[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
& C) `' t9 i" I( M#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
& G9 N; m; z% F) l+ w; i: A#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
& z& m4 G: X  ~4 e#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
6 v/ M. |0 f) F! x) I
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
8 t) j5 i8 e* B6 P0 \$ }5 j6 \( Kconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
8 ?  ?. M! ?7 B1 L2 e$ B0 t% R
* b+ w  [6 m8 v0 q0 dconst int MAX_IDE_DRIVES = 4;

// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
' c( [, o& Y' z5 m; |const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
4 z. h1 U+ q. o/ @  Y' |4 ?1 v# Aconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
( |  ]3 s$ T' x
9 U% ~0 V" l9 |% N2 Rtypedef struct _SRB_IO_CONTROL
{
( J$ r5 Y8 {: g) ~+ m    ULONG HeaderLength;
; h" x, v. f' F5 T( H+ m    UCHAR Signature[8];
   ULONG Timeout;
; ]& u) J; v4 U' \3 j    ULONG ControlCode;
( A( V1 @& G: K7 T$ t- ]% R) ~    ULONG ReturnCode;
   ULONG Length;
% J: Q9 }. }% F! c/ i}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
8 U$ B: z* o$ x2 H  L" u
, p6 E- X! l, ~& W6 S// 读取的主函数
+ F) W# D7 M, G0 y& tvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
! T4 i1 z* A* M$ s( o# L
! E+ Q( ~$ Q3 L; F// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
& W# W8 \1 E- `7 V% Qvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
0 `* ~" L. f- Jbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
5 L2 \2 ]7 w- S$ q( z$ G        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
+ \6 \  F; s. q" C        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
, {& z. B) I2 w4 I1 Evoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

6 V4 T% E8 h7 a# D0 M* F6 M( j// SCSI读取函数(for NT/2000/XP)
4 ^* }$ i3 }! f% {# v, r( YString __fastcall ReadIDEDriveAsScsiDriveOnNT();
" G9 i/ M. K! w. X0 X3 G7 g; G//---------------------------------------------------------------------------
7 }+ x* u2 z. E) p; E8 t& e& l// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
   switch(Win32Platform)
   {
, F4 \$ v! `% R: y1 V  C        case VER_PLATFORM_WIN32_WINDOWS:
4 D8 }9 p+ A$ {) w8 f& s3 |& p4 y            ReadPhysicalDriveOnW9X(pSerList, pModeList);
# N5 t; @/ k1 g& c0 H            break;
( T2 v/ S8 t+ C) ?% E        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
2 W+ j& M' F+ V# e/ S            break;
   }
  v$ `% m# m, T) i8 E}
' Z* U! L! c8 J//---------------------------------------------------------------------------
8 b4 Y& }9 A9 \# |$ }, y* \// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
! r# @* m+ z9 G7 @1 K    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
) r/ n7 [" x: }' A
) s! `0 t. s: F    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
: f9 ]3 N, K- J/ X+ _6 `6 m3 K. s% u+ Y        // Get high BYTE for 1st character
! ^' C( ?& o' B3 [7 Q5 G9 U        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
6 Z$ D" E! y% Y8 k" V& c( ?
       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
8 E4 L4 Q6 Y8 R) ?% \0 K1 X: W        nPosition++;
   }
( t6 \2 ?8 D; C8 x
! W7 B. y. c7 R# m5 j. ~    // End the string
   szResBuf[nPosition] = '\0';
( g& ?* x3 [, u/ C/ T, p! S
   // Cut off the trailing blanks
: F- v# B, T: e3 Q8 h    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
5 ]3 s' Y1 k- W! c        szResBuf[nIndex] = '\0';

5 F: D8 f6 j( Z7 x8 A# K/ e    return szResBuf;
% t# `" }6 Q  r9 e" v( ]7 j6 j& Q# C}
//---------------------------------------------------------------------------
! o1 K& R0 g; H) J9 ?' U// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
5 e( }! [) y+ ovoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
; [6 y5 A6 |8 H- X, w, V! }
* v! \9 c, J9 m! j" K/ ~9 i6 ~8 z    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
8 M0 t6 o2 J6 w4 T* H    {
/ h# B" K( [; o3 U% s0 z        HANDLE hPhysicalDriveIOCTL;
* B6 {2 h( O/ c5 |( R+ Z- G        char szDriveName[32];
  p; x% |- A2 U6 W8 ^2 H
" ~' k+ i- [! [! E& k; c1 `        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
; R+ V) I6 w1 E                        GENERIC_READ | GENERIC_WRITE,
" O; s8 ?8 D2 V- D2 P                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
6 v8 C: a! B9 t* e; t; t3 J6 g                        OPEN_EXISTING, 0, NULL);
: u! l& L0 l  F* U; O% ?. I) S% Y
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
/ n6 V, F. n& b( h7 ?9 R2 W: y        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
4 u0 V- h9 x4 g# ~+ T+ K. P
           // Get the version, etc of PhysicalDrive IOCTL
2 D# ^- p. s! F; J            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
2 P* @. ]- {9 ~. y7 ^  }3 n/ j
( W) W$ B8 h* V# p            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
7 ?$ ~0 a' C0 C                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
2 a5 o; Q- }2 |. s                    &dwBytesReturned, NULL))
           {
               continue;
           }
- \! j- \8 {% U3 Z  Q- Q
           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
0 ?4 e0 L* n$ X* N                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
3 \9 a) t: K) V+ e! I* {                SENDCMDINPARAMS InParams;
) F6 K* A4 d+ W1 V7 z5 u                // Now, get the ID sector for all IDE devices in the system.
# d" x7 W  ]2 o$ \5 x! O0 y5 P                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
) U- O+ z. Y+ z$ W/ D                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
  f+ s/ a# U0 C) x9 `                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
4 }/ x# [7 D0 P$ M                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
& Y0 s. j2 M/ ?; q9 y- ^0 w; a
               if(DoIdentify(hPhysicalDriveIOCTL,
( K2 I& b) N* v0 {0 j. x! X4 S                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
5 F! W/ c) h5 X7 O  R# N                {
+ w( l: \4 Q2 c& a6 o                    DWORD dwDiskData[256];
: I0 H+ C8 W. ]5 ?0 S, B                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];

1 h! I* }: u% T, k5 E                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
' W6 ^& B% j' Q0 y: v- M( Y                    for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
0 C2 y7 n( v) d                    // 取系列号
6 H5 x; D" H, A& a5 w7 y& |  |( ?                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
5 r$ ^/ @; ^! f1 h/ r( E                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
# ~' P  U+ G( `3 L5 Y
0 m* T' D7 V2 y: h9 _" o3 i                    pSerList->Add(szSerialNumber);
* S  R0 i; F% F  X( v& S6 [                    pModeList->Add(szModelNumber);
               }
           }
" S1 ?# u5 ?1 A3 b4 ?/ X1 M3 C            CloseHandle (hPhysicalDriveIOCTL);
       }
   }
# W. k9 v: `# E* I}
//---------------------------------------------------------------------------
0 J8 w5 t. n6 P7 Q// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
% ~/ n: r# ~2 ], b- S' @              PDWORD pdwBytesReturned)
' c0 u. d2 @* \! a{
9 e. k, i) ^( ^$ s' }2 f# N. P9 c    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
' W. M$ `5 \6 E# i4 M! ]    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
! n0 V# B6 o- Y0 b    pSCIP->irDriveRegs.bCylLowReg  = 0;
' r& r: P# o- J4 ~) Y    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
+ P, c: E, l; b. k    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
, R4 |1 ]3 E- m/ Y9 J. _
9 Q, W6 C: {/ I. e" C$ {$ f    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
2 l; G* i( h; Q: |) X' b6 F  R4 b           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
& ?& i7 |# q" q. p+ ?* O4 J//---------------------------------------------------------------------------
: D+ x$ b: t% Q! Y  M7 d// Windows 95/98/ME 代码
, Z! r+ B6 G7 ^//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
$ a5 r5 p* N  D1 `/ ~void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
5 G5 B' \7 S$ |6 D" x) c  V    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
& k7 s$ y/ U) w, G
9 D* @$ K# T2 t6 Z! @- w    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
9 s  `* \- m- g0 U) p/ C* U# A    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
% f: H& j0 s5 I3 R& @! M8 {: D        WORD dwBaseAddress;
+ L$ {9 s# v& g& H' p        BYTE btMasterSlave;         // Master Or Slave
: T9 r: X3 `# C' k+ p        bool bIsIDEExist;
       bool IsDiskExist;
- D4 q5 H% A0 P6 G. Y
       switch(nDrive / 2)
1 ]0 v3 W( \& A% L! k        {
           case 0: dwBaseAddress = 0x01F0; break;
0 \1 \5 ^% `- ^% L% I: x. X3 d            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
/ Y" @( O& x- s' `- Z) F) b" m            case 3: dwBaseAddress = 0x0168; break;
  A- x5 S$ {7 S5 S( |4 E        }
; S% [; o8 `1 W4 f! T4 a" k
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
3 L" i9 z/ [. Y# y8 G+ m  R        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }
6 i5 U. T/ U, e6 x( Y/ L
   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
+ U0 C, Q- X$ u2 V9 e" P) U  `        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
; q3 p3 l6 I- K# Q$ i: f9 b        bool bIsIDEExist;
! R2 ]4 d/ \4 w9 k( i1 X: \        bool bIsDiskExist;
       switch(nDrive / 2)
, ?) [- j, p  \% F3 e. S( v  k. a3 q# ]        {
9 \: K, t8 u& q            case 0: dwBaseAddress = 0x01F0; break;
; D$ x9 ^$ V' }1 N            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

- N  u  L  O$ u) F3 k: M        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

8 V( v0 h* c* x        // 进入Ring0
, q; j3 e& z5 C& j* P9 B        bIsIDEExist  = false;
       bIsDiskExist = false;
* k& l4 Q% P0 v/ H0 {- {% U! h8 m        ZeroMemory(wOutData, sizeof(wOutData));
! v2 Q0 A% j* P8 S7 y+ S
) I- n9 B, k! h% ~# E        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
       {
( C5 [! B5 B" Y" h. z( o            DWORD dwDiskData[256];
/ v8 W6 ^7 n  c3 {; k1 q6 h2 A' Y            char  szSerialNumber[21];
3 L6 f2 h* i3 h& g            char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
; X! H1 o3 g9 b0 E* o7 N
! t- k( U/ P: @8 L" U( ~9 H) s            // 取系列号
6 Z, B, E; \' x7 Z% S4 G            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
) G, k! E5 Y( f# P$ x* e            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
( R# N4 r8 N( z; W2 O1 a
/ b7 y9 a9 R8 @0 L4 F3 J- a            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
6 @' O" T; Y* F8 ]            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
3 v: C/ |4 [: N            pModeList->Add(szModelNumber);
8 {+ S- h3 W4 T6 I0 h+ ?3 i        }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
& K- F# T1 V2 Y% S/ `7 K}
3 A! e* e% D1 Y& J$ w9 {- S//---------------------------------------------------------------------------
) i! `. Z& E: m% R$ f// ReadPhysicalDriveOnW9X_Ring0()
# k* _" d+ k2 }+ G' C( I1 t8 g//
+ N0 H8 @4 o& |4 q% z, s4 W// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
1 _8 d" o: i1 m        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
0 f. Y/ \' q0 `( `9 g    const int nHookExceptionNo = 5;
( y: x8 J& d) n" i6 ]8 q
# Y8 f% \. Z6 K$ B* q    BYTE  btIsIDEExist = 0;
3 r% g  i! K/ S- ]' K4 v' Y    BYTE  btIsDiskExist = 0;
: A' X7 s' `8 q. S" J6 l    WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;
3 v) x1 Z" T2 H4 Q- u
   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
+ v& c6 \3 A- w0 M+ e/ u    const BYTE btBit07 = 0x80;
. F! b0 P$ m% `  Y- U! e1 J    // const BYTE btERR  = btBit00;
4 H- [% V- O# R! o) V2 O    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
& L9 y/ X1 H( x+ b. D" I. z2 q
9 f" J9 u9 v. R  M5 G/ D* a    __asm
   {
       // 必须先执行这条语句
       JMP EnterRing0
  ]8 D6 \) N& A5 N
       // 定义过程
       // 等待IDE设备直到其不为忙为止
0 }! l( B) ~! K( p/ }- ^8 b0 Y' [# `: g        WaitWhileBusy proc

4 |4 v8 R$ _. c" F$ u4 }6 x( ]        MOV  EBX, 100000
       MOV  DX, dwBaseAddress
- Y2 S3 |# j; M& k$ y+ a/ v        ADD  DX, 7
$ W) _% Z" X6 V* R
       LoopWhileBusy:
, B7 y* e  k( \% S- r) s5 p
' A' Y- b6 J& N2 N" O        DEC  EBX
+ V, k4 \5 D: K' y4 R+ {; y* L        CMP  EBX, 0
5 ?& t, y2 c. t, f* S5 U$ J$ V$ a        JZ   Timeout
' i, r. O; O: P2 K        in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
/ h1 M6 @5 N; D- c5 X        JMP  DriveReady

) `0 b1 \! h) P        // 超时，直接退出
2 f  x4 g+ i/ P' D        Timeout:
       JMP  LeaveRing0
       DriveReady:
       RET
) E2 W% `3 _/ k/ K* K        ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
       SelectDevice proc
' z0 M8 S) X) h4 y& M2 p  p8 k1 g
       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
$ K4 c& j9 ?! _
       out  DX, AL
/ Y1 |( p5 I, F$ y( p6 Z        RET
# b0 h2 _9 x2 S& m4 Q" ]
& W$ U4 k& z- n        ENDP  // End of SelectDevice Procedure
: Z6 d6 f3 O- M2 Z" o& N: k; z
       // 向IDE设备发送存取指令
" M# E! g$ X8 ^+ R        SendCmd proc
/ [$ |5 B# z3 ]2 B
       MOV DX, dwBaseAddress
! J1 [  M' c9 m& U        ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
2 b6 Y) N3 e2 I7 k' O; v: Y        RET
       ENDP  // End of SendCmd Procedure

       // Ring0代码
       Ring0Proc:
       PUSHAD
5 Y% S  \, Q9 p3 N+ x9 l- M5 U$ ^        // 查询IDE设备是否存在
5 e- O% Z5 A. C, j- ]6 b- f9 X& g        MOV DX, dwBaseAddress
$ {/ x  U  T4 @" t8 c        ADD DX, 7
* V# s; C1 I) a, P6 ?, F- G        in  AL,DX
( a! k% t7 D9 H% l
9 x0 X. o  o$ r# F  |5 h# j( X  A        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
/ n0 M# Q* q/ E. S7 e# y3 h1 j        JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
; t5 ?/ _9 Q" E2 m
* i& O, G6 F. E/ s        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice
  I4 q, I! n" b/ B
       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
' m2 A2 z) m7 }2 D        CMP  btIsFirst, 1
       JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
5 |; J# ~2 z: `" ~        CALL WaitWhileBusy
3 L  p+ D; r/ Q1 S: ^5 i
       // AL的值等于cBit06时，不存在驱动器，直接返回
5 m0 P+ F0 S: x( b        TEST AL, btBit06
       JZ   LeaveRing0

       // 设置驱动器存在标志
. M2 L& L& A9 \% Z) x2 g* S2 ?        MOV  btIsDiskExist, 1
- U" Z/ I" h" q: g
9 d! c9 f4 H3 v# X# a) I3 ?        // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
' D" A6 y2 x8 u- I. C/ {        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
+ K8 N7 _5 @  [$ U6 \2 M/ \        CALL WaitWhileBusy
. [. C! o' z2 B        CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
' j/ S9 ?! C$ H" f) L! A# W        CALL SendCmd
0 s& g+ I' D/ X$ {) {: V/ V        CALL WaitWhileBusy
1 B+ _1 d! F, P/ K
( J9 j/ x5 X2 h! ~( W9 [: n; {        // 检查是否出错
9 x: B# L/ @2 |6 v; _9 }2 I) S+ O        MOV  DX, dwBaseAddress
       ADD  DX, 7
% g- w& j# z0 V. S, C- M; j% c
( s( S3 h. `8 f" g& i: m        in   AL, DX
# _8 D! Z, ~9 F# O
! z. N( x! D, w/ y0 }        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
' g- Q1 z' ]3 I; j2 X; I! J7 ~; t        CALL SelectDevice
7 Y9 r8 m% _- e; [' l        MOV  BL, btAtapiCmd
& h4 m5 N# u+ ^% ^4 h( s0 Z        CALL SendCmd
       CALL WaitWhileBusy

* C& Y# h( f- ?4 M5 U        // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

& l% j+ [2 d( v        // 读取数据
       RetrieveInfo:
* t5 `% [. W0 j8 g% N9 I6 E* i1 O
! {& E; ?9 S  e) Y0 i/ X4 I        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
4 J& r. H( d/ U" ?        CLD
/ i+ A7 G0 ?, |; s! R: v7 D+ @
2 H. z! u% P6 L" H4 x7 i. p        REP  INSW
! q7 l4 o8 \1 I7 @. E# K
       // 退出Ring0代码
       LeaveRing0:
0 T) g# n. N+ a$ v
) E" T+ j3 o* q" B' J        POPAD
4 f; Q* M: ^) [% _- v        IRETD
7 j. Q4 p, _& z. v% h
       // 激活Ring0代码
0 L8 Y0 {( p6 k! I! ^        EnterRing0:
4 Q0 S, ^% D& w9 Y* C; H
1 _2 k1 m4 c" ]        // 修改中断门
$ [; Z; u9 p' s0 N4 K, }# ]* u        SIDT FWORD PTR btIDTR1
7 A9 [! N, l* v  c        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
7 V/ f2 |" L$ r! n1 i% O' X6 q0 g7 w2 k
       // 保存原异常处理例程入口
* W0 V8 `) `+ }/ A. E! X  P        MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
- n+ s: \" `# I9 q/ L' w        MOV dwOldExceptionHook, ECX

       // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
* i, Q5 Y+ u0 _- r2 D9 u4 c        MOV WORD PTR[EAX+02h], BX
/ @! F& Y1 d8 a6 }) I6 T% a$ o
       // 激活Ring0代码
5 _# S+ e7 x9 e. P# N2 R6 R        INT nHookExceptionNo

       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
2 y; x; j, g  L0 w        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
   }
   if(!bIsFirst)
# E% ~( y8 J! b& Y" L1 G    {
. s8 e9 V  u* Q+ |. W, J9 P        bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
6 P2 z5 w3 `9 x- y  L3 b8 f" p        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
+ m4 p/ k# v/ n/ O7 H0 [2 _7 n" @9 K}
//---------------------------------------------------------------------------
// 调用方法：
' k3 I" w4 k6 u& x9 z2 R, X5 [! Uvoid __fastcall TForm1::Button1Click(TObject *Sender)
% B/ J" K6 W$ p% X) y) z{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}