[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
- y" m1 d. B. u. f4 n. K#include <stdio.h>
+ o0 ~- t# [* Y
6 W! J3 K4 I6 l2 |/ k#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
# F% H( z1 @+ x' n4 L2 U: v#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
# h: |( J9 n$ I#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
' D' [7 B# z; r, U) pconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

const int MAX_IDE_DRIVES = 4;
/ v$ m. c1 b- J* e: @& R
# n8 V& R* V  s8 s// SCSI专用变量
- }. \4 R6 I) n' H- Cconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
7 f8 ?# {* ?# @& n* Econst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
  p. y$ x7 Y! X& Q( e* Xconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
# C1 h; u/ f$ R! x1 J* t9 f$ ~* @const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

$ C5 l3 f/ s% ftypedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
2 b2 P& `- x9 L( y) x6 K; @    UCHAR Signature[8];
$ I6 K5 Q1 `/ N0 n' A5 U7 W( N    ULONG Timeout;
   ULONG ControlCode;
: O; ]' M! F- f  O$ z- y    ULONG ReturnCode;
1 d7 o% z# p0 e% T. D& W: D' B+ X/ j    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
5 \  U! \% @# N, X  F& a
6 J) \* D- Z5 c+ p4 `/ D' `9 C( ], m// 读取的主函数
- i# q6 c/ r" m( I$ Jvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
0 }6 U0 C% x' l; S
5 O6 \& ^4 M* M( P$ ~1 f3 i8 ^// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
1 s; g( z5 @, }) a- x! q7 zbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
. G( ~$ X5 X! V( Z# V- {: r6 z        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
* K  u- h; V* f7 S1 |% A( d        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
; B4 c; Y% y0 n6 Q// Windows 9X函数
; e, c" u' F1 F2 ^+ c6 mvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
8 ?% A5 \, U; j1 h( N; ^. s# _void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

9 y9 L7 C; r) ~: t: e// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
! x1 h  O3 g0 {( ~8 h$ F//---------------------------------------------------------------------------
. k+ c/ p6 R* c// ReadPhysicalDrive
+ V9 |1 }  T9 u: j2 Qvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
) @" S9 Q" m, j; l0 _- [9 `% M{
0 |2 L6 w; ?) `' N# m8 D4 m: i    switch(Win32Platform)
   {
4 o  f( K' T- r. \        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
0 M5 A6 a: m% a3 u- V! V            break;
       case VER_PLATFORM_WIN32_NT:
5 z- {, L6 W3 a  m; y            ReadPhysicalDriveOnNT(pSerList, pModeList);
* q4 `) W0 D6 x! M            break;
       default:
           break;
4 t7 w; y0 t) Z8 E5 _$ e( w    }
: ~1 ^0 N9 V" g3 O5 a$ t. s}
//---------------------------------------------------------------------------
, Z) b0 z! z' c// ConvertToString
+ `8 W9 h2 d  G# p/ Uchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
   int nIndex = 0;
, L1 a0 l) o0 a1 b2 q; a    int nPosition = 0;
  }, C9 F" V2 C7 p
   // Each integer has two characters stored in it backwards
0 x* p& l& w1 X& y0 n! {4 k' m; |    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
+ {' J, X) Q( c1 O9 I* g8 N    {
% R5 ~- V: [) v4 U1 y. o+ l" u        // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
6 S4 ]0 r6 V& F- @. H        nPosition++;

/ S) F9 ^" \( B+ f# \6 T' t        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
/ U4 Q- r! J$ I" K9 P: O2 v' {        nPosition++;
   }
% n% Z! k$ w- Y' V
3 t0 L8 ?7 Q. l0 q; X    // End the string
8 `' q$ l* [( j; t0 F& b2 c    szResBuf[nPosition] = '\0';
. Y& }5 [5 w! J9 W. I
   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
( F/ G/ I$ K" G: E" y9 f: I& G        szResBuf[nIndex] = '\0';

' j$ z+ e$ |7 X0 ~0 t3 @; T, p    return szResBuf;
}
0 a5 }2 D2 ?' Q- l//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
  [+ X* h- c+ n! M  Lvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
$ X3 z" J2 G7 _) V% ]  o    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

; y- X: Z- l( s% g    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
0 z" y' z, V, F- R- o        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

/ A7 s, Q: {$ b- c& a2 E        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
4 w0 j5 l5 d' n' O7 d( y6 W        hPhysicalDriveIOCTL = CreateFile(szDriveName,
) k. H: f( |6 i) `+ J& }* Y( P                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
4 `& F( ?! U/ d; M! b8 a
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
1 E6 F- w, ?# ?/ K* @        {
           DWORD dwBytesReturned = 0;
. t4 M5 G7 h( }, D  G6 d            GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
( o# b* Z, r- O, B5 r            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
' q5 }% y' Y! s+ E5 f
! u. h4 l' A. G0 l9 x5 {            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
9 y, _8 m' I0 `! s                    &dwBytesReturned, NULL))
           {
               continue;
           }
% Y5 K6 I7 x; z, e
           if(gvopVersionParams.bIDEDeviceMap > 0)
! |+ K% L, _: `9 H3 y4 t1 i            {
$ J+ ?" y7 Q3 I: t                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
2 P2 N' ]9 w6 M! u6 a* s  ?                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
+ j' _  g! h6 G" E7 r& ]% R) |                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
. y4 F$ }% L- V  U* a                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
  I- m8 z$ ]! n& }- w5 H
  D5 p. V0 l: ]; z" H# y9 e3 X                if(DoIdentify(hPhysicalDriveIOCTL,
7 x& ]. ~" x9 G6 ?! P; v                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
; l9 G+ w4 K3 O" V! s& i' Q                    DWORD dwDiskData[256];
0 _7 h' T/ R" s                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
3 ?5 V. i+ ~( S6 |  K1 g                    char szModelNumber[41];
% z2 f" d+ O) I, p
  G8 `  S  R# ?4 S$ Z                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
$ U; u/ k, }1 u1 e" V' c! v                    for(int i=0; i < 256; i++)
+ k( A# Z8 V0 f- G( [; X" u                        dwDiskData = pIDSector;
                   // 取系列号
1 o1 N4 J5 d1 a3 Z$ o                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
1 `5 m' v1 p8 _                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
( v6 X# f) `' Q  X, f8 F: f                    pModeList->Add(szModelNumber);
               }
           }
/ j) r) `# t& S            CloseHandle (hPhysicalDriveIOCTL);
% [7 J7 F: J$ ]3 N  F9 U        }
   }
$ V2 Y+ @7 }) N1 u% a4 o: K}
; F: j! ?; u: e) ]. S; v- q//---------------------------------------------------------------------------
6 Q  [& T/ J% n// DoIdentify
5 l. m3 u- j* Q# j& Kbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
' n% v$ o/ X2 W  ~( ?6 x$ h% W" \              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
. `" x& F8 h5 ~              PDWORD pdwBytesReturned)
. d: M8 Y8 h6 i4 {{
   // Set up data structures for IDENTIFY command.
2 @4 U& x& |3 H& }  C7 _    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
  `. C9 L; U& \1 ?5 H& ]2 r    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
5 X. b0 J/ n4 v' n; l( }    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
: C% S8 ]- z$ V, g    pSCIP->irDriveRegs.bCylHighReg = 0;

0 q2 O+ B4 F: [    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
5 }' Z) T/ S. I; D9 T( u* K2 d
   // The command can either be IDE identify or ATAPI identify.
( c5 N$ P9 J( O% [    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
2 f! C7 |0 ^3 c% m6 V- u5 Z0 x& J    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
! X9 v& ?$ ?" n3 m
9 m3 M8 |, ], w    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
) |1 A0 \2 D7 [/ [+ d           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
. Q! o, d+ P" h5 Y// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
; V6 k- y; a' Q/ ]5 [( F& z// ReadPhysicalDriveOnW9X
4 z- }4 Y1 F* \+ h: gvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
. K; [7 U8 \+ H8 h+ N5 Z9 x5 `    WORD wOutData[256];
! Y5 Y- L  \& z+ ^! J    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

! @. @: }9 q2 L3 E+ y6 w    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
' w% B  a8 u' m0 D. o0 `3 B    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
* B7 }4 C; H  e2 t3 r* u        BYTE btMasterSlave;         // Master Or Slave
; i: i) |$ R8 t0 y% R7 p4 P9 i6 L" E        bool bIsIDEExist;
       bool IsDiskExist;
' @, N& i" a( g' g7 s3 P
$ @' B2 K6 h# F1 P        switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
' C; \5 C3 |7 U" w            case 2: dwBaseAddress = 0x01E8; break;
( T4 s& V) r& O& i$ p( m            case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

" N+ W& b( i# F1 ?/ l9 y3 T. r+ a# H        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
& {7 @; h/ R- C& P+ n/ m6 i# @* Y/ u    {
       WORD dwBaseAddress;
2 E9 E2 Z3 l" N1 Y# v# U8 D        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
8 c" x/ {  ?4 V6 c$ I# d. u0 l& ?        bool bIsDiskExist;
$ `. R6 g9 E; f        switch(nDrive / 2)
! g/ x: k& K, q        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
2 h# b! u) ?! z            case 2: dwBaseAddress = 0x01E8; break;
0 R& \+ b7 W# [8 i: n$ D" z2 V) g            case 3: dwBaseAddress = 0x0168; break;
: h6 x4 L) J2 E! w        }

5 b5 {$ S1 G" r$ S( _        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

9 @; p/ T' O9 I7 u. \        // 进入Ring0
0 i/ {5 M2 H5 R1 |        bIsIDEExist  = false;
$ X+ ?( [' ]  s: g. E1 h0 p! u& m* W( O        bIsDiskExist = false;
2 i0 |. O2 y" A( q8 E        ZeroMemory(wOutData, sizeof(wOutData));

+ v4 b) D  l/ a! ?7 g8 g        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
! O4 p+ X* D9 x: O
. u) X/ i1 E0 Z/ t. w0 e" x2 Q        if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
; `5 `1 h# S# m& l- N1 F            char  szSerialNumber[21];
           char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
3 C1 v; N& m2 F  c& q
. w. J7 `+ Z4 s$ P            // 取系列号
+ G5 C) ?# M- K% b            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

) d- p* {  Q' g            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
' V$ d  J0 T" E1 ~$ p! x9 |            pModeList->Add(szModelNumber);
8 A* R) {" E5 l. M2 c0 m0 I4 s        }
   }
' G) q$ R+ z( X" C$ ^    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
1 d' x0 I( G" g+ b, x1 C}
& I+ L% t$ c4 Y% Q+ v//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
- e" A' k+ O/ W//
( t% a% g& }% U: p// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
8 t- }8 H0 g& }- f, Hvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
3 D" W9 q& n; q1 w, A    const int nHookExceptionNo = 5;
9 Y9 h% m' f. o9 T- c
   BYTE  btIsIDEExist = 0;
1 h) \  |$ r  D9 [( y    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

! {5 k( H  q4 Q* G1 k    BYTE  btIsFirst = (BYTE)bIsFirst;
* j& C* P+ M5 J9 l4 D8 ~% [
   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
* v5 y& _9 D1 w. H+ w6 p    const BYTE btBit07 = 0x80;
' X/ ?: B. w  B5 x# y    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

   __asm
* i0 r" }* W; k/ A5 K    {
* x3 ~+ ?! ?* [( X  K. v0 j; {" l        // 必须先执行这条语句
: I0 c: q& X* q        JMP EnterRing0
& N# Z/ S2 M, a. d
       // 定义过程
       // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

       MOV  EBX, 100000
       MOV  DX, dwBaseAddress
       ADD  DX, 7

9 l8 G( O# t" C        LoopWhileBusy:

       DEC  EBX
       CMP  EBX, 0
) j3 }! \* Y$ @: {% |0 @5 x        JZ   Timeout
& T8 f& v- X, q! v        in   AL, DX
. y" N. X. g5 g4 N( T' c        TEST AL, btBusy
" v" b8 G1 x$ O' ~8 Q: z& ?" z        JNZ  LoopWhileBusy
7 L1 n; v  N6 w% F' b. z" g/ Y8 d+ S4 o        JMP  DriveReady

% {2 ~- T& n# z* l        // 超时，直接退出
       Timeout:
1 ]3 M/ f! T$ W: f        JMP  LeaveRing0
       DriveReady:
; W7 j1 w7 f4 \        RET
       ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
% H+ B0 r7 R, E( j% Q        SelectDevice proc

       MOV  DX, dwBaseAddress
; [" G* q! H& c* y- Y& j        ADD  DX, 6
       MOV  AL, btMasterSlave

       out  DX, AL
       RET

       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc
8 M0 K% N: _8 ?! k, ?( g
3 C% H, q, p! U8 Z) f2 f        MOV DX, dwBaseAddress
       ADD DX, 7
: G% |0 x6 _( q( k9 _        MOV AL, BL // BL是主从盘标识，在过程外设置
2 c5 G7 ^1 L, b        out DX, AL
       RET
       ENDP  // End of SendCmd Procedure

       // Ring0代码
; r2 h6 I% K) @; D( ~/ E+ G* P        Ring0Proc:
8 S6 \4 v1 r( p! I* Z        PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
& p% D% L. U4 d, R1 o. M. ~        ADD DX, 7
0 I% w- d" M' x. |' D# P$ i4 R        in  AL,DX

( n6 g. W/ ]* q, J; V        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
9 Q( Y2 `( r- L        JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0

+ c  ?2 V9 d9 `7 T. j        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1
; J0 t& L, A; D8 \# G8 o+ ~$ E# D0 {2 n
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
) q) j% K! e1 J( P* x1 L; J        CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
# S& y* V; x; K, |        CMP  btIsFirst, 1
# H) |8 Q) ]# H7 m8 Q* T        JZ   LeaveRing0
5 V6 H% V% H! k' G; t) e' c
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
/ K: }7 p3 S) N- M. L+ @        CALL WaitWhileBusy

! b" Q2 ?- u5 O  j9 X        // AL的值等于cBit06时，不存在驱动器，直接返回
2 E; f* G/ l( r/ }' K" [6 s        TEST AL, btBit06
       JZ   LeaveRing0
6 h- Z' t9 w2 f$ R
       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
0 }. \$ F6 X/ [' v4 c$ y
       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
  }7 D6 R. Y7 q8 h9 G        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
  |# z4 |6 p& ^( A, ?8 x9 t        MOV  BL, btAtaCmd      // 发送读取命令
* K% C$ J! I! p% [  r$ Q        CALL SendCmd
       CALL WaitWhileBusy

       // 检查是否出错
       MOV  DX, dwBaseAddress
9 r* u  x* O* _2 R0 G+ D  Q* n        ADD  DX, 7
$ Y# o' ?( _/ \$ J) k6 u3 E4 u5 x, X
       in   AL, DX

6 M! k& v% G2 n, ?4 w7 T        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
3 x4 o+ X; j4 n4 C) e( E/ @
       // 如果出错，则进一步尝试使用ATAPI设备命令
+ w- M! N( Q. A, d- V7 E        CALL WaitWhileBusy
& U8 E' _  p4 s8 r, I3 s        CALL SelectDevice
% R; L) S* d" h' g0 K! C; `/ `        MOV  BL, btAtapiCmd
       CALL SendCmd
: h* e9 h0 h* g        CALL WaitWhileBusy

       // 检查是否还出错
+ o; s2 i7 c. H6 e7 _6 @        MOV  DX, dwBaseAddress
  o: d- D. D( j# q4 ?8 ~/ P) j  f        ADD  DX, 7
       in   AL, DX
, t8 K& q' q! T4 Q* e        TEST AL, btBit00
8 ?& }* K% k% c+ w; j        JZ   RetrieveInfo   // 没有错误时则读数据
4 J! `$ ~4 p) z0 }' j" `        JMP  LeaveRing0     // 如果还是出错，直接返回
- }; A1 b' F; ]0 U5 c: t
       // 读取数据
4 T5 z* \: ?0 e5 Q' m9 X. J% V        RetrieveInfo:

1 K/ ]1 W! ?# b        LEA  EDI, wOutDataBuf
7 H: v: M" J9 b9 S        MOV  ECX, 256
  q) Y/ r. M+ ]' Y# T! L% n- [        MOV  DX, dwBaseAddress
. v. f4 s1 s% {& E- ~) D" ~        CLD

       REP  INSW
4 h6 `5 Q( B5 c8 z7 C
/ `3 u2 O$ r2 I4 a; W' Z        // 退出Ring0代码
       LeaveRing0:
1 f; |5 T2 Q7 C, f# k
6 B1 [- a/ M! ]) L9 K        POPAD
7 q& N5 G& w4 B' L. h9 ~; \        IRETD
* F5 [: o/ z' y4 `' m0 r; H
       // 激活Ring0代码
1 B: n; N- K# L2 x  N        EnterRing0:

       // 修改中断门
+ F4 v8 c, t% S( x& L        SIDT FWORD PTR btIDTR1
7 v$ U( u0 z( }# Y3 v- i) h        MOV EAX, DWORD PTR btIDTR1 + 02h
9 \% s) o5 A6 K+ u$ }        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

' D, j& g3 x3 |( n+ m1 A        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
: ~! t& V# K; T7 B7 W) l        MOV dwOldExceptionHook, ECX
" a. q: p1 k: ~" F. Y
       // 指定新入口
  A1 M3 N' ^2 }! g        LEA EBX, Ring0Proc
% M9 Z8 k' j& r0 u' E, J8 e        MOV WORD PTR [EAX-04h],BX
; ~# M8 g7 f' I, _. g" x        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
7 u9 m' {& ~3 j! z1 Z+ d+ R+ \; a        INT nHookExceptionNo

0 F. y# G+ }! U2 c0 o8 M2 o+ u        // 复原入口
( G0 y& h" T  `) n# K        MOV ECX,dwOldExceptionHook
" y% x! ]& m6 {% \2 R3 }        MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
( Y! @: Q2 v2 g        MOV WORD PTR[EAX+02h], CX
       STI
   }
2 C2 ^5 v5 y8 j2 n. c. b( ]+ E    if(!bIsFirst)
. P# D) ?# ^/ v1 ~    {
       bIsIDEExist  = (bool)btIsIDEExist;
/ b- ^5 D1 M$ r+ F  c# L7 z2 j0 G! B        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
. R5 n. {6 @" I" T1 ^+ d3 ^}
; D# ], o; d: ~1 v$ |9 c//---------------------------------------------------------------------------
// 调用方法：
4 G+ H5 w1 N' w1 svoid __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
4 X8 D+ C1 u" }; a8 k}