typedef struct _UNICODE_STRING{

       USHORT Length                  //字符串长度

       USHORT MaximumLength           //字符串最大长度

       PWSTR   Buffer;                //字符串指针

}UNICODE_STRING, *PUNICODE_STRING

typedef struct _STRING {

  USHORT Length;

  USHORT MaximumLength;

  PCHAR  Buffer;

} ANSI_STRING, *PANSI_STRING;

typedef struct _DRIVER_OBJECT {

    CSHORT Type;  //类型

    CSHORT Size;  //大小.

    PDEVICE_OBJECT DeviceObject; //设备对象链表开始,一个驱动对象可以有多个设备对象.其中DeviceObject结构体中有相关信息.

    ULONG Flags;

    PVOID DriverStart;   //内核模块在内核中间的开始地址跟大小.

    ULONG DriverSize;

    PVOID DriverSection;

    PDRIVER_EXTENSION DriverExtension;

    UNICODE_STRING DriverName;//驱动的名字

    PUNICODE_STRING HardwareDatabase;

    //快速IO分发函数.

    PFAST_IO_DISPATCH FastIoDispatch;

    PDRIVER_INITIALIZE DriverInit;

    PDRIVER_STARTIO DriverStartIo;

    //驱动对象的卸载函数.

    PDRIVER_UNLOAD DriverUnload;

    //一个函数指针数组. 普通的分发函数.数组中保存了分发函数的地址.

    PDRIVER_DISPATCH MajorFunction[IRP_MJ_MAXIMUM_FUNCTION + ];

} DRIVER_OBJECT;

typedef struct _DRIVER_OBJECT *PDRIVER_OBJECT;

typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _DEVICE_OBJECT {

    CSHORT Type;  //类型跟大小.

    USHORT Size;

    //引用计数

    LONG ReferenceCount;

    //这个设备所属于驱动对象的指针. 保存了驱动对象.

    struct _DRIVER_OBJECT *DriverObject;

    //下一个设备对象.一个驱动对象可以有n个设备.用单向链表进行连接.

    struct _DEVICE_OBJECT *NextDevice;

    struct _DEVICE_OBJECT *AttachedDevice;

    struct _IRP *CurrentIrp;

    PIO_TIMER Timer;

    ULONG Flags;                                // See above:  DO_...

    ULONG Characteristics;                      // See ntioapi:  FILE_...

    __volatile PVPB Vpb;

    PVOID DeviceExtension;

    //设备对象类型

    DEVICE_TYPE DeviceType;

    //堆栈大小.

    CCHAR StackSize;

    union {

        LIST_ENTRY ListEntry;

        WAIT_CONTEXT_BLOCK Wcb;

    } Queue;

    ULONG AlignmentRequirement;

    KDEVICE_QUEUE DeviceQueue;

    KDPC Dpc;

    //

    //  The following field is for exclusive use by the filesystem to keep

    //  track of the number of Fsp threads currently using the device

    //

    ULONG ActiveThreadCount;

    PSECURITY_DESCRIPTOR SecurityDescriptor;

    KEVENT DeviceLock;

    USHORT SectorSize;

    USHORT Spare1;

    struct _DEVOBJ_EXTENSION  *DeviceObjectExtension;

    PVOID  Reserved;

} DEVICE_OBJECT;

typedef struct _DEVICE_OBJECT *PDEVICE_OBJECT; 

typedef struct DECLSPEC_ALIGN(MEMORY_ALLOCATION_ALIGNMENT) _IRP {

    CSHORT Type;   //类型

    USHORT Size;   //大小

    //

    // Define the common fields used to control the IRP.

    //

    //

    // Define a pointer to the Memory Descriptor List (MDL) for this I/O

    // request.  This field is only used if the I/O is "direct I/O".

    //

    PMDL MdlAddress; //内核描述符指针.读写的缓冲区.

    //

    // Flags word - used to remember various flags.

    //

    ULONG Flags;

    //

    // The following union is used for one of three purposes:

    //

    //    1. This IRP is an associated IRP.  The field is a pointer to a master

    //       IRP.

    //

    //    2. This is the master IRP.  The field is the count of the number of

    //       IRPs which must complete (associated IRPs) before the master can

    //       complete.

    //

    //    3. This operation is being buffered and the field is the address of

    //       the system space buffer.

    //

    union {                                //SystemBuffer里面看看请求是那个IO请求.来取决于用上面的缓冲区还是下面的缓冲区.

        struct _IRP *MasterIrp;

        __volatile LONG IrpCount;

        PVOID SystemBuffer;

    } AssociatedIrp;

    //

    // Thread list entry - allows queueing the IRP to the thread pending I/O

    // request packet list.

    //

    LIST_ENTRY ThreadListEntry;

    //

    // I/O status - final status of operation.

    //

    IO_STATUS_BLOCK IoStatus;        // IO的请求状态.一般请求完成后的返回情况放在这里.

    //

    // Requestor mode - mode of the original requestor of this operation.

    //

    KPROCESSOR_MODE RequestorMode;

    //

    // Pending returned - TRUE if pending was initially returned as the

    // status for this packet.

    //

    BOOLEAN PendingReturned;

    //

    // Stack state information.

    //

    CHAR StackCount;             //栈空间大小.

    CHAR CurrentLocation;        //当前的IRP栈空间.

    //

    // Cancel - packet has been canceled.

    //

    BOOLEAN Cancel;

    //

    // Cancel Irql - Irql at which the cancel spinlock was acquired.

    //

    KIRQL CancelIrql;

    //

    // ApcEnvironment - Used to save the APC environment at the time that the

    // packet was initialized.

    //

    CCHAR ApcEnvironment;

    //

    // Allocation control flags.

    //

    UCHAR AllocationFlags;

    //

    // User parameters.

    //

    PIO_STATUS_BLOCK UserIosb;

    PKEVENT UserEvent;

    union {

        struct {

            union {

                PIO_APC_ROUTINE UserApcRoutine;

                PVOID IssuingProcess;

            };

            PVOID UserApcContext;

        } AsynchronousParameters;

        LARGE_INTEGER AllocationSize;

    } Overlay;

    //

    // CancelRoutine - Used to contain the address of a cancel routine supplied

    // by a device driver when the IRP is in a cancelable state.

    //

    __volatile PDRIVER_CANCEL CancelRoutine;     //用来取消一个未决请求的函数.

    //

    // Note that the UserBuffer parameter is outside of the stack so that I/O

    // completion can copy data back into the user's address space without

    // having to know exactly which service was being invoked.  The length

    // of the copy is stored in the second half of the I/O status block. If

    // the UserBuffer field is NULL, then no copy is performed.

    //

    PVOID UserBuffer;                          //与MdlAddress 跟SystemBuffer一样都是缓冲区.

                                               //缓冲区的特性不同.

    //

    // Kernel structures

    //

    // The following section contains kernel structures which the IRP needs

    // in order to place various work information in kernel controller system

    // queues.  Because the size and alignment cannot be controlled, they are

    // placed here at the end so they just hang off and do not affect the

    // alignment of other fields in the IRP.

    //

    union {

        struct {

            union {

                //

                // DeviceQueueEntry - The device queue entry field is used to

                // queue the IRP to the device driver device queue.

                //

                KDEVICE_QUEUE_ENTRY DeviceQueueEntry;

                struct {

                    //

                    // The following are available to the driver to use in

                    // whatever manner is desired, while the driver owns the

                    // packet.

                    //

                    PVOID DriverContext[];

                } ;

            } ;

            //

            // Thread - pointer to caller's Thread Control Block.

            //

            PETHREAD Thread;         //发出这个请求的线程.

            //

            // Auxiliary buffer - pointer to any auxiliary buffer that is

            // required to pass information to a driver that is not contained

            // in a normal buffer.

            //

            PCHAR AuxiliaryBuffer;

            //

            // The following unnamed structure must be exactly identical

            // to the unnamed structure used in the minipacket header used

            // for completion queue entries.

            //

            struct {

                //

                // List entry - used to queue the packet to completion queue, among

                // others.

                //

                LIST_ENTRY ListEntry;

                union {

                    //

                    // Current stack location - contains a pointer to the current

                    // IO_STACK_LOCATION structure in the IRP stack.  This field

                    // should never be directly accessed by drivers.  They should

                    // use the standard functions.

                    //

                    // 一个IRP 栈空间的元素.

                    struct _IO_STACK_LOCATION *CurrentStackLocation;

                    //

                    // Minipacket type.

                    //

                    ULONG PacketType;

                };

            };

            //

            // Original file object - pointer to the original file object

            // that was used to open the file.  This field is owned by the

            // I/O system and should not be used by any other drivers.

            //

            PFILE_OBJECT OriginalFileObject;

        } Overlay;

        //

        // APC - This APC control block is used for the special kernel APC as

        // well as for the caller's APC, if one was specified in the original

        // argument list.  If so, then the APC is reused for the normal APC for

        // whatever mode the caller was in and the "special" routine that is

        // invoked before the APC gets control simply deallocates the IRP.

        //

        KAPC Apc;

        //

        // CompletionKey - This is the key that is used to distinguish

        // individual I/O operations initiated on a single file handle.

        //

        PVOID CompletionKey;

    } Tail;

} IRP;