Geoff Chappell - Software Analyst
The MEMORY_PARTITION_PAGE_COMBINE_INFORMATION structure (formally _MEMORY_PARTITION_PAGE_COMBINE_INFORMATION) both provides input for and receives output from NtManagePartition when given the information class SystemMemoryPartitionCombineMemory (3).
The MEMORY_PARTITION_PAGE_COMBINE_INFORMATION structure is 0x0C or 0x18 bytes in 32-bit and 64-bit Windows, respectively, up to and including Version 2004. Note, however, that the 32-bit form is useless in practice before Version 1703 because the 32-bit NtManagePartition fails trivially (returning STATUS_NOT_SUPPORTED).
Offset (x86) | Offset (x64) | Definition | Remarks |
---|---|---|---|
0x00 | 0x00 |
PVOID StopHandle; |
input |
0x04 | 0x08 |
ULONG Flags; |
input |
0x08 | 0x10 |
ULONG_PTR TotalNumberOfPages; |
output |
Among the Flags, only 0x01 is originally valid and only then if operating on the system partition. What flags are valid for later versions is left for another time.