MI_USER_VA_INFO

The MI_USER_VA_INFO structure (formally _MI_USER_VA_INFO) is a vital part of the implementation of the Working Set List (WSL) in Windows 8 and higher. Indeed, it’s the largest and most complex of all the implementation’s structures. Some measure of its importance as an implementation detail—or its deserved obscurity, depending on perspective—is that the MI_USER_VA_INFO disappears entirely from Microsoft’s public symbol files for the 1607 release of Windows 10, and is not known in any since.

History

From all the way back at Windows NT 3.1, the Working Set List is modelled by the MMWSL structure. Each process has one, pointed to by the VmWorkingSetList member of the MMSUPPORT that’s nested in the EPROCESS as the latter’s Vm member.

The MI_USER_VA_INFO looks to have been introduced to tidy the implementation of the Working Set List in Windows 8. An assortment of MMWSL members, some long-standing and some very large, were collected into the new structure as a new member named UserVaInfo at the end of the MMWSL. The splitting of the MMWSL for the 1607 release of Windows 10, into an MMWSL_INSTANCE and MMWSL_SHARED, also split off the MI_USER_VA_INFO: it is not nested in either. Better, perhaps, would be to say the MMWSL was split in three.

In the 1607 release itself, the MI_USER_VA_INFO precedes the MMWSL_FULL (which in turn has the Instance and Shared parts). All these parts of the Working Set List are in hyperspace, as for earlier versions. For 32-bit Windows, hyperspace continues to have the fixed address 0xC0800000 and the MI_USER_VA_INFO has the fixed address 0xC0802000. For 64-bit Windows, however, the 1607 release allows that hyperspace can vary. What can be said in common about the positioning of the MI_USER_VA_INFO is that it has a fixed offset into hyperspace: 0x2000 and 0x10804000 bytes in 32-bit and 64-bit Windows, respectively.

The 1703 release reverses the order: the MI_USER_VA_INFO begins immediately where the MMWSL_INSTANCE ends. Neither is in hyperspace. Both are instead in one allocation of non-paged pool. The MMWSL_INSTANCE at its start is pointed to from the VmWorkingSetList member of the MMSUPPORT_FULL structure that is embedded in the EPROCESS as its Vm member.

Variability

As an internal structure with little, if any, visibility outside the kernel, the MI_USER_VA_INFO varies greatly between versions and even between builds. The following changes of size give a rough measure of this variability so far:

The size for the 1607 release of 64-bit Windows is uncertain. The kernel’s own use that is yet known reaches up to but not including offset 0x0164. With 8-byte alignment the structure then is 0x0168 bytes. But the MMWSL_FULL that follows the structure is at offset 0x0170. In the difference may be use that is not yet accounted for. What is here thought more likely is that the MMWSL_FULL has 16-byte alignment, apparently picked up from its nesting of MMWSL_SHARED.

Layout

These sizes, and the offsets, names and types in the tables that follow, are from Microsoft’s symbol files for the kernel from version 6.2 up to and includng the 1511 release of Windows 10. What’s known for later versions is something of a guess, or at least a work in progress, pending discovery of type information in public symbol files (or some similarly authoritative but public disclosure).

ULONG NumberOfCommittedPageTables;

ULONG PhysicalMappingCount;

ULONG VadBitMapHint;

ULONG LastAllocationSizeHint;

ULONG LastAllocationSize;

ULONG LowestBottomUpVadBit;

ULONG VadBitMapSize;

PVOID HighestTopDownAllocationAddress;

MI_VAD_ALLOCATION_CELL VadCell [MiVadAllocationCellMaximum];

ULONG VadBitMapCommitment;

ULONG_PTR VadBitMapCommitment;

ULONG MaximumLastVadBit;

LONG VadsBeingDeleted;

LONG NumberOfDebugEnclaves;

ULONG_PTR PhysicalMappingCount;

KEVENT *LastVadDeletionEvent;

ULONG *VadBitBuffer;

PVOID LowestBottomUpAllocationAddress;

PVOID HighestTopDownAllocationAddress;

PVOID FreeTebHint;

LIST_ENTRY SubVadRanges [1];

LIST_ENTRY SubVadRanges [2];

LIST_ENTRY SubVadRanges [1];

LIST_ENTRY SubVadRanges [3];

LIST_ENTRY SubVadRanges [4];

LIST_ENTRY SubVadRanges [2];

BOOLEAN NumaAware;

ULONGLONG CloneNestingLevel;

ULONG_PTR PrivateFixupVadCount;

PVOID FreeUmsTebHint;

MI_CFG_BITMAP_INFO CfgBitMap [CfgBitMapMax - 1];

ULONG CommittedPageTableBufferForTopLevel [0x30];

ULONG CommittedPageTableBufferForTopLevel [8];

RTL_BITMAP CommittedPageTableBitmaps [1];

RTL_BITMAP CommittedPageTableBitmaps [3];

RTL_BITMAP_EX CommittedPageTableBitmaps [3];

USHORT UsedPageTableEntries [0x0600]; [0x0600];

ULONG CommittedPageTables [0x30];

ULONG *CommittedPageTables;

ULONG PageTableBitmapPages;

ULONG PageTableBitmapPages [3];

ULONGLONG CommitedPageDirectories [0x80];

ULONGLONG CommitedPageDirectoryParents [1];

PVOID FreeUmsTebHint;

The CfgBitMap member is indexed by the MI_CFG_BITMAP_TYPE enumeration. Its first element is for native addressing. This is the only element in 32-bit Windows but 64-bit Windows has a second for the 32-bit address space of WOW64 processes.