Geoff Chappell, Software Analyst
The MI_PARTITION_CORE structure exists only within an MI_PARTITION. It is 0xE8 or 0x0168 bytes in 32-bit and 64-bit Windows, respectively.
| Offset (x86) | Offset (x64) | Definition |
|---|---|---|
| 0x00 | 0x00 |
USHORT PartitionId; |
| 0x04 | 0x04 |
union {
ULONG LongFlags;
MI_PARTITION_FLAGS Flags;
} u;
|
| 0x08 | 0x08 |
ULONG_PTR ReferenceCount; |
| 0x0C | 0x10 |
MI_PARTITION *ParentPartition; |
| 0x10 | 0x18 |
LIST_ENTRY ListEntry; |
| 0x18 | 0x28 |
MI_NODE_INFORMATION *NodeInformation; |
| 0x1C | 0x30 |
MDL *MdlPhysicalMemoryBlock; |
| 0x20 | 0x38 |
PHYSICAL_MEMORY_DESCRIPTOR *MemoryNodeRuns; |
| 0x24 | 0x40 |
MI_PARTITION_STATISTICS Stats; |
| 0x74 | 0x90 |
PHYSICAL_MEMORY_DESCRIPTOR *MemoryRuns; |
| 0x78 | 0x98 |
KEVENT ExitEvent; |
| 0x88 | 0xB0 |
PVOID SystemThreadHandles [5]; |
| 0x9C | 0xD8 |
PVOID PartitionObject; |
| 0xA0 | 0xE0 |
PVOID PartitionObjectHandle; |
| 0xA4 | 0xE8 |
EX_PUSH_LOCK DynamicMemoryPushLock; |
| 0xA8 | 0xF0 |
LONG volatile DynamicMemoryLock; |
| 0xAC | 0xF8 |
KEVENT TemporaryMemoryEvent; |
| 0xBC | 0x0110 |
KEVENT *MemoryEvents [0x0B]; |
The MI_PARTITION_FLAGS structure is of ULONG bit fields. While the structure seems to be used nowhere else, the bit fields may as well be presented here.
| Mask | Definition |
|---|---|
| 0x00000001 |
ULONG BeingDeleted : 1; |
| 0x00000002 |
ULONG ObjectInitialized : 1; |