[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
0 F; V' I  u1 i% A% `, r
. L% J2 Z! U* r3 |' h( d#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
4 r2 j5 {7 n& Y6 v# @  d#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
# M9 @0 ^4 o7 U. O# Q! @1 t/ c0 }#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
$ h- x. T: g; E
const int MAX_IDE_DRIVES = 4;
4 `) s' _7 m, t, ~
) r7 d7 l0 u& Q/ X: w9 H// SCSI专用变量
9 L1 r* O1 D" @- F9 L4 M1 W/ sconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
( {! ]3 w2 Y6 K5 c+ D# p* jconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
% p2 N; |. n# tconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
1 J) e4 O2 K0 o, Xconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
{
% e7 O( h. g5 Q- D    ULONG HeaderLength;
" c, }6 ~6 M( y$ D5 h0 ~    UCHAR Signature[8];
: B# J1 W# J9 A9 R. F, \0 a! U" R    ULONG Timeout;
   ULONG ControlCode;
  [9 t* m" ~/ d/ l$ @    ULONG ReturnCode;
   ULONG Length;
, G  {# m6 E" b6 V3 j% m}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

. R6 M# \; Y0 i0 ?% X- s// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
3 c0 b! K( |" A, u4 Y2 _' y
5 D$ o7 g5 o- W: k9 q// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
0 p: ^/ o' E9 y5 G" N        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
8 s5 V' h7 V' g/ w8 _$ b// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
- r7 M. X) L( H9 J        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
6 j, p2 y/ f, x4 {' N  i6 C6 S( VString __fastcall ReadIDEDriveAsScsiDriveOnNT();
8 r5 m2 U4 |# W//---------------------------------------------------------------------------
// ReadPhysicalDrive
$ K" ]* _3 o5 `- P( M/ `' `; |0 Avoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
! b  C) v! x2 t$ A{
  t$ H" Z/ |0 Y; X" T    switch(Win32Platform)
* `  E& ^. a+ {: S    {
0 V% s8 C. t/ n/ X6 Z6 O* x        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
. T: ]4 j3 ^% C            break;
       default:
/ ^' {6 e& Y! y; V7 @# w            break;
) A' e' [, D* C    }
}
//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
& q, i; e/ t6 [# f0 |( N{
0 L/ U# [, w0 ]7 g    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;

   // Each integer has two characters stored in it backwards
8 H2 {0 }: ~6 `+ N' _    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
+ m" k" w2 Z# X4 F5 h% S1 R7 k5 i- {        // Get high BYTE for 1st character
! P$ D* M% v4 o: }2 D        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
8 k# a) S$ y! G
       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
6 I; a) O9 d; f9 Y: e* Z5 q        nPosition++;
$ l: E; P9 Q) h& \6 o    }
6 S0 U) N; g9 W; @& Z  a( z$ Z
   // End the string
   szResBuf[nPosition] = '\0';

- c1 @3 u! ?3 s+ }    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
# e# k8 b5 k; W        szResBuf[nIndex] = '\0';

, L2 A3 D) L$ t    return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
  s) p, b# H0 t. K" @$ i- m//---------------------------------------------------------------------------
% ~% O* h$ }2 G3 m2 ^4 r2 j: a4 `// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
9 I6 G9 q$ R, G) d, ^! y# N
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
) v; E* e/ W/ l( V    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
7 q& C  p- a2 ~& E
9 ?+ P4 s( d) t$ ~        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
* S# r2 p" V; n2 i: s                        GENERIC_READ | GENERIC_WRITE,
3 w  c* U+ o) S% {                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
: `3 b9 i  u4 ~) x& L                        OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
. A: y8 B, U/ ?            GETVERSIONOUTPARAMS gvopVersionParams;
; L7 V/ L$ }; M1 s- y
4 i" ~* N& L/ u! w- J5 B            // Get the version, etc of PhysicalDrive IOCTL
' R6 A" Q2 z5 k7 ]0 Q  N            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
$ n2 s  V* W, ^! j$ i# g8 c            {
0 |4 O9 A; K9 p+ @( X5 z% ^3 q                continue;
- G4 n- p2 ~% ]2 W( Z; D! |6 e            }
. W. C% t; T. h) C, K6 ^4 S
           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
, Y8 b& `0 t2 n8 y! L* C                BYTE btIDCmd = 0;
  o& O& Y4 d/ y7 D7 _+ s9 e  t                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
% d. p) K. M, d# j8 K                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
- u" U. ]. j: ~/ M8 {$ Y                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
% ^% {* h! P$ p+ h. j                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
+ S, h: o; e( M2 S) Z' [/ n                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
( s+ z7 s! F5 d. _5 s
$ A4 B  B' a2 i: @7 ^9 G8 C  `                if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
                   DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
8 c" O% o7 }0 h+ R# ]% S( d                    char szSerialNumber[21];
* H0 ~5 b  t: Z& n                    char szModelNumber[41];
3 }0 c6 ~8 i/ ~5 O( ?( r
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
" N( u) i$ T6 E+ k8 r                    for(int i=0; i < 256; i++)
0 N; `" `. [+ J$ J                        dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
) o. c& |' r6 t1 }, z) h
                   // 取模型号
( @$ V9 U: g6 ^                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
, B, h8 i5 T1 F                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
! t: n9 V/ f9 T" R                    pModeList->Add(szModelNumber);
. ]8 i( }3 f8 X. P                }
           }
' t; N1 I. k  h' L7 Z( q            CloseHandle (hPhysicalDriveIOCTL);
4 {3 D+ y3 ^- b7 k        }
9 t; b' @" b6 H    }
}
//---------------------------------------------------------------------------
// DoIdentify
, H& m( h7 M# E, ^7 Z: Dbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
: D, J$ ~( t/ G, D7 D              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
* }; s+ L- z7 D3 ?7 E              PDWORD pdwBytesReturned)
{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
  _6 r% L8 F5 A+ N& e6 m    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
+ f/ c" f/ i, z5 T; ~7 M- X    pSCIP->irDriveRegs.bCylHighReg = 0;
! ]( E* ?0 \- L. N
* m% D; J8 y5 p  W5 V9 H, K    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
  j, |( _$ X# m# O) _
   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
; h, B- E: Q' d8 T9 [    pSCIP->bDriveNumber = btDriveNum;
# l" s2 z: l! O/ p& U% _5 ^2 m0 h    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

6 q5 M; t0 ]( r. x    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
. [; C& N0 ^( E; [           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
; }! |6 Q$ |& T% {' o           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
' C. |* e! @5 {/ f4 n" R           pdwBytesReturned, NULL);
% X% g0 Y. M) b, b# G}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
8 k+ K! s( x! L% u2 i1 `//---------------------------------------------------------------------------
( f5 }7 A2 e# k1 U/ l& t// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
9 I9 J- n/ L9 }" l) B7 T{
+ {/ T5 U1 V  \% Y% M# M  h$ s7 k3 p    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
: j2 s4 x4 x" T( a
   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
1 _3 j( E" S% r  P# b0 u7 x    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
) @  n* `5 V/ d* q8 X    {
% E4 g) c4 M( {        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
( D0 E3 t# Y: `        bool bIsIDEExist;
       bool IsDiskExist;

$ U! S9 U! z; i: V0 I: Z" J2 M" x        switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
# X- p+ U/ B8 a/ y4 L4 z            case 2: dwBaseAddress = 0x01E8; break;
$ L4 I+ F' B' m% U& U+ E            case 3: dwBaseAddress = 0x0168; break;
, S  k; F; d, c4 g+ m3 t. t; w        }
, a" Z* P, ]8 f
: Y% W0 E+ f% j4 @7 p4 r6 h% X* w        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

4 C# T; Q: G& u( s; E        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
: e8 \# |4 q+ Y0 ]                bIsIDEExist, IsDiskExist, wOutData);
   }
( A$ [! Z( |6 ~8 {
   // 开始读取
- b( x; \( n6 M0 f  f# o    for(int nDrive = 0; nDrive < 8; nDrive++)
& V" p+ P9 e& V- i' j) @! D    {
       WORD dwBaseAddress;
/ g% ~  T- P- R( s% S        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
% J0 _; l) C0 }4 M5 |5 q& Z, A( x0 Z        bool bIsDiskExist;
       switch(nDrive / 2)
4 R0 Z- ?& I0 A3 H( k& K0 B        {
% b3 i# U# u$ g1 e$ ~3 z8 T            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

5 c# H7 f( e& ^: I* Y        // 进入Ring0
       bIsIDEExist  = false;
4 y0 H+ I6 t; l% Q3 r( q" y7 `        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

6 L; [9 k8 F* v        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
; `0 q! j0 c; y  x. ]' X9 T$ v                bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
1 h; f$ N+ y0 x' E# U; K2 G        {
           DWORD dwDiskData[256];
5 {' Z- y: c4 F; w            char  szSerialNumber[21];
           char  szModelNumber[41];
% s% i3 m$ M: p9 I1 [- ~
% W, d8 a, |  e1 n* Z* c2 C            for(int k=0; k < 256; k++)
. A) M, s( u: `4 L5 y/ k& K                dwDiskData[k] = wOutData[k];
6 @/ J8 }; C# q$ t& q6 q: r' z
           // 取系列号
0 }2 V# x9 R% G; y" y% I            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

# f7 G5 I/ {" ]. k1 {( L; c            pSerList->Add(szSerialNumber);
7 a/ {: u% c. i- y: b            pModeList->Add(szModelNumber);
! o8 N; B; R4 V/ o( x& w        }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
* f! U! {" v0 C}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
3 \" J) }" B# @  B) {" H// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
! ]+ Y! z, X# Z# g: R9 W- H# @- H        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
- b3 M+ Q/ Z' D. P. A$ b! x8 r{
$ U* |8 M$ D+ Y' _3 Y9 b    BYTE  btIDTR1[6];
  \( I* v5 ^* ~9 @    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
- }% Y" z& s' S5 a
3 ]/ F7 e9 a' B$ p    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
9 o% E; l& W8 c7 m2 P( e    WORD  wOutDataBuf[256];

, N8 r1 m! W  e. w1 |' O    BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
* l7 m: A. a: n, ]2 C: E5 L. y/ j    // const BYTE btBit02 = 0x04;
9 [% E2 C" v6 r( M5 R    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
, k! `: W" s1 d# N3 r    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
4 [% s8 _' L# y5 W7 I- h+ O6 p    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

2 Z" V8 E* a, p' L- X- u    __asm
   {
' L& s$ U! x- K% k        // 必须先执行这条语句
       JMP EnterRing0

7 s- ?; L: M' X: a        // 定义过程
       // 等待IDE设备直到其不为忙为止
6 P# L4 n$ h4 Q8 i4 f1 H        WaitWhileBusy proc
; I# H5 x# `" S- E5 m& ^8 _# A
       MOV  EBX, 100000
, ~" a# I, N" @$ I3 f        MOV  DX, dwBaseAddress
* A9 X- v7 M8 Q; ]% D        ADD  DX, 7
3 v4 c' W) g/ J; Q7 g2 S
       LoopWhileBusy:
8 G; ^- g; Y% m9 O% i( Q) }# g
       DEC  EBX
3 \' U! J* S' x: F3 Z4 s. ^        CMP  EBX, 0
       JZ   Timeout
0 L8 Z: R/ [$ M- ^        in   AL, DX
       TEST AL, btBusy
3 u3 Q3 {, q) h. w- H! o- U        JNZ  LoopWhileBusy
1 D; r* S) J! F. X1 s        JMP  DriveReady

) A) h+ |0 f: I# I- z6 `        // 超时，直接退出
       Timeout:
6 k. f! x9 P! c% C        JMP  LeaveRing0
       DriveReady:
       RET
       ENDP   // End of WaitWhileBusy Procedure
# w* E$ C% z! t. [
       // 设置主盘和从盘标志
       SelectDevice proc
- N) @; c" g- X; g8 @: ]
- j9 R2 q8 P* P  T3 ?3 `: O        MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave

! _+ q. A. W  }' Q1 p3 A        out  DX, AL
5 A: X0 p" H/ p4 x        RET
& W+ F) \+ {! e9 G* f4 ^, z
       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
+ F. x3 B/ z8 c; f$ J; j# D, b1 ~        SendCmd proc
. k# V% M- |5 e% x) n- o
; a- h! C3 T' H3 i# p        MOV DX, dwBaseAddress
       ADD DX, 7
9 e$ B) s4 I2 }  e0 x        MOV AL, BL // BL是主从盘标识，在过程外设置
+ O3 J5 T  \' S; o: S- D/ I        out DX, AL
       RET
$ ?, j0 K* x/ I2 J        ENDP  // End of SendCmd Procedure

       // Ring0代码
       Ring0Proc:
       PUSHAD
, l( ~+ j6 L# q8 n5 U        // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
' x9 F0 O" F, ~& p* g2 b        ADD DX, 7
" ~+ s0 ]: G, }' ?/ F        in  AL,DX
' B: }$ X! e( W3 |6 P
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
1 J5 j$ J' p  B  u        CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
4 L4 `$ n. K# `9 h  v) ?( P
2 X! d' F7 h% v8 h7 E8 N) Y        // 设置IDE设备存在标志
# e& r" u: `: v: u1 K. g7 o        MOV btIsIDEExist, 1
9 v4 U. M, G4 v7 q% U- Q
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
  M3 r+ A3 w% g% x( g$ H; Z        CALL WaitWhileBusy
& _& `7 V9 Z' T        CALL SelectDevice
. n# o& g3 d$ ?9 W% n% M
5 h; l/ p9 q5 z* G        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
' b' I" C4 q- N2 t/ O& j- w9 ~        CMP  btIsFirst, 1
       JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
( H7 p. S/ s* X- x/ q2 ?8 H; C. T        CALL WaitWhileBusy

, R% `6 T; v2 ~! ]        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0

       // 设置驱动器存在标志
) p# U0 ]  l3 G: w9 R% Y        MOV  btIsDiskExist, 1

8 |: l% {2 t) j1 d) C* D        // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
5 r, N9 E; b! E0 }0 f        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
( T* D. X6 W  J& `9 N; x6 O% A& b' B4 W        CALL WaitWhileBusy
4 k: L! g6 i4 N        CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
, R% S# O" v+ M' A        CALL WaitWhileBusy
" k. N" n$ _) _- G& c) b
       // 检查是否出错
$ I1 @: y% ^3 ]1 t! O+ ]        MOV  DX, dwBaseAddress
  t8 Y9 D& l. {6 o  x0 T        ADD  DX, 7

0 A5 C# \) l" f        in   AL, DX

       TEST AL, btBit00
; _# o0 T9 c/ V7 x- u: M9 o8 f        JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
! U5 `2 a. y, t- i& h$ X& r        CALL WaitWhileBusy
) ^3 h' @8 h% C( g1 P        CALL SelectDevice
       MOV  BL, btAtapiCmd
9 _1 r! k2 W7 m  ~  D2 c% O        CALL SendCmd
( R# M: x$ M( Z3 u& `. x' a        CALL WaitWhileBusy
6 l: S) c# h3 [+ q; ?1 v
       // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
9 h7 N  b9 O& C1 A. t( y! q        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
% B& ^" D! L- Q' n) D, V) @
       // 读取数据
( B# E4 c, H, m/ k        RetrieveInfo:
) C5 n8 u, R% U! r4 d" F2 e
       LEA  EDI, wOutDataBuf
4 j; t: [0 [+ P& ~4 [% V        MOV  ECX, 256
" @1 V, M" {, @5 m* |        MOV  DX, dwBaseAddress
8 n* H5 Z5 L& b+ `: k+ N+ {% c. H        CLD
7 T; f7 A4 ^6 \9 ?( I8 Z) Q1 y
/ @- z9 g0 R! i/ J        REP  INSW

6 l: e4 D0 J4 \3 d  J        // 退出Ring0代码
4 u  G+ o0 Y8 s9 P        LeaveRing0:
1 @7 j( |, _' Y4 Z* s2 W1 C
       POPAD
       IRETD

! j5 \* i9 X5 u0 c2 g; G        // 激活Ring0代码
+ m. |- o2 e+ I  W- K0 u9 }* X9 \2 c7 U        EnterRing0:
# ?* V) B/ l$ ?3 f8 W
" B: h/ z0 J: B( H        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
9 q2 @5 w; }- q, N, s        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

       // 保存原异常处理例程入口
' D, h7 J/ ?" R' q- t! E" a        MOV ECX, DWORD PTR [EAX]
5 C$ \( x" U9 V# c: f        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
2 S' [# c9 ?+ n$ N! q0 D/ `
- W! S8 L9 m+ L        // 指定新入口
( T( ~: c$ K1 @& J5 c        LEA EBX, Ring0Proc
. G3 y: j3 G4 a; v* o- ~3 E" N; f# y        MOV WORD PTR [EAX-04h],BX
+ H  N' y4 t  U/ i        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

6 a& f! Z2 i! k& X; v3 M$ y9 p; n+ u& Q        // 激活Ring0代码
; }( j* R  C7 v: V& L        INT nHookExceptionNo

9 y: \5 Z% z) B7 g4 T        // 复原入口
5 Y8 n' c: [/ B, }- r% I$ h5 L        MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
* R- m: ^9 k5 B& s' p        SHR ECX,10h
. G, R6 q' r' R        MOV WORD PTR[EAX+02h], CX
       STI
   }
   if(!bIsFirst)
* u0 R. l! F5 q: V$ z    {
       bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
$ n. Y# d  R6 q5 G1 O# i2 f! K}
! ~# }* D. [0 }0 j4 @  ~//---------------------------------------------------------------------------
// 调用方法：
% m( B/ X' [% S8 U/ S1 Hvoid __fastcall TForm1::Button1Click(TObject *Sender)
{
* L+ _% j$ R5 W    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}