[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
+ ]( t( t# \, u( G9 x# w. [#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
; |$ D" q+ T7 `' v) h% Q0 w$ U3 p
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
5 a/ \/ R1 J6 m  M" xconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
5 J; F; u0 E4 F/ A- r5 |" a
const int MAX_IDE_DRIVES = 4;
* u$ c& I, o& b; ?( f! J9 r- I% O6 i% k
6 b7 [# b4 C- [. f9 G// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
! _# `9 ?0 L! k6 gconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
{
% ?  a. P' a! H1 Q9 Y5 d    ULONG HeaderLength;
9 ]! o$ J1 d- z) }2 N    UCHAR Signature[8];
   ULONG Timeout;
1 Z+ n6 h) q$ o5 j. ]6 V( B! r. q    ULONG ControlCode;
   ULONG ReturnCode;
. y% _3 c; `7 @; `5 g4 l    ULONG Length;
. C8 m: W6 g% U" P5 S% g8 {+ @}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
6 Z' v+ m) d1 A: f: A9 B
& C3 u% G9 h. P; b! U// 读取的主函数
3 B8 N2 }$ q  f8 J$ i3 ?void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
5 f" ~+ K. H# z  P4 a" T2 f
// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
2 X6 `$ u/ q8 N% Hvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
  M: ^6 e0 O1 e4 j6 |) w5 ~( ?, ibool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
; L2 ^  ?8 S, f0 @5 j" w5 H8 xvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
. o8 u+ m# ^! H" c, M4 pvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

8 S( T0 f1 s" u4 |// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
+ }7 t6 D% j( ~//---------------------------------------------------------------------------
1 E/ Z/ |1 v2 K6 o( r, n2 @// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
5 R" B, r3 @& h5 S& y1 O! A* ^    switch(Win32Platform)
   {
5 Y- p" t, }  N4 s5 z        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
9 x/ m6 e8 G- d' G            ReadPhysicalDriveOnNT(pSerList, pModeList);
" H8 n  W9 V, e# e+ \            break;
! s3 T. D. D. Z8 m, V% _1 D* D- P        default:
) b9 z3 q& [4 j6 n+ D            break;
" D% ]! d1 d+ O; z  p$ G    }
' C6 R, a2 _8 r, {}
//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
/ Q- J- j( L4 k+ u. M! O: g( Z{
7 G: C& r+ [4 r0 h! c    static char szResBuf[1024];
9 p2 r3 t0 ~/ F% J7 Q' V    int nIndex = 0;
" ~7 \- p: Z7 s! P/ J; |' I6 G" W, s# J. y    int nPosition = 0;

* I& p5 s$ O! Y    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
! L' n" w% o8 r6 U# Q" ~
% x: J& V5 [% s* F1 {        // Get low BYTE for 2nd character
& C* j' s' N) L7 i5 W8 ^4 m        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
) }1 o$ v9 F6 |! e1 a, l/ X* V3 W        nPosition++;
- u4 B" u/ E3 O; ]    }
$ S$ [& R, S# w' |% W
   // End the string
! I  X" T5 q) x. I" K7 z    szResBuf[nPosition] = '\0';

+ }9 Z- R6 h# x' \* M1 ?& a    // Cut off the trailing blanks
4 b; a! K/ W3 j$ g    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
6 Z, G. s2 A% x3 p. R7 a        szResBuf[nIndex] = '\0';
1 j7 a2 s, x7 v; h  C$ W* S
   return szResBuf;
}
3 z! M( N5 U' t" [  e7 t//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
$ g4 U2 S  u6 V8 }! ~' z1 B( q7 Q//---------------------------------------------------------------------------
7 b( C: A0 u- ^2 ~: D4 z; z1 b- M// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
4 ^6 q: {' x" V/ u( U! M. ~{
& d* H7 u" N5 F$ r; i3 p/ X    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

7 I$ E  R5 o1 H) {7 V    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
4 Q/ j: v2 C( ~    {
7 l8 f! g9 E4 O. V        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
! L/ @6 h1 O, v7 {, [# s
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
' T* N$ ]# D. q/ U6 P                        GENERIC_READ | GENERIC_WRITE,
2 ?6 [% I7 ~  U5 `                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
5 `$ [) s; p  i/ p* h                        OPEN_EXISTING, 0, NULL);
5 d) i. M3 M# n6 z8 l- ^* F
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
* m& d# Y4 V! p( J. r, r        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
$ b) a5 L, p5 v4 S
" \( a) \4 w# C  z& T% U            // Get the version, etc of PhysicalDrive IOCTL
. y- A0 J8 ^) K) Z$ f            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
7 L. M4 b: d6 z- m: t0 O* M% z+ A
. r8 m5 I7 d; C% L2 J5 @, S0 G$ A            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
1 }9 X( |- \2 F. Q( Z( \$ j2 J            {
               continue;
" }! h3 I1 _' A: ^            }
6 m. X0 i3 A0 {  Z% C
           if(gvopVersionParams.bIDEDeviceMap > 0)
3 I+ c2 z6 ?) M+ P# s            {
3 I$ R# }4 X# o. F( D& W# a                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
3 s7 u. g( L! v  c# t                SENDCMDINPARAMS InParams;
* j5 Y! ]1 E; g' w% \. \+ v5 k                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
# N  L2 O2 z1 _8 U" O' C& [) J                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
' a' g% R. K$ ]& C# Z                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
$ W, k" y! s$ }! c0 U; g                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
! F& r4 e' D$ Q& |, b. i6 r
               if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
, o5 E! R  d& b& f                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
- [  t( D8 R' [5 v& M0 q1 K( Z                {
- n4 y( U! r5 l: i) ]                    DWORD dwDiskData[256];
1 Y9 b) |; G1 x( r0 {+ U                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
7 p! {* g* u$ ~. Z6 l  [                    char szModelNumber[41];

% R1 K( X. i: S1 y9 w- _* \5 K                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
( z, F5 E! ^4 b( l" l, `                        dwDiskData = pIDSector;
2 b. _0 \9 B/ G6 B                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
. s0 b0 `, Y2 x$ T. r! w4 T
                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
* K; Q9 v1 Q9 t' U4 G                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
. }+ k" a4 x+ U& c( w7 [$ l# v, ]
                   pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
+ R& w3 ?. {4 S8 Y& j0 T: n                }
           }
# q. Y% }# B7 F6 Y) ]            CloseHandle (hPhysicalDriveIOCTL);
       }
0 W+ ~6 o) y: k7 L) [    }
}
//---------------------------------------------------------------------------
// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
0 T3 B" R/ }4 w$ ~8 F              PDWORD pdwBytesReturned)
{
/ N* s; V* i9 y    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
- j% \; R( N6 }# w  x3 u7 ?    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
( p+ I) M! L2 Z/ g* C6 D7 B    pSCIP->irDriveRegs.bSectorNumberReg = 1;
8 E/ T1 Y0 T1 W5 B4 {" o    pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
  E  S! j2 k! z5 |- U: r1 u+ v! B
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
% d" ^+ {! }2 P$ N6 Z    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

0 r7 p8 E: e& q6 d+ m  S+ V8 W) a    // The command can either be IDE identify or ATAPI identify.
% p) {. ~2 E5 G5 g/ R3 n, @% ]    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
% [6 ]) F7 R2 g" |    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

7 t1 V  Z% n+ w2 h3 V    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
9 K( G4 t, g1 X0 g, e: v) G           (LPVOID)pSCIP,
5 P! I; s/ f6 I( p! p           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
- K- I, v. |" `; W  ^: B' d$ R" ~1 s- a//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
1 G1 O5 }& R. S  t//---------------------------------------------------------------------------
% x7 T  K$ s) Z& S% N// ReadPhysicalDriveOnW9X
+ S8 U, s3 {+ Z+ ?. S# T! B$ Cvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
' v& q8 H5 Q8 N    WORD wOutData[256];
0 P  A2 x1 Z$ n4 y$ L    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
- m3 \+ U5 X; t+ Y
, I2 Z6 ^5 Y0 k1 ?    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
2 X' R( a. H- H2 d, `0 i' a7 c    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
4 l& x) H' o# g' K    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
2 P0 W$ E) b& S: c- E    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
  }6 I9 x: c* h5 n" g% a        bool bIsIDEExist;
       bool IsDiskExist;
+ e" |3 j5 _" b  b8 V; f
       switch(nDrive / 2)
       {
) z7 w1 v$ Y0 Y2 A            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

/ J% _: l# P5 S$ V        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
  D5 _: {# g" R. t: h
. W) X, Y3 ?. W8 I2 y        // 进入Ring0
6 f: E7 c$ S+ h4 m: P& j        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
# y, ]3 n2 U. s5 i$ x. H. p    }

   // 开始读取
7 r9 m4 k, t. U; i8 _3 m) W$ C    for(int nDrive = 0; nDrive < 8; nDrive++)
$ i+ V2 S# F" r8 y( ?    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
6 B% X/ E  M( o* _0 K4 Q; \        switch(nDrive / 2)
4 @/ o6 o: ?6 h/ j        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
/ k, N! \) P9 M# @- W% X        }
2 A; o; `' E4 g9 Z
) E2 g0 w; U+ R3 S8 R1 ~        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
; @2 D' p& ~% N( v1 H. g. q
       // 进入Ring0
       bIsIDEExist  = false;
3 q. l: T7 W9 n& n        bIsDiskExist = false;
! i! h; M; E! \" H$ C3 [        ZeroMemory(wOutData, sizeof(wOutData));

- k3 G! j8 i8 t  z4 P        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
- j/ \) e: L7 T8 o- {4 ^4 l                bIsIDEExist, bIsDiskExist, wOutData);
: O* j  e0 J2 D5 d0 M3 C
, [: i2 \3 W; Y0 e0 P8 }: N: O        if(bIsIDEExist && bIsDiskExist)
       {
1 G6 z3 @0 f8 n8 V$ L            DWORD dwDiskData[256];
+ x/ I  f  q. |; I1 h  p9 F6 b' z4 b            char  szSerialNumber[21];
" V$ D5 l- C( a% T4 K) E0 w# d* w            char  szModelNumber[41];
3 o6 F! I: }% p# j
" t- h% C4 A4 @' F9 I0 b- U/ r2 h            for(int k=0; k < 256; k++)
0 S' O- d& x7 S2 @- s# }3 [                dwDiskData[k] = wOutData[k];

) T, p4 k+ F8 h+ E3 B+ |: K            // 取系列号
6 [5 |6 N  [3 i. K            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
' ~* C$ y' T# |5 A1 m9 z9 A8 I' M
           // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
* N4 P4 R0 `% q* x; P+ T3 F            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

7 w' P1 `: k& O; T            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
       }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
) K, x. I5 H: |* W}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
, \& y$ \6 G  F  H  s' E// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
$ m( x: _' g4 {- j# f9 G7 W. J// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
$ J7 v; F4 ~  V" T2 B& C* O$ hvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
3 H  L% Q. q0 [        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
0 o' d) E# [- r7 r. E{
   BYTE  btIDTR1[6];
1 ^! L) A5 Q  P8 y9 I& F    DWORD dwOldExceptionHook;
8 E' V6 l9 G% b% z$ s. K4 ~    const int nHookExceptionNo = 5;

$ P6 D  }1 J3 @  Y; T3 t    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
' j2 A  J3 Y7 `5 a, {! h
3 ?9 Q9 ?2 E' S% Z    BYTE  btIsFirst = (BYTE)bIsFirst;
5 i  f* T4 z/ x- J/ `$ E
; o3 o  g7 f0 d" Z    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
: c9 K# g( Z2 e. L+ n1 F6 b  k    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
* s# r0 L/ `1 {/ P+ c$ H3 T' v    const BYTE btAtapiCmd = 0xA1;
( J  ^( A& x. }6 I) N8 @
   __asm
0 G* _0 P1 w) y    {
& h7 o9 M4 F# h0 w' |* b        // 必须先执行这条语句
7 K3 O# s& K: c; F) G' _( u        JMP EnterRing0

' Z4 d3 g8 C$ G) E        // 定义过程
1 f( m, E2 N9 a" ^, H        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
* T. p  G. L9 C3 [  D3 W% v# ?
       MOV  EBX, 100000
* q0 g( G6 G; V- W# p: u# T& N        MOV  DX, dwBaseAddress
       ADD  DX, 7
) V" K3 G2 Q) \8 h
       LoopWhileBusy:

       DEC  EBX
       CMP  EBX, 0
- q* z1 [  z( f        JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady
% q3 u( a" V1 y) L
, n. G: a* L7 L7 j        // 超时，直接退出
6 G# t: h$ ]" Z; e* S' ~        Timeout:
# u* L4 G- P5 g- }% G: Y        JMP  LeaveRing0
3 _2 }2 g9 l- S# P7 `        DriveReady:
' B7 _: e6 s+ [        RET
       ENDP   // End of WaitWhileBusy Procedure

: a  a" \" Q+ \        // 设置主盘和从盘标志
6 @4 O, N3 X' e' `( V# a, z        SelectDevice proc
3 D4 R' S- f! l( p+ }  ~& ?8 Q
       MOV  DX, dwBaseAddress
4 m+ Q+ H2 z' y! l        ADD  DX, 6
, G: E+ P- f8 I" T! y        MOV  AL, btMasterSlave
+ q$ C/ z9 m7 s0 l, C# j
       out  DX, AL
       RET

       ENDP  // End of SelectDevice Procedure
1 M( L; b: K( i5 {
       // 向IDE设备发送存取指令
- c& m8 @1 M1 Z% |        SendCmd proc
9 `3 ~3 ]# [8 n, N' ^6 q' @
: ~8 ]! t  Q) H3 H        MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
       ENDP  // End of SendCmd Procedure
1 N6 X: i1 G6 l. Y
5 q- Z+ w' C. \        // Ring0代码
  B, {& G. q% l' T+ t, y6 a        Ring0Proc:
1 P$ {; Z8 T( o/ E5 U# a        PUSHAD
       // 查询IDE设备是否存在
$ n/ m4 A4 W$ T, x% @( D0 N        MOV DX, dwBaseAddress
/ l9 r( s; t/ l' R/ C        ADD DX, 7
       in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
! [9 J* V4 c1 f1 v8 S
1 _$ _7 f7 c- z        // 设置IDE设备存在标志
# J8 P! n  D9 |" s        MOV btIsIDEExist, 1
( q7 ?! [3 p' X3 h0 x% u7 M
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
- n3 V7 g7 v1 R7 T& T        CALL WaitWhileBusy
  K; r/ F. g# _6 P        CALL SelectDevice
3 a2 R; o+ }' ]6 N; [
- I1 ?( L8 I: c7 q; J6 }        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
! c5 I3 u, b# e        JZ   LeaveRing0

5 A. c/ B9 [' S# ]4 K6 J        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
( @2 c: s, n! P" ~        JZ   LeaveRing0
' D1 p0 A1 e) B
% r+ G. D* m. B8 S- J, e        // 设置驱动器存在标志
3 Q# R; @0 E+ U% F1 p) a% J! B0 Y        MOV  btIsDiskExist, 1

       // 发送存取端口命令
  f9 d. I* y  S/ m        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
6 J5 O- w$ z0 ^8 ]4 y, ?0 e+ n5 o        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
2 ?$ P) [. m: `. K' f- C        CALL WaitWhileBusy

0 X# {7 W* s. d: N& |# b        // 检查是否出错
! F4 z, M% C( a7 ?( T        MOV  DX, dwBaseAddress
: _% U; u) F9 X- i" g& s        ADD  DX, 7
# D' E0 _* Y" @- f' g( [2 d
# `( Y6 a# r/ M        in   AL, DX

       TEST AL, btBit00
; B) P2 m; ?. \0 J. Q. S& M5 d. o8 c3 g        JZ   RetrieveInfo   // 没有错误时则读数据

0 k6 j& s) Q, i. C9 ^        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
; L, y+ A$ I0 [9 Q6 q# @        CALL SelectDevice
; }% a4 ~2 D# y# [3 o( s$ f5 a        MOV  BL, btAtapiCmd
       CALL SendCmd
       CALL WaitWhileBusy
% K# l( k) c5 ~( g3 _) q
       // 检查是否还出错
, {9 |! E6 i3 T5 d. Z        MOV  DX, dwBaseAddress
       ADD  DX, 7
0 h' w& _' _) ?# ~' V0 E, [        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
9 u+ Y! T  d9 b5 C& B6 N+ E/ i& ~
       // 读取数据
       RetrieveInfo:

       LEA  EDI, wOutDataBuf
4 L5 ]& ^3 V2 ~, ~) v        MOV  ECX, 256
       MOV  DX, dwBaseAddress
2 @; t, I- D' x0 }6 ?  A( m        CLD
5 y- S* N0 s9 P/ o+ G& \4 Q4 u
       REP  INSW

5 G- y+ ^% [% W, B; J        // 退出Ring0代码
       LeaveRing0:
! t$ I6 k3 r: M5 t* J
       POPAD
       IRETD

       // 激活Ring0代码
       EnterRing0:
* g/ f) e. t5 a3 @
; G& Y# ~. F5 b9 X5 C5 L        // 修改中断门
9 {2 i* S, F  Z# h, {; h        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
# w) F" ?3 k9 Q2 h        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
2 F' i9 \+ L5 P
0 K9 R" L2 \/ e5 I        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
2 N0 e! ?7 w9 w. A  c3 H6 J& N        MOV CX, WORD PTR [EAX-04h]
& w) i& a: G! M, \9 O        MOV dwOldExceptionHook, ECX
8 {8 l7 n0 U8 k4 x1 D5 H
( M2 R1 d! b+ y; i4 l        // 指定新入口
( k. |, E, r  `8 v) p1 R# b" e; _9 x        LEA EBX, Ring0Proc
* e/ _. ^  j& r5 {) `        MOV WORD PTR [EAX-04h],BX
# q( p5 z5 f6 H% E7 o        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

3 A6 P+ I; ^8 }6 k0 ]& B        // 激活Ring0代码
. o1 x4 D; B" d        INT nHookExceptionNo
- i0 [& c0 M! A6 |* E+ \/ [% V
       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
3 I' |# i- f* j% G/ ]6 V        SHR ECX,10h
, G) d- |9 H' T+ v' u        MOV WORD PTR[EAX+02h], CX
, ~0 m7 C4 _) }9 t        STI
   }
; ~) f* x$ Q3 x/ f* {" ?$ d. W    if(!bIsFirst)
# G; {$ k& ?  }# D$ L    {
2 @  L4 f4 f+ P+ i        bIsIDEExist  = (bool)btIsIDEExist;
" }+ F/ Z; a- D6 x* l        bIsDiskExist = (bool)btIsDiskExist;
9 e: N. v* ^( [2 G5 U/ @9 P        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
//---------------------------------------------------------------------------
// 调用方法：
& D. r+ W* Y7 r% s- dvoid __fastcall TForm1::Button1Click(TObject *Sender)
; v6 h+ J  L- Y# R; |{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}