MI_USER_VA_INFO

The MI_USER_VA_INFO looks to have been introduced to tidy the MMWSL for Windows 8. An assortment of MMWSL members, some long-standing and some very large, were collected into the new structure as a new member named UserVaInfo at the end of the MMWSL. The splitting of the MMWSL for the 1607 release of Windows 10, into an MMWSL_INSTANCE and MMWSL_SHARED, also split off the MI_USER_VA_INFO.

Variability

As an internal structure with little, if any, visibility outside the kernel, the MI_USER_VA_INFO varies greatly between versions and even between builds.

Version Size (x86) Size (x64)
6.2 0x0CFC 0x0478
6.3 0x0D1C 0x0128
10.0 0x0D20 0x0108
1511 0x0D48 0x0158
1607 0x0D50 0x0170

Layout

These sizes, and the names, offsets and types in the tables that follow, are from Microsoft’s symbol files for the kernel.

Offset (x86) Offset (x64) Definition Versions Remarks
0x00 0x00
ULONG NumberOfCommittedPageTables;
6.2 to 1511 previously at 0x20 and 0x28 in MMWSL
0x04 (6.2 to 6.3) 0x04 (6.2 to 6.3)
ULONG PhysicalMappingCount;
6.2 to 6.3 next at 0x24 and 0x28
0x04 0x08
PVOID HighestTopDownAllocationAddress;
1511 only previously at 0x34 and 0x48
0x08 (6.2 to 6.3);
0x04 (10.0)
0x08 (6.2 to 6.3);
0x04 (10.0)
ULONG VadBitMapHint;
6.2 to 10.0 previously at 0x24 and 0x2C in MMWSL
0x0C (6.2 to 6.3);
0x08 (10.0)
0x0C (6.2 to 6.3);
0x08 (10.0)
ULONG LastAllocationSizeHint;
6.2 to 10.0 previously at 0x34 and 0x3C in MMWSL
0x10 (6.2 to 6.3);
0x0C (10.0)
0x10 (6.2 to 6.3);
0x0C (10.0)
ULONG LastAllocationSize;
6.2 to 10.0 previously at 0x38 and 0x40 in MMWSL
0x14 (6.2 to 6.3);
0x10 (10.0)
0x14 (6.2 to 6.3);
0x10 (10.0)
ULONG LowestBottomUpVaHint;
6.2 to 10.0  
0x18 (6.2 to 6.3);
0x14 (10.0)
0x18 (6.2 to 6.3);
0x14 (10.0)
ULONG VadBitMapSize;
6.2 to 10.0  
0x08 0x10
MI_VAD_ALLOCATION_CELL VadCell [2];
1511 only  
0x1C (6.3);
0x18 (10.0);
0x40
0x1C (6.3);
0x18 (10.0);
0x60
ULONG VadBitMapCommitment;
6.3 to 1511  
0x1C (6.2);
0x20 (6.3);
0x1C (10.0);
0x44
0x1C (6.2);
0x20 (6.3);
0x1C (10.0);
0x64
ULONG MaximumLastVadBit;
6.2 to 1511 previously at 0x30 and 0x38 in MMWSL
0x20 (6.2);
0x24 (6.3);
0x20 (10.0);
0x48
0x20 (6.2);
0x24 (6.3);
0x20 (10.0);
0x68
LONG VadsBeingDeleted;
6.2 to 1511  
0x4C 0x6C
LONG NumberOfDebugEnclaves;
1511 only  
0x24 (10.0);
0x50
0x28 (10.0);
0x70
ULONG_PTR PhysicalMappingCount;
10.0 to 1511 previously at 0x04
0x24 (6.2);
0x28 (6.3 to 10.0);
0x54
0x28 (6.2 to 6.3);
0x30 (10.0);
0x78
KEVENT *LastVadDeletionEvent;
6.2 to 1511  
0x28 (6.2);
0x2C (6.3 to 10.0)
0x30 (6.2 to 6.3);
0x38 (10.0)
ULONG *VadBitBuffer;
6.2 to 10.0  
0x2C (6.2);
0x30 (6.3 to 10.0)
0x38 (6.2 to 6.3);
0x40 (10.0)
PVOID LowestBottomUpAllocationAddress;
6.2 to 10.0  
0x30 (6.2);
0x34 (6.3 to 10.0)
0x40 (6.2 to 6.3);
0x48 (10.0)
PVOID HighestTopDownAllocationAddress;
6.2 to 10.0 next at 0x04 and 0x08
0x34 (6.2);
0x38 (6.3 to 10.0)
0x48 (6.2 to 6.3);
0x50 (10.0)
PVOID FreeTebHint;
6.2 to 10.0  
0x58 0x80
LIST_ENTRY SubVadRanges [1];
1511 only (x86)  
LIST_ENTRY SubVadRanges [3];
1511 only (x64)  
0x3C (6.3 to 10.0);
0x60
0x50 (6.3);
0x58 (10.0);
0xB0
BOOLEAN NumaAware;
6.3 to 1511  
0x40 (10.0);
0x68
0x60 (10.0);
0xB8
ULONGLONG CloneNestingLevel;
10.0 to 1511  
0x38 (6.2);
0x40 (6.3);
0x48 (10.0);
0x70
0x50 (6.2);
0x58 (6.3);
0x68 (10.0);
0xC0
ULONG_PTR PrivateFixupVadCount;
6.2 to 1511  
  0x58 (6.2)
PVOID FreeUmsTebHint;
6.2 only next at 0x0120
0x44 (6.3);
0x4C (10.0);
0x74
0x60 (6.3);
0x70 (10.0);
0xC8
MI_CFG_BITMAP_INFO CfgBitMap [CfgBitMapMax - 1];
6.3 to 1511  
0x54 (6.3);
0x58 (10.0);
0x80
0xC0 (6.3);
0xA0 (10.0);
0xF8
ULONG CommittedPageTableBufferForTopLevel [0x30];
6.3 to 1511 (x86)  
ULONG CommittedPageTableBufferForTopLevel [8];
6.3 to 1511 (x64)  
0x0114 (6.3);
0x0118 (10.0);
0x0140
0xE0 (6.3);
0xC0 (10.0);
0x0118
RTL_BITMAP CommittedPageTableBitmaps [1];
6.3 to 1511 (x86)  
RTL_BITMAP CommittedPageTableBitmaps [3];
10.0 to 1511 (x64)  
0x3C (6.2);
0x011C (6.3);
0x0120 (10.0);
0x0148
 
USHORT UsedPageTableEntries [0x0600];
6.2 to 1511 previously at 0x48 in MMWSL
0x0C3C (6.2) 0x60 (6.2)
ULONG CommittedPageTables [0x30];
6.2 only (x86) previously at 0x0C48 in MMWSL
ULONG *CommittedPageTables;
6.2 only (x64) previously at 0x68 in MMWSL
  0x68 (6.2);
0x0110 (6.3);
0xF0 (10.0);
0x0148
ULONG PageTableBitmapPages;
6.2 only  
ULONG PageTableBitmapPages [3];
10.0 to 1511  
  0x70
ULONGLONG CommitedPageDirectories [0x80];
6.2 only previously at 0x78 in MMWSL
  0x0470
ULONGLONG CommitedPageDirectoryParents [1];
6.2 only previously at 0x0480 in MMWSL
  0x0120 (6.3);
0x0100
PVOID FreeUmsTebHint;
6.3 to 10.0 previously at 0x58

The CfgBitMap member is indexed by the MI_CFG_BITMAP_TYPE enumeration. Its first element is for native addressing. This is the only element in 32-bit Windows but 64-bit Windows has a second for the 32-bit address space of WOW64 processes.