MI_MEMORY_EVENT_TYPES

The MI_MEMORY_EVENT_TYPES enumeration (formally _MI_MEMORY_EVENT_TYPES) looks to have been introduced for Windows 10 to help with supporting memory partitions. What had been internal variables for the kernel’s management of physical memory now had to be reproduced for each partition. They were reworked as members of structures that are nested in the MI_PARTITION. In the particular case of the many separate variables in which the kernel kept pointers to KEVENT objects to signal on the occurrence of corresponding events in memory management, the variables were collected into an array named MemoryEvents in the MI_PARTITION_CORE. The MI_MEMORY_EVENT_TYPES indexes this array.

The KEVENT structure for each of these events is not merely a kernel object such as might be referenced by any kernel-mode software that learns the address. Instead, these events are Object Manager objects which can be opened by name (subject to security), including by user-mode software. It’s almost as if much of the point to the memory events is that they are accessible to user-mode software such as may alert the user (or system administrator) at notable moments in the use of memory. Yet Microsoft documents the events only as Standard Event Objects for drivers to use—and even then does not document the last two. There must be other documentation to find—or more to write about these events!