[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
; z$ T' F% I( q5 K$ j! p
, k, {: z, \2 j# J; j4 G9 m1 @#pragma inline
% Z/ A$ l0 [( \' q+ ?) H//---------------------------------------------------------------------------
, m. E: {1 f7 h$ Q1 D- ~# k// IDE NT/2000/XP专用变量
, _3 c2 ]6 |+ P0 d#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
: U4 l) S) _3 F# p% U  g0 r#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
+ \" n6 A5 h% @4 O
# [$ ?+ S- ?- s7 Fconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
7 h7 z7 N: v9 ^! L! @
: c5 Q5 j4 a' G* |; s* vconst int MAX_IDE_DRIVES = 4;
3 B: i8 G1 I& F7 w# n. \' N+ S
// SCSI专用变量
& [; ?" b; u5 S# I7 t' sconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
  o, N7 n3 {% z8 X" T5 Q) Fconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

" L3 n) s4 x% i. Xtypedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
; g3 q8 e. V4 l' R    UCHAR Signature[8];
4 N5 \  K& K4 j1 X! S    ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
: J& N1 x! }8 u9 G5 m
* C* p8 m. a' k// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
0 Z$ a" ^# j% J& t9 n9 q) @2 b" O
// 辅助函数
1 Y5 `! l" X3 O4 N& e) Rchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
  C4 l% [8 p, x! nbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
) I4 [" G% `, {7 `) Y        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
( P3 V. f$ I; Z, u! I3 @: o        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
  w* T+ Y( b( k7 l" Q// Windows 9X函数
# w. K/ o, I6 n/ G0 i: |/ _1 U: `2 Fvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
+ a- ~  E, ?6 n$ f: M$ yString __fastcall ReadIDEDriveAsScsiDriveOnNT();
" {7 w8 R/ T7 {1 Y//---------------------------------------------------------------------------
8 {5 d( T- M2 U$ N" j" k// ReadPhysicalDrive
$ g: r7 i  r. Y, F: O" s4 `void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
3 u$ J  i" q4 u+ B) c4 x{
   switch(Win32Platform)
   {
% M' N: [- r) j4 ]0 b& W+ q; y; W/ Q        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
* q9 z8 A  _$ O            break;
: {* n8 f# H$ i5 V        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
0 d' v" p7 `2 m. V. n& q1 o        default:
           break;
   }
}
//---------------------------------------------------------------------------
2 y1 \8 y2 F2 v& j// ConvertToString
" w5 r7 l4 q0 H" Z% i7 s& uchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
   int nIndex = 0;
- p8 x0 e2 h, S& G2 X    int nPosition = 0;
- m2 J* _0 S  W3 ~1 l3 e9 M
; J: w3 q7 L. e1 ]- G    // Each integer has two characters stored in it backwards
& `& F& s- @* D% E/ v( M    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
. O" l! N# Z* D1 L    {
       // Get high BYTE for 1st character
8 S! ~1 [+ r2 H0 [  l        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
; m5 _( ?1 _% _9 s+ ]6 ?" T        nPosition++;
" x& p' Z" c' ]" o) U" d" {
2 C; o! ^3 z; C% r. v        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
4 |( r) e$ d; d0 c! B9 Q3 O        nPosition++;
, C+ @; t! ~, `7 o) V    }
# k& @+ ~% U9 \" Z: j
- v2 [# i9 v* L0 v' Z+ O    // End the string
   szResBuf[nPosition] = '\0';
- Y7 q2 ^9 j; o6 n
( J" K% M% ^. u2 i5 j/ O7 T    // Cut off the trailing blanks
1 [7 g8 \8 p% n) ~$ n    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
- x% |( C& y" \        szResBuf[nIndex] = '\0';
/ q% Z& X! |- x0 j; n) k* O
- W" Z, {! \) a1 Z% z- c' [    return szResBuf;
}
9 v8 ?4 D/ G" W  ]+ D//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
0 \& b% R1 }: n- y/ m  ^2 Qvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
  J2 `' M3 w: c, u( y0 R6 r    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
# F; _; ^! O. l( s/ l, d
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
* i, r1 O. u4 f& G, L  T7 g3 o( Y. u% u    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
, S/ s& [) T. A8 ~) J3 a
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
; r- l* z% J+ l                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
" a+ q8 [+ T4 x+ M) i4 O                        OPEN_EXISTING, 0, NULL);

3 v3 n7 A- {4 ]9 W) j1 j) |        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
6 F1 l# j- A) i& k/ v                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
+ [7 s( [% Y2 U: O) f                    &dwBytesReturned, NULL))
& `5 v' N1 J$ N* u' ?            {
6 |! s/ O/ ?5 p# x# I% a2 _) m& j                continue;
           }
0 n6 ?, _1 c6 y) I8 i# O' X: g4 U
           if(gvopVersionParams.bIDEDeviceMap > 0)
0 |5 [. R# {" [% _/ s$ P5 ~            {
, Z* z/ T4 T0 d& e$ N8 Q                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
: [' `' @8 i7 J8 d9 E4 c% A4 x3 W                SENDCMDINPARAMS InParams;
( L! D5 ]9 ?( Y5 Y0 a                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
/ d. ?- y8 O8 d5 p& w, A- k( q3 G" y8 u                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
) |6 g6 o$ I. J$ o                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
2 Z" i& Q% ^' Z: Z5 L1 k+ E! [                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
. Q; A/ L& C" E, d
               if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
9 J5 Y( Y3 t: }5 o8 A$ ?                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
( e/ |, J! `- o" H& X. E2 B) X8 h                {
                   DWORD dwDiskData[256];
& H' J( W0 T9 u! C. G9 U                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
, k; C  D2 r& [4 t4 r                    for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
( N! n$ U+ W; ~, @" i# z" c6 X                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
- h& V7 l! n/ g. z( f* A. s% b$ P0 Z                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
) q& Z! Z# F! S4 I2 P2 s8 w/ h                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
# Z9 r/ q4 B5 S! l* g
$ @  s7 u, t2 u                    pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
4 P: R3 w; M4 S; u6 W' F7 V                }
8 t/ ]' w4 ^& J( _; _            }
6 ^3 }9 d, ^2 f: w) M2 }5 i7 g" w            CloseHandle (hPhysicalDriveIOCTL);
       }
7 w  l" T. {/ W" _: s) t    }
}
6 M+ v( @  O. s//---------------------------------------------------------------------------
0 J+ X9 w' r4 a! Y1 W/ ]$ B2 ^// DoIdentify
. Z" a# w7 k5 Q% @bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
/ ]( ?! S& W# O1 L* P  q& h7 e9 u# X              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
9 c, y. B( F. M! e4 m  @  {{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
: }* z- v3 @- U% D" ?  E' p    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
' z1 P" r/ f/ H2 \! {    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
3 T* \- E# V) `. c    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

* F. b* s; c" u" }+ g    // The command can either be IDE identify or ATAPI identify.
, v9 m% Q( X, i. ^% ^& A1 s: y. D1 _    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
' [2 J9 x' ]" P  M# X; c/ o
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
/ m1 ]) b8 q+ {; G- @           (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
4 g, L+ b0 l, o+ S           pdwBytesReturned, NULL);
}
, h% I! V! f# E9 f//---------------------------------------------------------------------------
( I  g  v0 I$ L( {0 \+ H, a! C// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
; v# @) G0 x  A+ J8 E// ReadPhysicalDriveOnW9X
4 W0 b5 x& Y1 R+ p% P/ u9 [; Pvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
: l" m! ]+ d/ O( Q5 k, h3 e$ K  P    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
: Z1 J2 H0 D, A  q8 s5 u" N
7 [9 j. F9 Y! y    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
/ z) k+ V! L2 {& I( g6 F2 R+ s" B5 y7 W6 J    {
9 E' D2 s  l  S1 Q# ]( `9 q; P        WORD dwBaseAddress;
' e% R8 Y* w" u# }) B        BYTE btMasterSlave;         // Master Or Slave
' [' ]: _2 j8 D# K0 x5 J        bool bIsIDEExist;
       bool IsDiskExist;
  ]4 g! E0 A+ @% @- M( v$ x
, J) G. @; u( b3 L, ^. s8 k        switch(nDrive / 2)
+ f& o* d. H( r! W, m        {
           case 0: dwBaseAddress = 0x01F0; break;
2 ^5 h. S) }/ A. s            case 1: dwBaseAddress = 0x0170; break;
# Z4 Q* C8 S; M            case 2: dwBaseAddress = 0x01E8; break;
( I1 F; L. u8 o            case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

4 u% C0 J$ e2 Z" ^3 D. B, G        // 进入Ring0
8 x8 ]7 E3 Q& v" U1 ]6 D, {        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

! ?: m2 _% t+ x    // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
& j4 e. V( Z4 S, x" r* v! L    {
       WORD dwBaseAddress;
  e* |1 b2 k- X+ s: W        BYTE btMasterSlave;         // Master Or Slave
, ^  H& U( w. H        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
8 J3 G# E$ S! Y            case 0: dwBaseAddress = 0x01F0; break;
, B. ^7 }+ D$ x: @+ ~6 @; g            case 1: dwBaseAddress = 0x0170; break;
0 _& Q- W3 g/ W5 R1 m# k! w6 \            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
1 F/ D7 r6 M6 o" E+ O1 n: g        }
2 |4 [  I2 S. L* J, _+ p8 L
# m( Y: e% T4 y& n6 X1 s9 \+ U        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
" w/ P/ V9 j; R0 R        bIsIDEExist  = false;
       bIsDiskExist = false;
' a6 z$ W4 g" Q. H1 p        ZeroMemory(wOutData, sizeof(wOutData));

" l% P" E$ P2 F        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

6 H* C% ?# [" K; P$ y* F, @        if(bIsIDEExist && bIsDiskExist)
3 [( A4 z$ O1 h  n  V" r5 d5 g/ t        {
5 A, I/ I5 Q, K9 s- \* X7 X; H            DWORD dwDiskData[256];
           char  szSerialNumber[21];
" ]# p$ O$ y' v- @7 H            char  szModelNumber[41];

9 G. M2 Z" I. J/ o6 K            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

& E" L$ F+ v: \. @4 ]- `            // 取系列号
4 K$ L* W) F8 y3 d            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
, E" s* @8 M& I6 l% b- Q* c
. O7 k- H/ _" m. p            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
       }
* {( ], K$ f. O    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
+ z- t( j8 w- b; B3 t}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
( }6 N5 `) o! }// btMasterSlave = Master(0xA0) Or Slave(0xB0)
0 E) Z; x- W( i$ k6 j, a//---------------------------------------------------------------------------
1 w7 s& ]( O" N+ S4 K& svoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
5 Z: n7 s: h1 [/ ^% i: \0 K. o        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
3 [, c0 m* y. z$ j, `    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
' ?( W/ o4 b/ T3 A/ ?    const int nHookExceptionNo = 5;
' G4 c# C& y4 q7 e0 U
' {$ N* ~- q; n$ S& q7 |9 C    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
" v  f* z* E- ^. `7 [    WORD  wOutDataBuf[256];
+ W: ^2 h0 \( R& }6 D* I- ?
+ d, D* O2 \% N    BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
: K1 P% V3 ]/ R! n; A0 I9 l" \    // const BYTE btBit02 = 0x04;
5 i9 X1 n- W% r+ }    const BYTE btBit06 = 0x40;
* C" C3 [' r2 k- C8 y% Y    const BYTE btBit07 = 0x80;
! }" \" {) o+ Y/ s0 f/ m7 [$ S    // const BYTE btERR  = btBit00;
! {8 E6 X" R/ `% z    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
+ ?! L4 J; J/ t    const BYTE btAtapiCmd = 0xA1;

   __asm
9 B  v9 R5 J, a: E3 d/ q. c    {
       // 必须先执行这条语句
       JMP EnterRing0

( T2 O  u) E" i- m6 `6 V# Z3 z( d        // 定义过程
9 c$ @* j: p. f- V        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

( ^1 @! Q6 t7 @        MOV  EBX, 100000
2 ?6 s( @& ?: W2 c        MOV  DX, dwBaseAddress
       ADD  DX, 7
6 j# h! ^9 {$ U* u* }" E- R
% e; F. Y* q- w3 Q" H" W+ D        LoopWhileBusy:

: _9 r- ?* H1 g$ l, f# m- F        DEC  EBX
. G6 f" y6 \& ^. t" I  y( m        CMP  EBX, 0
       JZ   Timeout
) e. o' t/ ^3 o  V+ \: z        in   AL, DX
       TEST AL, btBusy
- {, M# ^2 z5 x: Z% R        JNZ  LoopWhileBusy
3 |1 m8 b/ R4 M, X; S+ ?# v        JMP  DriveReady

       // 超时，直接退出
       Timeout:
) j9 T0 n- w' s& {0 B: o( A        JMP  LeaveRing0
       DriveReady:
       RET
8 S& z6 V) e. [        ENDP   // End of WaitWhileBusy Procedure
1 @( u( P+ `3 b
! A+ U1 P" M* F1 n, i6 Z        // 设置主盘和从盘标志
! Y+ T" s! z% D& Q6 j        SelectDevice proc

4 |) i; F+ K9 ^9 Y" D        MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
* F/ L% W3 U4 @7 V; J& T
! C. V- R" {; P        out  DX, AL
4 V: M" Z8 I, J5 k4 O7 D        RET

       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc

       MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
7 D0 M$ s5 A- ?9 Y        RET
) @- u) e3 ?' u( `( \        ENDP  // End of SendCmd Procedure

       // Ring0代码
6 J7 }* P/ O+ _6 Q8 c* e( Z# X8 [        Ring0Proc:
9 o$ m7 N+ u- }# n4 I        PUSHAD
1 p) S- M) T% o$ ~        // 查询IDE设备是否存在
9 m) C. r$ l! O5 r3 i  k        MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
) j7 |3 w- H0 L6 H        CMP AL,0xFF
6 C0 ?9 s# \, \6 ^        JZ  LeaveRing0
       CMP AL, 0x7F
8 a" F  {/ Y# l1 x4 e& p3 h( O        JZ  LeaveRing0

, `; G9 T  e5 F4 u8 q5 u3 [        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

2 h! r8 D7 P2 J1 {        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
/ @+ ]' Q- k/ g3 k/ q0 ^; R        JZ   LeaveRing0
1 ^; r. o( a3 v, H( M
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
9 u( _. f: h4 W3 M) F1 J        CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
$ ]! h2 I+ F+ F" G        TEST AL, btBit06
6 j+ F6 b) p  T9 u1 K& ^        JZ   LeaveRing0

; r- v( B. g! V# e* A        // 设置驱动器存在标志
$ Z+ c6 r' W& n        MOV  btIsDiskExist, 1
' X* `( S! n* W5 Y% z* E9 ~; O
       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
. }$ b3 q& D- {# n% W5 h        CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy
3 ?5 a7 \7 F6 K" o0 P# O1 m
       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
# {3 W, X6 ]1 C* c/ H
       in   AL, DX

+ }$ u& m. F7 o# R& k5 P$ d        TEST AL, btBit00
6 U; `& J( s2 P: v3 G3 T3 y        JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
, I3 r" G$ p. J+ X1 S+ K        CALL WaitWhileBusy
! d  H% Q6 U) K! [8 Z# R5 {        CALL SelectDevice
+ e; k+ `+ G+ Q3 F        MOV  BL, btAtapiCmd
6 ?& \; P2 a" t& Q; w( v* {# s        CALL SendCmd
       CALL WaitWhileBusy

       // 检查是否还出错
. e# R9 s$ J: W/ }* Q        MOV  DX, dwBaseAddress
% a: W: Z7 d" ^( H( t( b        ADD  DX, 7
; u% ]' G5 ^  ~        in   AL, DX
+ ~" u$ R; u/ x  n+ ]        TEST AL, btBit00
. Q7 y6 z, G0 J9 p! O; R        JZ   RetrieveInfo   // 没有错误时则读数据
. o& H1 R! O8 [) l' c- b0 p; ~: T/ |. u        JMP  LeaveRing0     // 如果还是出错，直接返回
) k7 z0 ^/ n" f. ^  U' y1 U
/ k) G; Y4 q- ~# {' M        // 读取数据
- \/ ]6 C3 i9 C1 Q        RetrieveInfo:

/ H& C9 y3 P* u5 f4 X        LEA  EDI, wOutDataBuf
1 {$ N2 ~% K- s# l        MOV  ECX, 256
* y, U& D8 G4 s        MOV  DX, dwBaseAddress
       CLD

" V5 z4 j" }3 g( d" z1 r# f$ c        REP  INSW
7 S6 S6 Q( |) ]
       // 退出Ring0代码
" N! `1 l" n% o7 c6 }$ x: L        LeaveRing0:
" i( h1 W* v, Z6 M/ A
       POPAD
       IRETD

! R  B1 q% |: ^8 S; f3 y. O# s        // 激活Ring0代码
       EnterRing0:
* F2 L( K# m/ A+ m
& t8 y5 O- [4 J2 s3 R        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
/ J/ O  e. _4 K2 j        CLI

       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
0 K# E1 N7 ?+ C2 [8 [' f; z$ V$ y        MOV dwOldExceptionHook, ECX
' K/ M2 ~) Y8 J; K
       // 指定新入口
. z4 O& y; U! V( @  L% {- S7 M        LEA EBX, Ring0Proc
1 L5 U) ]5 b) n* D        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
% _. K  V$ a, \) M9 [        MOV WORD PTR[EAX+02h], BX
0 y, k8 X) `  d8 q' O/ b
       // 激活Ring0代码
       INT nHookExceptionNo
" r0 b1 J) X) G3 p: ^& V
       // 复原入口
3 z1 |# X8 H# x6 e$ z        MOV ECX,dwOldExceptionHook
7 x6 m' |- S$ j* k        MOV WORD PTR[EAX-04h], CX
, x: P; p# o! S  W1 W        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
( l/ ?& Q2 `+ y/ l7 Y        STI
   }
   if(!bIsFirst)
' [7 p" f+ j. z- `4 V6 ~2 ~5 f    {
       bIsIDEExist  = (bool)btIsIDEExist;
3 Q9 E  b2 b. [# q( Y        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
5 m- `* q6 W8 @- }' a$ N//---------------------------------------------------------------------------
, k5 e& ]" f7 G: W// 调用方法：
% k4 `0 j5 m- t; ^) J. ?  |- ^+ u3 `- pvoid __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
$ `; R  o4 v# u* |}