SYSTEM_FILECACHE_INFORMATION

The SYSTEM_FILECACHE_INFORMATION structure is produced as output by the functions ZwQuerySystemInformation or NtQuerySystemInformation when given any of the information classes

The first two are also acceptable as input to the functions ZwSetSystemInformation or NtSetSystemInformation.

The information classes select different Working Sets to operate on: the System Cache for the first two, the Paged Pool and the System PTEs for the second two.

Documentation Status

The SYSTEM_FILECACHE_INFORMATION structure is not documented.

Layout

The SYSTEM_FILECACHE_INFORMATION is 0x24 or 0x40 bytes in 32-bit and 64-bit Windows, respectively.

Offset (x86) Offset (x64) Definition
0x00 0x00
ULONG_PTR CurrentSize;
0x04 0x08
ULONG_PTR PeakSize;
0x08 0x10
ULONG PageFaultCount;
0x0C 0x18
ULONG_PTR MinimumWorkingSet;
0x10 0x20
ULONG_PTR MaximumWorkingSet;
0x14 0x28
ULONG_PTR CurrentSizeIncludingTransitionInPages;
0x18 0x30
ULONG_PTR PeakSizeIncludingTransitionInPages;
0x1C 0x38
ULONG TransitionRePurposeCount;
0x20 0x3C
ULONG Flags;

When this structure is used for setting system information, only MinimumWorkingSet, MaximumWorkingSet and Flags matter. The Flags matter only for SystemFileCacheInformationEx. For SystemFileCacheInformation, the Flags are treated as zero. The valid bits in the Flags are defined in WINNT.H and are documented for SetProcessWorkingSetSizeEx:

Mask Symbolic Name
0x00000001 QUOTA_LIMITS_HARDWS_MIN_ENABLE
0x00000002 QUOTA_LIMITS_HARDWS_MIN_DISABLE
0x00000004 QUOTA_LIMITS_HARDWS_MAX_ENABLE
0x00000008 QUOTA_LIMITS_HARDWS_MAX_DISABLE