[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
; }/ V" o; G% Q  o! w! @8 d- O
; S0 p  y/ s5 C# w* y#pragma inline
! s( Q* j+ G9 C6 I1 k, ]: V//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
9 x2 J4 S7 t+ N3 D$ [#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
/ R" X" W' v" F#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
( J" i1 P7 f* u8 o#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
# J8 P2 [: s9 W, I% j! K+ d$ @- oconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
( E4 X2 z, M" H5 p6 i' I9 b- u
const int MAX_IDE_DRIVES = 4;
) L5 E; D8 k! s
// SCSI专用变量
' J1 u* X: H; F& Wconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
$ S# \; C% U$ }' _- V! ^" ?const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

" N- d, V* F. i$ H4 {typedef struct _SRB_IO_CONTROL
* P' g: x5 {: ?* b{
& W4 F! \" H: b    ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
# z% {/ U9 ~4 ?, V/ u2 y# \) y$ l    ULONG ReturnCode;
$ ?+ U5 K, l( @) x( ]    ULONG Length;
6 T  C. p9 D+ ~; T+ y}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
2 ]" a/ {# R) ]1 o0 w/ K
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
% ?2 X1 W& w7 m3 Y+ @5 U9 m7 A
- K8 N( k: s+ y% S: E! o// 辅助函数
% q- K' }$ s/ j- K' X0 j% Mchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
1 w5 \/ P8 L% `) Jvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
6 @- Z9 z& ~" w( V0 C/ B7 y4 Ubool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
( y5 }, a- k% X, y4 n# _# x: J2 e        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
+ Y  _# w- h2 ^4 E' }void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
  f& j8 O" r( U& q4 ]( A% jvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
, B$ ]9 U! X9 `3 p* M) T1 c        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

/ ]9 Z2 ?! v; \5 z( m5 Q// SCSI读取函数(for NT/2000/XP)
. ]$ w1 p* l7 Q! N; h/ lString __fastcall ReadIDEDriveAsScsiDriveOnNT();
* [# j7 H, b: f# `1 l9 M+ V$ Y//---------------------------------------------------------------------------
* l$ l0 ^7 X3 ]6 f// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
  j/ p! H5 x7 A$ Z$ q" ]{
, A0 I9 _/ x+ `    switch(Win32Platform)
   {
5 p5 ]" o$ }+ c        case VER_PLATFORM_WIN32_WINDOWS:
& }, j. y- |$ y+ [            ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
" ^: @2 C' J* j4 |: i            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
           break;
3 c/ ]. y7 F3 ?1 C" c4 I+ b+ A, K  t    }
/ Y6 v$ q$ t/ }3 y}
2 ]9 f$ Z  i; b0 W//---------------------------------------------------------------------------
// ConvertToString
8 e3 ~8 q! x+ K% _! P$ ichar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
5 T  j6 ~% T5 N    static char szResBuf[1024];
) Q/ H( p8 V% ~1 p+ g9 I2 _4 L    int nIndex = 0;
+ n5 W5 Q# }* G, `; L4 t6 c    int nPosition = 0;
3 r, }% |! J! ]. Z% [- Q0 K
   // Each integer has two characters stored in it backwards
6 [, J, |, ?: D! \2 G9 H    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
" Z: F! U4 k1 C8 A! O    {
5 I6 G  C  d" S8 v1 z. _, a9 ~& O        // Get high BYTE for 1st character
/ z# l% T7 M/ t/ M2 i4 {        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
5 c1 ]! u: J) a2 z" b3 g( f/ O
' K8 V. X. {0 e8 r        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }
$ l: c# V* Y/ f
   // End the string
   szResBuf[nPosition] = '\0';
! z* [8 U* U6 P9 }
   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
}
: W; b- t& }. p1 I- b5 P//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
) Z) E, q  h1 @  b// ReadPhysicalDriveOnNT
& t1 `  r) G9 M$ T' _5 u) ?void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
' b' u3 q5 P2 W& @{
& L; Q$ x6 ^0 T( O8 R6 U5 F; J    // 输出参数
, C% O) u  h  T  i& X- J    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

2 C, b7 I0 y+ U( L% h$ i    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
( s  f- Z' x2 j  U# x* X  ^        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
, v- h7 W# F3 X0 ^& |7 Q
! {+ D! v6 a- E7 B0 r. h7 Z" p        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
1 k  ]1 j2 K  v                        GENERIC_READ | GENERIC_WRITE,
' u, H4 R( H  p( v5 n7 C: ]/ m                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
  D7 `+ K7 @3 y/ Q1 V                        OPEN_EXISTING, 0, NULL);

6 J/ s0 h' D/ R* y) x& d        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
$ Q8 @6 a+ R/ p" P  Q            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
2 W; J* P3 @$ H& p/ S  r% D; ]% U
* ?& {! F8 |& c) S, `0 [& \            // Get the version, etc of PhysicalDrive IOCTL
7 m1 s3 E9 ]7 {  u5 W  L            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

6 L" i3 O/ v6 j5 Y" m6 ?            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
+ H' w8 |; A9 i                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
2 T& r5 P( b- f; y  c                    &dwBytesReturned, NULL))
" n+ m* N( e% m  h+ Z            {
1 \+ d5 @" l7 L5 \: y                continue;
           }

           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
% L: Z, k6 ?9 u6 g6 U: |/ B                BYTE btIDCmd = 0;
9 g- J8 B/ N5 s- E6 h                SENDCMDINPARAMS InParams;
' k5 Z) J5 D( U( b6 ^, {: T( {                // Now, get the ID sector for all IDE devices in the system.
$ d. s1 ?9 M- b% M5 |                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
, \8 _, D( ]# K; {                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
( q9 {+ w) S# k! |* @" X                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
9 Q" c" z9 D9 @5 u* m0 `& y
8 {4 Y+ {8 ?* N: I; f+ g1 L& D3 g' D% `                if(DoIdentify(hPhysicalDriveIOCTL,
9 N% R$ o" P- e6 }7 q$ Z                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
/ D! \2 ^& i9 e! y/ q8 h- M                {
8 _! e9 T3 S( H7 h                    DWORD dwDiskData[256];
9 j+ F& f, ]# O6 _0 ^                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
: V, m' b, W+ F# `3 `                    char szSerialNumber[21];
* \" i1 g6 E" z% {( W9 r                    char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
7 b0 l' z4 s; N8 z2 s- [2 D                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
% R% L) f7 T, U" M5 h/ o                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
5 [! _6 c6 Y0 ~                    pModeList->Add(szModelNumber);
               }
           }
( t! V$ ~- n4 a  \            CloseHandle (hPhysicalDriveIOCTL);
' c# \- p" S# H: q" f        }
   }
3 j4 b/ m, U# w; z, C}
) t+ g& N/ J& I& f$ W# }//---------------------------------------------------------------------------
// DoIdentify
  J" m2 N9 P! J8 G" a, ^' jbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
, N8 |6 b3 \9 z2 J              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
4 g3 k+ n# C: Q* @6 o9 c! S              PDWORD pdwBytesReturned)
{
7 z: N* A- k* @9 L) h! g6 P    // Set up data structures for IDENTIFY command.
' X. x& f) q; U: R4 y; ]    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
5 z! B) k+ C' z) p1 T1 A; m7 O8 W    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
. R% g  _) p' z& X5 A! y    pSCIP->irDriveRegs.bCylLowReg  = 0;
' \6 M# ^- H4 U$ D    pSCIP->irDriveRegs.bCylHighReg = 0;
0 X) O% b8 X* e8 V
4 \5 K4 X+ l* A: l2 O1 [    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

  E5 S3 ?* h( w3 W    // The command can either be IDE identify or ATAPI identify.
: [1 {( U" p3 Y9 R9 h    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
: I/ V4 g1 o" C2 g0 \& e# T    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
0 y1 s3 |$ Q8 V; u" P; i) O/ M
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
& H* l/ T0 s) L           (LPVOID)pSCIP,
  i$ }% g3 P' L           sizeof(SENDCMDINPARAMS) - 1,
9 U! k/ i# z# m9 F& i0 f/ s$ ?           (LPVOID)pSCOP,
' X) x2 r/ P3 z9 A2 |2 m8 W           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
1 F- a3 m. U5 O* I7 T( [) m/ |           pdwBytesReturned, NULL);
}
1 O- ?. H" L  P' `$ ]- M/ d% p2 g' m//---------------------------------------------------------------------------
7 C, l$ N' y+ H9 R+ L2 Y! ~- z: s// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
2 Q: |  {0 I5 {0 A4 z// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
+ Y0 n8 E8 E3 K. g& T{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
( d2 V; [! I( s! d* y% E    {
) f  H4 o' z: m- Q: V        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
: X- ]1 U+ V$ Q* P/ }, g% Z        bool bIsIDEExist;
       bool IsDiskExist;
& |0 y% V3 F0 \3 Z# ?$ i: f
6 ^9 h0 \% u6 U2 Q3 e        switch(nDrive / 2)
       {
" A7 ~% {& w, q+ x6 v3 o            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
+ h! F3 i; a, t$ o/ w            case 3: dwBaseAddress = 0x0168; break;
       }

  f+ W, b' _* ?/ H+ G        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
* b: J9 O1 J0 b4 g$ I7 u
       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
0 f' f- P, }' P5 L9 Z( u. y    }
' ~, n8 {# D4 \
   // 开始读取
7 X, l9 k0 V+ b5 ^    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
9 q( L$ A4 j" V) P: a- \        switch(nDrive / 2)
+ t' J9 P3 Y; S, U. \. P        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
% H1 {  G# u. S% h) R2 R0 V! l            case 2: dwBaseAddress = 0x01E8; break;
5 v5 l; o: s/ K; |! j5 B            case 3: dwBaseAddress = 0x0168; break;
' y1 i# i$ R4 X. [3 \        }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
* O! Q; Q, ~. m/ N( K
0 R* \3 w. D( ]1 o* E5 a/ y; Q        // 进入Ring0
       bIsIDEExist  = false;
2 ^( ]$ d- ?5 ~        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
+ Y9 i7 v# _* M2 v8 y0 {
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
2 i2 \+ F! s4 a
' ]! ~. v  G$ P/ a2 N9 ]# h& E" e* w        if(bIsIDEExist && bIsDiskExist)
' ]  c5 i& ~  s% {5 L. L/ X        {
           DWORD dwDiskData[256];
" e* p0 m9 @- S            char  szSerialNumber[21];
           char  szModelNumber[41];

           for(int k=0; k < 256; k++)
" ^# Q) b! v( `: d) K  F$ u                dwDiskData[k] = wOutData[k];

           // 取系列号
6 {$ ^" ~( }5 Q+ Z            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
/ @) s8 s% t0 e4 Z( Y            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

: w' x+ D" A6 i) u- V6 a9 f% ?4 j            // 取模型号
* F( E/ o) w8 H0 J0 X            ZeroMemory(szModelNumber, sizeof(szModelNumber));
1 g( \8 u( E0 |            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
& m* _' _3 x6 i. \
/ v5 H7 X) J% q, J4 B- P            pSerList->Add(szSerialNumber);
# e" p5 E/ @  K0 c- E7 o            pModeList->Add(szModelNumber);
0 v. F1 y5 G" Q3 Y  [        }
) r$ e* c2 y$ A5 v; A1 W/ Z7 ^1 `    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
5 y. |0 D- m, b/ h& P2 K//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
4 u# a$ q# r0 t{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
! B( T* E2 z! A, c: X    const int nHookExceptionNo = 5;
8 b: S/ }, ^; e
1 g8 T1 ~' ^- I4 q  J; X' [7 G    BYTE  btIsIDEExist = 0;
5 }- P$ v% l* K    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

. O( @6 j# w& }/ u    BYTE  btIsFirst = (BYTE)bIsFirst;
4 p, U# t0 B% t/ k- @! b( M: o& W
   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
7 S# @3 l1 _; i" \* z    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
+ @) x3 s0 d+ o, P2 {    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

! k/ h% Y, G! e5 z) s& u' w0 f    __asm
/ n' P- B* [( w, G: H    {
       // 必须先执行这条语句
) ^. r- J; u4 ]1 g: B1 \6 N7 b$ Z        JMP EnterRing0

) f0 M' D/ F6 N/ B1 @! P0 Z. j        // 定义过程
  [: H0 `$ h5 G2 A+ s        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
  e% y4 @- E/ @: G; F: A9 @
; x9 w! @$ p! o9 x' O        MOV  EBX, 100000
       MOV  DX, dwBaseAddress
3 c$ ?9 J+ q- |3 {        ADD  DX, 7
7 t9 \* Z# X' ^( P4 r. [
6 J( G; o' K6 _7 c        LoopWhileBusy:
2 f2 @$ o& \" @5 |+ z
       DEC  EBX
       CMP  EBX, 0
+ d+ `4 D1 z% O" s: J% R7 l  h        JZ   Timeout
( y; D( E+ ?/ f        in   AL, DX
1 u' v* s( N: W" {        TEST AL, btBusy
8 `0 n9 U2 k, V8 T1 X0 v$ ?1 V        JNZ  LoopWhileBusy
       JMP  DriveReady

" I5 S# K5 l3 o        // 超时，直接退出
  u4 {" q: u# b1 W& o        Timeout:
! e9 n/ y: c! {+ R9 i! @# j" M        JMP  LeaveRing0
* W' Q  ^) h% J3 @1 W( D& T        DriveReady:
. r9 i+ X! \6 }# F0 P        RET
       ENDP   // End of WaitWhileBusy Procedure
0 k7 v6 w0 ]9 e* ?' M; x
+ ]4 q# p( W2 b1 M# p6 T8 E        // 设置主盘和从盘标志
. ~6 K, D: H0 f: y6 X# N* M        SelectDevice proc

       MOV  DX, dwBaseAddress
, \' w" @6 l. d' v0 e        ADD  DX, 6
# ]# [4 X# _  x        MOV  AL, btMasterSlave
4 R6 z9 Q! ]7 M& R8 J
       out  DX, AL
       RET
) v" f1 a4 U# F& n7 D, S3 h
8 d' R4 i# W+ l  B        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc

* `& w$ T: [3 l7 S+ ~        MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
, m5 _. f" V* {7 R, @        RET
8 U4 u$ p+ m+ H( g# V' t        ENDP  // End of SendCmd Procedure
* l) {) H, B- q' g; y; w1 D1 X& i
" B  u1 _. C9 \5 ^4 j* ~8 T        // Ring0代码
       Ring0Proc:
4 W; F1 L! U7 c$ F        PUSHAD
       // 查询IDE设备是否存在
, b/ T/ J; l0 l/ l7 I) x        MOV DX, dwBaseAddress
$ O1 d: M* r% [5 q        ADD DX, 7
       in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
9 v. E+ Q, R' P  f* K1 m3 {        CMP AL,0xFF
# m  s* b% n$ l; E        JZ  LeaveRing0
       CMP AL, 0x7F
6 p7 f. U* n0 a2 l( E- ?" k        JZ  LeaveRing0
0 D  }8 V! q1 s* E6 D
8 i/ @1 T4 s; Q( d: a4 C- ~1 B        // 设置IDE设备存在标志
. d! Q$ n& K! L; K        MOV btIsIDEExist, 1

. I; o0 P' E2 g+ Z# `6 V. {        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
* ^* V/ u1 x7 ^+ d' K9 b$ s        CALL WaitWhileBusy
4 V; b6 ^/ i7 `/ i$ L& v) w        CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
9 T3 W* u. _* m6 _        JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
5 ^9 s2 ?; T* p$ L8 O$ S        CALL WaitWhileBusy
/ J; ]1 K6 }0 M9 }% I
( L( v0 J& K2 o* ^9 b7 Y% x        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0

       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
; F. j4 R7 V% }/ }* T3 M: p        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy

% V1 f; m. T5 E$ M  f4 F        // 检查是否出错
       MOV  DX, dwBaseAddress
$ S" |  s# K; n# ~; L" I        ADD  DX, 7

       in   AL, DX

" G. a" T' S  F2 @        TEST AL, btBit00
3 ^0 A3 {0 K* F% B0 M4 l3 n! n8 E. _        JZ   RetrieveInfo   // 没有错误时则读数据

5 `- L1 A4 G5 Y( z) _5 g        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice
9 _* l( m1 Y  e( y" _8 ?+ U        MOV  BL, btAtapiCmd
       CALL SendCmd
; t) K8 E0 A4 w        CALL WaitWhileBusy

- d- Q5 X2 I$ ~; V! q# X- |        // 检查是否还出错
- Y4 Q- ~. P" t& P7 W: v        MOV  DX, dwBaseAddress
; `# S" k0 M5 e  Q4 {; f7 ?        ADD  DX, 7
$ v- q, F# r3 F        in   AL, DX
1 j* j. I% p. g2 `% v) y6 A0 r9 q        TEST AL, btBit00
2 ~0 v6 J. f* Y5 ~0 R        JZ   RetrieveInfo   // 没有错误时则读数据
! X$ Y( R' C# I/ i$ Q        JMP  LeaveRing0     // 如果还是出错，直接返回

6 j3 j  _3 ?! \- x0 ^7 E4 l        // 读取数据
       RetrieveInfo:
  D# B7 \) |: h2 e3 s
4 K2 N( z5 C% [3 ?6 I        LEA  EDI, wOutDataBuf
* s, @2 n6 O$ @2 R! L        MOV  ECX, 256
  h' A* E; D1 z* y8 n% b6 y% S        MOV  DX, dwBaseAddress
  ?  |, N+ Y9 w2 L        CLD

1 P2 E# s# m3 N  y' r        REP  INSW
1 R9 z) b( C$ t, i6 c2 _* j
       // 退出Ring0代码
       LeaveRing0:

& i* N5 {+ p' j        POPAD
       IRETD

       // 激活Ring0代码
/ N1 O3 f% h& y        EnterRing0:

       // 修改中断门
       SIDT FWORD PTR btIDTR1
8 r  T! }9 l* }, V' ~: e        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
: m+ M% y, Q2 e. q
8 l* G  K1 Z* g! H$ o        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
  W: t8 X# u, e* A* ~) Q$ L+ y; W        MOV CX, WORD PTR [EAX-04h]
  {& h7 T! n$ l        MOV dwOldExceptionHook, ECX

       // 指定新入口
       LEA EBX, Ring0Proc
+ x. j' S# i2 F6 i3 {        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
' Q+ u4 O) `7 M) p        MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
3 v3 s9 }( W' z! i        INT nHookExceptionNo

       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
( l& u/ m9 P- }; e; y9 e        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
   }
. J  |& C* [- ]( i. E    if(!bIsFirst)
8 E& U1 ?2 s+ U0 i: C- |) s7 C    {
       bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
  L5 X% m; K# e- s7 {. W        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
1 w. U$ l6 q: |$ w}
//---------------------------------------------------------------------------
// 调用方法：
# ~5 @/ v1 O4 q. zvoid __fastcall TForm1::Button1Click(TObject *Sender)
* y# _) N3 h1 p- I{
. b" B! ~, B4 B$ E4 [7 j    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}