At first I thought the type of “BSTR” was “WCHAR”, so I write a test code like this:

It seems that the “SysStringLen” return an error result so that I think the method has some problems.
At Simon's suggestion, I have just found some information on the Internet:

So I modify my code like this:

It returns the correct result.
But how does it know the length of the “m_str”?
Then I try to find the answer in the memory.

It seems that nothing is found. But when I scroll up the mouse, I have found something interesting.

Then I try to modify the string,

I am sure the length is written in the memory.