[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
+ M/ v; N& k, K' A; g+ _( J#include <stdio.h>

#pragma inline
) y$ i8 C" X% Y+ q# ~//---------------------------------------------------------------------------
! z5 `4 ?+ U3 a9 T// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
% `$ V& p) i( P#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
9 L* ~" Q/ {. F6 @! q# d" R#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
9 K# e) n7 T/ B: A2 C9 V' econst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
( Q5 O. w3 d# t# o2 U7 X8 y* B0 q
const int MAX_IDE_DRIVES = 4;

// SCSI专用变量
$ u! p9 w! W  ?& x' f+ z* f. W% O& bconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
7 _- m+ j) G6 i/ r: ]; Cconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
4 a* D. y  M& ^) v6 wconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

: o) X' a" [, X' n$ m. y0 atypedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
   UCHAR Signature[8];
: q5 s- f' C1 e$ g    ULONG Timeout;
5 O4 g( @  L+ e* ^5 Z3 `    ULONG ControlCode;
" u1 X8 S: c7 r3 |, P    ULONG ReturnCode;
, L6 x6 Z1 W$ n' d4 J* u  l  l9 {    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

5 C5 G+ x% F, [: K. }// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

: ^0 T$ e9 X% ]; R) e// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
& s. M, R+ d/ j9 Z/ `/ F/ ]8 Z! R// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
$ w1 C. m5 q/ `8 t) m: z8 ]bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
6 c2 ?0 \# n0 {. b4 Y        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
$ K; }" k! b+ b/ e- hvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
" n8 P. L" f8 a* t9 ivoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
2 F$ p9 J8 q$ G! z* Z. o* i, v1 P        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
( Q9 @% T' h! t7 A4 h# @
6 M, ?/ ^. s: F0 [7 D// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
) l$ B# d% q: l6 k/ }$ j//---------------------------------------------------------------------------
; A' o0 j  p) c+ ^1 V! I// ReadPhysicalDrive
" G: U( U% K9 P: A7 r& Evoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
+ Q# i+ ~6 l! y1 M{
   switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
9 H- B0 m0 F5 ~2 H& U+ R+ x            break;
# S1 f/ A3 d" M! C5 F4 a8 U+ E        default:
4 t- P# z( C' E9 Y( E- q" ^            break;
$ K5 [, f- Q/ w: t6 B    }
/ T: x, D5 g2 o}
//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
( K% m; k' t: ~$ w% z* ?{
   static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
  [5 n, c+ x! \2 X% ~
$ z; w: k% a. q2 B/ |, q+ O) I    // Each integer has two characters stored in it backwards
) X/ ~( I+ f5 J7 `" h2 ^: ?    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
5 o* n' W. _. r1 r& h: \' f    {
  L& H+ R1 ]$ G: R1 ?        // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
  F: j$ D1 h) G. \! _- B        nPosition++;
; U7 `! p/ e2 G: l: ^/ j5 I
# k. K: u4 H5 G9 s% U        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

   // End the string
0 a3 Q" e  F* t( m0 G7 b7 e$ ]3 w    szResBuf[nPosition] = '\0';
5 L6 f8 E9 f& J4 g! v1 Z# @
   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

6 k- {- r4 K7 F! a' R4 g+ j    return szResBuf;
}
; d- A0 h& Q0 g8 l" T//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
( h5 P' o5 b+ _{
& F4 K6 P# s( y; F8 @1 S    // 输出参数
' v* N# P2 V7 M    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

1 B% c8 X/ q: s  M, o0 \$ h    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
+ e7 f6 e. Y8 f$ H0 |: o( K    {
6 [0 f0 C: ?% n  Z2 V) U0 x; a        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
4 X8 {6 F* I) t: G, M& B* ^/ v
  h# e: q& p( C1 R9 j4 N        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
+ ]2 [) J" S: ]* a( N
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
3 w2 p( V4 H. Q& ]0 u% a7 U        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
' }* @0 D4 W. `5 x
           // Get the version, etc of PhysicalDrive IOCTL
1 W1 `% d/ d2 N+ F0 \* [            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
( r' y" b( K( [7 }. ]8 z; N                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
               continue;
           }
/ V$ `! c+ P9 p5 o4 A, q
           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
; D8 A: G+ d: _/ ~+ C3 d9 ?                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
) F, f! d+ `9 A: A+ M/ {1 V                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
- C+ o( O0 R9 s( B+ ]                // otherwise use the IDE_ATA_IDENTIFY command
* H* {0 Z* x0 X+ U" F( V. r: h1 p2 n                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
/ _0 f+ V' o1 M' T0 `7 a( ~; F. S7 M                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
4 y+ R3 o% a, b. h  i$ s                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
9 m' j. d$ k3 a, U; A) P/ i! Z
               if(DoIdentify(hPhysicalDriveIOCTL,
9 F2 L- G8 R  {2 c% M                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
4 g; S$ d1 e1 ]: X6 J# _                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
0 I" F( T8 I9 y5 Y' J! z+ O                {
1 {" w( H) ^2 w9 L0 P& k                    DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];

. x1 ?1 D' `" \% _/ L! e                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
5 K% C4 H3 p) x3 D1 h( F                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
( f5 p4 s6 ]8 q$ S: y
                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
. b4 S! F0 ~. r9 k5 D! D+ s
! V& f; _. F! `/ w3 K; h! u                    pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
! a& e) S& l; b3 N& G3 w                }
/ F3 h) w1 g* U            }
5 S4 m9 J; ~$ a+ h, _7 v            CloseHandle (hPhysicalDriveIOCTL);
% T, E6 J  Y9 e, \" t# A0 k' L        }
2 |* V$ U$ z; B; O2 K    }
}
$ f( U7 A% @5 [//---------------------------------------------------------------------------
// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
8 n- p  L( y' U$ n2 K    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
. j) b! {; n, M) B" W6 C  h    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;

. P. y* F- {. y( U' d4 P: P    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
# Z* O; {1 H2 C0 u7 F
   // The command can either be IDE identify or ATAPI identify.
. v- }8 a3 x' ~* o, V* ^( g8 l    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
* f% }+ I0 N# d  Y# G           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
0 f* {. M4 U+ |! i9 [% s( b           (LPVOID)pSCOP,
* B/ w: F1 ]% V6 g           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
. e2 e! W! r- N  {// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

7 s- t% |3 h' a% g    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
  B9 q  Q' R" m  S    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
, E! H  [- n; K4 X" a! e; R0 W' w- ^    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
# k) f) q/ r* N9 }! J  q( p    {
) W) }! v& b2 P. P        WORD dwBaseAddress;
3 B+ E+ R5 Q7 K4 Y: n: b* D        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;

# X" v" S4 k* L. \* ^% s7 e' A        switch(nDrive / 2)
/ t4 Q- {% m2 \        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
  |# g8 b. Y4 q3 d( [" `8 y% u, U            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }
% b: L) f9 r; i7 G- t* f' O
- O3 P% c3 B! t% i/ k        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
+ _2 w: U2 v( Z- ^9 I" x, `                bIsIDEExist, IsDiskExist, wOutData);
5 g6 Q8 h1 e: G, b7 F0 M4 M    }

% N  K* K9 B- c  D) M0 p    // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
; U/ n5 K. t1 [* n/ L    {
2 Y) K$ ~7 E# J# B        WORD dwBaseAddress;
; @( k% [9 A/ E! `7 X  F( e        BYTE btMasterSlave;         // Master Or Slave
+ m$ G" G6 D1 }, x* a+ j* a0 j, w        bool bIsIDEExist;
7 F! e3 R3 |( o5 M* m( M$ O9 J        bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
8 E0 n; a+ }' f9 ^) r- z$ C# O            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
( |6 Y$ W" l' O- h: M            case 3: dwBaseAddress = 0x0168; break;
6 q* ^. Y0 |+ A. O9 R        }
; n4 N% P5 }1 v" o5 }5 t
1 X9 R3 Y4 G& |! F  V) u- j' S6 m        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
9 ~9 E& E) ?  x6 c0 N' D; T4 {
0 M) i1 V5 `+ o0 g: t: g! ?        // 进入Ring0
       bIsIDEExist  = false;
( _) j0 ^2 U* X) b& Y" ?* [# k        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

* R7 H- s- c" K. P+ b) c( i        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

0 q* l1 S& {9 u' U- b        if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
, \  h. }) [3 u& O) q) l- C3 G            char  szSerialNumber[21];
8 B% {1 Z: b  Q# h) ~            char  szModelNumber[41];
' C: ]. r& v7 [8 A3 o# m7 V2 E5 w
           for(int k=0; k < 256; k++)
9 o; V4 b0 X7 s9 d' @# U5 S- ?                dwDiskData[k] = wOutData[k];
2 g# T# Y0 U& j( G
. ~  H9 ~  R4 k! C" J            // 取系列号
0 T. v' [$ W- G( w/ q! h5 \            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
  \. z) \! s2 \6 y% Y$ H; M  i            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

4 o2 _: a. c7 q. _- u            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
1 _& z/ e4 i9 A4 E! I            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
$ a  ?' N. s' L+ O+ A
: V: z2 K9 f6 A            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
       }
   }
" l2 B; e) ]# P* ^    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
. W2 }3 v* G) p9 l' E// ReadPhysicalDriveOnW9X_Ring0()
1 q$ T: j) m8 @& H- Q5 Z( j/ o& K//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
; Y- ^) x, F1 G; i1 X# @  d9 v; Q{
   BYTE  btIDTR1[6];
+ X; G( C5 S4 s- S3 Z/ J$ `2 s    DWORD dwOldExceptionHook;
" ?+ G; }3 n: w3 ^    const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
1 @" U! |( \2 h+ P/ k
% }' u5 x# F( y8 m    BYTE  btIsFirst = (BYTE)bIsFirst;
) q8 Q8 @# n' G" S, T
, \) u* L' O1 ~3 R6 R3 O' G, U. e$ M    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
- w- K3 m  j# O; q# ^) {( E    const BYTE btBit06 = 0x40;
! p8 C  B* o* b' s% S; G    const BYTE btBit07 = 0x80;
0 u; E! x+ J9 l) O+ ?/ M# x* b# \    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
* P- T3 [& e3 ~3 o) V
# ?1 J' c! N6 i& d2 w    __asm
   {
& m+ `8 r9 N) F6 a8 ]2 j        // 必须先执行这条语句
3 J" g& G# r, A% i1 n: s        JMP EnterRing0
: ?% \4 ~; P8 m
1 O8 \( Z. e  U2 A( A7 P# o        // 定义过程
* i( M9 p9 E2 s( ^8 Y# s5 A        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
: N9 n+ G: [9 }- c/ X
       MOV  EBX, 100000
- [1 W- P, _; l5 I9 ~/ U        MOV  DX, dwBaseAddress
! V5 _; ?) L( \. g, J3 f( {& v        ADD  DX, 7
1 y. H& t1 s$ g& p
       LoopWhileBusy:

+ O. ^( {* ?1 y, U2 x: ?        DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
       in   AL, DX
- [  `2 E8 n' _# k3 T        TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady

% A) J2 U# r( R) q$ ~6 D9 b        // 超时，直接退出
; E5 `4 N# U' M3 |% d        Timeout:
/ H6 d8 T" y% c7 ^! q1 S$ Z        JMP  LeaveRing0
       DriveReady:
       RET
& N& P& a2 s! N" h- D, u9 R7 I        ENDP   // End of WaitWhileBusy Procedure
8 I* m+ A, T! M2 h# A' y
       // 设置主盘和从盘标志
       SelectDevice proc
9 J7 h; O& H) {- T: ?  Q, T
+ i' ^! p& S4 j  m- D; t        MOV  DX, dwBaseAddress
$ r( v4 R. @0 ^        ADD  DX, 6
       MOV  AL, btMasterSlave
7 j6 W; p! E* v  A! n7 G3 w* A/ l& a
       out  DX, AL
/ J- h  R# d2 d( U8 u+ _        RET

1 r5 j9 B; c# P0 l        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
  M. K" o# L0 W( Q' c3 ?3 Y6 ^& m        SendCmd proc

, m; K1 q4 Z4 f' `1 f        MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
2 @8 ]* H9 u" \$ B        RET
- y0 {( F$ L8 l+ l        ENDP  // End of SendCmd Procedure

9 y4 _, X: t4 n5 |7 T; l) P        // Ring0代码
9 U/ |) S: p& Z# g. x        Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
/ a4 \1 Q, J8 W; J1 g6 {        MOV DX, dwBaseAddress
       ADD DX, 7
; M; {$ f5 t% a        in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
# l, ]$ \. i+ d1 G5 D7 z; R        CMP AL,0xFF
* @3 o, F2 p( A* l, _& s        JZ  LeaveRing0
7 {- N& v; u: H' b9 E, \( f        CMP AL, 0x7F
+ S- {( r. Z7 f* w. L        JZ  LeaveRing0

       // 设置IDE设备存在标志
; G2 w# S) h. g6 ]; F: K3 }        MOV btIsIDEExist, 1
2 h9 z* G5 h1 _& V+ E
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
$ Y5 B) w2 `9 Y        CALL WaitWhileBusy
- |" I$ {' F' x7 H        CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
: L! C% X! J2 r/ l        CMP  btIsFirst, 1
( a) k- X, x" e8 O% q        JZ   LeaveRing0
0 o4 s9 W3 r( q% }4 [$ L8 F4 k
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
* c% ~; ^( L4 \% K7 T) z! V        TEST AL, btBit06
       JZ   LeaveRing0
5 d. Q! h+ @% S. Z0 c
: S" N8 P7 H% d# S        // 设置驱动器存在标志
; m) w  G: e9 d! S8 E- x3 O" ]        MOV  btIsDiskExist, 1
: r3 a2 F! ~6 u! B) |/ P1 Z! W4 V; l
       // 发送存取端口命令
* @/ m& x) z; l4 i! M$ W        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
! a7 Z) I" c3 k/ {8 M  }9 r        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
- x+ Z2 f% T" J: @  m        CALL WaitWhileBusy

       // 检查是否出错
3 @; D4 d+ @4 p8 J0 O        MOV  DX, dwBaseAddress
       ADD  DX, 7
- T* d. H1 u& x1 Z' }" L" }6 l
       in   AL, DX
4 A6 q; U7 j' @7 R
       TEST AL, btBit00
7 j7 U0 G$ P! [7 U        JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
' M- K% U5 D! x        CALL SelectDevice
       MOV  BL, btAtapiCmd
$ p2 q4 N, o+ H; [7 V, d/ K7 W        CALL SendCmd
       CALL WaitWhileBusy

       // 检查是否还出错
$ R6 M; l7 e% W; G        MOV  DX, dwBaseAddress
/ o; `$ a3 b, \7 N        ADD  DX, 7
+ l/ e) }' R) H; z" k  A8 K, A; d        in   AL, DX
       TEST AL, btBit00
5 Q# w/ x' T& H$ w! j9 L        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

% p3 w# \- f2 i6 @; v0 o        // 读取数据
       RetrieveInfo:

% C2 f% r) w, L        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
* c; R' }0 U( `8 T0 t        MOV  DX, dwBaseAddress
       CLD
' m* R2 e4 b' s, y& |0 k; h2 K  s  c
/ n% J9 r# I5 u  a+ B* U        REP  INSW
$ e0 ?3 R" N) t" z- `- e
       // 退出Ring0代码
       LeaveRing0:
# G4 S  x2 e9 \, ]: b
  A% X6 U: g9 c. O" _        POPAD
       IRETD

       // 激活Ring0代码
$ @( c! d' d. N- h+ L8 ?        EnterRing0:
1 x& w! w) n9 n+ D( g
       // 修改中断门
       SIDT FWORD PTR btIDTR1
) A4 n9 l3 T$ x* L$ |        MOV EAX, DWORD PTR btIDTR1 + 02h
9 b+ t+ n% G6 Q* g& B        ADD EAX, nHookExceptionNo * 08h + 04h
$ s5 `! z. O. ]- l) g        CLI

       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

       // 指定新入口
6 Y( t% f% R# ?2 f7 h( [        LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
( {, W& s7 Q$ I; B9 u* E0 x        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
( b3 s3 g0 F  @3 A4 A5 ?
2 o2 W8 N/ m5 b0 B  A        // 激活Ring0代码
       INT nHookExceptionNo

       // 复原入口
: L! J7 S) P+ J( b6 ?3 R        MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
! V, ]  v" [' }+ T7 _/ U        STI
   }
0 Q' X! Q9 g0 Q6 P; L% @    if(!bIsFirst)
) I& n9 @- O: b: L/ n2 i    {
7 I% Y* T+ R; B) P# J        bIsIDEExist  = (bool)btIsIDEExist;
  m  _. `' l1 ~0 A; w" f        bIsDiskExist = (bool)btIsDiskExist;
3 V9 Q+ l' e, P$ H- N2 e/ |' |# K        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
, ^8 m! g4 u) ]3 j- s    }
}
//---------------------------------------------------------------------------
7 d: K* t4 K6 o. i9 g// 调用方法：
8 P' y  X0 x# }$ `$ F2 Tvoid __fastcall TForm1::Button1Click(TObject *Sender)
8 H4 `1 n4 m8 `4 B{
8 Y+ C& n. l0 r4 q    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}