MI_SYSTEM_INFORMATION

The MI_SYSTEM_INFORMATION structure (formally _MI_SYSTEM_INFORMATION) is not just one of the largest that the kernel works with. It’s also arguably the most important of all structures to know for any kernel-mode debugging of Windows 10 that touches on memory management. The reason is that where earlier Windows versions have numerous internal variables for memory management, all (or most) of them showing plainly when debugging with public symbols, Windows 10 turns very many of them into members of the one internal variable, named MiState, with the side-effect that they show much less plainly. The MI_SYSTEM_INFORMATION is this variable’s type.

Variability

As a collection of what had been internal variables, the MI_SYSTEM_INFORMATION is highly susceptible to changing between builds. Almost all of the change from one build to the next is within substructures. Seen just at the immediate level of the structure’s own members, there have only been one addition, two removals and one relocation (this last to recover ten bytes of alignment space in the 64-bit builds). Still, very few of the members, let alone of members of members, keep their offsets from one build to the next. The following changes of size give a rough indication of the structure’s variability:

It is no accident that the size is always a multiple of 0x40: cache alignment is plainly a consideration for many of the members and substructures.

Layout

The sizes in the preceding table and the names and types in the next are from type information in the public symbol files for the kernel.

MI_POOL_STATE Pools;

MI_SECTION_STATE Sections;

MI_SYSTEM_IMAGE_STATE SystemImages;

MI_SESSION_STATE Sessions;

MI_PROCESS_STATE Processes;

MI_HARDWARE_STATE Hardware;

MI_SYSTEM_VA_STATE SystemVa;

MI_COMBINE_STATE PageCombines;

MI_PAGELIST_STATE PageLists;

MI_PARTITION_STATE Partitions;

MI_SHUTDOWN_STATE Shutdowns;

MI_ERROR_STATE Errors;

MI_ACCESS_LOG_STATE AccessLog;

MI_DEBUGGER_STATE Debugger;

MI_STANDBY_STATE Standby;

MI_SYSTEM_PTE_STATE SystemPtes;

MI_IO_PAGE_STATE IoPages;

MI_PAGING_IO_STATE PagingIo;

MI_COMMON_PAGE_STATE CommonPages;

MI_SYSTEM_TRIM_STATE Trims;

MI_RESAVAIL_TRACKER ResTrack;

MI_ENCLAVE_STATE Enclaves;

ULONG_PTR Cookie;

LONG volatile ZeroingDisabled;

PVOID volatile *BootRegistryRuns;

LONG volatile ZeroingDisabled;

BOOLEAN FullyInitialized;

BOOLEAN SafeBooted;

RTL_BITMAP LargePfnBitMap;

RTL_BITMAP PfnBitMap;

struct _TlgProvider_t const *TraceLogging;

MI_VISIBLE_STATE Vs;