Geoff Chappell, Software Analyst
The MI_VISIBLE_PARTITION structure exists only as a component of the MI_PARTITION. It is 0x0B80 or 0x1100 bytes in 32-bit and 64-bit Windows, respectively.
Offset (x86) | Offset (x64) | Definition |
---|---|---|
0x00 | 0x00 |
ULONG_PTR LowestPhysicalPage; |
0x04 | 0x08 |
ULONG_PTR HighestPhysicalPage; |
0x08 | 0x10 |
ULONG_PTR NumberOfPhysicalPages; |
0x0C | 0x18 |
ULONG volatile NumberOfPagingFiles; |
0x10 | 0x20 |
MMPAGING_FILE *PagingFile [0x10]; |
0x80 | 0xC0 |
ULONG_PTR volatile AvailablePages; |
0xC0 | 0x0100 |
ULONG_PTR volatile ResidentAvailablePages; |
0xC4 | 0x0108 |
ULONG_PTR volatile TotalCommittedPages; |
0x0100 | 0x0140 |
MMPFN_LIST ModifiedPageListHead; |
0x0140 | 0x0180 |
MMPFN_LIST ModifiedNoWritePageListHead; |
0x0154 | 0x01A8 |
ULONG_PTR TotalCommitLimit; |
0x0158 | 0x01B0 |
ULONG_PTR TotalPagesForPagingFile; |
0x015C | 0x01B8 |
ULONG_PTR VadPhysicalPages; |
0x0160 | 0x01C0 |
ULONG_PTR ProcessLockedFilePages; |
0x0164 | 0x01C8 |
ULONG ChargeCommitmentFailures [4]; |
0x01D8 |
ULONG_PTR volatile PageTableBitmapPages; |
|
0x0174 | 0x01E0 |
LONG volatile PageFileTraceIndex; |
0x0178 | 0x01E8 |
MI_PAGEFILE_TRACES PageFileTraces; |
By itself, the MI_PAGEFILE_TRACES structure at the end, being just 0x50 or 0x78 bytes, would bring the MI_VISIBLE_PARTITION to 0x01C8 or 0x0260 bytes. How, exactly, the MI_VISIBLE_PARTITION ends up so very much larger does not seem to be knowable from the type information in the symbol file.