MMPAGING_FILE

The MMPAGING_FILE structure either holds or points the way to pretty much everything that the kernel’s Memory Manager tracks about a paging file.

Variability

As an internal structure, the MMPAGING_FILE varies between versions, but far less than do many others and apparently never between builds of the one version. The changing size gives a rough guide to the variability:

Layout

These sizes, and the offsets, types and names in the tables that follow, are from Microsoft’s symbol files for the kernel starting with Windows 2000 SP3. Since symbol files for earlier versions do not contain type information for the MMPAGING_FILE, what’s known for them is instead inferred from what use the kernel is seen to make of the MMPAGING_FILE. Sizes are relatively straightforward, even without symbol files, but Microsoft’s names and types for all the members in these early versions can be something of a guess.

ULONG_PTR Size;

ULONG_PTR MaximumSize;

ULONG_PTR MinimumSize;

ULONG_PTR FreeSpace;

ULONG CurrentUsage;

ULONG_PTR PeakUsage;

ULONG Hint;

ULONG_PTR HighestPage;

ULONG_PTR FreeReservationSpace;

ULONG_PTR LargestReserveCluster;

FILE_OBJECT *File;

MMMOD_WRITER_MDL_ENTRY *Entry [2];

RTL_BITMAP *Bitmap;

FILE_OBJECT *File;

ULONG PageFileNumber;

SLIST_HEADER PfnsToFree;

UNICODE_STRING PageFileName;

RTL_BITMAP *Bitmap;

RTL_BITMAP *EvictStoreBitmap;

MI_PAGING_FILE_SPACE_BITMAPS *Bitmaps;

ULONG BitmapHint;

ULONG AllocationBitmapHint;

ULONG ReservationBitmapHint;

ULONG LastAllocationSize;

ULONG LargestNonReservedClusterSize;

ULONG RefreshClusterSize;

ULONG LastRefreshClusterSize;

ULONG ReservedClusterSizeAggregate;

ULONG ToBeEvictedCount;

union {
    ULONG ToBeEvictedCount;
    ULONG HybridPriority;
};

ULONG HybridPriority;

ULONG PageFileNumber;

/*  ULONG bit fields, see below  */

/*  USHORT bit fields, see below  */

 struct {
    USHORT AdriftMdls : 1;
    USHORT Spare1 : 15;
};

struct {
    UCHAR AdriftMdls : 1;
    UCHAR Spare1 : 7;
};

UCHAR Spare2 : 8;

UCHAR Extended;

UCHAR HintSetToZero;

BOOLEAN BootPartition;

ULONG PageHashPages;

ULONG PageHashPagesPeak;

ULONG *PageHash;

HANDLE FileHandle;

SLIST_HEADER AvailableList;

SLIST_HEADER NeedProcessingList;

KSPIN_LOCK Lock;

ETHREAD *LockOwner;

RTL_AVL_TREE FlowThroughReadRoot;

MI_PARTITION *Partition;

RTL_BALANCED_NODE FileObjectNode;

The MMPAGING_FILE is in non-paged pool, of course—and, starting with version 6.2, in non-paged no-execute pool. So too are various helper structures, e.g., those for the Entry array and the various bitmaps. The paging file’s name, however, is not accessed during paging I/O. It is kept just for information. The Buffer in PageFileName is in paged pool. Moreover, it just records what filename was given to the NtCreatePagingFile that created this MMPAGING_FILE. This filename need not still be valid when inspected later.

Bit Fields

Even now that Windows 10 has an array of MMPAGING_FILE pointers for each memory partition, each array still has the age-old capacity of 0x10. To allow 32 bits for the PageFileNumber, which indexes the array, always was excessive and the opportunity was eventually taken to make bit fields of both it and the boolean BootPartition.

ULONG PageFileNumber : 4;

USHORT PageFileNumber : 4;

ULONG ReferenceCount : 4;

ULONG BootPartition : 1;

USHORT BootPartition : 1;

USHORT WsSwapPagefile : 1;

USHORT NoReservations : 1;

USHORT VirtualStorePagefile : 1;

USHORT SwapSupported : 1;

USHORT NodeInserted : 1;

USHORT StackNotified : 1;

ULONG Reserved : 23;

USHORT Spare0 : 11;

USHORT Spare0 : 9;

USHORT Spare0 : 5;