Trace the function implemented by DeviceioControl

I am working with a WinCE device which has a ra开发者_如何学JAVAdio manager driver written for it in MFC. In the code for the Radio GUI, I can see the function Deviceiocontrol with a specific IOCTL being called. However, I'm unable to trace the particular piece of code called by this function. Can someone tell me how Deviceiocontrol works?

DeviceIoControl calls through to the device driver by using the file handle. You have to use a kernel debugger if you want to step into the device driver itself.

The file handle represents a kernel object which consists of a DEVICE_OBJECT structure which contains a function table. In this table at the index of IRP_MJ_DEVICE_CONTROL, the driver sets its handle function. The function then gets called with the io control parameters which are packaged into an IRP.

Do you have the source code for the driver the IOCTL is sent to?
You pass a handle to DeviceIoControl - the handle is opened using a call to CreateFile(L"XXX#:",...) - XXX being the prefix of the driver as set in the registry. and # is the index the driver is giving at load time (also can be set in the registry).
To see the functionality that is performed, search for the IOCTL you send to DeviceIoControl in the driver's source code. You will find it in the driver's implementation of XXX_IoControl.