MI_PARTITION_STATE

The MI_PARTITION_STATE structure is known only as the type of the Partitions member of the MI_SYSTEM_INFORMATION, which is in turn the type of the internal kernel variable MiState in Windows 10.

The MI_PARTITION_STATE is highly susceptible to changing between builds, yet has so far changed only by appending new members.

Version Size (x86) Size (x64)
10.0 0x30 0x58
1511 to 1803 0x38 0x60

These sizes and the names and types in the table below are from type information in the public symbol files for the kernel.

Offset (x86) Offset (x64) Definition Versions
0x00 0x00
ULONG_PTR PartitionLock;
10.0 and higher
0x04 0x08
EX_PUSH_LOCK PartitionIdLock;
10.0 and higher
0x08 0x10
ULONGLONG InitialPartitionIdBits;
10.0 and higher
0x10 0x18
LIST_ENTRY PartitionList;
10.0 and higher
0x18 0x28
RTL_BITMAP *PartitionIdBitmap;
10.0 and higher
0x1C 0x30
RTL_BITMAP InitialPartitionIdBitmap;
10.0 and higher
0x24 0x40
MI_PARTITION *TempPartitionPointers [1];
10.0 and higher
0x28 0x48
MI_PARTITION **Partition;
10.0 and higher
0x2C 0x50
ULONG_PTR TotalPagesInChildPartitions;
10.0 and higher
0x30 0x58
ULONG CrossPartitionDenials;
1511 and higher
0x34 0x5C
BOOLEAN MultiplePartitionsExist;
1703 and higher

The Partition member is for all practical effect the kernel’s master record of all memory partitions for ready access. Partitions are more often referred to by a 16-bit partition ID which indexes this array.