Geoff Chappell - Software Analyst
The MI_PARTITION_MODWRITES structure (formally _MI_PARTITION_MODWRITES) is here thought to exist only as a subdivision of the MI_PARTITION, specifically as the latter’s Modwriter member.
The MI_PARTITION_MODWRITES structure is an implementation detail and can be expected to change between builds. The following changes of size give some rough indication of the variability so far:
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 10.0 | 0x01B0 | 0x02A0 |
| 1511 to 1703 | 0x01D0 | 0x02D0 |
| 1709 | 0x01C8 | 0x02C0 |
| 1803 to 2004 | 0x01D0 | 0x02C0 |
The sizes in the preceding table and the offsets, names and types in the next are from type information in public symbol files for the kernel.
| Offset (x86) | Offset (x64) | Definition | Versions |
|---|---|---|---|
| 0x00 | 0x00 |
MMPAGE_FILE_EXPANSION AttemptForCantExtend; |
10.0 and higher |
| 0x38 (10.0 to 1703); 0x34 |
0x60 (10.0 to 1703); 0x58 |
MMPAGE_FILE_EXPANSION PageFileContract; |
10.0 and higher |
| 0x70 (10.0 to 1703); 0x68 |
0xC0 (10.0 to 1703); 0xB0 |
ULONG_PTR NumberOfMappedMdls; |
10.0 and higher |
| 0x74 (10.0 to 1703); 0x6C |
0xC8 (10.0 to 1703); 0xB8 |
LONG volatile NumberOfMappedMdlsInUse; |
10.0 and higher |
| 0x78 (10.0 to 1703); 0x70 |
0xCC (10.0 to 1703); 0xBC |
ULONG NumberOfMappedMdlsInUsePeak; |
10.0 and higher |
| 0x7C (10.0 to 1703); 0x74 |
0xD0 (10.0 to 1703); 0xC0 |
MMMOD_WRITER_LISTHEAD MappedFileHeader; |
10.0 and higher |
| 0x94 (10.0 to 1703); 0x8C |
0xF8 (10.0 to 1703); 0xE8 |
BOOLEAN NeedMappedMdl; |
10.0 and higher |
| 0x95 (10.0 to 1703); 0x8D |
0xF9 (10.0 to 1703); 0xE9 |
BOOLEAN NeedPageFileMdl; |
10.0 and higher |
| 0x96 (10.0 to 1703); 0x8E |
0xFA (10.0 to 1703); 0xEA |
BOOLEAN TransitionInserted; |
10.0 and higher |
| 0x98 (10.0 to 1703); 0x90 |
0xFC (10.0 to 1703); 0xEC |
LONG LastModifiedWriteError; |
10.0 and higher |
| 0x9C (10.0 to 1703); 0x94 |
0x0100 (10.0 to 1703); 0xF0 |
LONG LastMappedWriteError; |
10.0 and higher |
| 0xA0 (10.0 to 1703); 0x98 |
0x0104 (10.0 to 1703); 0xF4 |
ULONG volatile MappedFileWriteSucceeded; |
10.0 and higher |
| 0xA4 (10.0 to 1703); 0x9C |
0x0108 (10.0 to 1703); 0xF8 |
ULONG MappedWriteBurstCount; |
10.0 and higher |
| 0xA8 (10.0 to 1703); 0xA0 |
0x010C (10.0 to 1703); 0xFC |
ULONG LowPriorityModWritesOutstanding; |
10.0 and higher |
| 0xAC (10.0 to 1703); 0xA4 |
0x0110 (10.0 to 1703); 0x0100 |
KEVENT BoostModWriteIoPriorityEvent; |
10.0 and higher |
| 0xBC (10.0 to 1703); 0xB4 |
0x0128 (10.0 to 1703); 0x0118 |
LONG ModifiedWriteThreadPriority; |
10.0 and higher |
| 0xC0 (10.0 to 1703); 0xB8 |
0x0130 (10.0 to 1703); 0x0120 |
ULONG_PTR ModifiedPagesLowPriorityGoal; |
10.0 and higher |
| 0xC4 (10.0 to 1703); 0xBC |
0x0138 (10.0 to 1703); 0x0128 |
KEVENT ModifiedPageWriterEvent; |
10.0 and higher |
| 0xD4 (1511 to 1703); 0xCC |
0x0150 (1511 to 1703); 0x0140 |
KEVENT ModifiedWriterExitedEvent; |
1511 and higher |
| 0xD4 (10.0); 0xE4 (1511 to 1703); 0xDC |
0x0150 (10.0); 0x0168 (1511 to 1703); 0x0158 |
LONG volatile WriteAllPagefilePages; |
10.0 and higher |
| 0xD8 (10.0); 0xE8 (1511 to 1703); 0xE0 |
0x0154 (10.0); 0x016C (1511 to 1703); 0x015C |
LONG volatile WriteAllMappedPages; |
10.0 and higher |
| 0xDC (10.0); 0xEC (1511 to 1703); 0xE4 |
0x0158 (10.0); 0x0170 (1511 to 1703); 0x0160 |
KEVENT MappedPageWriterEvent; |
10.0 and higher |
| 0xF0 (10.0); 0x0100 (1511 to 1703); 0xF8 |
0x0170 (10.0); 0x0188 (1511 to 1703); 0x0178 |
MI_MODWRITE_DATA ModWriteData; |
10.0 and higher |
| 0x0120 (10.0); 0x0130 (1511 to 1703); 0x0128 |
0x01B0 (10.0); 0x01C8 (1511 to 1703); 0x01B8 |
KEVENT RescanPageFilesEvent; |
10.0 and higher |
| 0x0130 (10.0); 0x0140 (1511 to 1703); 0x0138 |
0x01C8 (10.0); 0x01E0 (1511 to 1703); 0x01D0 |
MMMOD_WRITER_LISTHEAD PagingFileHeader; |
10.0 and higher |
| 0x0148 (10.0); 0x0158 (1511 to 1703); 0x0150 |
0x01F0 (10.0); 0x0208 (1511 to 1703); 0x01F8 |
ETHREAD *ModifiedPageWriterThread; |
10.0 and higher |
| 0x014C (10.0); 0x015C (1511 to 1703); 0x0154 |
0x01F8 (10.0); 0x0210 (1511 to 1703); 0x0200 |
EX_RUNDOWN_REF ModifiedPageWriterRundown; |
10.0 and higher |
| 0x0150 (10.0); 0x0160 (1511 to 1703); 0x0158 |
0x0200 (10.0); 0x0218 (1511 to 1703); 0x0208 |
WORK_QUEUE_ITEM PagefileScanWorkItem; |
10.0 and higher |
| 0x0160 (10.0); 0x0170 (1511 to 1703); 0x0168 |
0x0220 (10.0); 0x0238 (1511 to 1703); 0x0228 |
ULONG PagefileScanCount; |
10.0 and higher |
| 0x0164 (10.0); 0x0174 (1511 to 1703); 0x016C (1709) |
0x0224 (10.0); 0x023C (1511 to 1703); 0x022C (1709) |
LONG volatile ClusterWritesDisabled [2]; |
10.0 to 1709 |
| 0x016C | 0x022C |
LONG volatile ClusterRestrictionLock; |
1803 and higher |
| 0x0170 | 0x0230 |
MI_RESTRICTED_MODWRITES ClusterRestriction [2]; |
1803 and higher |
| 0x017C (1511 to 1703); 0x0164 (1709); 0x0178 |
0x0248 (1511 to 1703); 0x0238 |
KEVENT NotifyStoreMemoryConditions; |
1511 and higher |
| 0x016C (10.0); 0x018C (1511 to 1703); 0x0184 (1709); 0x0188 |
0x022C (10.0); 0x0260 (1511 to 1703); 0x0250 |
UCHAR volatile DelayedMappedWrite; |
10.0 and higher |
| 0x0170 (10.0); 0x0190 (1511 to 1703); 0x0188 (1709); 0x018C |
0x0230 (10.0); 0x0264 (1511 to 1703); 0x0254 |
ULONG volatile PagefileReservationsEnabled; |
10.0 and higher |
| 0x0174 (10.0); 0x0194 (1511 to 1703); 0x018C (1709); 0x0190 |
0x0238 (10.0); 0x0268 (1511 to 1703); 0x0258 |
EX_PUSH_LOCK PageFileCreationLock; |
10.0 and higher |
| 0x0178 (10.0); 0x0198 (1511 to 1703); 0x0190 (1709); 0x0194 |
0x0240 (10.0); 0x0270 (1511 to 1703); 0x0260 |
WORK_QUEUE_ITEM TrimPagefileWorkItem; |
10.0 and higher |
| 0x0188 (10.0); 0x01A8 (1511 to 1703); 0x01A0 (1709); 0x01A8 |
0x0260 (10.0); 0x0290 (1511 to 1703); 0x0280 |
ULONGLONG LastTrimPagefileTime; |
10.0 and higher |
| 0x0190 (10.0); 0x01B0 (1511 to 1703); 0x01A8 (1709); 0x01B0 |
0x0268 (10.0); 0x0298 1511 to 1703); 0x0288 |
WORK_QUEUE_ITEM WsSwapPagefileContractWorkItem; |
10.0 and higher |
| 0x01A0 (10.0); 0x01C0 (1511 to 1703); 0x01B8 (1709); 0x01C0 |
0x0288 (10.0); 0x02B8 (1511 to 1703); 0x02A8 |
LONG volatile WsSwapPageFileContractionInProgress; |
10.0 and higher |
| 0x01A4 (10.0); 0x01C4 (1511 to 1703); 0x01BC (1709); 0x01C4 |
0x0290 (10.0); 0x02C0 (1511 to 1703); 0x02B0 |
EX_PUSH_LOCK WorkingSetSwapLock; |
10.0 and higher |
| 0x01A8 (10.0); 0x01C8 (1511 to 1703); 0x01C0 (1709); 0x01C8 |
0x0298 (10.0); 0x02C8 (1511 to 1703); 0x02B8 |
LONG volatile WorkingSetInswapLock; |
10.0 and higher |