Geoff Chappell - Software Analyst
The MEMORY_PARTITION_TRANSFER_INFORMATION structure (formally _MEMORY_PARTITION_TRANSFER_INFORMATION) is expected as input to NtManagePartition when given the information class SystemMemoryPartitionMoveMemory (1).
The MEMORY_PARTITION_TRANSFER_INFORMATION structure is 0x0C or 0x10 bytes in 32-bit and 64-bit Windows, respectively, at least to the 2004 edition of Windows 10. Note, however, that the 32-bit form is useless in practice before Version 1703 because the 32-bit NtManagePartition fails trivially (returning STATUS_NOT_SUPPORTED).
Offset (x86) | Offset (x64) | Definition |
---|---|---|
0x00 | 0x00 |
ULONG_PTR NumberOfPages; |
0x04 | 0x08 |
ULONG NumaNode; |
0x08 | 0x0C |
ULONG Flags; |
The NumaNode can be 0xFFFFFFFF to mean the node for the current thread’s ideal processor.
Though the original Windows requires that all bits be clear in the Flags, valid bits soon were defined. Microsoft’s names are not known:
Mask | Versions | Remarks |
---|---|---|
0x00000001 | 1511 and higher | |
0x00000002 | 1703 and higher | |
0x00000004 | 1703 and higher | |
0x00000008 | 1709 and higher | |
0x00000010 | 1709 and higher | |
0x000001E0 | 2004 and higher | |
0x00000200 | 2004 and higher | not invalid, but not (yet) supported |