[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
3 M5 x' V2 s3 J6 d1 T9 B" K#include <stdio.h>

- D7 N8 u# ?& ^1 ~, X/ h0 o8 s#pragma inline
//---------------------------------------------------------------------------
, }7 E# _( e5 {( n' S// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
0 g5 t3 i. a3 i* M' S! M% I#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

& w. T1 t9 E7 c2 z/ U0 zconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
1 f! ]6 k5 b* G/ I# _$ L4 H0 }const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

const int MAX_IDE_DRIVES = 4;

// SCSI专用变量
8 W0 M% m- Z  y3 O9 h5 v/ Vconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
! |, g  `& |5 J! gconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

2 q1 T9 `0 y' i# w2 e# }typedef struct _SRB_IO_CONTROL
{
; i4 r- \( e& M7 C    ULONG HeaderLength;
+ K. Z4 F( W% y. _: [" w: t. A    UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
- L  ^0 p; ?0 p0 a    ULONG ReturnCode;
$ n, d. f0 l' ]1 z; W9 k/ k    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

4 L0 _4 l( `$ g/ X% T6 {3 V// 读取的主函数
3 ^" U) k8 ^6 F1 Fvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
' f9 R  H: H- ]! w4 K! i: Z/ m
3 }: s, B  |1 i/ ]0 E; A- J// 辅助函数
% Q2 r; C& w' c1 H" V: Ichar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
7 ]$ A3 o( j- {9 Y2 F6 q// NT/2000/XP函数
: l" b) T  P; h2 O% Y$ Mvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
* B; t$ Y. K4 k* }! l        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
# r! U( A( j8 A// Windows 9X函数
8 l3 p3 F* Y  y% c) avoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
2 T% y2 \$ K2 U  N. }* ]3 k6 y        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
6 x+ j3 X) G4 ^% T- C8 [String __fastcall ReadIDEDriveAsScsiDriveOnNT();
. K, G, a2 X3 o, B$ D//---------------------------------------------------------------------------
// ReadPhysicalDrive
0 Y+ f, j1 c- ]9 S& [: N2 W5 Y( ivoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
5 \1 M% t; M! n. S' m! m1 [( |7 k{
   switch(Win32Platform)
% W8 b6 T$ _; O: J    {
  {; }1 D& F  E, x0 S6 l" q* m        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
4 R& N7 i( Q  e& S' {$ ]' D        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
0 I( |4 m* ^7 Z# a7 j/ [        default:
3 I, Y9 |. e# f4 ?8 W$ {            break;
3 z( g4 }) J! D4 b7 B! q    }
  v( ^2 y/ h+ K4 D2 J}
4 x) y: N# A4 Z: E1 v% O5 R//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
' g0 m8 x% T% J; C8 C" I; n{
  j2 y! O& b8 H" q, O& Y    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
3 W* a2 E6 N9 S& g  x2 k0 M! K
0 L7 ]" ~7 X9 T) V" r) X    // Each integer has two characters stored in it backwards
3 S. |$ r3 f- Y2 w' L$ p    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
) a, g/ x8 q% b, [0 d* D& r; |3 V    {
  j" L4 r* V1 J+ x" v3 R        // Get high BYTE for 1st character
% F5 {$ X: r- s, ~- k0 y        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
/ {% |. i) M+ {3 v" r
       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
' g2 V6 O. r+ [0 B- T        nPosition++;
. y5 j, b) @3 ]' l7 h    }
% C2 `2 _8 V6 g6 m) c+ [7 z
2 {6 x- I: D# m/ [6 v6 }    // End the string
' w0 I. S* f1 q% h. |( i    szResBuf[nPosition] = '\0';

6 E0 P1 D& @$ @0 l: }2 T    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
, y6 ~5 a! |5 v; a+ L' m        szResBuf[nIndex] = '\0';

3 e2 _- G# V9 d- V    return szResBuf;
}
//---------------------------------------------------------------------------
+ s5 W; d) |: Q/ u. p// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
* p4 ?4 R6 j$ |// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
4 k  l1 j  M/ ~* C{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
% |2 k% z9 v& K- M: t/ M
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
5 t6 M/ `) D2 ^4 i        char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
& {; |6 F9 K' B5 _/ y# l& P/ ]                        GENERIC_READ | GENERIC_WRITE,
) z2 f( G3 b: _) c                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
) p7 E  j3 N1 {/ P8 D+ Q                        OPEN_EXISTING, 0, NULL);

3 d0 H$ U7 q5 ^# z3 O+ x        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
# u/ D* \/ ?- |0 d( P8 s0 j5 \        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
7 n! i* R4 ?2 j& |' t" e6 g% z
3 r- E8 ]: R8 v2 \2 W9 k% M            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
5 W- r* g$ B: t* o2 K' w& m                    &dwBytesReturned, NULL))
           {
/ U4 I6 s0 _7 b                continue;
           }

2 O$ h2 _; q( _" J            if(gvopVersionParams.bIDEDeviceMap > 0)
# k! L* P, J: _6 ^" w: Q  S0 ^            {
               // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
+ O$ g4 a5 k  }  F  ]                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
. r" n9 r( Q. w: c9 }. F                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
7 D4 |# \6 B5 P3 i! s0 {1 K& j                // otherwise use the IDE_ATA_IDENTIFY command
- {+ X7 t/ O! `2 [( i                // 具体所得结果请参考头文件中的说明
& o- {% Y- F! D, b; B9 U                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
# \9 b' L- O4 E+ M- h" s) D) Z  ^" ^                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
: e/ _: D& K# a% {* |# r/ `                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

               if(DoIdentify(hPhysicalDriveIOCTL,
; ]! I8 A( m/ N0 d' _                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
* n  W+ l# r& U+ Y8 N0 f: }                    DWORD dwDiskData[256];
# J% O) {% G- L# [                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];
% G9 G% A! a- i7 n4 U% j
9 L( L, n% O9 j! P7 X2 C                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
" n1 w) r, M; o, [                    // 取系列号
9 O1 A# }+ s9 S# d# B0 j7 G. @2 y                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
3 q7 r$ y: C3 F: S                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

. T$ t% P+ N4 a% Z& S3 [) _7 _; H                    // 取模型号
" M5 t  M$ p: B2 E. Y                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
; `; j; M' K" S7 h( x
                   pSerList->Add(szSerialNumber);
) J4 Q5 _/ z! ~                    pModeList->Add(szModelNumber);
" n( Z% q5 B- R0 f                }
# |7 A0 H- d/ y& J, Z( f& ?5 i7 T            }
* |% N1 e$ B7 c/ s9 F3 B; U            CloseHandle (hPhysicalDriveIOCTL);
3 U: n1 `7 q# _, x1 u2 C        }
2 e( R8 q, _8 m4 w; c2 s4 ^    }
7 E8 n$ Q$ D* s}
) g0 S3 W" `* a* F  N//---------------------------------------------------------------------------
// DoIdentify
$ q. j" P. h  ?/ l6 T, \  Tbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
) d' u, y9 m' E9 E- v+ ]7 X              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
; _/ {* C. U4 z              PDWORD pdwBytesReturned)
{
3 b6 w) q& Y# l3 k) S; H    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
' F- p+ t; ]+ n2 M9 r& Y5 n    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
7 B, U1 u( K) L3 x. J    pSCIP->irDriveRegs.bCylHighReg = 0;

, C0 p: U2 L: W/ l% K    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
: S4 t* b  v# \/ r) ?, N, x7 p    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
( V4 G8 ~0 Y0 l
   // The command can either be IDE identify or ATAPI identify.
( ?$ b) a& a! A2 }0 o) [    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
, Y5 N% m" P, U+ u           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
; Y7 N1 [( `: u6 I, Y           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
$ E( h4 h- U# {% D* h( o           pdwBytesReturned, NULL);
5 N/ I. v6 a. Q: u1 v4 @}
//---------------------------------------------------------------------------
3 e# M' Z. \# O( M5 t// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
) a) F- n7 G( S# Q) g' c7 S! ?1 }// ReadPhysicalDriveOnW9X
4 L2 Q6 c2 O- \4 _void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
- H% g% d9 s; t" _. @& `6 ~    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
+ H6 p1 i/ w" t7 ~0 X* C) H    // 避免蓝屏的出现。（期待高人能指出原因）
% `/ \  l0 A- _0 N* j    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
8 o+ q/ i" F4 ~  ^" S1 O' X* y        BYTE btMasterSlave;         // Master Or Slave
+ B; _+ u& f# u0 O! t' e        bool bIsIDEExist;
       bool IsDiskExist;

       switch(nDrive / 2)
; \& \' S" c( n* M6 h! a) L        {
% ?# J, t9 k6 T0 d( w+ r; Q; P            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
) k# E7 f9 o. R8 H$ h2 `% A. F: h            case 2: dwBaseAddress = 0x01E8; break;
' E+ X  U" V- |' F' X            case 3: dwBaseAddress = 0x0168; break;
       }

- S! H& A" h# c+ K6 d! x1 ?0 F; }        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
! j# X. w5 G. v9 o
5 I: B( S8 T" y7 ~7 f        // 进入Ring0
- D0 l2 X5 B: m, \. z: W" x        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
# F# t0 J2 e: Y1 G7 o                bIsIDEExist, IsDiskExist, wOutData);
9 O2 X; N% X7 p6 ~; t) ?8 ~) R, M! P    }

% |9 c- L7 ^( [( j$ i    // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
. g( c8 W+ }1 [* I/ o# k/ j  i4 Z  P    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
  K+ M. T( r2 F4 m! {        bool bIsIDEExist;
9 f0 I6 ?( u# J: M* ~* w: \" z        bool bIsDiskExist;
9 a9 x' S+ O- J3 I2 d# f        switch(nDrive / 2)
  K) n8 V4 D6 d0 U; i  H! y$ ~7 O        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
/ D) d! n, d0 \2 ^9 N. p7 ~/ T+ @            case 2: dwBaseAddress = 0x01E8; break;
, L7 c3 h8 G2 q- Y7 O) k# W  W            case 3: dwBaseAddress = 0x0168; break;
       }
+ N4 y- C& I, s8 T( d3 J
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
9 F) V# N5 ~2 B! `
       // 进入Ring0
- w' F9 m, ]& C; e( |6 l        bIsIDEExist  = false;
       bIsDiskExist = false;
- j1 d% n9 W, t1 d+ @5 X( o        ZeroMemory(wOutData, sizeof(wOutData));
& b& H4 {) C+ I8 f4 c8 t
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
  U$ o# E1 x1 P+ H: K+ o8 |                bIsIDEExist, bIsDiskExist, wOutData);
5 P$ D, {4 s  o" x0 H# h) x
6 b4 Y3 r, U3 C7 l) k5 C/ D$ Q        if(bIsIDEExist && bIsDiskExist)
       {
& V- k% B  Q! w            DWORD dwDiskData[256];
           char  szSerialNumber[21];
1 r) Y7 s1 Q, }6 C            char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
2 d6 d+ Q8 Y+ M  Z6 x# T
- t, n+ v5 i5 C" h# C8 T            // 取系列号
% u# a  A" G. M. m) j* U            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
! e0 c" a4 P% B' {6 [            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
7 ~2 N  O8 B% `
, X2 U% p/ W* h3 p- Q) T& `            // 取模型号
  j$ ~8 t. K: \# _! a$ _            ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

5 k1 H* q" q3 R9 t( \7 N) J            pSerList->Add(szSerialNumber);
3 m+ L* p, J# V4 Y0 i            pModeList->Add(szModelNumber);
       }
6 X# _( i8 ~8 O+ K) O$ s    }
; u" _5 _# F/ y7 Q2 }* H+ g    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
3 A8 k, w# o0 y  }7 g4 P# Z) }4 y" P//---------------------------------------------------------------------------
3 L; i! W  q% b, _  h// ReadPhysicalDriveOnW9X_Ring0()
7 |/ @9 R* Z; \) ]/ h9 N" r/ l+ `//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
- |; k8 R2 {1 Z8 b3 L// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
+ w5 H  @3 _' y8 y        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
; K# b" t! U6 G% f) }4 Q, D2 U1 N{
+ ?* w0 m8 C1 y9 F! `* W6 b    BYTE  btIDTR1[6];
7 |$ D9 q6 v: B# {8 ?& T% m    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
; G, ^) ^; f# n# k    BYTE  btIsDiskExist = 0;
2 C% Z  O0 ^3 c1 Y! Q: o% ~  R    WORD  wOutDataBuf[256];
' \3 A0 {: k8 N! o9 a0 I  N: z
- y2 c2 G) F# ?( |7 i+ P    BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
" \! n) O5 E# U5 x5 D4 a( i    const BYTE btBit07 = 0x80;
( ~) T1 Z2 y, p2 a    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
# _9 h7 F6 ]4 F, n9 c  ]    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

- y" q; ~. g: e: D    __asm
   {
; t. b1 q& O9 f* S        // 必须先执行这条语句
- ?" J2 R* S; I3 Q$ j        JMP EnterRing0
7 e+ S! o! ^& V. u$ j$ `8 d
# [; `0 d5 c1 }        // 定义过程
1 K2 A: m  P1 z        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
. j7 v* Z" M3 x, n
( e4 R* @/ X$ Q. X$ \) D        MOV  EBX, 100000
5 V# d/ H9 C* v+ l" g7 l- Z        MOV  DX, dwBaseAddress
- j6 ]  m* @2 C8 u: I6 J        ADD  DX, 7
! q& ?: u" [4 O4 m3 j% f8 [
/ b0 [/ p( t0 R2 a        LoopWhileBusy:
8 I, O% y3 M! _  f+ o+ ?# R( r
" e( [5 @# L  w( |+ \        DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
. ~4 z: ?0 [; D5 s        in   AL, DX
       TEST AL, btBusy
$ w, f! B3 P) W- A2 d  b        JNZ  LoopWhileBusy
: V& s' `% @6 ?0 H# V        JMP  DriveReady
; b' n% ]- N. A' j2 r
! E  C# q0 e) Y: A5 U4 p; g        // 超时，直接退出
& K! y9 X$ ^4 _        Timeout:
( {1 S1 g1 k5 W3 W+ O5 S) H        JMP  LeaveRing0
* n- J, z+ [1 t9 _* D$ ]        DriveReady:
       RET
8 l& V7 q" f# q; F/ B0 g        ENDP   // End of WaitWhileBusy Procedure
* c9 y6 b+ J$ n% {
! M$ m! N% ]- ?) o% n& F' R        // 设置主盘和从盘标志
  E8 z4 K* F7 u5 I9 d; P" O) v; F+ }/ U        SelectDevice proc
' k! K# A5 P2 m
$ u. G- n( h( k: t        MOV  DX, dwBaseAddress
: A( {8 F6 n0 ^( e7 p9 v' z2 p        ADD  DX, 6
       MOV  AL, btMasterSlave
1 {( b6 Z: J6 }, d& S4 P& t
       out  DX, AL
/ T' S8 a3 G2 l8 I6 N6 G        RET

" A: P5 S% p6 K        ENDP  // End of SelectDevice Procedure
# t, |# U5 U5 A6 L7 ^) O6 V2 {
       // 向IDE设备发送存取指令
* h! O/ Y  F0 j( L, ~) y) u& M        SendCmd proc

       MOV DX, dwBaseAddress
' y5 Y1 t. G2 X; m: `& _        ADD DX, 7
4 Y7 }+ E( a% `; n        MOV AL, BL // BL是主从盘标识，在过程外设置
0 l' B$ J9 j# r' `0 z# J& O3 r& Y+ _        out DX, AL
       RET
& X! L2 q/ u. x) W! t        ENDP  // End of SendCmd Procedure

4 Q* ^# q; q  ?+ q+ K8 X        // Ring0代码
       Ring0Proc:
7 }: ?* x8 ^. T. O+ t% P3 o: ~        PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
* c- c3 e$ ^! X1 a& ~. \
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
( _, i# e: {( G' W        JZ  LeaveRing0
% ]; T, H" i4 a8 l7 N8 c% S" ^
" |) b1 C8 V# u# d3 }8 n        // 设置IDE设备存在标志
; `0 L/ M% h' i8 r/ \        MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
2 k6 Q+ s2 {: Y( K        CALL WaitWhileBusy
3 T; s' P: B, B' c/ d3 O8 _        CALL SelectDevice

2 Q6 L7 \1 I2 h5 @, D  u        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0
; L; P: F% c& b+ k( c( @
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
9 O% K5 A9 z/ z. K! C* d        CALL WaitWhileBusy

' }8 R  k- ?; Y: [7 F/ c        // AL的值等于cBit06时，不存在驱动器，直接返回
/ ]+ W1 t7 Z# W4 ?8 [        TEST AL, btBit06
       JZ   LeaveRing0
6 H( L# B3 s7 c/ d$ ]
. f' q6 W' X, U  Q" _( P- S        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
. o& `# M2 n- M0 W. s1 V
       // 发送存取端口命令
1 X9 ]. E$ z- d+ k) Q- ^! F        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
  p' d2 O4 G8 O7 d+ v        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
2 w( q; f0 }$ Y. U) m+ [        CALL WaitWhileBusy
0 O; o3 G2 s  i; e4 Z/ z        CALL SelectDevice    // 设置主从盘标识
/ V2 E1 R! u5 c2 H) B        MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
6 p- y3 q1 |$ s        CALL WaitWhileBusy
% h& g) o" Y: u: g6 S% I
       // 检查是否出错
       MOV  DX, dwBaseAddress
6 H/ W9 v% v' e+ L  O& z        ADD  DX, 7
9 p6 s7 L7 \- C8 E  K5 E6 W
       in   AL, DX
2 z4 Y4 y" Q$ _5 A1 B6 r
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

& n. E5 O2 ~4 s" u        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
' A) D8 X) ?0 D% m' `        CALL SelectDevice
* z5 v, l& n" b3 y1 {1 Z        MOV  BL, btAtapiCmd
+ S5 e: L, N4 z, W        CALL SendCmd
       CALL WaitWhileBusy

. K/ b! Y7 ^' H  U$ F, i, |5 s        // 检查是否还出错
* u2 y7 j2 x7 V5 w        MOV  DX, dwBaseAddress
# q$ k6 t7 M* A+ s        ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
: b3 F/ E) q6 ~# {" [! c( V" b        JMP  LeaveRing0     // 如果还是出错，直接返回
* M" |! [) W4 e
5 F, n' S* k* A3 l4 ?' t$ a5 x+ V        // 读取数据
9 u7 J# }* |3 n* t7 ]8 G9 w3 @5 f) P, L        RetrieveInfo:

# x/ g7 I, F& g* \# m) p( n        LEA  EDI, wOutDataBuf
) k: f+ l5 p7 T9 h        MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD

       REP  INSW

7 l6 O( b% _. }2 W  Q; L        // 退出Ring0代码
       LeaveRing0:
& n+ u6 }4 K0 D1 {7 j4 F" W( |6 n( J
       POPAD
. O0 b1 K0 T* Q        IRETD

       // 激活Ring0代码
6 H7 [1 q$ v' p* J: s        EnterRing0:

       // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
! \  P' y( `/ B( U& j        CLI

       // 保存原异常处理例程入口
6 N; L# `- m1 l1 P+ c. a( H        MOV ECX, DWORD PTR [EAX]
" B" o. V) A5 Z8 K- E( ]        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
! N, S# y- F+ O) q
9 V7 d* _* i" J1 z- a        // 指定新入口
       LEA EBX, Ring0Proc
2 E7 o' r" q; n! [        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
" Q- w( n) f5 P( m3 n' ^, a
       // 激活Ring0代码
       INT nHookExceptionNo

4 d6 b  K# `/ @, a        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
- r+ H: y4 Z9 h& k        MOV WORD PTR[EAX+02h], CX
% N) f( c) v/ I, b# o( B5 t        STI
% f; D3 j' ^3 r2 h+ c& y. ~    }
   if(!bIsFirst)
  F3 k0 O# U3 \    {
       bIsIDEExist  = (bool)btIsIDEExist;
' _, z* H' x) p# V" [9 d( E0 p7 \! P        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
9 j, u( `! J$ [) M9 `9 d# m/ b- c    }
8 l) c' u4 [7 u# p4 b$ g( B  y}
4 U8 m2 M8 \, R//---------------------------------------------------------------------------
// 调用方法：
5 f1 I' h7 m' P. ?, P: [void __fastcall TForm1::Button1Click(TObject *Sender)
5 W, ?: O* y2 P2 c{
1 Q4 c4 `9 B% E' w    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
9 V1 C; w: x, B  A}