关于向数据buffer中添加自己的数据

系统平台是win2000，我想对TDI层接收到的数据做一定的判断，然后添加一些自己的数据，设置回调函数等工作基本完美,也能得到接受到的数据，可就是添加数据的时候我真不知道该怎么办了，那个老大帮帮忙 :(
NTSTATUS OurClientEventReceive(
    IN PVOID TdiEventContext,
    IN CONNECTION_CONTEXT ConnectionContext,
    IN ULONG ReceiveDatagramFlags,
    IN ULONG BytesIndicated,
    IN ULONG BytesAvailable,
    OUT ULONG *BytesTaken,
    IN PVOID Tsdu,
    OUT PIRP *IoRequestPacket)
{
NTSTATUS stats;
char* szDataBuffer = NULL;
char* szFind = NULL;
ULONG uLength = 0;
ULONG uIndicatedLength = 0;
ULONG uAvailableLength = 0;
char* pBuffer = NULL;
PIO_STACK_LOCATION irpStack;

// _asm int 3;
if (BytesAvailable>100)
{
szDataBuffer = (char*)Tsdu;
szFind = strstr(szDataBuffer,\"Received\");

if (szFind!=NULL)
{
szFind = strstr(szDataBuffer,\"Subject\");

if (szFind!=NULL)
{
//New Buffer
szMyEmailBuffer = ExAllocatePool (NonPagedPool,PAGE_SIZE);
RtlZeroMemory(szMyEmailBuffer,PAGE_SIZE);

pBuffer = szMyEmailBuffer;

//Find the \"Subject\"
szFind += strlen (\"Subject\") + 2;

//copy the header
uLength = szFind - szDataBuffer;
RtlCopyMemory(pBuffer,szDataBuffer,uLength);

// Insert \"FUCK\"
pBuffer += uLength;
RtlCopyMemory(pBuffer,\"FUCK\",strlen(\"FUCK\"));

//copy the last
pBuffer += strlen( \"FUCK\" );
RtlCopyMemory(pBuffer,szFind,uAvailableLength-uLength);

pBuffer = szMyEmailBuffer;
_asm int 3;
uAvailableLength = BytesAvailable + 4;
uIndicatedLength = BytesIndicated + 4;

while (uIndicatedLength>0)
{
stats =  ((PTDI_IND_RECEIVE)(eventContext.old_handler))(
eventContext.old_context,
ConnectionContext,
ReceiveDatagramFlags,
uIndicatedLength,
uAvailableLength,
BytesTaken,
pBuffer,   // pointer describing this TSDU, typically a lump of bytes
IoRequestPacket            // TdiReceive IRP if MORE_PROCESSING_REQUIRED.
);

if(STATUS_SUCCESS == stats)
{
uIndicatedLength = uIndicatedLength -  *BytesTaken;
uAvailableLength = uAvailableLength - *BytesTaken;
pBuffer = pBuffer + *BytesTaken;
continue;
}
else if ( STATUS_MORE_PROCESSING_REQUIRED == stats )
{
uIndicatedLength = uIndicatedLength -  *BytesTaken;
uAvailableLength = uAvailableLength - *BytesTaken;
pBuffer = pBuffer + *BytesTaken;
//提取IRP中回调函数
if (IoRequestPacket!=NULL)
{
// //好象是在这儿处理，可是。。。。。。。。。。
break;
}

continue;
}
else
{
return stats;
}
}
}
}
}

// return STATUS_DATA_NOT_ACCEPTED;
stats =  ((PTDI_IND_RECEIVE)(eventContext.old_handler))(
eventContext.old_context,
ConnectionContext,
ReceiveDatagramFlags,
BytesIndicated,
BytesAvailable,
BytesTaken,
Tsdu,   // pointer describing this TSDU, typically a lump of bytes
IoRequestPacket            // TdiReceive IRP if MORE_PROCESSING_REQUIRED.
);

return stats;
}

Sorry，代码有错，请注意：
RtlCopyMemory(pBuffer,szFind,BytesAvailable-uLength);
中的第三个参数
我最近很郁闷，请各位原谅

各位大哥，谢谢你们的参观，小弟费了9牛2虎的力量，终于搞定了，其实很简单，只要加上这些代码就Ok：
如果返回STATUS_MORE_PROCESSING_REQUIRED
RtlCopyMemory(outputBuffer,pBuffer,uIndicatedLength);
MyIrp->IoStatus.Status = 0;
pMyIrp->IoStatus.Information = uIndicatedLength;
IoCompleteRequest(pMyIrp,IO_NO_INCREMENT);