[Windows Phone 7 Development and Hacking] WithinRafael:
While the driver prefixes are different, it appears (haven't done an exhaustive comparison) that the IO control code + method codes are the same for the drivers across device. Don't quote me on that just yet.

Here's the Samsung driver list (pulled from 5523D4D7-F2FB-4f23-9880-EB69061C325F.rgu):

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\RIL]
"Dll"="rilsec.dll"
"Prefix"="RIL"
"Order"=dword:15
"Index"=dword:1
"IClass"=multi_sz:"{A32942B7-920C-486b-B0E6-92A702A99B35}"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VirtCOM]
"Dll"="rilsec.dll"
"Prefix"="COM"
"Order"=dword:15
"Index"=dword:5
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\DPRAM]
"Prefix"="DPR"
"Dll"="DPRAM.Dll"
"Index"=dword:1
"Order"=dword:0
"DeviceArrayIndex"=dword:0
"DeviceType"=dword:0
"FriendlyName"="Dual Port RAM1:"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\DPRAM2]
"Prefix"="DPR"
"Dll"="DPRAM.Dll"
"Index"=dword:2
"Order"=dword:0
"DeviceArrayIndex"=dword:1
"DeviceType"=dword:0
"FriendlyName"="Dual Port RAM2:"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\SLOG]
"Prefix"="SLG"
"Dll"="MUX.Dll"
"Index"=dword:1
"Order"=dword:0
"FriendlyName"="Samsung Log Driver"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\MUX1]
"Prefix"="MUX"
"Dll"="MUX.Dll"
"Index"=dword:1
"Order"=dword:1
"DeviceArrayIndex"=dword:0
"DeviceType"=dword:0
"FriendlyName"="Multiplexer1:"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\RCD]
"Prefix"="RCD"
"Dll"="Rcd.dll"
"Index"=dword:1
"Order"=dword:5
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\WWN]
"Dll"="wwan.dll"
"RasConnPriority256"=dword:91
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VSP_7500]
"Order"=dword:17
"Flags"=dword:02
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\ModemBridge]
"Order"=dword:67
"Flags"=dword:02
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\RemoteAtcop]
"Order"=dword:68
"Flags"=dword:02
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\WWN]
"Order"=dword:24
"Flags"=dword:02
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VSP_7500]
"DeviceArrayIndex"=dword:0
"Prefix"="COM"
"Dll"="vsp_7500.dll"
"Priority"=dword:0
"DispatchPriority256"=dword:9F
"PPPTimerPriority256"=dword:9F
"Port"="COM1:"
"DeviceType"=dword:0
"FriendlyName"="7500 VSP Modem"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VSP_7500\Unimodem]
"Tsp"="Unimodem.dll"
"DeviceType"=dword:0
"FriendlyName"=mui_sz:"unimodem.dll,#9013"
"DevConfig"=hex: 10,00, 00,00, 02,00,00,00, 10,01,00,00, 00,4B,00,00, 00,00, 08, 00, 00, 00,00,00,00
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VSP_7500\Unimodem\Init]
"1"="AT<cr>"
"2"="ATE0V1&C1&D2<cr>"
"3"="ATS7=60M1<cr>"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\VSP_7500\Unimodem\Settings]
"MaxCmd"=dword:28
"Prefix"="AT"
"Terminator"="<cr>"
"DialPrefix"="D"
"DialSuffix"=";"
"DialBilling"=dword:1
"Pulse"="P"
"Tone"="T"
"Blind_Off"="X4"
"Blind_On"="X3"
"CallSetupFailTimeout"="ATS7=<#><cr>"
"Reset"="ATZ<cr>"
"FlowHard"="AT\\Q3<cr>"
"FlowSoft"="AT\\Q1<cr>"
"FlowOff"="AT\\Q<cr>"
"Answer"="ATA<cr>"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\ModemBridge]
"Dll"="qcomv1_ModemBridge.dll"
"Prefix"="MBG"
"ComToSmdBuffLenInBytes"=dword:4000
"SmdToComBuffLenInBytes"=dword:8000
"MaxApiChkRetries"=dword:F
"ApiChkRetryTimeOut"=dword:3E8
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\RemoteAtcop]
"Dll"="qcomv1_RemoteAtcop.dll"
"Prefix"="RAT"
"Enable"=dword:1
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\SRILUIProxy]
"Prefix"="SRP"
"Dll"="SRILUIProxy.dll"
"Index"=dword:1
"Flags"=dword:10
"AccountSid"="SID_UDEVICE_ELEVATED"
"IClass"=multi_sz:"{4619249B-6362-4520-B700-984C8E7BC7A4}"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\IMEICompareDll]
"Prefix"="IMC"
"Dll"="IMEICompare.dll"
"Index"=dword:1
"Flags"=dword:10
"AccountSid"="SID_UDEVICE_ELEVATED"
"IClass"=multi_sz:"{4619249B-6362-4520-B700-984C8E7BC7A4}"

The user-mode driver I'm reverse engineering is SRILUIProxy.dll. This driver implements the usual XXX_IOControl function that handles DeviceIoControl calls.

I'm not sure why, but they really bastardized the way you communicate with the driver. I've included my code thus far, although my buffer structure is still undocumented and non-functional:

(removed -- see LaunchPad project for updated code)

Errors I've seen thus far:

ERROR_INVALID_PARAMETER (87) - Either the DeviceIoControl parameters are dorked or the method code is invalid.

ERROR_EXCEPTION_IN_SERVICE (1064) - The driver threw an exception internally. This is likely the result of the driver trying to write to an input buffer that isn't specified correctly in the _SECRETSAUCE structure. (Pending reverse engineering to fix.)

Method codes (may be incomplete):

(removed -- see LaunchPad project for updated code)