MI_PAGING_FILE_SPACE_BITMAPS

The MI_PAGING_FILE_SPACE_BITMAPS structure holds the state of two bitmaps that the Memory Manager uses to track pages in a paging file. The structure was introduced for Windows 8 to tidy some changes that started with Windows 7. Since ancient times the MMPAGING_FILE structure had one RTL_BITMAP, named simply Bitmap, which tracked the allocated pages. Windows 7 gave it a second, the EvictStoreBitmap. When Windows 8 added a third, the ReservationBitmap, it collected the lot as the MI_PAGING_FILE_SPACE_BITMAPS.

Variability

As an internal structure, it varies between versions. Time will tell how much. So far, there has been just the one change, for Windows 10.

Version Size (x86) Size (x64)
6.2 to 6.3 0x18 0x30
10.0 0x14 0x28

Layout

Offset (x86) Offset (x64) Definition Versions
0x00 0x00
union {
    ULONG RefCount;
    MI_PAGING_FILE_SPACE_BITMAPS *Anchor;
};
6.2 and higher
0x04 0x08
RTL_BITMAP AllocationBitmap;
6.2 and higher
0x0C 0x18
RTL_BITMAP ReservationBitmap;
6.2 to 6.3
union {
    RTL_BITMAP ReservationBitmap;
    RTL_BITMAP EvictedBitmap;
};
10.0 and higher
0x14 (6.2 to 6.3) 0x28 (6.2 to 6.3)
RTL_BITMAP *EvictStoreBitmap;
6.2 and higher