Geoff Chappell, Software Analyst
The MI_VISIBLE_PARTITION structure exists only as a component of the MI_PARTITION. It is 0x0B80 or 0x1100 bytes in 32-bit and 64-bit Windows, respectively.
| Offset (x86) | Offset (x64) | Definition |
|---|---|---|
| 0x00 | 0x00 |
ULONG_PTR LowestPhysicalPage; |
| 0x04 | 0x08 |
ULONG_PTR HighestPhysicalPage; |
| 0x08 | 0x10 |
ULONG_PTR NumberOfPhysicalPages; |
| 0x0C | 0x18 |
ULONG volatile NumberOfPagingFiles; |
| 0x10 | 0x20 |
MMPAGING_FILE *PagingFile [0x10]; |
| 0x80 | 0xC0 |
ULONG_PTR volatile AvailablePages; |
| 0xC0 | 0x0100 |
ULONG_PTR volatile ResidentAvailablePages; |
| 0xC4 | 0x0108 |
ULONG_PTR volatile TotalCommittedPages; |
| 0x0100 | 0x0140 |
MMPFN_LIST ModifiedPageListHead; |
| 0x0140 | 0x0180 |
MMPFN_LIST ModifiedNoWritePageListHead; |
| 0x0154 | 0x01A8 |
ULONG_PTR TotalCommitLimit; |
| 0x0158 | 0x01B0 |
ULONG_PTR TotalPagesForPagingFile; |
| 0x015C | 0x01B8 |
ULONG_PTR VadPhysicalPages; |
| 0x0160 | 0x01C0 |
ULONG_PTR ProcessLockedFilePages; |
| 0x0164 | 0x01C8 |
ULONG ChargeCommitmentFailures [4]; |
| 0x01D8 |
ULONG_PTR volatile PageTableBitmapPages; |
|
| 0x0174 | 0x01E0 |
LONG volatile PageFileTraceIndex; |
| 0x0178 | 0x01E8 |
MI_PAGEFILE_TRACES PageFileTraces; |
By itself, the MI_PAGEFILE_TRACES structure at the end, being just 0x50 or 0x78 bytes, would bring the MI_VISIBLE_PARTITION to 0x01C8 or 0x0260 bytes. How, exactly, the MI_VISIBLE_PARTITION ends up so very much larger does not seem to be knowable from the type information in the symbol file.