MMMOD_WRITER_MDL_ENTRY

The MMMOD_WRITER_MDL_ENTRY structure holds the state of the file I/O that the Memory Manager does with a paging file. The Memory Manager has zero, one or two of these per paging file, depending on the type of paging file.

Variability

As an internal structure, it varies between versions, and even a little between builds, but far less than do many others.

Version Size (x86) Size (x64)
3.51 to 5.1 0x58  
5.2 0x60 0xA8
early 6.0 (before Windows Vista SP1);
late 6.0 (Windows Vista SP1 and higher);
6.1
0x60 0xA0
6.2 to 6.3 0x68 0xA0
10.0 0xA0 0x0108

Layout

Offset (x86) Offset (x64) Definition Versions
0x00 0x00
LIST_ENTRY Links;
3.51 and higher
0x08 (3.51 to 5.2) 0x10 (5.2)
LARGE_INTEGER WriteOffset;
3.51 to 5.2
0x10 (3.51 to 5.2);
0x08
0x18 (5.2);
0x10
union {
    IO_STATUS_BLOCK IoStatus;
    LARGE_INTEGER LastByte;
} u;
3.51 to 5.2
union {
    IO_STATUS_BLOCK IoStatus;
} u;
6.0 and higher
0x18 (3.51 to 5.2);
0x10
0x28 (5.2);
0x20
IRP *Irp;
3.51 and higher
0x1C (3.51 to 5.2) 0x30 (5.2)
ULONG_PTR LastPageToWrite;
3.51 to 5.2
0x20 (3.51 to 5.2) 0x38 (5.2)
MMMOD_WRITER_LISTHEAD *PagingListHead;
3.51 to 5.2
0x24 (3.51 to 5.2) 0x40 (5.2)
LIST_ENTRY *CurrentList;
3.51 to 5.2
0x14 0x28
union {
    ULONG LastPageToWrite;
    ULONG KeepForever;
} u1;
early 6.0 only
union {
    ULONG KeepForever;
} u1;
late 6.0 to 6.1
MODWRITER_FLAGS u1;
6.2 and higher
0x18 0x2C
ULONG StoreWriteRefCount;
10.0 and higher
0x1C 0x30
KAPC StoreWriteCompletionApc;
10.0 and higher
0x18 (6.2 to 6.3);
0x4C
0x2C (6.2 to 6.3);
0x88
ULONG ByteCount;
6.2 and higher
0x50 0x8C
ULONG ChargedPages;
10.0 and higher
0x28 (3.51 to 5.2);
0x18 (6.0 to 6.1);
0x1C (6.2 to 6.3);
0x54
0x48 (5.2);
0x30 (6.0 to 6.3);
0x90
MMPAGING_FILE *PagingFile;
3.51 and higher
0x2C (3.51 to 5.2);
0x1C (6.0 to 6.1);
0x20 (6.2 to 6.3);
0x58
0x50 (5.2);
0x38 (6.0 to 6.3);
0x98
FILE_OBJECT *File;
3.51 and higher
0x30 (3.51 to 5.2);
0x20 (6.0 to 6.1);
0x24 (6.2 to 6.3);
0x5C
0x58 (5.2);
0x40 (6.0 to 6.3);
0xA0
CONTROL_AREA *ControlArea;
3.51 and higher
0x34 (3.51 to 5.2);
0x24 (6.0 to 6.1);
0x28 (6.2 to 6.3);
0x60
0x60 (5.2);
0x48 (6.0 to 6.3);
0xA8
ERESOURCE *FileResource;
3.51 and higher
0x28 (6.0 to 6.1);
0x30 (6.2 to 6.3);
0x68
0x50 (6.0 to 6.3);
0xB0
LARGE_INTEGER WriteOffset;
6.0 and higher
0x38 (5.2);
0x30 (6.0 to 6.1);
0x38 (6.2 to 6.3);
0x70
0x68 (5.2);
0x58 (6.0 to 6.3);
0xB8
LARGE_INTEGER IssueTime;
5.2 and higher
0x78 0xC0
MI_PARTITION *Partition;
10.0 and higher
0x38 (6.0 to 6.1);
0x40 (6.2 to 6.3);
0x7C
0x60 (6.0 to 6.3);
0xC8
MDL *PointerMdl;
6.0 and higher
0x38 (3.51 to 5.1);
0x40 (5.2);
0x3C (6.0 to 6.1);
0x44 (6.2 to 6.3);
0x80
0x70 (5.2);
0x68 (6.0 to 6.3);
0xD0
struct {
    MDL Mdl;
    PFN_NUMBER Page [ANYSIZE_ARRAY];
};
3.51 and higher

Flags

The first substantial change in the MMMOD_WRITER_MDL_ENTRY came when Windows Vista did away with the paging list. The reorganisation moved the LastPageToWrite into a union with a new member named KeepForever. The former seems not to have been needed after all, and was soon discarded from the union. The latter is anyway a boolean. Windows 8 formalised this by turning the union into bit fields.

Mask Definition Versions
0x00000001
ULONG KeepForever : 1;
6.2 and higher
0x00000002
ULONG Networked : 1;
6.2 and higher
0x0000001C
ULONG IoPriority : 3;
6.2 and higher
0x00000020
ULONG ModifiedStoreWrite : 1;
10.0 and higher