Geoff Chappell, Software Analyst
As a feature of the Memory Manager, a memory partition is represented by the MI_PARTITION structure. Exposed through the Object Manager, a partition object is a pointer to an MI_PARTITION.
The MI_PARTITION structure is 0x1740 or 0x25C0 bytes in 32-bit and 64-bit Windows, respectively. Memory partitions are new for Windows 10.
Offset (x86) | Offset (x64) | Definition |
---|---|---|
0x00 | 0x00 |
MI_PARTITION_CORE Core; |
0xE8 | 0x0168 |
MI_PARTITION_MODWRITES Modwriter; |
0x0298 | 0x0410 |
MI_PARTITION_STORES Store; |
0x02E8 | 0x0490 |
MI_PARTITION_SEGMENTS Segments; |
0x03C0 | 0x05C0 |
MI_PARTITION_PAGE_LISTS PageLists; |
0x0A80 | 0x1280 |
MI_PARTITION_COMMIT Commit; |
0x0AA0 | 0x12B8 |
MI_PARTITION_ZEROING Zeroing; |
0x0AD0 | 0x1300 |
MI_PAGE_COMBINING_SUPPORT PageCombine; |
0x0BA8 | 0x1488 |
PVOID WorkingSetControl; |
0x0BAC | 0x1490 |
MM_WORKING_SET_EXPANSION_HEAD WorkingSetExpansionHead; |
0x0BC0 | 0x14C0 |
MI_VISIBLE_PARTITION Vp; |