to 6.3) | 0x28 (6.2 to 6.3) |
RTL_BITMAP *EvictStoreBitmap; |
6.2 and higher |