[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
5 g5 L2 A% a. C#include <stdio.h>
" q- K4 }; ]# Z6 P0 l
#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
% @2 I/ M& R7 F5 a$ ~' i#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
8 p1 T' @8 o: O7 H2 ^#define DFP_GET_VERSION         SMART_GET_VERSION
5 x2 j1 K8 |; V- i, T9 @( a- C9 Z#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
3 d% d2 q8 H% M6 ~! r#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
1 |4 B( M8 ?* M6 p* X- y) P' ^
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
6 u5 L/ P; _2 K
9 }# i4 }# ]6 f" [const int MAX_IDE_DRIVES = 4;
/ s' V7 O. [' h) F* X* h( D& ?( K- w
// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
) `8 A5 M, [& Z! }$ K, [const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
: k, ~0 f- G( zconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

  I1 s/ w2 i, f6 ^% }3 ntypedef struct _SRB_IO_CONTROL
) D) i2 x( {4 t: Z6 J+ o2 M- D{
   ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
3 H: \% }: a. C8 p: F    ULONG ReturnCode;
   ULONG Length;
2 z% Y& C2 }8 v# H$ E4 E1 }* X}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
* S- E( j& O8 k  t. p6 ]3 A
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
% ~, D6 G3 F6 B9 z
9 q  T! u1 g  Y( ^' q6 J) E" ~2 o  S// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
. p% {9 w% H3 Z, hvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
8 a) Q4 X% u4 `/ f  |        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
% x. V! x7 |4 K  J, s, U; t// Windows 9X函数
5 i' t) N! |& E" \void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
% k1 j) B3 h( M. `$ Kvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
. Q- Q3 _. d) Q% K* z, M4 H- O
% ?9 }2 N4 d  ]( l// SCSI读取函数(for NT/2000/XP)
2 B5 E9 B( o; t  C& M7 dString __fastcall ReadIDEDriveAsScsiDriveOnNT();
" M3 G% ^) _+ @7 v- A3 b$ d" v//---------------------------------------------------------------------------
  ]/ H5 \# _4 q& W! i3 ]( r" f4 i. S// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
* q# O' `7 r. [+ S4 n) X; I2 c{
   switch(Win32Platform)
) i1 A9 X; H% \) I    {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
2 k4 a+ A; U4 J" |+ S2 a        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
8 U5 d4 e$ U& \/ d            break;
   }
}
//---------------------------------------------------------------------------
// ConvertToString
0 _7 }& c- [5 K+ L, Rchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
7 X7 u* A0 l$ r$ b6 i    int nIndex = 0;
2 T9 |* G, v: g! {3 }* M6 O$ ~# G    int nPosition = 0;
5 r& [5 ^3 {3 ]9 G
. C) s4 R, d% N0 m& J: |    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
7 c: J7 r. @2 ~3 \! H" s- E" n! K    {
6 R& f* d) \+ O9 s4 a/ b6 u        // Get high BYTE for 1st character
8 X6 k) @0 _& K% P% T        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

5 C2 T4 y1 c0 H3 F" v. ~0 N        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

   // End the string
   szResBuf[nPosition] = '\0';
3 a% E1 ?5 [8 D+ e6 Z4 M
, y# f2 {1 D* s  y- B* I8 K    // Cut off the trailing blanks
& ~& r  j4 I2 r* {" a0 ?* h    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
+ F3 K+ U6 n: E% S  ^}
, b* p; U! J) d* Z$ j. m//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
- D) G- ?4 M  F//---------------------------------------------------------------------------
; `5 \7 Y" F) |. E// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
& C! Q2 q/ r: g/ |' ?{
- I9 z* p* [4 z8 y, U9 }1 S    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

. j* ]& y/ h$ e% e! ^4 N  v    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
) g2 G; S$ _# c4 g    {
       HANDLE hPhysicalDriveIOCTL;
7 _2 B; h/ H4 @+ }# q( h        char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
1 v$ d4 B: I0 M" G/ I                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
5 h( r) X7 w3 u# Y* k3 X        {
, X- }* V. R/ a# a4 h; Y' o% @            DWORD dwBytesReturned = 0;
" C# \5 b7 f# E' L3 `: t            GETVERSIONOUTPARAMS gvopVersionParams;
/ r& i1 G& X. d# U
           // Get the version, etc of PhysicalDrive IOCTL
+ a6 y! Y, N1 F4 d4 C/ Z            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

/ Y( W3 s6 r1 k: g+ X0 T            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
) v) _2 X6 {" G4 U" |7 ~                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
               continue;
0 l. H5 l" z) {+ m) L6 D7 C            }

           if(gvopVersionParams.bIDEDeviceMap > 0)
$ [6 k, \! @0 v8 `; w3 {' Z7 A            {
' V0 X# Z1 O+ K, I+ f                // IDE or ATAPI IDENTIFY cmd
: L; z% }5 X) r$ Q- C9 {                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
* P' N7 ]" Y. X' P7 n; j7 G" ^                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
6 X# V. v: l, {9 k" M6 @  D2 `                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
7 O& Z; l$ T5 P- F                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

; a/ W1 {0 H: P% M( R+ E, _6 p                if(DoIdentify(hPhysicalDriveIOCTL,
+ J! V! q: B+ \% f- E                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
- _" W6 |9 g/ {+ [; j" D5 W8 k. F9 B                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
, K  o. K9 ~* L+ s) G/ O                {
                   DWORD dwDiskData[256];
$ W. C; t/ a' [" g! P                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
, V& D3 N$ Z) O5 v                    char szSerialNumber[21];
                   char szModelNumber[41];
1 a1 X) Q& t+ u3 @5 J
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
6 u$ a7 T3 x3 F. t3 T* k& Z                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
  {7 m  g. O- Q9 f0 q                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
* G4 j6 T3 b1 o. |! N' o5 A& B                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
, p6 h7 |9 {2 B% T2 D                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
. K% S/ w/ _$ W                    pModeList->Add(szModelNumber);
               }
           }
           CloseHandle (hPhysicalDriveIOCTL);
       }
2 g, j- z9 k4 [/ N1 f# b1 B& j    }
$ n% V0 U. m% Y% `$ g}
" C4 n) U. ~* p4 e//---------------------------------------------------------------------------
1 f. Q" X' @/ N& j1 p// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
8 o0 V% E! H3 y. q* j2 G& Q              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
" O2 x- b( }$ |' r  D{
   // Set up data structures for IDENTIFY command.
$ F% ?: u  P; v' M# G    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
: U4 l% M* M9 C5 X, Q" x- [    pSCIP->irDriveRegs.bFeaturesReg = 0;
* n5 i: i+ \5 c, @3 n9 i0 a/ x    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
: @3 O; ]) g1 m, w8 D    pSCIP->irDriveRegs.bCylHighReg = 0;
0 t" v& V* n1 x- X- Z5 @5 n, n
# q/ [+ h5 \' Q! s    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
  }7 Q# H/ u8 w! \    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
1 P  r* V; W! Z5 c- @7 K    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
% A9 M& W& H1 u* z
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
- H1 d* K" c+ K( T% S. G+ e6 t6 a           (LPVOID)pSCIP,
4 V# w9 x. _* o5 K" F5 }           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
- N9 s6 b/ m! i8 m% ~           pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
0 p" Z, w7 |- Z% }% h    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
  X; p* p2 _8 R- J
0 `- H* f# s" c    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
% E! h0 h7 }/ G8 a    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
" \  ~2 y: [1 y    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
" T, G6 b! C+ L/ U2 ?) F        bool bIsIDEExist;
       bool IsDiskExist;
- Q7 c, ~2 T5 [+ D" k1 n; w
       switch(nDrive / 2)
       {
( r- ]1 H1 v( m+ Y# L            case 0: dwBaseAddress = 0x01F0; break;
+ W# u9 W( I6 j1 a            case 1: dwBaseAddress = 0x0170; break;
7 z: T" X, K) B7 P  }. e( n            case 2: dwBaseAddress = 0x01E8; break;
8 g( e: L% \. V3 H) S' y            case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
: [0 G7 D( X3 k; w        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
+ u+ \" V5 _' ~5 y' p5 g$ N, t' j% k                bIsIDEExist, IsDiskExist, wOutData);
   }
/ {/ ^/ p/ f; [( ~, T. m
! y) t. N/ }1 {9 {7 \# K6 a    // 开始读取
. }9 V9 z2 f% w5 L" ?    for(int nDrive = 0; nDrive < 8; nDrive++)
# L* o* F- p5 @1 R7 h    {
! f- \) j* c1 h  W9 |        WORD dwBaseAddress;
  [' B- M6 d  _$ C, j: z8 A. N        BYTE btMasterSlave;         // Master Or Slave
; Y$ B* V* `  m8 b% U1 g. Q4 Y        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
3 |  D  t5 Z+ H+ ]2 m/ m+ Y        {
9 a% W' r, p2 T9 g            case 0: dwBaseAddress = 0x01F0; break;
5 O9 R7 ?( Y) o            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
- x" W  K- h; ]            case 3: dwBaseAddress = 0x0168; break;
       }

3 I) |2 {4 w! _4 F% O5 m8 m        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
  y& [/ n1 l- l- L0 c' r
       // 进入Ring0
) ]9 u. S/ c4 ]' I+ {3 a' f  ^        bIsIDEExist  = false;
$ t8 o- m6 e+ R# Y! {: {: y        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

5 X: k& Y' ~* ]/ P6 [' P3 z* D        if(bIsIDEExist && bIsDiskExist)
       {
$ O* [% m: }6 h6 S/ N5 ?( n8 _            DWORD dwDiskData[256];
9 d2 m0 K! K5 j! U, v            char  szSerialNumber[21];
2 K6 D6 v3 R  a" e% \            char  szModelNumber[41];

2 L: B, @1 l" O1 n            for(int k=0; k < 256; k++)
4 O, z+ f  _' A2 [  F% p: H                dwDiskData[k] = wOutData[k];

5 w4 `% C5 t- D+ K" V7 F            // 取系列号
; M6 u, s0 @  _. G9 N. f% H            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
% m" j: |; R1 W* a) t' O            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
* N4 V* }) c; w: s7 K
2 f( j* M) Z5 t1 s            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
/ e/ o; y0 R1 D7 ]# e  g% m) T$ l            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
9 S8 S9 a1 [) \& v/ A! I% @% P
3 t) C7 u9 _+ |; W/ j0 g/ Y  Y: H( Z            pSerList->Add(szSerialNumber);
! k' X' F% O: k9 r/ _$ ?& c& O6 F( S            pModeList->Add(szModelNumber);
       }
; O( A( H. a: l& ]' d, g! E    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
2 y7 a) n; P& x# `" d// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
% U6 F1 v" U0 k, N% z( l8 M9 B        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
8 P& J& F; V: l1 u: w{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
3 j3 d, D8 L, F9 m8 r    const int nHookExceptionNo = 5;
6 G* y( t8 X0 F$ I! R/ M  W
9 ~: T: N% L6 |) N% e7 K' C; f    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
& E, D/ |. [/ u  Q    WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;
# U" f) ^7 G; D4 B, q0 F. @
" B/ A6 J# `# N1 U    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
- d6 ?# c" @4 m1 \( V9 s$ z    const BYTE btBit06 = 0x40;
) [/ C3 Q& D6 l" I    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
  n, h2 h! O6 j3 e5 H) ]    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

   __asm
   {
5 o. H7 q! R6 k2 _" f        // 必须先执行这条语句
       JMP EnterRing0
8 O6 N( |7 z9 U- i$ o% C0 e: O4 z9 M
       // 定义过程
       // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
3 [7 Q, D8 n  C. c7 v
. h2 n8 b7 {8 d8 l6 o        MOV  EBX, 100000
# Y- s- c% k9 a  d2 d' d* L        MOV  DX, dwBaseAddress
6 r9 x9 Z; J/ g2 {/ A) |8 g        ADD  DX, 7

6 |' x1 Z$ G# e1 @$ }, \        LoopWhileBusy:
. ^* e$ F: d& M% v0 Q. y& \
       DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
# i! P$ r$ `+ J- A4 H8 O        in   AL, DX
9 O8 w( m* [) s/ n. P0 K        TEST AL, btBusy
/ ?7 _; \* r% x' b5 G% g% F, z        JNZ  LoopWhileBusy
. p2 `' p. ?: Z) r% W) K) w0 q        JMP  DriveReady

4 t# t# P+ N- z! s. k- w        // 超时，直接退出
7 M2 }1 ^, }6 @! W" A5 x        Timeout:
       JMP  LeaveRing0
       DriveReady:
+ x( I+ ~$ K& V! v/ {        RET
       ENDP   // End of WaitWhileBusy Procedure
( J. A% g9 c7 Y  q! v1 O; ?
       // 设置主盘和从盘标志
       SelectDevice proc

2 Q' ]  C7 {6 X) e! m8 [        MOV  DX, dwBaseAddress
/ v7 G& h3 b' p- V! C1 S& W        ADD  DX, 6
  b7 {& z2 y* K        MOV  AL, btMasterSlave
3 f6 e, S: Z; ]0 A% ~' j
       out  DX, AL
2 y) o7 s2 t1 e; E        RET
/ X! b0 w8 a- J* r
  O7 d/ X& C9 M8 \( G  m        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
) |7 {3 r- R7 ^! h4 `        SendCmd proc
, c/ U) i+ D: k  O, V0 F' z: D+ `
& o, M$ A7 R, c& V/ \& f- ~4 g        MOV DX, dwBaseAddress
       ADD DX, 7
* v- g# J! {( ?) T        MOV AL, BL // BL是主从盘标识，在过程外设置
7 \7 k4 M8 H, L0 @( [$ w        out DX, AL
       RET
       ENDP  // End of SendCmd Procedure
6 [1 j$ ]- M, u% {1 Y
       // Ring0代码
# k5 H5 |$ k$ X        Ring0Proc:
* e/ R- J1 S0 r9 _        PUSHAD
3 X: M$ \2 O7 {) x/ N9 o        // 查询IDE设备是否存在
  V" a' |; P: {. d# f; a3 \0 v        MOV DX, dwBaseAddress
       ADD DX, 7
( H! c3 l$ K) x! o. g% G        in  AL,DX
" ]/ A! y/ A! q/ [. o
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
1 j  k% C7 n6 w& T$ |6 o! P  `        CMP AL,0xFF
       JZ  LeaveRing0
( W4 t3 N' y2 ~$ B. n% \        CMP AL, 0x7F
       JZ  LeaveRing0

       // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
$ \* r' Y: M+ I3 G9 Q6 z6 @* _        CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
6 E5 d7 X$ o0 J7 ?, q        CMP  btIsFirst, 1
       JZ   LeaveRing0
% {* Y* a9 C3 P$ L) n
6 \4 W3 c, R/ k! x; ]; A2 T        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
* R6 j' z- \  F, O        JZ   LeaveRing0

1 @$ g$ k. I2 Q4 P* D1 C  T& ?        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
/ L) k! u; T3 E& Q0 Y7 x
       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
$ P6 T* u! B6 P5 Z+ q3 Q0 D        CALL WaitWhileBusy
& S0 ?% S8 h# J& S% m5 q$ L
  u' K" u. l2 C; f1 x: W3 Z        // 检查是否出错
7 L. U9 R, E1 C$ J        MOV  DX, dwBaseAddress
       ADD  DX, 7
& J8 X, B! i% T' b9 w* l3 u
       in   AL, DX

       TEST AL, btBit00
8 v! c$ Q. ^" R! Y9 j( G2 z        JZ   RetrieveInfo   // 没有错误时则读数据
* Z5 Q, Q/ ~+ B% P
+ l" j3 X" b. }( o  D; V        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
7 z, ]2 H3 c, U1 e+ E- E$ p1 W        CALL WaitWhileBusy

4 d% l! J9 }' @        // 检查是否还出错
, x4 [! }) {: R; r5 N" z        MOV  DX, dwBaseAddress
       ADD  DX, 7
8 e* R/ G" v% c9 J        in   AL, DX
+ B% c1 ?5 f' f' q7 g( z7 M        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
) e+ v' c0 J: w3 O        JMP  LeaveRing0     // 如果还是出错，直接返回
% y+ T7 Z' j0 u( _
       // 读取数据
       RetrieveInfo:
0 x* t6 S8 ~2 V; S0 I; g- D
       LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD
  Q* `/ k  H2 l. B* Y$ R+ I
       REP  INSW

       // 退出Ring0代码
       LeaveRing0:

       POPAD
       IRETD
, }( f, @9 c3 B( e$ M
       // 激活Ring0代码
       EnterRing0:
& X8 {# x8 w' h6 _
% I+ W: H. K* @# z! U& m' Y        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
' j; g  q" E4 k4 S6 q; X
       // 保存原异常处理例程入口
) W& V9 B: Y) k% \, j        MOV ECX, DWORD PTR [EAX]
% B! b: [8 l( ?/ T0 h. z0 j        MOV CX, WORD PTR [EAX-04h]
; [& B7 @- b  {% g; i        MOV dwOldExceptionHook, ECX

! P% {8 r5 w0 A0 }7 s! x3 X! p        // 指定新入口
) X" J; |  s2 b8 b' S; b" i9 w        LEA EBX, Ring0Proc
6 _4 a! g4 F% v: s4 R0 s0 b        MOV WORD PTR [EAX-04h],BX
# o5 [0 z) P' o3 \, w. V3 Q        SHR EBX, 10h
/ W' _' C7 `3 @  Z        MOV WORD PTR[EAX+02h], BX
! l5 N& P1 r2 K8 b. l6 \( [" U
% k2 ^% q7 i$ P: K& m        // 激活Ring0代码
       INT nHookExceptionNo
' h; P7 Q3 S# m3 G/ x
6 n( ?6 O) R) p( _7 d( |        // 复原入口
: Q4 m7 l6 P! ]5 l& }" X        MOV ECX,dwOldExceptionHook
+ N9 y: ]/ H: k; V8 J1 K6 U4 _' M/ N/ Z        MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
' H0 ~3 `8 V+ s% y5 V7 i6 H( Z        STI
; Q5 F- d1 ^+ z0 S' |    }
   if(!bIsFirst)
! F, v1 C% j5 N9 _/ A    {
. p( D- v6 i" J- b8 D        bIsIDEExist  = (bool)btIsIDEExist;
4 `' E; Q7 q6 k% U        bIsDiskExist = (bool)btIsDiskExist;
9 _2 J2 _! _. N1 d        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
( z/ p9 ]* \" V$ o5 _& w9 z}
, G9 _& }' M# u7 T/ d//---------------------------------------------------------------------------
; U) T  m$ h4 Q! a7 a; G$ {. x// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
{
+ k: m& u) ^, x2 @0 ^    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}