#ifndef _NTPFAPI_H

/**
 * The PF_VIRTUAL_QUERY structure queries extended working-set information for a process.
 */
typedef struct _PF_VIRTUAL_QUERY
{
    ULONG Version;                              // Request version: PF_VIRTUAL_QUERY_VERSION (1).
    union
    {
        ULONG Flags;                            // Mutually exclusive page-table options; valid mask 0x3.
        struct
        {
            ULONG FaultInPageTables : 1;        // Fault page-table state in for the queried user VAs.
            ULONG ReportPageTables : 1;         // Report page-table-related state for the queried user VAs in the returned MEMORY_WORKING_SET_EX_INFORMATION entries.
            ULONG Spare : 30;                   // Reserved field; initialize to zero and do not interpret on output.
        };
    };
    PVOID QueryBuffer;                          // MEMORY_WORKING_SET_EX_INFORMATION[NumberOfPages] (input: VirtualAddress[], output: VirtualAttributes[])
    SIZE_T QueryBufferSize;                     // NumberOfPages * sizeof(MEMORY_WORKING_SET_EX_INFORMATION)
    HANDLE ProcessHandle;                       // Handle identifying the process whose working set is queried.
} PF_VIRTUAL_QUERY, *PPF_VIRTUAL_QUERY;

#endif
View code on GitHub