SYSTEM_POOL_INFORMATION

The SYSTEM_POOL_INFORMATION structure is what a successful call to ZwQuerySystemInformation or NtQuerySystemInformation produces in its output buffer when given the information classes SystemPagedPoolInformation (0x0E) and SystemNonPagedPoolInformation (0x0F).

These information classes are not implemented in any known Windows version, at least not in retail builds.

Documentation Status

The SYSTEM_POOL_INFORMATION structure is not documented.

Layout

The SYSTEM_POOL_INFORMATION is 0x1C or 0x28 bytes in 32-bit and 64-bit Windows, respectively.

Offset (x86) Offset (x64) Definition
0x00 0x00
ULONG_PTR TotalSize;
0x04 0x08
PVOID FirstEntry;
0x08 0x10
USHORT EntryOverhead;
0x0A 0x12
BOOLEAN PoolTagPresent;
0x0B 0x13
UCHAR Spare0;
0x0C 0x14
ULONG NumberOfEntries;
0x10 0x18
SYSTEM_POOL_ENTRY Entries [ANYSIZE_ARRAY];

The SYSTEM_POOL_ENTRY structure is 0x0C or 0x10 bytes in 32-bit and 64-bit Windows, respectively. While it seems to be used nowhere else, it may as well be presented here:

Offset Definition
0x00
BOOLEAN Allocated;
0x01
UCHAR Spare0;
0x02
USHORT AllocatorBackTraceIndex;
0x04
ULONG Size;
0x08
union {
    UCHAR Tag [4];
    ULONG TagUlong;
    PVOID ProcessChargedQuota
};