Geoff Chappell - Software Analyst
The MI_PARTITION_STATE structure (formally _MI_PARTITION_STATE) is known only as the type of the Partitions member of the MI_SYSTEM_INFORMATION, which is in turn the type of the internal kernel variable MiState in Windows 10.
The MI_PARTITION_STATE is highly susceptible to changing between builds, yet has so far changed only by appending new members.
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 10.0 | 0x30 | 0x58 |
| 1511 to 1809 | 0x38 | 0x60 |
| 1903 | 0x38 | 0xC0 |
These sizes and the offsets, names and types in the table below are from type information in the public symbol files for the kernel.
| Offset (x86) | Offset (x64) | Definition | Versions |
|---|---|---|---|
| 0x00 | 0x00 |
ULONG_PTR PartitionLock; |
10.0 and higher |
| 0x04 | 0x08 |
EX_PUSH_LOCK PartitionIdLock; |
10.0 and higher |
| 0x08 | 0x10 |
ULONGLONG InitialPartitionIdBits; |
10.0 and higher |
| 0x10 | 0x18 |
LIST_ENTRY PartitionList; |
10.0 and higher |
| 0x18 | 0x28 |
RTL_BITMAP *PartitionIdBitmap; |
10.0 and higher |
| 0x1C | 0x30 |
RTL_BITMAP InitialPartitionIdBitmap; |
10.0 and higher |
| 0x24 | 0x40 |
MI_PARTITION *TempPartitionPointers [1]; |
10.0 and higher |
| 0x28 | 0x48 |
MI_PARTITION **Partition; |
10.0 and higher |
| 0x2C | 0x50 |
ULONG_PTR TotalPagesInChildPartitions; |
10.0 and higher |
| 0x30 | 0x58 |
ULONG CrossPartitionDenials; |
1511 and higher |
| 0x34 | 0x5C |
BOOLEAN MultiplePartitionsExist; |
1703 and higher |
| 0x60 |
RTL_BITMAP_EX HugeIoPfnBitMap; |
1903 and higher | |
| 0x70 |
MI_HUGE_PFN *HugePfnDatabase; |
1903 and higher | |
| 0x80 |
ULONGLONG HugeRangesLock; |
1903 and higher |
The Partition member is for all practical effect the kernel’s master record of all memory partitions for ready access. Partitions are more often referred to by a 16-bit partition ID which indexes this array.
Note that HugeRangesLock is cache-aligned.