struct UNICODE_STRING
Length UINT16
MaximumLength UINT16
PADDING 4
Buffer PVOID
ends
struc defUNICODE_STRING [udata]
{
common
local stringData,stringSize
align sizeof.PVOID
stringData du udata
stringSize = $ -stringData
align sizeof.PVOID
.:
.Length UINT16 (stringSize)
.MaximumLength UINT16 (stringSize + 1)
PADDING 4
.Buffer PVOID stringData
}
定义:
align 4
szusDeviceName du '\Device\devVirtToPhys',0
align 4
g_usDeviceName UNICODE_STRING 21*2,22*2,szusDeviceName
或者用第二个结构定义(等价):
g_usDeviceName defUNICODE_STRING '\Device\devVirtToPhys'
自定义控制码:
macro CTL_CODE DeviceType,Function,Method,Access
{
(((DeviceType) shl 16) or ((Access) shl 14) or ((Function) shl 2) or (Method))
}
用法:
IOCTL_GET_PHYS_ADDRESS equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_READ_ACCESS + FILE_WRITE_ACCESS)
等价于:
IOCTL_GET_PHYS_ADDRESS equ 22E000h