#ifndef _NTPFAPI_H
// begin_private

// rev
typedef struct _PF_VIRTUAL_QUERY
{
    ULONG Version;
    union
    {
        ULONG Flags;
        struct
        {
            /*
             * Fault page-table state in for the queried user VAs.
             * From MiWorkingSetInfoCheckPageTable, when the queried user address has a leaf PTE that is in transition or non-present with a paging-file offset,
             * this takes the MiMakeSystemAddressValid path to make the backing page-table state resident before retrying the query.
             * Use this for ordinary committed user pages when you want page-table faults resolved rather than merely reported.
             * Mutually exclusive with ReportPageTables.
             */
            ULONG FaultInPageTables : 1;
            /*
             * Report page-table-related state for the queried user VAs in the returned MEMORY_WORKING_SET_EX_INFORMATION entries.
             * From MiWorkingSetInfoCheckPageTable, this produces PageTable = 1 when the queried user address has a leaf PTE that is in transition or non-present with a paging-file offset,
             * i.e. ordinary committed user pages after trimming/page-out. Mutually exclusive with FaultInPageTables.
             */
            ULONG ReportPageTables : 1;
            ULONG Spare : 30;
        };
    };
    PVOID QueryBuffer; // MEMORY_WORKING_SET_EX_INFORMATION[NumberOfPages] (input: VirtualAddress[], output: VirtualAttributes[])
    SIZE_T QueryBufferSize; // NumberOfPages * sizeof(MEMORY_WORKING_SET_EX_INFORMATION)
    HANDLE ProcessHandle;
} PF_VIRTUAL_QUERY, *PPF_VIRTUAL_QUERY;

// end_private
#endif
View code on GitHub