50分恳请大侠指教IOCTL的问题

在应用程序中有一段内存，然后我如何通过IOCTL传递给驱动这段内存的指针和长度，然后驱动程序分配一个内存来拷贝这段内存进去呢？我写了一段如下的代码，后面有些工作，比如如何取得指针等就不会写了，恳请大侠指教！调试通过以后50分奉上！
在APP中：
void CTestDriverDlg::OnCtrl()
{
HANDLE hDevice;
DWORD dwDev;
TCHAR szOutputBuffer[20];
PVOID psharememory;
DWORD dwReturn;
//a simple route table
TCHAR dest_mac[1024]={
             0xc0,0xa8,0x00,0x02,  //ip address:192.168.0.2
                     0x00,0x40,0x05,0xc7,0xd8,0xde   //mac address
                    };
//我就是想把这个数组传给驱动的内存

hDevice = CreateFile(\"\\\\\\\\.\\\\My_Passthru\",
GENERIC_READ| GENERIC_WRITE,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);

if(hDevice == ((HANDLE)-1))
MyGetLastError();

if(!DeviceIoControl(m_hDevice,
IO_GIVE_ROUTETABLE,
(LPVOID)dest_mac,
1024,
NULL,
0,
&dwReturn,
NULL))
{
MyGetLastError();
return;
}


VirtualFree((LPVOID)pRules, 1024, MEM_DECOMMIT);
return;

}
在SYS中：

RtlInitUnicodeString(&nameString, L\"\\\\Device\\\\MyPassthru\" );
RtlInitUnicodeString(&linkString, L\"\\\\??\\\\MyPassthru\");

for(FuncIndex = 0; FuncIndex <=IRP_MJ_MAXIMUM_FUNCTION; FuncIndex++)
{
MajorFunction[FuncIndex] = NULL;
}
   
MajorFunction[IRP_MJ_CREATE]         = MydrvDispatch;
MajorFunction[IRP_MJ_CLOSE]          = MydrvDispatch;
MajorFunction[IRP_MJ_DEVICE_CONTROL] = MydrvDispatchIoctl;

Status = NdisMRegisterDevice(
                    WrapperHandle,
                    &nameString,
                    &linkString,
                    MajorFunction,
                    &MyDeviceObject,
                    &NdisDeviceHandle
                    );

if(Status != STATUS_SUCCESS)
{
DbgPrint(\"NdisMRegisterDevice failed!\\n\");
}
// 分配与应用程序共享的内存
SystemVirtualAddress = ExAllocatePool(NonPagedPool, 1024);
Mdl = IoAllocateMdl(SystemVirtualAddress, 1024, FALSE, FALSE, NULL);
MmBuildMdlForNonPagedPool(Mdl);

return NDIS_STATUS_SUCCESS;
}
static NTSTATUS MydrvDispatchIoctl(IN PDEVICE_OBJECT DeviceObject, IN PIRP Irp)
{
PIO_STACK_LOCATION IrpStack;
NTSTATUS status;
ULONG ControlCode;
ULONG InputLength, OutputLength;
OBJECT_HANDLE_INFORMATION objHandleInfo;
PFILTER_RULE pFilter_rules;
HANDLE hEvent = NULL;
int i;
PVOID pRouteTable

IrpStack = IoGetCurrentIrpStackLocation(Irp);

// 得到DeviceIoControl传来的控制码
ControlCode = IrpStack->Parameters.DeviceIoControl.IoControlCode;

switch (ControlCode)
{ case IO_GIVE_ROUTETABLE:
DbgPrint(\"IO_GIVE_ROUTETABLE\\n\");
//这里应该如何处理呢？
//具体工作是：得到指针，长度，分配内存，拷贝，然后返回
break;

default:
break;
}

IoCompleteRequest(Irp, IO_NO_INCREMENT);

return status;
}

[编辑 -  6/5/03 by  ruberman]