[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

& Y& |- N5 U* ]0 Q" V8 Q& ?! E- ~5 a#pragma inline
//---------------------------------------------------------------------------
6 O4 o! ]( V' m2 ~0 p. y- @// IDE NT/2000/XP专用变量
! F' k  E6 {5 Y' {! @: F#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
, K' N, F* G8 a* [3 ^#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
. ~6 z( {. z" ~& K# _% u
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

% W& U% @1 m  u8 Zconst int MAX_IDE_DRIVES = 4;
+ O/ ]( D; _; r3 W2 B  v5 S8 _
4 ?% U- _4 ]0 m, A$ z5 p// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

& O- b5 E( P3 g9 o/ C7 `( k0 n9 Vtypedef struct _SRB_IO_CONTROL
! D) B; t* h- z( B! P' O# J{
   ULONG HeaderLength;
7 b5 h) {" {2 h" W    UCHAR Signature[8];
. s: q+ {3 G6 n& |! Y3 L6 N  |    ULONG Timeout;
   ULONG ControlCode;
; C2 j. L6 r" s- [( {$ r' a1 f5 p    ULONG ReturnCode;
, |" q5 [/ N0 l2 z/ A9 e9 G; B& L    ULONG Length;
1 P* J: Q( r! u4 X- G}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

2 B: z  X, G8 Y$ r0 M( d$ }// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
" a6 O0 T( O* l4 k* ?5 Dvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
- a6 j: M: L5 \! O+ g" {# Rbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
- W; W, \9 A+ j! H- k7 _* b1 W' M        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
5 V' v8 d, U7 F' N& F% Gvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
4 S- \' h9 Q  F- Rvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
# l) O* }4 B$ }
6 e0 x( j' q9 [& K1 [- _6 ^// SCSI读取函数(for NT/2000/XP)
: F. s: V3 \: Z9 B' DString __fastcall ReadIDEDriveAsScsiDriveOnNT();
3 O3 y- ~. ]  K+ P# j//---------------------------------------------------------------------------
, S. i; B4 [9 g0 @// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
- _$ T, G3 P( O3 l$ h( h" E    switch(Win32Platform)
   {
3 g- Z7 _/ u/ d3 p8 t        case VER_PLATFORM_WIN32_WINDOWS:
8 R: |/ v5 r6 \- [. `. d1 |            ReadPhysicalDriveOnW9X(pSerList, pModeList);
$ m+ Q' u: Y2 n            break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
* ^8 {3 o3 q& I1 M            break;
       default:
           break;
  M' S$ t8 F% ^0 x( r% S- Z3 B    }
9 a  j% n8 ^- `: u}
//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
+ _9 K/ U- M- \. I. @( s    int nIndex = 0;
   int nPosition = 0;

   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
1 x- Q9 ], g8 F( `        nPosition++;
9 x/ [2 H. k- M, X9 t# w$ |
       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
' j& m3 m$ b* ^/ Z! w        nPosition++;
, U; S, S5 ]5 T: Q- u    }

   // End the string
   szResBuf[nPosition] = '\0';
+ S2 L8 S5 _$ E0 s" u
& m8 ^; n# d5 B1 A, W1 `    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
( t: T+ o( \9 c; \$ k//---------------------------------------------------------------------------
9 R0 b- D( r2 D. B// ReadPhysicalDriveOnNT
, \" ]% Y* d8 Fvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
  i% d/ t# d! h5 w{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
/ h, G. H9 `( u6 ?5 |
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
1 p8 v4 C* K4 j5 D0 m& {    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

) N" k( i7 `4 f  X1 t        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
+ q* {& {/ y0 `3 A6 W( R                        OPEN_EXISTING, 0, NULL);
5 d. G  U$ V/ t9 ?$ j6 }1 y  n
1 R" q; X# [. O: D' D3 W+ _" D1 u7 b        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
0 u/ y0 z; T3 _+ @1 g5 V/ u: O        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
  U% w" z4 N; ?* e, D. s3 i7 J
           // Get the version, etc of PhysicalDrive IOCTL
% o7 e% A; A% W1 e            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
& G5 X: U! ]3 G. c7 _                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
# v* Y. \) W0 r' k: k; @                continue;
* }; A/ u. J9 F2 X; e3 v9 F+ l            }
& d, s6 \5 i! p* A) S: H" w
! P) X0 ~4 Q. W7 f            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
' [, `/ n9 T+ V# v5 x. u: q# ?" i                BYTE btIDCmd = 0;
8 T  H1 u2 t- A- g2 l# c. ]! L/ A5 m2 d                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
/ u6 w, e3 a1 Y0 l6 j+ {' A                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
# h; F& }4 ]. F& T# @                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
5 d; ~1 r, p) p  ^! N                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
( m# \! j- u' a8 ?                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
' W/ J# l$ T+ H: w! {+ U0 k& Y
               if(DoIdentify(hPhysicalDriveIOCTL,
1 s# Z7 m, R! A# X/ m                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
  M" k1 J/ S/ Y7 ], `9 a                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
5 [# O# F( r+ J6 J                    DWORD dwDiskData[256];
0 m5 c  C7 a4 {* G" i                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
5 n- [1 x+ j+ G3 [                    char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
. ]9 b1 }0 H# \) H" J! s7 U                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
: G/ Z3 X8 Q, S- ?/ Q1 l2 S' H                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

: O! X, [" _+ P( k9 q5 I7 \2 i4 b% U                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

1 o2 r$ f( y3 U) l- Q" y                    pSerList->Add(szSerialNumber);
& H) x! K' ?9 K! V                    pModeList->Add(szModelNumber);
               }
           }
           CloseHandle (hPhysicalDriveIOCTL);
       }
3 C  ~$ C- b/ F8 u" t4 ^+ L    }
) z! R2 S. S4 C3 f- p4 }}
. Z! r" S( k& w1 o& P//---------------------------------------------------------------------------
// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
0 n) H1 H! y. l6 k              PDWORD pdwBytesReturned)
{
   // Set up data structures for IDENTIFY command.
6 Z0 C5 {6 p9 i    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
/ |5 q, I$ n0 z$ K    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
6 F  [6 |5 J" d: s* h0 u+ p
0 }, h: k8 P& _    // The command can either be IDE identify or ATAPI identify.
" a. \( M$ k3 J) H9 R    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
8 @! h* V- D8 ]6 S1 v& Z' k8 T6 j    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

- f) s9 Z/ R7 C6 g! X    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
9 \1 I7 @5 P- ^/ x) ?           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
- o9 M# \: S9 |$ Y5 e2 k           pdwBytesReturned, NULL);
}
. g. b. t7 T  u: N$ W# e//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
! e1 {! B: t3 d$ h// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
' B: B% a) m8 Y9 Q. Z$ C! ^6 q0 j    WORD wOutData[256];
9 ~9 x% P3 c- E! G9 e    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
4 S% l4 ~0 }* b" h/ `    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
% n7 v3 O- \, ~0 U        WORD dwBaseAddress;
9 u8 Z& }" S. I3 [% l) \; z        BYTE btMasterSlave;         // Master Or Slave
% K2 ]- j; k1 p7 z        bool bIsIDEExist;
       bool IsDiskExist;
2 W/ l" p9 g3 Q: e& a$ q' `
6 f  o. R0 x1 s        switch(nDrive / 2)
( u# y" u, M. s; D0 y0 |        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
3 q! |' w) }3 G+ b
1 u6 W4 Q1 C" ^) Y        // 进入Ring0
. }- S: U" D- K7 o$ W        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
* |8 W& t( O2 w2 ~  u9 V6 |    for(int nDrive = 0; nDrive < 8; nDrive++)
% M. n7 m  t7 L    {
       WORD dwBaseAddress;
. ~. F9 h7 B+ m0 P( Y% H5 H+ Y6 W        BYTE btMasterSlave;         // Master Or Slave
5 q/ {5 k$ X5 u. G5 F5 F- L        bool bIsIDEExist;
( D$ v: ?% ?" F" U        bool bIsDiskExist;
       switch(nDrive / 2)
! K. a) e) [$ ]0 p+ h! g7 o        {
1 y9 m! f" d: z8 {  h. f            case 0: dwBaseAddress = 0x01F0; break;
! ~& a0 H% |9 a& B            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
1 I+ L1 L- h  {+ Z        }
. Y) G- R- E$ W8 |1 U2 v; [+ Z
* O1 G$ ?. i* `; V/ A& ?        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
4 A. U- ^1 `) U. X1 v
       // 进入Ring0
8 ?! `- p/ J/ b+ R/ ]        bIsIDEExist  = false;
+ b+ e6 V4 s* \2 E        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
  M3 r! O; u* h7 Z. p, o3 \                bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
8 |! U# n9 R. A7 R8 p6 X0 Z" }( _        {
           DWORD dwDiskData[256];
           char  szSerialNumber[21];
+ I* W2 }# }! S            char  szModelNumber[41];

$ B9 {) q( Q+ l4 _9 g            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

           // 取系列号
9 }) A, k# T$ n8 B            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
# s  b3 n' _8 L$ l% T  K            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

# V; ?: r: E/ [! s# W) d            // 取模型号
$ y: ]2 }! {9 {+ p7 s            ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
7 Q: j0 }) ^# n3 y
; z0 z& }% N5 v( P1 G            pSerList->Add(szSerialNumber);
- D0 ^# }. X3 l: B            pModeList->Add(szModelNumber);
       }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
6 b* b* @4 Z% J' C# {& I* H/ W! G//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
" N6 |2 }' D6 @0 X4 u, S- o// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
0 C# m7 ^) w0 p" z//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
: ]3 H# B0 s% ^        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
$ I( Y5 ]. c7 L8 Y7 ~# k3 x5 U, Y{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
, U" G$ o% c7 S# _# D' p    BYTE  btIsDiskExist = 0;
+ [5 S/ w/ L# l    WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;
4 R( t& @' o- t3 ^1 K" H/ m
   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
9 Y3 l3 a/ d  f* `3 z+ `' T8 T    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
# y+ a& t* L" A9 p* X    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
4 G& d' ~% L9 @
8 H8 \, c! N: o1 ~" m. p6 w2 T, i    __asm
. J7 z, X' x1 W( j1 h    {
- V& ^8 W$ @& K6 f$ e2 t! W7 j% n' ^        // 必须先执行这条语句
       JMP EnterRing0
# z$ M" K# j! I/ t' t
       // 定义过程
2 O3 ~4 D; ~& q% Q) v        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

       MOV  EBX, 100000
       MOV  DX, dwBaseAddress
! r8 K1 E+ z# w: T2 N        ADD  DX, 7

       LoopWhileBusy:

       DEC  EBX
4 f2 ]' x4 _+ _2 m; z% D        CMP  EBX, 0
+ ~! n' n$ z2 ^& [; d, d        JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
, L( h9 _) y: f4 e7 g        JNZ  LoopWhileBusy
       JMP  DriveReady
: s- T3 E) z- R2 P! e
       // 超时，直接退出
& E4 Z; U  A2 |* x( a% L; f) L        Timeout:
! e* |! E* @: Z. m        JMP  LeaveRing0
1 w* K/ U7 t, H  @. i3 c5 M& K        DriveReady:
+ _+ x" Y5 Q! M9 G% ?        RET
% ?' Q3 G) p# N1 c, o) k3 A9 ]. Z        ENDP   // End of WaitWhileBusy Procedure

# N4 q/ u8 s2 {        // 设置主盘和从盘标志
) [- A3 v/ v8 w! X5 l, ?        SelectDevice proc
; V* @# g) O0 U0 M5 Y# d# x# w
       MOV  DX, dwBaseAddress
       ADD  DX, 6
4 E+ c- i1 }5 V2 l" U1 A7 A* O        MOV  AL, btMasterSlave

       out  DX, AL
' L3 a/ P$ Z  o* u9 M4 j        RET
* }3 H  i! Y9 G
+ W- t2 m1 |" j  N- G) Q, [7 P4 h$ r        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc

# i0 V8 a0 n& t1 @$ A) _3 e        MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
       ENDP  // End of SendCmd Procedure

0 L+ C5 r& s0 C. Z9 `- q  ?0 W        // Ring0代码
       Ring0Proc:
       PUSHAD
. e8 w+ a5 w6 U9 {0 W8 C3 R( [. D        // 查询IDE设备是否存在
  C5 _9 i& i, i7 u        MOV DX, dwBaseAddress
: F3 Z/ l7 |7 B9 Y        ADD DX, 7
       in  AL,DX
5 D  \$ [: ~- O" B
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
- `3 s3 O$ C! K. P        CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
& M- k. I8 U7 W1 P, l
       // 设置IDE设备存在标志
4 n% E3 I- A  r- f! N  e        MOV btIsIDEExist, 1
/ M) J- v1 V7 c: t  t& D
) `! ?/ E- P+ u2 Y" [' M6 `        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice
& d4 M/ S7 `+ E9 ?( n
       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
. B& e9 k) b! r& d+ ~4 z$ k% w+ p+ n        CMP  btIsFirst, 1
2 ]2 m* ?' F% D0 k3 s- m        JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
9 s" O2 _! h. r        CALL WaitWhileBusy
8 |: F. t: |$ [
       // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
$ `' f8 @; e8 _8 k5 S8 m+ q( w        JZ   LeaveRing0
: b* V* k! P) G1 ^
$ ^7 {( P% m9 u1 K$ I2 i( W        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
, x1 R" I$ e/ w8 Z8 a5 N
( k" T. F3 U- t3 P- Q' M        // 发送存取端口命令
" t/ M2 D. E7 Z- L. t& F6 n        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
5 }2 e. t4 J% t        CALL SendCmd
0 S1 p5 Z, \: ?8 h        CALL WaitWhileBusy

       // 检查是否出错
( O2 v# {* ]& _0 E0 K- G        MOV  DX, dwBaseAddress
       ADD  DX, 7
9 b: X! x6 T) \. a$ h: x
       in   AL, DX

       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
+ ?5 q% x9 }2 q4 E1 O- ]9 c
2 x" g8 I+ Z) }, C$ x. ^        // 如果出错，则进一步尝试使用ATAPI设备命令
, i9 s1 @4 ]" b5 s; }  Q3 J  I        CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
       CALL WaitWhileBusy
/ n" F2 }% j6 h! n# y( l
       // 检查是否还出错
       MOV  DX, dwBaseAddress
' w4 U$ y8 c$ G, m* N) z        ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
( r; P$ ~8 W- o        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
1 n6 b0 |7 a/ n/ k/ v" p
       // 读取数据
' N. z8 v+ ]$ _2 b  l        RetrieveInfo:

/ V2 G# f6 E1 b4 S5 l        LEA  EDI, wOutDataBuf
/ t' c; Y, W# }- ^! T1 A        MOV  ECX, 256
5 f3 g. `: P) M' w" @4 h4 ]( J% M        MOV  DX, dwBaseAddress
0 _  G( m8 H1 o) f8 {$ X( ]5 ], n- W        CLD
5 I( J2 _# |0 @  A! E. V
       REP  INSW

       // 退出Ring0代码
- b$ f& ?8 u: t1 J9 }+ n2 Y% K        LeaveRing0:
6 i  U5 E# T5 W
       POPAD
8 Q. Z1 z# N% H& E" N        IRETD

. H# P9 ?5 n: @# H6 }        // 激活Ring0代码
3 o* g* V; f; L( g' }, i* I. {) a* y; u* N        EnterRing0:

7 D' Y# m+ Z0 Y( H        // 修改中断门
       SIDT FWORD PTR btIDTR1
- q) @" C2 r& y1 }3 x        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
9 J% W' s8 O: S0 \# ]# h        CLI

       // 保存原异常处理例程入口
' T% U3 C# P- T5 I1 q        MOV ECX, DWORD PTR [EAX]
: m8 p  w# p4 s# J( o" c: q        MOV CX, WORD PTR [EAX-04h]
) w/ O* b/ P; U& [( j1 c3 r0 j        MOV dwOldExceptionHook, ECX
" f. ~: o. g; O
       // 指定新入口
) x+ A+ a3 p7 p/ Y- V+ o' x( `        LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

$ J; U$ d. @) ?        // 激活Ring0代码
7 r: C% k# j# S: ?* y        INT nHookExceptionNo

; q) J  I+ y3 m) Z8 [        // 复原入口
       MOV ECX,dwOldExceptionHook
4 O9 Y* d; R& g* \        MOV WORD PTR[EAX-04h], CX
: L4 k# y3 M4 [- g3 N" L( c3 ?3 ]- R        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
% f5 L3 b0 e# z" ~1 b. d) \7 A    }
   if(!bIsFirst)
   {
4 k7 `( M+ D" [' E) N        bIsIDEExist  = (bool)btIsIDEExist;
7 }3 |( z3 e6 Z, J: n5 Y# U        bIsDiskExist = (bool)btIsDiskExist;
8 \% N6 v0 ~; |7 Q. f( c        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
* }$ ~8 |7 [. L    }
# A1 n  R  R) Q8 c' f}
9 T1 |+ T' L# ?, ?- Z5 E" S4 ]//---------------------------------------------------------------------------
// 调用方法：
# `$ r5 F6 ?" _/ w# |+ d( Evoid __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}