UNICODE_STRING

struct UNICODE_STRING
    Length          UINT16
    MaximumLength   UINT16
                    PADDING 4
    Buffer          PVOID
ends

struc defUNICODE_STRING [udata]
{
  common
  local stringData,stringSize
  align sizeof.PVOID
  stringData        du      udata
  stringSize        =       $ -stringData
  align sizeof.PVOID
  .:
  .Length           UINT16  (stringSize)
  .MaximumLength    UINT16  (stringSize + 1)
                    PADDING 4
  .Buffer           PVOID   stringData
}

定义:

    align 4
    szusDeviceName          du '\Device\devVirtToPhys',0
    align 4
    g_usDeviceName          UNICODE_STRING 21*2,22*2,szusDeviceName

或者用第二个结构定义(等价):

g_usDeviceName          defUNICODE_STRING '\Device\devVirtToPhys'

自定义控制码:

macro CTL_CODE DeviceType,Function,Method,Access
{
      (((DeviceType) shl 16) or ((Access) shl 14) or ((Function) shl 2) or (Method))
}

用法:

IOCTL_GET_PHYS_ADDRESS  equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_READ_ACCESS + FILE_WRITE_ACCESS)

等价于:

IOCTL_GET_PHYS_ADDRESS equ  22E000h