[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
4 c: Q) T+ o4 C8 B
5 a) ^/ }- o+ S$ s. n: }#pragma inline
0 h$ C5 J" [, [0 `+ r5 ?//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
- _2 Z; z/ z7 a" y  r#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
# D# s. k5 W- A& [1 M( ~#define DFP_GET_VERSION         SMART_GET_VERSION
+ K- l9 S8 W4 B) x: W#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
% @7 q1 n; E9 O) d#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
$ X. d* @. D" U8 }% N
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
7 v" E0 ]- s' e) d. H+ ]
const int MAX_IDE_DRIVES = 4;
8 F: l. H! L: ~: w! R3 x. @; ~
// SCSI专用变量
+ \5 q* P0 P8 q  ?9 T" W' u% n; ^const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
6 B% [1 m  t0 {; xconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
" Z+ r' L2 n; Hconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

. Q& {! {& Y8 v9 K5 y# l( V/ Mtypedef struct _SRB_IO_CONTROL
{
3 G. W2 s0 W$ F7 E0 \  I7 F3 p    ULONG HeaderLength;
1 m  t8 O" l1 ]% W% u    UCHAR Signature[8];
   ULONG Timeout;
8 k# Y4 N1 x% A; s, e    ULONG ControlCode;
   ULONG ReturnCode;
8 g# H7 Q5 {* z1 L  F1 O3 q    ULONG Length;
! K- ~% e/ d6 f; ~$ u}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

// 读取的主函数
1 _7 q% P0 v& p5 Dvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
. K- z" x$ B; w  c" |8 e1 u
// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
7 g+ m$ L3 i, W' a& E: Uvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
& p2 I# @- [% K' a        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
7 F6 A& Z8 K; s6 [+ U( F$ K( G        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
9 l! t' A2 S$ F* Q% P  c# c        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
( o, y+ L9 Z- n9 V$ |  n+ d* d
// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
* R3 W8 x+ a. O//---------------------------------------------------------------------------
1 ^  o1 z6 a& T4 i0 _// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
+ h1 G# n2 I7 Y# L$ L{
9 @! ]1 a, P0 O& R/ N    switch(Win32Platform)
   {
8 b' L; \. C$ X" B% f        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
# V5 p' ~8 n- X* x- A% s+ v. z; Z- g            break;
       case VER_PLATFORM_WIN32_NT:
' d7 {$ ~" W) I( j            ReadPhysicalDriveOnNT(pSerList, pModeList);
* {# O" f3 i3 h' x% c            break;
$ @; B5 ?7 _9 U( k- R5 d        default:
           break;
) z, K9 W) `. }    }
+ I9 d( u; K0 r( ]  [8 P5 p}
//---------------------------------------------------------------------------
// ConvertToString
% M5 a3 l' Q* ^char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
; G2 M, y7 b  L" Y9 n8 E, B2 v    static char szResBuf[1024];
   int nIndex = 0;
  M! t7 |$ D4 ?. D0 `    int nPosition = 0;

3 C; E( }- I* s7 [! i# R    // Each integer has two characters stored in it backwards
0 P$ ^+ W; T# G+ T    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
6 \( M7 o% C, N& \! _    {
9 e( X+ E& }% W7 d  t; @* f% r7 t        // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

1 {: l' [, ^0 I0 X3 X! q! e7 y1 f        // Get low BYTE for 2nd character
$ s& P' ?& W# n* O8 D* X5 j* M7 j        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

1 |' c1 v: }7 l    // End the string
   szResBuf[nPosition] = '\0';
2 f7 p7 N) w4 f: C! c' j
   // Cut off the trailing blanks
' B3 V, w; K: Q0 j8 n! f    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
' y2 x# I9 ]  T. h4 c. [1 |# t//---------------------------------------------------------------------------
2 q# O3 w( f" y- l$ f* ~// ReadPhysicalDriveOnNT
0 C3 B. E6 k8 H1 ovoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
3 o5 H. \! m) C$ [4 W! p; D& S  i{
  j6 h. m% h' f    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
* L  |  B' k( d% ~* q: x
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
% e7 K. q# d3 M7 g$ Z    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
7 h, N0 [  V% E5 ~/ @% q  W1 m
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
: z8 S; J5 F2 r% x, A6 {) n                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
( n6 b' |7 q% K: E3 y9 g; }
( r/ b! z7 T( ]" ~! i5 K        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
! K2 D3 U' R5 T. K' e4 o/ A6 u9 `        {
- q, C# e; r, H6 E3 q! V            DWORD dwBytesReturned = 0;
9 ^& |3 i* Z/ G- h# {/ A$ ~0 w" D            GETVERSIONOUTPARAMS gvopVersionParams;

$ k3 T4 z7 [" \3 _            // Get the version, etc of PhysicalDrive IOCTL
8 `8 P6 {4 x0 z2 ]9 h9 ~; @            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

- U( Z9 w; d" J( J. i# S            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
* D& K0 e4 M3 _$ e+ p7 i                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
" W1 {. g% g6 P2 _0 `" o                    &dwBytesReturned, NULL))
           {
               continue;
) p9 Y" J1 h9 r            }

           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
, K6 Z& S8 R; s9 [$ d! \# D                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
8 e# \* B) s1 S/ c: Q$ j$ M                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
! M  z  G& y9 v4 J1 T1 P                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
+ d4 }9 X, n; m* f  R5 t
6 g5 d/ k# F' W/ K9 m                if(DoIdentify(hPhysicalDriveIOCTL,
" ?3 u, R( \. a6 F( u, `                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
0 B) p2 n0 O# O& K, F' N9 I                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
' I0 I7 ^8 Z- d' b$ ~  T& h                {
                   DWORD dwDiskData[256];
  B) P: V3 ^0 e- W                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
/ O! i/ q/ U, Z* W                    char szModelNumber[41];
5 g9 N! z# O9 S' d$ t. B
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
+ @' w: v( D7 b, N' T5 Z4 t                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
1 F6 G) M# J& y( u                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

; D4 f1 a7 n/ o% {                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
4 G( R: X( ?6 d! R% r6 ?7 g% Y7 I                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
4 N3 N1 E2 z- m, H% b  \
                   pSerList->Add(szSerialNumber);
8 P( F  H/ s1 \4 j7 J$ B                    pModeList->Add(szModelNumber);
               }
# l; _0 E- L- z9 I; ^  u! U; d            }
           CloseHandle (hPhysicalDriveIOCTL);
% h- p/ C$ H4 t' q        }
9 L7 I% ], |* Y+ e& A) B4 o    }
3 ?# G  _; J- C3 M! D: F% q}
) U, n' N! c! X, j5 i" M! n6 v! t0 ]//---------------------------------------------------------------------------
+ m" Q/ Z! H# R; I! k7 Y) M// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
7 A; H4 A" ]6 y) n9 Z              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
* |1 y9 v! }4 b* m1 w5 I7 V9 i{
( H0 F* {# A* ]5 o    // Set up data structures for IDENTIFY command.
; Q* Q& X" T  h0 }" Y0 F    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
% `( V+ T9 X# m$ G* Q: ?    pSCIP->irDriveRegs.bSectorNumberReg = 1;
$ n% n7 K; S/ B, M    pSCIP->irDriveRegs.bCylLowReg  = 0;
# e/ ]) G" O3 Z+ v( A- n5 J    pSCIP->irDriveRegs.bCylHighReg = 0;
3 F/ p: O( i7 X% ^  a- E
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
. z4 z" d9 K/ o: u: c    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
# t, r2 E5 Q8 K% y. p$ N
   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
: Y* p3 }0 k! _4 A, {, f' r    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
# \  s, t3 N4 H0 M, }9 ]' t
* C# c; j1 @/ m6 I: {1 y    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
, \& k! U2 @+ X5 z: S9 c           sizeof(SENDCMDINPARAMS) - 1,
6 M, i8 d% F* Y9 j* S           (LPVOID)pSCOP,
! |( L3 q2 s; g2 ^- ]' j           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
: r8 m2 O* a( _# i           pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
) J8 u, f& y$ ?  |( A// Windows 95/98/ME 代码
( M& L. g) K6 u: y; E# P9 I! H2 t//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
9 h' g3 \! H6 K( j$ bvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
: m! N% b' Q/ @  p" e1 M
   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
7 {4 b) l& i! S# b+ ]    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
' m6 `6 f& o, `7 H    {
" D! O; r2 ^8 h# C5 e* l        WORD dwBaseAddress;
  Z: F2 Q6 }( c* k7 _3 u8 t        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
6 _, O1 H9 u* }/ P- [        bool IsDiskExist;
& p" y. ~% d" M. H' \
, o7 G6 ?% s7 t: I/ D5 ]- y        switch(nDrive / 2)
! |; j" C; B% @        {
# Z/ o2 h% V: C2 A; |            case 0: dwBaseAddress = 0x01F0; break;
2 D- Y* O* P  h: M! I            case 1: dwBaseAddress = 0x0170; break;
  C5 I  k# x; G9 }- @            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
9 C& d; h1 ?; j1 P! J9 D% j        }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

. v- l3 D( b# b2 I' `  n5 P5 \& r2 b        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
7 ^# Q( {! u' F                bIsIDEExist, IsDiskExist, wOutData);
' z5 O# A8 K7 g8 @+ h& K    }
. V# q0 G/ n  a! \0 K0 p
   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
6 i& _' M8 I. b. }    {
* w5 d0 o) h$ M3 C; M( P1 s        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
3 V, c/ v" k. j% e        bool bIsIDEExist;
       bool bIsDiskExist;
% K; H& N  ~1 w! f" L: D        switch(nDrive / 2)
       {
" ?) m* v9 x3 F+ |) ~8 c  T" r3 ~            case 0: dwBaseAddress = 0x01F0; break;
. f' ^- z9 W. e1 R; W7 }$ C, N            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
( L2 O' D! f& R
' [8 ]8 b2 a$ ?& @0 T        // 进入Ring0
       bIsIDEExist  = false;
& d9 @4 }2 d: O: p% e  h        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
! @$ h6 d2 `5 S& M/ M" q
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

$ t" y& v1 b5 l+ G) A        if(bIsIDEExist && bIsDiskExist)
) {+ @. _7 d3 B! e        {
$ V2 P# Y7 {* ^  C& ]+ P) j            DWORD dwDiskData[256];
, c3 {2 g3 n- K( c6 p$ x' y" c) X% J6 I            char  szSerialNumber[21];
           char  szModelNumber[41];

# ?* h& i" ]; {* b6 W3 O# s            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
, Z: Z* E! p! z
           // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

) G3 h' z6 T2 n' o* R3 _; ]            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

9 Z3 j) k) A% e$ j! [; R% M            pSerList->Add(szSerialNumber);
0 M" Z7 q1 ?2 U7 K4 J) r' c% D+ w            pModeList->Add(szModelNumber);
       }
- D$ i3 d+ a& n: t% W; Q1 V8 E; k    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
1 d+ H; ]0 T: w! r$ E6 p: j/ ^}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
5 y* R; @& \1 k- j3 u1 ~. O//
7 W  |  ]+ C0 E2 q& E4 r// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
2 \6 C: c+ U& a+ p//---------------------------------------------------------------------------
, u# @$ b/ X7 K+ uvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
" S( a3 W. `. b' M0 s# d& Z        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
$ ^: v- [7 b! a. H* i' n" h! S    BYTE  btIDTR1[6];
) v0 a9 ?& A/ x$ O    DWORD dwOldExceptionHook;
  ^. U$ _  q" v( Y$ R    const int nHookExceptionNo = 5;
  P' M8 v7 |- Q: m9 C" U
   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
7 z  q6 p* k  w0 P$ l2 H
   BYTE  btIsFirst = (BYTE)bIsFirst;
% m- o- a; W# ^3 ~" A9 w
4 o; B" @4 U6 d1 H' W    const BYTE btBit00 = 0x01;
- Z0 M" e8 P8 k. {    // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
: g/ `+ A% |8 N5 n! }, y' x$ S2 N    const BYTE btBit07 = 0x80;
: q7 ]9 y% j: z* y    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
( ^6 j1 \; ?% [/ v# X+ p! z9 |+ h    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

( ~% Y% n. A, q, N+ g    __asm
   {
( ]) Q, F- `7 X! g        // 必须先执行这条语句
       JMP EnterRing0

       // 定义过程
       // 等待IDE设备直到其不为忙为止
/ J- \0 C% H% E# d+ U        WaitWhileBusy proc
( A* E& s6 V/ S5 C6 X
# K+ |+ a/ f7 q+ B        MOV  EBX, 100000
       MOV  DX, dwBaseAddress
2 t  ~9 O, i( C9 b        ADD  DX, 7

# c9 P- |$ E% x$ a        LoopWhileBusy:

9 m% B0 P& |) D        DEC  EBX
       CMP  EBX, 0
) S& j: H% X/ |" E( s        JZ   Timeout
1 t; ~5 I& S' F0 Z( j7 Z        in   AL, DX
) P# E" f' f6 j2 U        TEST AL, btBusy
9 f9 @; c1 k& H/ \) f4 {9 x        JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
3 Q4 ^2 |7 V1 U8 f( M        Timeout:
$ o* l* C, C% _- G        JMP  LeaveRing0
       DriveReady:
       RET
! ~8 R' f5 ]3 _% K6 S- S        ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
       SelectDevice proc
- h- x, F" X1 H' s" b5 e. t
       MOV  DX, dwBaseAddress
! s4 V! L( m6 n7 k        ADD  DX, 6
       MOV  AL, btMasterSlave
  ^( ~& l; N+ t& q6 C6 B
" T. c5 J7 ]# Q9 @        out  DX, AL
       RET
3 H* r) Z9 i/ z3 p
8 o- m- F7 c4 C  a        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
% E; K4 ?' H% w8 s6 q1 t& E- v: D        SendCmd proc
/ g' y7 N2 E8 t( Q) f8 e! D2 r- b3 B7 P4 a
' K  j9 j9 B# i/ ~        MOV DX, dwBaseAddress
+ u3 @  N/ j& ]( Z: d, \5 l2 j, }        ADD DX, 7
/ T* l6 A8 X! `5 S6 K* p$ d        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
* N8 j# E( ^0 h  o0 R7 G        RET
       ENDP  // End of SendCmd Procedure
: V* \3 y* f1 @3 c
* `; P. m6 G' M4 q* x: F        // Ring0代码
       Ring0Proc:
  I# |( v3 n  k4 @- Y' P        PUSHAD
3 \$ y* \; d* b; g6 \9 n        // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
. w% C7 G* @% |/ F
* e2 H( E: Y" s        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
" j% |- W- o# y' I+ V$ u1 L
& P9 ?& n4 @4 X+ F7 @  \# |        // 设置IDE设备存在标志
/ y' i+ u7 }# |        MOV btIsIDEExist, 1
7 k- y2 b0 @+ `
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
" g2 z) k$ T4 J- q+ D/ W# E        CALL WaitWhileBusy
       CALL SelectDevice

7 u2 S+ h4 [7 P4 }        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
2 \9 K& v: Z0 o        JZ   LeaveRing0
: P1 o- u$ e4 a7 y# [1 Q
, d# v3 B4 n3 M1 x3 K3 w+ H        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
6 @$ T* G0 f' ]5 Q8 N        CALL WaitWhileBusy
5 o6 X7 S5 D5 w  m
6 m/ C8 n& j7 B  g! `/ D2 R9 s        // AL的值等于cBit06时，不存在驱动器，直接返回
4 F! o& X& O5 u        TEST AL, btBit06
' U& c9 L$ m$ V8 J; }, D3 p  f        JZ   LeaveRing0

       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
1 Q3 h( _. ~2 }. [; i- y        CALL WaitWhileBusy
7 T* E( _0 A# g9 ^# u        CALL SelectDevice    // 设置主从盘标识
# e( i# \& ^8 D8 g3 M0 l0 s4 v; x        MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
) ~5 b* p1 C; t$ M2 ?3 G; u6 F! a        CALL WaitWhileBusy

* W" _# ?: ?5 G$ I6 [+ B        // 检查是否出错
& D# V- U/ q; S5 s" j" y" C        MOV  DX, dwBaseAddress
# W# l. m( [% ]. J# `        ADD  DX, 7

       in   AL, DX

       TEST AL, btBit00
4 x8 S$ f0 |9 r$ x* H# v3 x1 }        JZ   RetrieveInfo   // 没有错误时则读数据

5 @0 Z( ?1 r6 w1 H! p& U$ k        // 如果出错，则进一步尝试使用ATAPI设备命令
3 t- R! k5 h2 S: [* t. W: K) _/ ~        CALL WaitWhileBusy
1 B5 q! W  D5 b        CALL SelectDevice
# w4 ^! k, t7 M* i% G6 s  P- B        MOV  BL, btAtapiCmd
       CALL SendCmd
       CALL WaitWhileBusy

$ S5 S. n# `: p% W        // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
* w3 Q; \9 B) N! \+ l6 S        in   AL, DX
. f7 K! c( b8 U        TEST AL, btBit00
& V+ J. A, d# x9 c- Z5 p# d9 |        JZ   RetrieveInfo   // 没有错误时则读数据
& E0 \* R/ u* \' {3 i3 w/ I        JMP  LeaveRing0     // 如果还是出错，直接返回
; I; Y. N8 f1 W8 X1 O9 q
       // 读取数据
% Z( Q6 C0 I1 z2 Q" [; k        RetrieveInfo:

       LEA  EDI, wOutDataBuf
: Y" H1 K: m! J" U        MOV  ECX, 256
! x1 Z$ A# y$ o) ?% p0 |0 E/ Z        MOV  DX, dwBaseAddress
       CLD
0 l& [( V& N2 p
       REP  INSW
5 A: B: `9 @0 t9 p- e
       // 退出Ring0代码
0 \3 _: S# ]: j( ]9 K* @' k        LeaveRing0:

6 _' d- ?) H1 E/ E, E9 z% V  `5 H        POPAD
7 f- t: q6 Q5 C4 t% K0 y: c4 V        IRETD

       // 激活Ring0代码
       EnterRing0:
' z% y, X9 V0 E' t
1 _# a3 b7 h7 f3 m- C$ U0 p        // 修改中断门
       SIDT FWORD PTR btIDTR1
$ p9 e, F0 G* K) ]        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
0 ?  t, M; b; C9 q" \7 c# }& `        CLI
5 \2 C) Y# g* f3 d4 V+ S
/ W6 p  u3 z" S* f        // 保存原异常处理例程入口
% g% }& f% B8 t; j        MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

# |7 r* `* _! Y6 u        // 指定新入口
       LEA EBX, Ring0Proc
/ Q- ^7 h7 v. W        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
7 f: Q( _$ B3 _  a4 u. T
       // 激活Ring0代码
4 _1 F3 x* ~# |  u% H  e        INT nHookExceptionNo

4 Z- f( v  }& C1 l) w9 T        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
0 _" p4 ~3 b' `2 G6 W- V3 p        MOV WORD PTR[EAX+02h], CX
& X4 `2 D( N$ M. C5 {0 M* Z        STI
' e7 `8 M' B+ R/ @+ V/ R    }
; A& T  h& x- N+ `4 ]    if(!bIsFirst)
5 g7 ~2 s$ h9 }" N% ?+ d2 h    {
       bIsIDEExist  = (bool)btIsIDEExist;
2 n8 X% A' B" g        bIsDiskExist = (bool)btIsDiskExist;
% D8 z$ i* c7 N, z4 h7 d& Z* U        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
/ }1 ^. V$ Q( ^+ V& q    }
}
' I4 E; k3 ]$ z1 b: A//---------------------------------------------------------------------------
// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
( L& T1 l; v8 ]( ~. D, t1 K) v{
- ~6 z1 D/ h( \4 d    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
& P: |/ B  G3 ]- y. @% M}