Geoff Chappell, Software Analyst
The MI_PAGING_FILE_SPACE_BITMAPS structure holds the state of two bitmaps that the Memory Manager uses to track pages in a paging file. The structure was introduced for Windows 8 to tidy some changes that started with Windows 7. Since ancient times the MMPAGING_FILE structure had one RTL_BITMAP, named simply Bitmap, which tracked the allocated pages. Windows 7 gave it a second, the EvictStoreBitmap. When Windows 8 added a third, the ReservationBitmap, it collected the lot as the MI_PAGING_FILE_SPACE_BITMAPS.
As an internal structure, it varies between versions. Time will tell how much. So far, there has been just the one change, for Windows 10.
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 6.2 to 6.3 | 0x18 | 0x30 |
| 10.0 | 0x14 | 0x28 |
| Offset (x86) | Offset (x64) | Definition | Versions |
|---|---|---|---|
| 0x00 | 0x00 |
union {
ULONG RefCount;
MI_PAGING_FILE_SPACE_BITMAPS *Anchor;
};
|
6.2 and higher |
| 0x04 | 0x08 |
RTL_BITMAP AllocationBitmap; |
6.2 and higher |
| 0x0C | 0x18 |
RTL_BITMAP ReservationBitmap; |
6.2 to 6.3 |
union {
RTL_BITMAP ReservationBitmap;
RTL_BITMAP EvictedBitmap;
};
|
10.0 and higher | ||
| 0x14 (6.2 to 6.3) | 0x28 (6.2 to 6.3) |
RTL_BITMAP *EvictStoreBitmap; |
6.2 and higher |