[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
7 Q$ c* Q+ ]9 y" L) x( k2 p% y# f
#pragma inline
8 u; }& R& O5 ?* W; {, P//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
' W3 z" N6 _! C4 i4 K- w+ Q5 u#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
; Z8 H3 T% V) }5 _$ h1 X1 x#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
  u: M3 |( R* B  }2 @# S
const int MAX_IDE_DRIVES = 4;

% ~- s3 h0 Z  W5 V) d// SCSI专用变量
& S& @6 f1 A. [- _1 y) q6 @const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
9 `; V# G8 ~1 o8 Wconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
) ?% [, b$ h  x; `const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
0 g" f; j8 z) Z7 X0 rconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
1 M3 ^" `0 o5 D' j8 T0 ~{
4 U8 ~4 O" r1 G; o% N    ULONG HeaderLength;
   UCHAR Signature[8];
7 f" @' L; s. E! S, Z, r    ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
! z& V2 }+ M: l    ULONG Length;
- K, A. `, W0 k$ W6 \6 d}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
2 l6 L9 U) }: G7 m- H& _- Z& ?
// 读取的主函数
* N5 Q4 d# [9 P9 F' d% D( L$ mvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

  Q" o8 b4 d. e/ P; W% m) F6 ^// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
" u/ S6 }9 V" n6 ~7 zvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
! E# v4 [' T7 ]3 |3 F( s) ]! r        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
. K  A8 H" ~  b$ X// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
* s1 G) m, b4 x, W! Lvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
% `0 {1 o( A; Q  F! c/ \# V        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
" o( V5 W6 g; iString __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
// ReadPhysicalDrive
" m8 Y. @, N( d; Ovoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
9 J, v! L  L' c, r& R3 f0 s+ u    switch(Win32Platform)
   {
( O! E% N* V# N) X* m- E        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
' t( c( W; U  J6 {5 l            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
           break;
   }
}
( L7 E7 c9 \  E8 J1 u+ T: ^//---------------------------------------------------------------------------
7 s0 e9 m9 w; o// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
6 z. F3 C$ j: }" G& U{
   static char szResBuf[1024];
" F2 L: }. O1 U/ Y  F    int nIndex = 0;
   int nPosition = 0;

" g. A- u: u2 j, S# C% J    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
- o" q" G( b* Q' m    {
0 D9 J& \$ a5 m" O4 ?: g) }; U        // Get high BYTE for 1st character
- H( f# S$ y7 }+ D+ K2 `( u        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

       // Get low BYTE for 2nd character
( k9 W: s! T/ O  d2 c" O        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

   // End the string
1 x! n1 c/ p3 }, N+ S2 H4 ~+ n    szResBuf[nPosition] = '\0';
& q) q. u2 q, I. p8 Y
   // Cut off the trailing blanks
) Z9 {1 T5 Z% L1 ?' U    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
! t+ E; w* I% n        szResBuf[nIndex] = '\0';

' }3 B( d; U# C4 i; p, K0 c    return szResBuf;
- }6 j( e1 @, g# f7 B8 p& u}
" A6 r8 Z" U2 H1 j& R//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
% m7 K$ j* X4 u6 m3 d- E// ReadPhysicalDriveOnNT
$ `/ H9 P; ]5 E0 c. s3 e8 I( avoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
$ s% _6 u( X2 F% A6 ]) H{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
+ k0 {5 m. g$ U
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
  g7 G: }/ g+ F% s+ W/ Z        char szDriveName[32];
0 `; a: \! `& ]" x  E# \  V
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
* N: R6 z( d9 E0 W                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
  z& }$ I" @9 j, A7 _; T" [2 H                        OPEN_EXISTING, 0, NULL);
0 a3 m+ P* x( M  u5 r
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
8 O/ {7 T2 o; D; t
( \5 `6 U+ S$ h$ r( L4 D            // Get the version, etc of PhysicalDrive IOCTL
  n5 `( e4 E% w3 L2 i1 M$ ?            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
1 {" Y3 h) }- J  j                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
% i; K3 ~# {. \, J& o                    &dwBytesReturned, NULL))
1 J( \5 K2 Q" ]) t            {
7 d" u+ J' _, d1 a& N6 ^                continue;
+ T6 o. j  G2 B9 g: D7 A7 a            }

0 R, x# c5 N, a" y, L            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
: p  d$ D1 X# f                // IDE or ATAPI IDENTIFY cmd
+ e! r% H$ o9 I; d" R0 x! w& r                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
7 z$ C2 ^- P- `+ U: K                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
* c- J0 F) C# o                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
) P' P+ u+ h% l1 N) ~                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
2 K# \7 X6 ?! _& w$ Y
( C/ F: g+ E/ `& R+ `                if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
/ O1 n( ]7 {+ n; _3 a                    DWORD dwDiskData[256];
, R4 D. N- q* \; U                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];

. n( ]' ?4 W! K0 D" [                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
5 X' j3 D* m/ e3 \* T7 ~& P+ {$ Y                    for(int i=0; i < 256; i++)
6 \" P( k0 F+ |: s. {, ?                        dwDiskData = pIDSector;
8 O1 _0 @3 y2 \1 k; u9 V                    // 取系列号
( W5 e( T. U0 a7 }6 Z                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
7 H$ b- S+ D7 D! [) U/ z                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

( t; M; h/ Z4 u' d7 e+ l                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

3 h7 |& z* `( M5 e* |4 N( I1 U                    pSerList->Add(szSerialNumber);
0 w/ ]! T! L, `/ C  r! F                    pModeList->Add(szModelNumber);
9 {( V6 P& F. U                }
           }
           CloseHandle (hPhysicalDriveIOCTL);
4 G. p: k- Q+ b5 _0 S, ]. T; L        }
' m) v. h0 N* s& D% i" V& y  ?    }
}
//---------------------------------------------------------------------------
9 g7 [* [1 i. h* S) ^// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
1 t1 _) j4 u" [% [4 `1 o              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
{
; V; ?* M  r6 V8 l( X( ]( B' z    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
, ?: V4 |5 y/ A; p, Q. J9 A    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
. D% k2 U( V: M3 q    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
8 D$ L( m) F1 _4 u
8 i1 X5 _$ I" a" Q# M% C3 y% Y    // The command can either be IDE identify or ATAPI identify.
% W! _9 ~0 X4 a( l    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
5 b: g& s- o+ A+ S* ]6 T- t           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
; h. w: U/ d* b9 G3 p           pdwBytesReturned, NULL);
7 D2 D" E: e* O/ @. e% R}
) I4 V$ @- k# x! j& a//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
. [; E! q9 S! W8 K% f//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
' @! h( ~- n& R    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

& L# w2 g5 L$ b% ^' i    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
* f2 ?) y  A- \: L/ [1 {! x0 y    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
( x7 e' v  X. }8 `# w% w    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
) M8 |# g6 i+ l5 u' @' G$ N        bool bIsIDEExist;
, ?( e9 ~  y; ~. E7 J5 y+ p        bool IsDiskExist;

       switch(nDrive / 2)
2 E3 _1 D  a+ Q        {
) N- u7 C! j9 b0 d* p/ N            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
. N  E0 s7 E/ @            case 3: dwBaseAddress = 0x0168; break;
8 F1 `! S# J/ W' i        }
$ k' ^) b1 W2 R0 N. V* Q3 k
2 R. ]8 w" k; C  X        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
2 Z2 I  E  {1 P, @' U
+ {. Y7 V" }5 e        // 进入Ring0
0 L) Y1 R9 L4 a4 m% l! U        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
/ B6 g- {- P- K& L                bIsIDEExist, IsDiskExist, wOutData);
$ g. d/ v  ]% @' ^/ [    }
% @& j  h3 a+ X- {: u( [
   // 开始读取
" G6 L" \/ D5 C8 r    for(int nDrive = 0; nDrive < 8; nDrive++)
& `& _( t1 h2 ^3 h4 P  P. o. U    {
. C6 [: J: a) Y) X+ e  y* B        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
5 ?8 ?' h# m' r5 L( b7 Q        bool bIsIDEExist;
: Z* U4 `* _* @1 w) X        bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
' d0 S: G; C6 R  E3 s8 K            case 1: dwBaseAddress = 0x0170; break;
' v2 C! H5 o3 q. J* Z/ J, ^            case 2: dwBaseAddress = 0x01E8; break;
4 B8 b. a7 T$ s            case 3: dwBaseAddress = 0x0168; break;
       }

. V& S3 b' U% s- v        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
       bIsIDEExist  = false;
; v! ]1 H* s  t7 S$ R        bIsDiskExist = false;
' ~7 K6 @5 M9 K- x7 W- p; M9 |$ x        ZeroMemory(wOutData, sizeof(wOutData));
( B  h0 y. V; }8 \
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
1 Z; }0 _% G8 u% I' H7 y$ R1 a! m                bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
, J! z! X+ w; V0 `5 d5 o            char  szSerialNumber[21];
: T7 w) I4 [0 W9 z            char  szModelNumber[41];
+ s2 L0 o) \9 N6 R5 d0 _
: u9 Y; {8 U" B0 r            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
9 r: w- L5 }, e: ~0 l
           // 取系列号
( o( _1 g/ r8 ^* X0 K            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
2 N( }9 X7 ]: e* w2 z9 q. S+ d& U
           // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

3 m; S3 o# F( D' ?2 d; p4 C            pSerList->Add(szSerialNumber);
% u% Y# Q- d4 G) _, B            pModeList->Add(szModelNumber);
       }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
0 b2 |2 N& U3 [# k9 h( G, k+ f}
//---------------------------------------------------------------------------
6 B6 K1 e2 f% ~$ e1 h6 E// ReadPhysicalDriveOnW9X_Ring0()
9 C% m: w5 F& e" v6 v& O2 w//
* q, }! U' Z6 a7 A  d9 T' d5 v7 v% ?// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
) d' J+ @) y, V// btMasterSlave = Master(0xA0) Or Slave(0xB0)
& M9 a) T7 |: S1 f& v//---------------------------------------------------------------------------
; e# P+ V. q& D; a* cvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
2 F) j" k; _  Q  z/ b        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
' P0 \+ n$ F. m! S9 b# ~7 i{
. b" c1 s+ h3 v4 q5 H4 B, D    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
& t; r: {$ B4 }( L1 ~1 t  e. @
   BYTE  btIsIDEExist = 0;
- N; f3 j. k% }! x, ~    BYTE  btIsDiskExist = 0;
5 ?& i6 @( A9 @9 d. p    WORD  wOutDataBuf[256];
. e8 N/ o+ a2 A, f/ |- k9 {& Z
   BYTE  btIsFirst = (BYTE)bIsFirst;

8 l; q, s5 P+ _. D. z3 [- r1 x9 w    const BYTE btBit00 = 0x01;
+ Z6 I" [' m9 k+ d$ v    // const BYTE btBit02 = 0x04;
( I& u: h0 k( Y2 u: u    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
' P% x7 y6 Q( b8 p! x# f    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
4 b' j' ?% I. Z5 x5 q
8 V: ~; F+ z4 {! W    __asm
   {
7 I: i" a/ |- ~. L- b% W        // 必须先执行这条语句
" V. O# f8 ^8 _9 F  e        JMP EnterRing0

1 h+ C% q' k0 f2 w        // 定义过程
       // 等待IDE设备直到其不为忙为止
, @* w$ W+ `; C8 P& M        WaitWhileBusy proc

       MOV  EBX, 100000
! T. R. b  Y# R% P3 ]5 g# k        MOV  DX, dwBaseAddress
       ADD  DX, 7

6 u5 E2 c( d0 \2 }        LoopWhileBusy:

       DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
       in   AL, DX
4 O3 y* \; T# k) q4 U) n+ w# I7 J        TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady
" [+ l2 o, Y1 J3 I7 Z; i% I) ~
       // 超时，直接退出
# r* \- J3 Q# m7 W/ h2 y5 M4 X        Timeout:
, U/ p* G1 c/ T. X7 B4 d        JMP  LeaveRing0
       DriveReady:
       RET
$ J8 ]1 `1 ?! S9 K) m        ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
       SelectDevice proc

  L. @$ t, @; D# V* F  U2 Q5 g        MOV  DX, dwBaseAddress
+ g, G4 i! p1 v6 G9 o" S7 P3 [7 V        ADD  DX, 6
       MOV  AL, btMasterSlave
: Y+ K, E# i0 l0 I4 N
       out  DX, AL
       RET

6 @6 n( M" `: O1 B/ K5 p        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
( O3 A0 w6 M% G8 }: c( j        SendCmd proc

       MOV DX, dwBaseAddress
       ADD DX, 7
. z' H  v3 {# g4 t, n7 h+ Z5 m        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
& `+ o0 E1 Y# m6 J, u! I7 `        ENDP  // End of SendCmd Procedure
+ x! g( |( U1 A7 G9 v( x* N0 f) W
9 B! b* n* x2 i& ~7 A5 n        // Ring0代码
0 W& C, J, a/ {  {        Ring0Proc:
2 [! f7 u4 T# e: N* q$ ^7 K        PUSHAD
/ f1 ^; z2 r( o" ^# V# j7 ~/ T        // 查询IDE设备是否存在
7 v  S# X, x& Z& y        MOV DX, dwBaseAddress
9 g5 I" E% x8 C1 ~/ `  r+ ]        ADD DX, 7
       in  AL,DX

& q, `" E- @( x8 Y        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
7 T% N! \3 b! ~' @6 c" y        CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
4 L. D" h$ W: f* A/ T        JZ  LeaveRing0

       // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

# }2 ]6 v& ^  ?" F' ~( u1 B. N0 y        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice
  {/ V9 P$ v9 |- e4 f
3 t$ ?0 @1 y. m& h. T* ]        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
$ n; Z8 X/ o- A- O. Q2 n        CMP  btIsFirst, 1
       JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
9 X# s# ~' y/ B" P$ X        CALL WaitWhileBusy
) g+ u: q) ^  o+ X0 D( k
8 f8 m0 q) M1 z- m0 b        // AL的值等于cBit06时，不存在驱动器，直接返回
7 o) ^; |: y- X        TEST AL, btBit06
$ m0 l( I+ A. I/ _" x' S' `        JZ   LeaveRing0
1 j0 f5 Y  |5 j6 n6 g
$ C4 M1 D8 d2 j$ V8 s, t% Z4 S        // 设置驱动器存在标志
8 Q9 R7 m4 f  P/ ^- R        MOV  btIsDiskExist, 1
" r) s* A5 x/ [3 b: i7 m& q
       // 发送存取端口命令
# ~" V# a$ f1 Q' t" @6 ~+ D' a  G        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
5 c% h0 C6 F3 G1 v        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
+ K  N2 }( Y  R2 G0 B' k        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy
1 d/ {4 r5 r- v
       // 检查是否出错
+ i+ G  H* E, r! X        MOV  DX, dwBaseAddress
       ADD  DX, 7

( ~6 I4 J, G/ u" U        in   AL, DX

       TEST AL, btBit00
9 H- T: _! P0 L        JZ   RetrieveInfo   // 没有错误时则读数据
! {3 f& z* t. Q; z# R
       // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
0 N6 Y+ I  P* k; f9 ^; i5 U        CALL SelectDevice
       MOV  BL, btAtapiCmd
- b5 ~0 w+ M" V# [  T5 l- D6 q        CALL SendCmd
7 x2 T8 z2 v4 W7 d7 [        CALL WaitWhileBusy
7 F) q' L( F- R' I4 ^
$ }" i+ T- j1 t7 ]7 }- ^: g        // 检查是否还出错
       MOV  DX, dwBaseAddress
$ Z5 a: E0 m: }+ N% ]. B3 O5 B) A        ADD  DX, 7
4 m; z9 m- Y2 |  x+ |$ ~  v        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
+ @0 _% p( [/ ?& W" v6 O$ S        JMP  LeaveRing0     // 如果还是出错，直接返回
) f  @+ E" Z8 C/ q
- v6 |0 l8 ?( u        // 读取数据
       RetrieveInfo:

0 B. N/ c  R) X- [        LEA  EDI, wOutDataBuf
+ m/ c( ^- L. o- S        MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD
. O; D+ r7 Z2 X( @$ S3 b# w& k
       REP  INSW

5 P+ J8 p6 G4 c, W$ X& J( a' P8 ?: k        // 退出Ring0代码
2 f& d* H7 I! ~  i: Z7 I        LeaveRing0:

( N: I% P4 t' C" D$ Z) U/ t* F; T        POPAD
       IRETD

  L6 [0 U8 m  T9 r' h' I$ o        // 激活Ring0代码
# ~0 P' m! N: [: {5 l        EnterRing0:
" M3 I0 V$ I! j- S
7 p* O& f2 A0 q4 u        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
, G# V8 k  [, W; ?        ADD EAX, nHookExceptionNo * 08h + 04h
) v+ F' C4 n  b$ B        CLI
7 p" \9 j8 y$ y5 M* Y1 O0 h
* C7 E2 I5 w. n! |# p- y. u2 I& n" w        // 保存原异常处理例程入口
+ q/ S& n- F; s" p5 v# R7 J8 k        MOV ECX, DWORD PTR [EAX]
( j$ j% p8 E( g" j) ^) f4 m        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
# ]- F# }. Q3 j; b1 c8 ^: H6 F' d
       // 指定新入口
       LEA EBX, Ring0Proc
, ]3 r9 `' A+ b- S/ P' r! H        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
8 o& H$ s3 G9 L' y9 @4 b        MOV WORD PTR[EAX+02h], BX
: Q  w3 w, z8 r! f4 U7 _$ C/ \/ j
       // 激活Ring0代码
6 ?  o1 |& b1 o  Z- J/ S& D- @9 T        INT nHookExceptionNo
4 D, w/ |+ B9 X! r7 M
       // 复原入口
       MOV ECX,dwOldExceptionHook
+ J1 ]; ^' h3 o* o        MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
* {( ?0 [# M( Q7 D6 ^        STI
   }
, u0 m1 j2 L6 B! @+ b# L    if(!bIsFirst)
   {
       bIsIDEExist  = (bool)btIsIDEExist;
: S, ?- R% s: H% }$ C: F4 C# z: s        bIsDiskExist = (bool)btIsDiskExist;
. _& i# M. |+ R4 E8 b5 \" w        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
$ v, }3 v# [& R# q- e8 V( I1 f! D8 V    }
}
//---------------------------------------------------------------------------
5 J2 D# A+ Q# j8 ?// 调用方法：
' F& h1 R+ m, K4 y( H. P7 {7 z. g% [, }void __fastcall TForm1::Button1Click(TObject *Sender)
5 L5 [; O3 i+ T1 t6 m. R{
) ~: ^9 e/ N" O; K  _1 U    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}