Geoff Chappell - Software Analyst
The MI_VISIBLE_PARTITION structure (formally _MI_VISIBLE_PARTITION) is here thought to exist only as the Vp member of an MI_PARTITION.
As a collection of what had been internal variables, the MI_VISIBLE_PARTITION is highly susceptible to changing between builds. The following changes of size give some rough indication:
| Version | Size (x86) | Size (x64) |
|---|---|---|
| 10.0 to 1511 | 0x0B80 | 0x1100 |
| 1607 | 0x0CC0 | 0x1380 |
| 1703 to 1709 | 0x0C40 | 0x1200 |
| 1803 to 2004 | 0x0C00 | 0x1200 |
The sizes in the preceding table and the names and types in the next are from type information in public symbol files for the kernel.
| Offset (x86) | Offset (x64) | Definition | Versions | Remarks |
|---|---|---|---|---|
| 0x00 | 0x00 |
ULONG_PTR LowestPhysicalPage; |
10.0 and higher | |
| 0x04 | 0x08 |
ULONG_PTR HighestPhysicalPage; |
10.0 and higher | |
| 0x08 | 0x10 |
ULONG_PTR NumberOfPhysicalPages; |
10.0 and higher | |
| 0x0C | 0x18 |
ULONG volatile NumberOfPagingFiles; |
10.0 and higher | |
| 0x10 | 0x1C |
BOOLEAN SystemCacheInitialized; |
1703 and higher | previously at 0x0238 and 0x03A0 |
| 0x10 (10.0 to 1607); 0x14 |
0x20 |
MMPAGING_FILE *PagingFile [0x10]; |
10.0 and higher | |
| 0x80 | 0xC0 |
ULONG_PTR volatile AvailablePages; |
10.0 and higher | |
| 0xC0 | 0x0100 |
ULONG_PTR volatile ResidentAvailablePages; |
10.0 and higher | |
| 0x0100 | 0x0140 |
MMSUPPORT_INSTANCE PartitionWs [1]; |
1607 and higher | |
| 0x0164 (1607); 0x0168 (1703 to 1709); 0x0164 |
0x0200 (1607); 0x0208 (1703 to 1709); 0x0200 |
MMWSL_INSTANCE PartitionWorkingSetLists [1]; |
1607 and higher | |
| 0x0238 (1607) | 0x03A0 |
BOOLEAN SystemCacheInitialized; |
1607 only | next at 0x10 and 0x1C |
| 0xC4 (10.0 to 1511); 0x023C (1607); 0x0180 (1703 to 1709); 0x017C |
0x0108 (10.0 to 1511); 0x03A8 (1607); 0x0230 (1703 to 1709); 0x0228 |
ULONG_PTR volatile TotalCommittedPages; |
10.0 and higher | |
| 0x0100 (10.0 to 1511); 0x0240 (1607); 0x01C0 (1703 to 1709); 0x0180 |
0x0140 (10.0 to 1511); 0x03C0 (1607); 0x0240 |
MMPFN_LIST ModifiedPageListHead; |
10.0 and higher | |
| 0x0140 (10.0 to 1511); 0x0280 (1607); 0x0200 (1703 to 1709); 0x01C0 |
0x0180 (10.0 to 1511); 0x0400 (1607); 0x0280 |
MMPFN_LIST ModifiedNoWritePageListHead; |
10.0 and higher | |
| 0x0154 (10.0 to 1511); 0x0294 (1607); 0x0214 (1703 to 1709); 0x01D4 |
0x01A8 (10.0 to 1511); 0x0428 (1607); 0x02A8 |
ULONG_PTR TotalCommitLimit; |
10.0 and higher | |
| 0x0158 (10.0 to 1511); 0x0298 (1607); 0x0218 (1703 to 1709); 0x01D8 |
0x01B0 (10.0 to 1511); 0x0430 (1607); 0x02B0 |
ULONG_PTR TotalPagesForPagingFile; |
10.0 and higher | |
| 0x015C (10.0 to 1511); 0x029C (1607); 0x021C (1703 to 1709); 0x01DC |
0x01B8 (10.0 to 1511); 0x0438 (1607); 0x02B8 |
ULONG_PTR VadPhysicalPages; |
10.0 and higher | |
| 0x0160 (10.0 to 1511); 0x02A0 (1607); 0x0220 (1703 to 1709); 0x01E0 |
0x01C0 (10.0 to 1511); 0x0440 (1607); 0x02C0 |
ULONG_PTR ProcessLockedFilePages; |
10.0 and higher | |
| 0x0224 (1703 to 1709); 0x01E4 |
0x02C8 |
ULONG_PTR volatile SharedCommit; |
1703 and higher | |
| 0x01E8 | 0x02D0 |
ULONG_PTR SlabAllocatorPages; |
1809 and higher | |
| 0x0164 (10.0 to 1511); 0x02A4 (1607); 0x0228 (1703 to 1709); 0x01E8 (1803); 0x01EC |
0x01C8 (10.0 to 1511); 0x0448 (1607); 0x02D0 (1703 to 1803); 0x02D8 |
ULONG ChargeCommitmentFailures [4]; |
10.0 and higher | |
| 0x01D8 (10.0 to 1511); 0x0458 (1607) |
ULONG_PTR volatile PageTableBitmapPages; |
10.0 to 1607 | ||
| 0x0174 (10.0 to 1511); 0x02B4 (1607); 0x0238 (1703 to 1709); 0x01F8 (1803); 0x01FC |
0x01E0 (10.0 to 1511); 0x0460 (1607); 0x02E0 (1703 to 1803); 0x02E8 |
LONG volatile PageFileTraceIndex; |
10.0 and higher | |
| 0x0178 (10.0 to 1511); 0x02B8 (1607); 0x0240 (1703 to 1709); 0x0200 |
0x01E8 (10.0 to 1511); 0x0468 (1607); 0x02E8 (1703 to 1803); 0x02F0 |
MI_PAGEFILE_TRACES PageFileTraces [0x0200]; |
10.0 and higher |