Geoff Chappell - Software Analyst
The MI_PARTITION_STORES structure (formally _MI_PARTITION_STORES) is here thought to exist only as a subdivision of the MI_PARTITION, specifically as the latter’s Store member.
The MI_PARTITION_STORES is highly susceptible to changing between builds. The following changes of size give some rough indication of the variability so far:
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 10.0 to 1511 | 0x50 | 0x80 |
| 1607 | 0x58 | 0x90 |
| 1703 | 0x58 | 0x80 |
| 1709 | 0x58 | 0x90 |
| 1803 to 2004 | 0x60 | 0x90 |
The sizes in the preceding table and the offsets, names and types in the next are from type information in public symbol files for the kernel.
| Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
|---|---|---|---|---|
| 0x00 | 0x00 |
union {
struct {
LONG FlushCompleting : 1;
LONG FlushInProgress : 31;
};
LONG volatile Long;
} WriteAllStoreHintedPages;
|
10.0 and higher | |
| 0x04 | 0x04 |
ULONG VirtualPageFileNumber; |
10.0 and higher | |
| 0x08 | 0x08 |
ULONG Registered; |
10.0 and higher | |
| 0x0C | 0x0C |
ULONG ReadClusterSizeMax; |
10.0 and higher | |
| 0x10 | 0x10 |
ULONG EvictFlushRequestcount; |
10.0 and higher | |
| 0x14 | 0x14 |
ULONG ModifiedWriteDisableCount; |
10.0 and higher | |
| 0x18 | 0x18 |
ULONG WriteIssueFailures; |
10.0 and higher | |
| 0x1C | 0x1C |
ULONG WritesOutstanding; |
1709 and higher | |
| 0x1C (1703); 0x20 |
0x1C (1703); 0x20 |
LONG volatile EvictFlushLock; |
1703 and higher | previously at 0x48 and 0x70 |
| 0x1C (10.0 to 1607); 0x20 (1703); 0x24 |
0x20 (10.0 to 1703); 0x28 |
ETHREAD *EvictionThread; |
10.0 and higher | |
| 0x20 (10.0 to 1607); 0x24 (1703); 0x28 |
0x28 (10.0 to 1703); 0x30 |
KEVENT EvictEvent; |
10.0 and higher | |
| 0x30 (10.0 to 1607) | 0x40 (10.0 to 1607) |
KEVENT EvictFlushCompleteEvent; |
10.0 to 1607 | next at 0x40 and 0x50 |
| 0x40 (10.0 to 1607); 0x38 |
0x60 (10.0 to 1607); 0x40 (1703); 0x50 |
SLIST_HEADER WriteSupportSListHead; |
10.0 and higher | |
| 0x48 (10.0 to 1607) | 0x70 (10.0 to 1607) |
LONG volatile EvictFlushLock; |
10.0 to 1607 | next at 0x1C |
| 0x40 | 0x50 (1703); 0x60 |
KEVENT EvictFlushCompleteEvent; |
1703 and higher | previously at 0x30 and 0x40 |
| 0x4C (10.0 to 1607); 0x50 |
0x78 (10.0 to 1607); 0x68 (1703); 0x78 |
RTL_BITMAP *ModifiedWriteFailedBitmap; |
10.0 and higher | |
| 0x50 (10.0 to 1607); 0x54 |
0x80 (1607); 0x70 (1703); 0x80 |
EPROCESS *StoreProcess; |
1607 and higher | |
| 0x58 | 0x88 |
ULONG DeleteStoredPages; |
1803 and higher |