Geoff Chappell, Software Analyst
The MI_PARTITION_CORE structure exists only within an MI_PARTITION. It is 0xE8 or 0x0168 bytes in 32-bit and 64-bit Windows, respectively.
Offset (x86) | Offset (x64) | Definition |
---|---|---|
0x00 | 0x00 |
USHORT PartitionId; |
0x04 | 0x04 |
union { ULONG LongFlags; MI_PARTITION_FLAGS Flags; } u; |
0x08 | 0x08 |
ULONG_PTR ReferenceCount; |
0x0C | 0x10 |
MI_PARTITION *ParentPartition; |
0x10 | 0x18 |
LIST_ENTRY ListEntry; |
0x18 | 0x28 |
MI_NODE_INFORMATION *NodeInformation; |
0x1C | 0x30 |
MDL *MdlPhysicalMemoryBlock; |
0x20 | 0x38 |
PHYSICAL_MEMORY_DESCRIPTOR *MemoryNodeRuns; |
0x24 | 0x40 |
MI_PARTITION_STATISTICS Stats; |
0x74 | 0x90 |
PHYSICAL_MEMORY_DESCRIPTOR *MemoryRuns; |
0x78 | 0x98 |
KEVENT ExitEvent; |
0x88 | 0xB0 |
PVOID SystemThreadHandles [5]; |
0x9C | 0xD8 |
PVOID PartitionObject; |
0xA0 | 0xE0 |
PVOID PartitionObjectHandle; |
0xA4 | 0xE8 |
EX_PUSH_LOCK DynamicMemoryPushLock; |
0xA8 | 0xF0 |
LONG volatile DynamicMemoryLock; |
0xAC | 0xF8 |
KEVENT TemporaryMemoryEvent; |
0xBC | 0x0110 |
KEVENT *MemoryEvents [0x0B]; |
The MI_PARTITION_FLAGS structure is of ULONG bit fields. While the structure seems to be used nowhere else, the bit fields may as well be presented here.
Mask | Definition |
---|---|
0x00000001 |
ULONG BeingDeleted : 1; |
0x00000002 |
ULONG ObjectInitialized : 1; |