Geoff Chappell, Software Analyst
The UNICODE_STRING structure keeps the address and size of a Unicode string, presumably to save on passing them as separate arguments for subsequent work with the string and to save on repeated re-reading of the whole string to rediscover its size.
The UNICODE_STRING is 0x08 or 0x10 bytes in 32-bit and 64-bit Windows, respectively.
|Offset (x86)||Offset (x64)||Definition||Versions|
The structure keeps two sizes. The Length member is the size in bytes of the array of Unicode characters at Buffer. If this array is null-terminated, which it explicitly need not be, then Length does not count the null terminator. The MaximumLength member is the size in bytes of the memory that is usable at Buffer.