[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
5 e. v: v* h: m3 _* U  {1 P, @) ?
#pragma inline
) z& i3 w* M. `+ n, o2 \  j//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
' j% G! r5 @' M8 @/ \9 D
" R" o6 L. X2 j2 @3 ?+ Q7 E& oconst int MAX_IDE_DRIVES = 4;

// SCSI专用变量
" N8 d9 v, S; R- Fconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
9 x$ b& b* h0 [7 }const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
' y! f% ]5 Z. J: r9 n' G0 J5 B+ U
typedef struct _SRB_IO_CONTROL
1 j: `; \- \$ w1 d/ N{
   ULONG HeaderLength;
   UCHAR Signature[8];
* Z) \4 K0 H% F! [    ULONG Timeout;
2 d* q0 V- G0 i% _$ [* K    ULONG ControlCode;
  n. A. Y( v3 m    ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
7 r8 x* z1 v3 N9 k: I9 o& K
$ A$ {4 m4 ]; F1 m/ `' p2 J, l# b// 辅助函数
2 p6 V% Z; p# {. n; d% g$ Z6 mchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
5 d6 _3 P& ~" H8 W( z" x8 u3 _// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
1 R  W* F' q7 \        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
: E1 K0 _1 d( X        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
$ E% \5 k& c! n) b" d7 ^, B% j. u6 ?" ~void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

- m( n, d! R; g: D// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
) K" D" S+ u6 F) ]* F// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
  o, m( Q& O# l, @{
   switch(Win32Platform)
' M6 u/ U/ a  U( Q    {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
: `6 T- d, Y; w3 T1 q) a( x  O; U            break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
. E% d3 R" Z( m. D" N6 M6 |            break;
8 h4 O2 `+ P, i4 V        default:
# w& A: @6 d0 @: F3 T( v            break;
! o% Y: ?/ W, J2 F- d  I' ^    }
. n/ O$ \$ \3 H& Z}
% x, v- N. B4 m) J  h6 g& p//---------------------------------------------------------------------------
// ConvertToString
4 G2 [& @- ^( a# T6 P- Z+ l7 B: Vchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
   int nIndex = 0;
  N; |6 E" D; X2 C' b    int nPosition = 0;

   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
, Y2 F  E& L0 m    {
       // Get high BYTE for 1st character
) Q0 l# ?  J) O2 D: M        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

# N( G& @8 M% Q        // Get low BYTE for 2nd character
8 x+ o" p  A$ X0 J- T: |        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
; D" l# O/ t8 A: ]7 c        nPosition++;
5 S. u5 J/ T% H+ p    }

- l- r" k: _( X' e. d    // End the string
   szResBuf[nPosition] = '\0';
% `2 S; k7 h" O
   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
8 O  h  N# c! |: A/ H) f4 H* Z/ R  q}
% R$ }9 |3 a+ l6 m//---------------------------------------------------------------------------
, b5 J: i8 l6 M: R) t, |// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

6 h% d( D. K. v3 m  {    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
' M  E/ [8 r; c% b! Y/ a0 F- P' P    {
1 z+ t+ b8 s1 ]8 Q. B        HANDLE hPhysicalDriveIOCTL;
. K9 E4 y1 m8 ~* A; E        char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
6 B+ o; d4 E9 z# }& K# N                        GENERIC_READ | GENERIC_WRITE,
/ Y1 U/ O9 {. Z! {4 h0 N) L+ K                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
* y2 C# N4 g( L" c" x5 t                        OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
! g6 O) U9 U* m' v4 H" Y/ h
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
4 t/ ~; a6 k! w1 t) O! v6 _( X                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
# y+ @$ o" |5 @( M7 g! H$ ?                    &dwBytesReturned, NULL))
           {
/ W( \7 U0 B+ U                continue;
$ N7 N, a( \5 I: }0 c            }

0 E$ |/ G1 A/ A0 U. Z            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
- s! z! y  q9 o: h1 O; s7 y9 U                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
, C. k$ q' n  Z8 y                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

2 ^( R7 Z1 ]4 \                if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
% ]9 Z. g6 |9 h1 u8 h0 i                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
6 r' d! q& m$ I1 x+ r1 Z                {
                   DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
, G0 }& ~9 g7 U+ z; t8 M                    char szSerialNumber[21];
' S2 Q- U9 l6 }1 V! P                    char szModelNumber[41];

$ ]4 A3 P- ^% u                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
3 }# V: U, H6 B) j( ^* J                    for(int i=0; i < 256; i++)
1 i- u; T" i; f& r, \( p, c& J                        dwDiskData = pIDSector;
8 v6 T% ^* J4 q( T1 m. Q1 n, D2 Z' w                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
) s6 n8 X" Z6 @                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

1 D2 m2 D2 m, T2 w: i. v                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
2 K0 c' ~7 y& S                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
" L0 D1 o) C' w$ W0 W1 v                    pModeList->Add(szModelNumber);
2 O, o. e+ n3 m# I& s" j4 n, E, t) _                }
( x# i: R; W) \            }
           CloseHandle (hPhysicalDriveIOCTL);
       }
   }
}
//---------------------------------------------------------------------------
9 h: ^% N& X$ R, A/ {4 {// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
! J6 A7 P1 q4 o# Z* A$ T5 q              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
" T1 e1 Y9 g1 `  U; E: o{
" S% j% u: H4 Y  ^# u' T; v    // Set up data structures for IDENTIFY command.
' v6 S$ n# d! ~( R8 F# n4 h    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
" Z; R; S: a& i9 \$ A( ~    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
* v9 A3 t: ]& Y$ \) m  P* S+ F
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
$ c9 ?9 f8 [! x' @5 t2 p    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

1 J5 S* \: ~7 x    // The command can either be IDE identify or ATAPI identify.
7 J, Y7 B3 @' X    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
# {" W' \. `1 ]8 ^) ^
* z/ ^1 D  k! n1 Z+ x( T    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
; c- e' G7 z) Q( ^& R+ h           pdwBytesReturned, NULL);
}
! D6 ?9 R8 `, n0 h  t8 Z//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
4 F6 U  [4 ?" v" J: A//---------------------------------------------------------------------------
, C. Z6 [3 x+ ]1 L9 Q2 n7 w4 {// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
5 z- h' q0 X! N  {& \! A8 T9 w    WORD wOutData[256];
: V' F; j) H6 ]; N    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
- O# W& S. p% o    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
4 Y# T: O1 R! K) @2 l% P    for(int nDrive = 0; nDrive < 8; nDrive++)
+ M5 k3 u% k* S( }% e2 W( c* A    {
       WORD dwBaseAddress;
6 G* N' ^$ v+ g) r# q' H        BYTE btMasterSlave;         // Master Or Slave
4 O2 l5 c. R5 w7 p, f        bool bIsIDEExist;
- x9 ^  b+ ^7 `+ P9 v9 Z        bool IsDiskExist;
' J# e9 @5 [  C
       switch(nDrive / 2)
) o1 W# i9 e1 g        {
           case 0: dwBaseAddress = 0x01F0; break;
# @8 L, R% G7 t7 P7 b+ ^" o5 }            case 1: dwBaseAddress = 0x0170; break;
2 ?( ?4 \1 i2 Q' a            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
  X# C5 g* S, J5 M        }
. H/ c: q* K: Q$ ^
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
* L3 N" ], }5 i                bIsIDEExist, IsDiskExist, wOutData);
; A4 `1 C& m+ C" B    }

   // 开始读取
* |2 {. k; o9 |    for(int nDrive = 0; nDrive < 8; nDrive++)
: m2 w: h* J1 g8 r  f$ Q- ]    {
; |2 W4 g. u1 i) x4 D        WORD dwBaseAddress;
6 U6 w9 F2 J5 [: Q, ~# j4 ?4 q6 y( z        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
2 b+ ?. K% L' Y7 o* J* b! \        switch(nDrive / 2)
  r- d% B5 ~& d0 v/ f, [, c7 a" b5 n5 `        {
; i& h3 ^" f2 ?9 l6 Q            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
( m( |( c5 i, P! e- S0 W& `2 `            case 2: dwBaseAddress = 0x01E8; break;
/ L! j6 ]1 ^* N: R# }            case 3: dwBaseAddress = 0x0168; break;
7 W. C8 D. Y2 G  K5 d        }

" Z1 O9 ^+ m* y/ |4 K/ G9 Z        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
$ X$ n# U. Q! X' P5 @6 \; W
  ^9 K& Z; h- y6 v- g& w        // 进入Ring0
       bIsIDEExist  = false;
       bIsDiskExist = false;
& i: {3 r9 z3 L        ZeroMemory(wOutData, sizeof(wOutData));
# w" Z4 Y& S' K7 ]
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
5 J* b" b- L3 U' g& b: f0 A
9 o: v- @& j: a# Y' C        if(bIsIDEExist && bIsDiskExist)
6 L* O5 x1 _1 Y        {
           DWORD dwDiskData[256];
  [8 q! p" N) e% f3 X4 `! E            char  szSerialNumber[21];
           char  szModelNumber[41];
/ j$ B8 B' g# ?8 E
           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
4 A  ?# E, Z9 \
: D" S+ _( Y. P- g, R, w            // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

' @9 B4 X: p- ?  ^: X8 N& J" ]3 E            pSerList->Add(szSerialNumber);
: Y/ e% z1 _' {            pModeList->Add(szModelNumber);
1 O. |; F- z" A; P3 d        }
9 h& U. m+ C! L6 x! C# v" t4 g# z    }
1 {& T5 z! |8 D( j% E" V7 L3 L    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
. L6 \9 i1 G: }0 F& l, t//---------------------------------------------------------------------------
3 e6 d2 i+ v8 R; J( t1 X// ReadPhysicalDriveOnW9X_Ring0()
//
4 a! q1 I4 C. Q1 `6 a8 W// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
! K, o; S3 N' Z5 `5 S0 D// btMasterSlave = Master(0xA0) Or Slave(0xB0)
: l; o4 B) w" i5 v. w//---------------------------------------------------------------------------
0 `; Z; c8 f7 k7 g* cvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
4 t" L- [1 L; C" G5 H: l; W' j{
' J9 _* V! U. o- q    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
3 K% E/ s7 G- L8 p3 w. _$ G    const int nHookExceptionNo = 5;

  y! W3 @  v7 I' v$ f4 ]    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
8 T0 [: v1 m) S0 V6 Y: e+ `    // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
& v7 |8 o  o. H3 _    // const BYTE btERR  = btBit00;
' e& U& b# d- q. L1 T$ J2 H    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
* `. {0 f! K! J: N    const BYTE btAtapiCmd = 0xA1;
+ v6 U9 z4 Q; U8 x0 O" o9 Y% W
   __asm
   {
- x, }5 z) \% \8 G/ j        // 必须先执行这条语句
       JMP EnterRing0

       // 定义过程
       // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

       MOV  EBX, 100000
* O. @* d  Z3 W% l# U9 r% x        MOV  DX, dwBaseAddress
, p4 z' ~& J' F- j3 J0 l6 U- c        ADD  DX, 7

+ b: z. ~# @8 V6 V2 }% n; G        LoopWhileBusy:
  R4 ^) m! P  c: Q9 m7 h5 j  i( w1 V
1 ~  t' A; |% [: x* H  T        DEC  EBX
* L8 D2 P. k: K( n7 d5 ~% H        CMP  EBX, 0
+ R: T7 A9 ?2 P- e$ Q" v        JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
8 j6 ?2 Y* }7 q5 `( j* Y3 b        Timeout:
       JMP  LeaveRing0
( T" O6 _+ e( `, F6 j2 R        DriveReady:
       RET
       ENDP   // End of WaitWhileBusy Procedure
7 j* u% N8 J3 W* x! u
       // 设置主盘和从盘标志
1 X  P7 I/ d6 C- r        SelectDevice proc
; |! q7 `- P& x' S2 T" R: v
2 X! J+ t8 @( L        MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
6 |9 v* R3 \3 P
       out  DX, AL
/ k5 k  k$ u. `8 S' v2 T! l5 y        RET

$ q$ Y( `+ H4 a        ENDP  // End of SelectDevice Procedure
  G% P, Z0 f! ]* r2 R4 a+ `
) Q3 `! |' |) M6 y( @        // 向IDE设备发送存取指令
! M% O6 p2 w: y' D        SendCmd proc

4 x  V9 I- Q) R. b        MOV DX, dwBaseAddress
       ADD DX, 7
0 j" [1 p# W+ E. u. w9 ~        MOV AL, BL // BL是主从盘标识，在过程外设置
/ {& t+ W$ [3 `        out DX, AL
4 `$ Q6 U# o" I) o/ e8 }$ u! v1 _        RET
& K! ]" E& m' s- D( r  E3 }        ENDP  // End of SendCmd Procedure

5 p4 T/ w! r1 K* ]1 E; @. U* A        // Ring0代码
. }+ r9 m3 e* B# |+ [        Ring0Proc:
0 F4 B. q' o2 X3 V        PUSHAD
. p2 C. c, B4 G. K8 ^        // 查询IDE设备是否存在
$ M- j  J; a2 l        MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
$ ?! B# x' N; u  z& }4 m
" P; J" E( W' _. h' r9 t0 u        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
9 S/ O# ?- z, ], E        CMP AL, 0x7F
# i' H, l4 S- X( \0 R, ?: X        JZ  LeaveRing0

       // 设置IDE设备存在标志
: i) @# _3 t+ t        MOV btIsIDEExist, 1

3 [; l6 T/ k7 |0 H        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
; y" p; x) Y8 T/ c3 D' _        CALL WaitWhileBusy
1 t% c* o" H" Z, I1 n        CALL SelectDevice

  X( n1 Y; P, z$ X; z( l3 P        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
/ ^5 f+ l8 h9 b+ ^        CMP  btIsFirst, 1
" U4 K( L7 T* W* r        JZ   LeaveRing0

: C, T3 C3 Q( O& M  p5 s) n        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
; f9 M0 L! j/ d3 y        CALL WaitWhileBusy
# \* U# ]) A2 W
7 S  i- x+ d' E! d! X* E        // AL的值等于cBit06时，不存在驱动器，直接返回
' a6 `% z$ g" }+ `1 J( P        TEST AL, btBit06
       JZ   LeaveRing0

1 M4 S8 O7 `7 M  s        // 设置驱动器存在标志
, g3 f+ Q& z; A7 z0 f        MOV  btIsDiskExist, 1
6 |! Q+ g/ T, Q/ e9 Z/ i
       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
" @4 c9 G+ q, S6 [        MOV  BL, btAtaCmd      // 发送读取命令
% Z! Z: e5 ~( E& Q9 t, u        CALL SendCmd
1 F0 W7 y* |/ O. l: y/ L        CALL WaitWhileBusy
0 ~5 p( H* [6 \* A/ t
       // 检查是否出错
       MOV  DX, dwBaseAddress
  _* {' S( K5 a        ADD  DX, 7

       in   AL, DX

       TEST AL, btBit00
& u  T6 ]: _. A+ Q! K, V6 s        JZ   RetrieveInfo   // 没有错误时则读数据

& s1 z0 q) G* P( e" G0 W3 G        // 如果出错，则进一步尝试使用ATAPI设备命令
1 e& o% ~! A6 i' R  q        CALL WaitWhileBusy
9 T* \( t) T3 {8 \  {  |) u        CALL SelectDevice
       MOV  BL, btAtapiCmd
  {7 X1 T1 Z( `$ U5 k1 F        CALL SendCmd
$ F3 l( R; u* X. [        CALL WaitWhileBusy

       // 检查是否还出错
       MOV  DX, dwBaseAddress
# A  o( E. M, N( Q        ADD  DX, 7
1 W1 K9 S( Q$ q$ e" Q        in   AL, DX
& E% n' x" W6 T6 [: z        TEST AL, btBit00
4 E5 i* B, i& X        JZ   RetrieveInfo   // 没有错误时则读数据
+ \3 T# W& Q! f" f/ Q/ U  w" P        JMP  LeaveRing0     // 如果还是出错，直接返回

       // 读取数据
1 f  C: w4 e# {. h4 \7 a1 V        RetrieveInfo:

# ~* B5 A* P/ i2 E4 ]        LEA  EDI, wOutDataBuf
2 v2 f; F4 y" }& t6 {+ S. G# `        MOV  ECX, 256
       MOV  DX, dwBaseAddress
& _/ U/ ]6 b: x4 G7 E0 z        CLD
' E! K0 }0 c- }) A! U
       REP  INSW

       // 退出Ring0代码
  d3 y: w$ A: N7 m; J! n+ B        LeaveRing0:
+ O( D, x- w, v0 L; q& O; X6 V5 P
       POPAD
       IRETD
9 @7 M0 j/ s+ l, _2 q/ F
& ?/ }6 V2 B* A6 D' k        // 激活Ring0代码
: e+ U' Y8 t2 t        EnterRing0:

       // 修改中断门
: g, T# S' q: p0 O' C( B1 |  C        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
. V/ a( x  T5 N% f; @2 i7 }4 h
, O( M' e8 W1 R  ]6 n2 u        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
5 `6 d8 ~. c4 _6 Q& R
. T( e5 ]* b9 ?( K  Y8 }* H% t        // 指定新入口
5 v& [7 s. ^) f2 o8 ]        LEA EBX, Ring0Proc
% C5 J! s: s' {8 ~        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
- f( `0 R2 E: a; m4 j! u/ H4 \        INT nHookExceptionNo

2 M* z2 a5 r$ n) k+ M        // 复原入口
  V9 h; J5 o9 X1 ?" D        MOV ECX,dwOldExceptionHook
2 J1 G6 C  b' [( U/ b( l* L        MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
6 S, O2 Q5 n) b7 K* H; V7 r        MOV WORD PTR[EAX+02h], CX
       STI
   }
' g1 B) A1 B& H- f    if(!bIsFirst)
   {
       bIsIDEExist  = (bool)btIsIDEExist;
3 G. N3 o5 h" j; a' {/ W8 u; `) b        bIsDiskExist = (bool)btIsDiskExist;
! p* ]$ v! r/ t0 @: @; H5 L: i$ T$ W        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
//---------------------------------------------------------------------------
// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}