[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
5 @5 p* j( {( {, L$ K//---------------------------------------------------------------------------
4 j) M  c" M7 @6 W  |( T// IDE NT/2000/XP专用变量
/ e- S5 C  }% T% D, p; v- V' d#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
# y% `" n0 e* r' ?#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
) C) m- S1 w  O1 U6 I7 y#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
; A1 O& C. }/ x2 S, E8 P# x5 b
+ l" Z, Z7 l! [+ o, Lconst int MAX_IDE_DRIVES = 4;

: T7 m/ l( }5 `# a* h// SCSI专用变量
  w4 }+ N+ s9 @; a2 xconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
( @+ w2 C$ [  m: Nconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
7 S" J  I7 h$ t: G3 t# q2 Wconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

8 Z" E$ B5 d9 K8 ^typedef struct _SRB_IO_CONTROL
. `* b0 H) c- V# F. k& @7 q. Z& E{
5 P9 f# P& p3 `4 n" F    ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
" f3 S( Q" @9 J5 T& r    ULONG ControlCode;
   ULONG ReturnCode;
7 @! W8 X4 o1 G3 d7 `) Q; s    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
! e$ ?2 u- c# Y$ Z2 B: p
, D+ F" p7 u8 N$ w. v// 读取的主函数
+ X- q/ Z% l: J+ ~- y6 dvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
5 ^+ V2 |1 y! a6 K5 rvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
/ L1 r3 ?( m% U4 b$ z( H; [bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
1 c/ A) O7 d0 y  Q, J  f, @8 h        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
: S3 I6 T' w4 c! A8 P* A6 k// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
- q0 ~+ C# Y6 g) ]void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
' K5 J6 e$ P0 Q
// SCSI读取函数(for NT/2000/XP)
- d4 g% c( P# ^' WString __fastcall ReadIDEDriveAsScsiDriveOnNT();
, w4 l( g+ p% Q! k+ R. m9 N" ^//---------------------------------------------------------------------------
// ReadPhysicalDrive
4 y' f! o2 I% q% ~. I" uvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
8 A8 n/ p2 \  b- v: t) G, ]+ x9 s{
   switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
+ j8 K9 T* x. _; m) B            ReadPhysicalDriveOnW9X(pSerList, pModeList);
8 m5 ^1 Z* ^3 k* l1 U, n6 @1 ~            break;
* J# F  G+ H# s2 k- r0 h! V        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
, V- N& v+ }6 Q: ~        default:
           break;
   }
}
5 U# _0 M+ }! l" W% s! H//---------------------------------------------------------------------------
1 [- a7 t! v8 ^5 _// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
5 a( H! F+ U0 X7 F& h{
( A* p8 n2 F- T! n    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;

* F7 T5 @  D( F; ~' f# v    // Each integer has two characters stored in it backwards
1 j0 u, y* m; c+ D. e( ^: I    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
% j& e( I$ o$ {4 T6 ^, ], q$ g    {
       // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
$ y1 g+ {+ P* g6 C  L& a: S' j! O
+ ~" W5 h7 ~* q7 ^# \( H        // Get low BYTE for 2nd character
' V1 w4 y6 a+ [* [/ W3 F) U        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }
! V, @" F# Y; R) v
- N& Y) [- D: r% r0 t% p    // End the string
   szResBuf[nPosition] = '\0';
& E, R: A; o% \" `. v6 `" L& c; r
- e- x# }- m; L+ ?: e: d    // Cut off the trailing blanks
- N% t* |/ e4 N8 y: v; \    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
' v, K2 a' [) w( K  i, V        szResBuf[nIndex] = '\0';

   return szResBuf;
}
" a; @- S$ \4 F; ~- n- M+ V3 n% I//---------------------------------------------------------------------------
2 ]* D) E5 t/ W; ]: u5 n/ O' I// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
7 Q" ~4 ^+ Y) ]1 d! t// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
3 J2 \, b3 X/ h6 K5 C$ o    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
4 [( e8 H9 W. K& B& X
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
' {; E9 Z1 J" ^8 O7 d        HANDLE hPhysicalDriveIOCTL;
0 ^$ _7 x0 b0 v) \! L* b        char szDriveName[32];
6 Z# i5 ?0 }/ i0 S3 ~% l
5 ]# }* x% K7 ]( X) g        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
4 B3 [; o6 r' m  w- R        hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
/ X+ l' G4 t' I; g; j: F1 x
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
- R8 w. r: R/ G9 P; V            DWORD dwBytesReturned = 0;
# l5 j: R% |8 v6 H            GETVERSIONOUTPARAMS gvopVersionParams;
% J0 ]3 ^& J) B8 N, P+ p) ^4 U
           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

0 w# ?! t# q7 [& m6 b' i2 N% i            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
$ V7 `+ X+ d( x4 s% r8 W& E) [                    &dwBytesReturned, NULL))
           {
               continue;
2 [6 N8 d; h) \6 M4 n1 z2 T/ d) J7 j            }
$ y  c' ~# K& j" {, G
  W  l- V: F" i& l" q( v            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
8 }4 a% \6 k# T1 h5 [) s                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
. S& L2 \  @% T7 T: @# J                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
4 p# A9 `0 f: g) ?8 H                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
" a5 P' A: a; j5 i6 q- j9 e8 |3 c                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
4 l# B7 D; ]6 J) x+ A# j) X                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
6 p. g2 G4 w0 }                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
5 p  x! ?3 N8 ]. {# t0 l/ ]                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

  K/ t+ ^; u0 v& z0 `$ ~4 E: |                if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
: p2 g8 ?( v* l  s( l2 X' k3 h/ q                    DWORD dwDiskData[256];
& p# J0 f# U* T7 C8 n& I/ W                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
3 Z0 d; ^. w7 h, b* d) [; N: s                    char szSerialNumber[21];
( R# X$ ^; R- s1 M5 t. q0 Y                    char szModelNumber[41];
- W. m# O0 C2 w) A. X
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
5 N! r# W6 i+ }; r                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

" h/ a  H0 i* k% V# L; w( K# J                    // 取模型号
! Q# f; e" ~1 j" Z                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
1 `+ d. @5 n  H+ e, `( h. T                }
           }
           CloseHandle (hPhysicalDriveIOCTL);
       }
   }
% N, M8 `: q. D}
/ b% f' ], ]' E) r//---------------------------------------------------------------------------
$ m9 D- p1 b: |: P/ g4 P  {$ e// DoIdentify
+ F. o0 p) [, y. P' Tbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
: s' s8 g+ V5 m! z  W! A$ ^    pSCIP->irDriveRegs.bFeaturesReg = 0;
' g  P% s& R6 j% Q; {. ]: G    pSCIP->irDriveRegs.bSectorCountReg  = 1;
1 g! M0 l% |* T  v% W  Z9 ^    pSCIP->irDriveRegs.bSectorNumberReg = 1;
. m6 `' [% q' ^9 W( _    pSCIP->irDriveRegs.bCylLowReg  = 0;
: \" l2 o  w& ]( k- R5 W    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
, r* ^8 y$ `9 C+ Z, f    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

0 k- K* z" N0 W0 k, Q8 Y) u/ A    // The command can either be IDE identify or ATAPI identify.
* {% R- ^# q# t- U1 F- J7 Y7 L; @    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
6 s2 Z2 j6 e: x7 I( d( K, G6 u    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
. @3 ]( e4 F8 f" Z
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
; E* h( l! w5 t$ J. W: U) L           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
" @/ N2 F9 C; b/ c           pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
, E- z0 r$ t! s5 e9 m2 r$ h- T//---------------------------------------------------------------------------
' A/ U4 B2 F; x. Q- D( o// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
+ r5 i* C% I% W; `. a% z' ?/ I{
. s  ^+ L# Y" i: i    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
; v1 }" f$ _8 D: E! i9 B
% z5 H$ s* i" {    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
$ N$ Q2 t. ^% _* g7 L* R% f    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
/ b5 z5 g2 b( b5 B    // 避免蓝屏的出现。（期待高人能指出原因）
& v0 R( @& f! _* G7 ]5 N    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
. R) Z% }  {, U# ~: q0 [! M  ?# @        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
8 ^! _( t& a* T+ j' @& ?# Y        bool IsDiskExist;
+ h7 f! X8 c3 P7 O. X. X: H- }
       switch(nDrive / 2)
& P9 I% n+ W6 v5 f; j2 l1 l. ~        {
! f- G. n. ]: Q            case 0: dwBaseAddress = 0x01F0; break;
3 O& S# _6 X) u3 Z, b" o            case 1: dwBaseAddress = 0x0170; break;
- e9 A: S( h2 ^1 }            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
" @# g7 {. n7 ?" n6 a/ z        }
1 [0 a0 i% e! b' O5 `# m5 `
* b. ?1 _: R  P+ n" R        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
# G+ G3 ~' d6 G! k5 |% O5 \' @
       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
. `5 F7 @. q! {    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
& f# ?6 c& N" }6 h' m6 ^        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
1 c! c0 \& r4 D* d4 v% C        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
) A% S* |! I4 e4 N- d            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
) Q6 B1 w% F, l+ c' u) Y2 \% Q; J1 d% e- s            case 3: dwBaseAddress = 0x0168; break;
. M5 ~6 E* Z0 o; ^# Y2 G: L        }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
       bIsIDEExist  = false;
       bIsDiskExist = false;
5 m- Q+ Q( s  l1 k" q2 t0 ?        ZeroMemory(wOutData, sizeof(wOutData));
4 m1 o) @' t4 m5 E9 a% e
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
) x/ ]( \9 b% s; M
: Q! W0 }- F0 |- _' y6 C9 V  R        if(bIsIDEExist && bIsDiskExist)
       {
2 a5 B* t$ \7 y  R% e* E            DWORD dwDiskData[256];
           char  szSerialNumber[21];
& c+ h- q' A0 h7 `/ A( r            char  szModelNumber[41];

/ L$ Y, X; c5 d            for(int k=0; k < 256; k++)
1 p/ E7 i$ ]% }# j, Y# ~: ^4 y                dwDiskData[k] = wOutData[k];
* J6 Q9 U/ e9 t) I2 m
! Z% S* {, X' P1 Y8 [            // 取系列号
( S; I; D# {  W0 f            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

+ `5 R: Y$ G+ N: R4 X            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
- F& S" L- h% P. V# L0 G/ p            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
0 s4 I8 L, d6 c- \3 _) J0 C( n' a            pModeList->Add(szModelNumber);
       }
   }
8 A; }% s, \( B" [1 P9 r% N    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
/ k9 a" Q& \* p& g! P}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
# p- e/ g( y+ `" V- |/ ^6 K( E// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
* s" }% z8 G2 A! [4 E// btMasterSlave = Master(0xA0) Or Slave(0xB0)
( r0 b+ U( O, p6 ^9 T9 v6 d; B! B//---------------------------------------------------------------------------
8 f; M0 @  p7 x) mvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
$ G/ |8 \( d1 F    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
, B& T$ i4 J( N# F/ M
$ E- j9 }, @1 ~; B' Z) Q" Q3 S, ^    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;
3 [; ~/ G7 a4 k/ @( J
+ Z3 ~+ F7 d1 E3 E1 z$ B" ]' d1 A    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
7 M# m$ |2 S1 @    // const BYTE btERR  = btBit00;
. m* U3 \0 Y8 M% z- L/ h. C    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
/ y7 O" T3 B4 [1 H    const BYTE btAtapiCmd = 0xA1;
6 h" u: k: o+ O1 e( R' v
   __asm
   {
       // 必须先执行这条语句
7 n0 O% S0 x. L4 d" z- W* j7 ]5 u8 o- x        JMP EnterRing0
9 l1 H, Q- i, z1 E3 Y# R
       // 定义过程
       // 等待IDE设备直到其不为忙为止
1 I+ S1 S: _+ n4 R7 h        WaitWhileBusy proc

       MOV  EBX, 100000
       MOV  DX, dwBaseAddress
3 T' ^! `. P9 }: ?        ADD  DX, 7

       LoopWhileBusy:

       DEC  EBX
- y+ q0 j- n* c6 O8 H        CMP  EBX, 0
       JZ   Timeout
       in   AL, DX
5 U% Y: k# m' h; `/ j! U2 ?/ Q' [        TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
5 b$ ]3 `7 \' C5 M. Z5 I/ `* {        Timeout:
* D6 K( g$ i6 J7 D1 E2 X# P9 f0 c+ r4 ]        JMP  LeaveRing0
/ r) ^. P+ T! {1 S, ~' u5 l! K        DriveReady:
       RET
4 t. c% K! u3 d. f! T        ENDP   // End of WaitWhileBusy Procedure
- S: F4 O6 \' J) g8 Z
       // 设置主盘和从盘标志
       SelectDevice proc
" s& ]9 D  K! u$ E( K% f$ |; }
6 E2 n: H4 n  K9 z  N2 I1 d        MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
  i$ M$ z  [) B: g
: q" L0 t9 @5 {0 f- ]9 z        out  DX, AL
+ c+ t8 F; L1 a" d$ u3 U  Z        RET

+ U, ^9 f' e& E6 E0 J        ENDP  // End of SelectDevice Procedure

5 F# v: h) z+ p        // 向IDE设备发送存取指令
& c% D6 h1 B. k( f2 n6 w) H4 \/ s        SendCmd proc

) C) O! ^5 ?9 g! e. S0 L        MOV DX, dwBaseAddress
. O1 D9 f8 K/ k+ P  s  g# O        ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
, ?! V9 C/ i% c4 n3 L: }1 K        out DX, AL
" S' j! K# [8 ~' E6 _3 i' M        RET
; o7 ]! o' S" a2 f        ENDP  // End of SendCmd Procedure
- k* e. {+ h# q, ~2 R) K6 G# Q
       // Ring0代码
/ D; [) l& Y  v/ m3 w        Ring0Proc:
5 X! _% T9 I. O9 f5 l) F. c2 H        PUSHAD
& M# m$ n1 v- r* |+ Y        // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
6 I1 ]+ ?+ T' q# v8 {        ADD DX, 7
& d+ K! E; r- b        in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
( L( b% g# J9 T8 U* |0 ]& e        JZ  LeaveRing0
6 J0 b' N: y+ G* R  t$ A        CMP AL, 0x7F
& h  q. H* T3 p1 l, y9 r3 k- q        JZ  LeaveRing0
& @$ U6 T8 B7 Z/ `* H5 C
       // 设置IDE设备存在标志
0 F  G( s. G+ F% g: A4 Y        MOV btIsIDEExist, 1
; U- B3 w3 y9 [" w; ?
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0
9 ?2 B  a( u, N3 v6 Q9 m: U, i
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
- i7 u$ ^% m% t  n/ m        CALL WaitWhileBusy
8 k. Y" p! a' p( i2 t* ]
+ b/ \7 g' K, ^3 S5 i# a6 L        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
% W6 \  C0 x( \6 K        JZ   LeaveRing0
5 L; ]* K! L; p3 ?7 m
, x, G! O4 g2 l" x        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
. `5 N" x, H5 Y: s        CALL SendCmd
5 i/ @* y: u; U4 K% r- \        CALL WaitWhileBusy
  F1 @" k% e: r3 P
       // 检查是否出错
       MOV  DX, dwBaseAddress
  W% d4 H) D3 i! n( D3 X        ADD  DX, 7

9 H- C$ g. {3 s3 Q0 |, i: t        in   AL, DX

       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

+ i. H( {) d6 s1 f. {0 Q, W" A        // 如果出错，则进一步尝试使用ATAPI设备命令
' u! `% t$ f; s- r! s        CALL WaitWhileBusy
% `0 g+ r1 m* W$ F        CALL SelectDevice
5 \$ J9 ]/ ^. K  r        MOV  BL, btAtapiCmd
       CALL SendCmd
+ z  `( `: p& p1 W4 q4 K: m" J        CALL WaitWhileBusy
4 N8 v4 {$ j) I' o
5 j4 c- n6 [. K$ \9 Z, h        // 检查是否还出错
       MOV  DX, dwBaseAddress
, r4 H; r  x8 V' m( J        ADD  DX, 7
       in   AL, DX
- |" f% _2 X* n$ I& l6 F, T        TEST AL, btBit00
! x$ O3 H1 J; M7 V& a& N% ~5 [        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
0 [. I( |6 z' u( `% J9 Q  D: F; C
       // 读取数据
       RetrieveInfo:
4 W+ g+ p! ]% X1 f; H$ k
+ l$ |/ |  F3 D# w# G: J8 L        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD

/ J1 {3 I! U' ^( Q8 Z9 Z6 h        REP  INSW

       // 退出Ring0代码
5 [: @6 o' G- I        LeaveRing0:

' B0 [' ?: J; A7 [/ a        POPAD
       IRETD
$ v- S$ H0 N$ y7 k
  C+ `! S! V4 t  z; U9 V0 l        // 激活Ring0代码
  r. G% [9 x& l3 ~% d& l4 |5 Y        EnterRing0:
2 ?3 l3 i6 i0 x" M! F9 O
       // 修改中断门
       SIDT FWORD PTR btIDTR1
! s' K  G4 F' \3 b        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
* u7 I5 ^' d* I0 T1 C' ?
       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
$ |* B# r+ d* C- q( h9 R% b$ D        MOV dwOldExceptionHook, ECX

       // 指定新入口
* f" J+ G2 }  x        LEA EBX, Ring0Proc
- C1 m$ X+ |# o; j9 b  P6 ?        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
3 g$ M4 O* f4 r% A* d* u' Q        MOV WORD PTR[EAX+02h], BX
; v0 T* I* n- g& A3 T# X0 [
       // 激活Ring0代码
* L$ Y: z8 U8 h) f. t        INT nHookExceptionNo
' C9 G! M6 V. f6 N( e
" u5 ?0 K1 S/ s% F        // 复原入口
       MOV ECX,dwOldExceptionHook
! s+ V# p! ^2 I& L' m4 o' F        MOV WORD PTR[EAX-04h], CX
  i- Z2 l2 m' G        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
- E) g. v6 I" a7 c4 S        STI
   }
# t* S, b& H" J: N/ \    if(!bIsFirst)
; ]* V; m( w  i, j- v, Z- i    {
       bIsIDEExist  = (bool)btIsIDEExist;
9 b& L- L+ `0 t6 K! b        bIsDiskExist = (bool)btIsDiskExist;
' a% X3 d0 D$ V; y& y        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
9 b7 s8 w( w" k" _}
; M2 B1 X7 y# }/ [/ b7 f) ]//---------------------------------------------------------------------------
' p( B: w5 W" L( B8 H8 e$ }// 调用方法：
7 e8 Y1 D) j( I% u) Ovoid __fastcall TForm1::Button1Click(TObject *Sender)
{
2 w3 m  p3 E, W5 w' F: i    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
; u8 i1 v& D5 E/ ?9 N4 `}