[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>
! E+ [( ?! w" ~1 f& D. _+ |
: y" i3 H+ _6 H#pragma inline
//---------------------------------------------------------------------------
, `* @6 X1 _, F) b6 _; g// IDE NT/2000/XP专用变量
0 Q4 Z. u: i7 M) n/ |( u#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
* m- L. g) A6 c8 A#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
# W" N# E. S6 {4 h, y* L! y
+ ~" ^2 h- G0 c9 s& Dconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
! t- U6 r- m# N7 V6 ~* g( y  P% Gconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
; K8 L0 J: ?' T3 o* r
" S' W- a0 ]; A( [const int MAX_IDE_DRIVES = 4;

% |9 {1 x  }9 X6 N// SCSI专用变量
3 x; M# X6 G% J( N2 U! `$ tconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
6 ^, j  x' k/ v* o1 v- X! A# Nconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
% P# Y$ {! b5 O6 Q
typedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
% F! M! {& o7 ^% a    UCHAR Signature[8];
6 q+ L/ c- ]0 ]+ `! W! @2 G# Q    ULONG Timeout;
6 p+ u+ N/ N( V# i& U    ULONG ControlCode;
1 M4 t" i! B+ d" q# @/ K- a    ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
4 T+ _, }5 o+ U( v7 R
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

7 R  A$ J+ l" X7 R0 p# h8 F# t// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
6 s4 p4 l3 q$ i: x0 W// NT/2000/XP函数
% Z" ^9 k0 i7 H5 }void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
1 |2 B- p5 b5 d0 c5 N        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
: s& h9 N2 F* g. C// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
* o2 _) }/ |. Q1 Z* g2 M9 [        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
2 _) N. d) i6 e+ T9 x! M
5 Y2 Q1 W. a0 E// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
  t. D; q# j0 q8 U2 b: W! O{
   switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
* R( F( z% x7 {$ u& f. f! C- {            ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
! V: d3 A; f; C5 x9 u& ~            break;
       default:
2 `  i+ @! K% @- w' d& A6 J            break;
6 k- K" \. e! M, G8 f9 ]. |3 |$ Y0 L    }
}
" i" D( p: [+ ?# j' @+ f//---------------------------------------------------------------------------
7 f4 G$ S% V5 G4 G3 ~: k% b// ConvertToString
2 |* q. u( o. \3 F2 [# o  _char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
' U4 w$ A6 t4 t7 h/ v{
0 x  q) a, _: u% v5 A8 A    static char szResBuf[1024];
   int nIndex = 0;
/ O& j: s$ c3 l$ l( I    int nPosition = 0;

   // Each integer has two characters stored in it backwards
2 _3 J2 K# {9 u    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
2 @( N" b0 a* x! ?  ]        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
4 f  B& w( J3 |# w! l8 R        nPosition++;

       // Get low BYTE for 2nd character
0 x' T4 e: Y6 J, i! s7 @        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
1 h/ l$ f( K; d        nPosition++;
   }

6 }" [* G2 A5 `' w    // End the string
2 w) I* b7 I1 d  K' F    szResBuf[nPosition] = '\0';

   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
& t" e( b7 J9 J" Y$ h- T
# E& c0 v) A( i0 X* G: i    return szResBuf;
, ~4 g, Z, l' z- a}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
2 n2 C. _# F' R8 S7 k! \* ?7 k+ }//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
7 J; ~9 K% m# j' Xvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
0 k; \7 |; C# j. o0 S9 X{
/ r6 y/ v0 z5 `! _    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
, P+ Y6 [8 E# y- U
: K% R& `  T: Q5 j5 b& D    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
; ^! Y1 P; i8 w0 i6 W! A, \/ {% J        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
' T* q& f) v) W/ t8 M5 a- H: r
; D% i- {1 |% j5 o  Z        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
& O, ~5 F1 [) Z) f" a        hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
6 u6 f8 z( _3 S$ U                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
. P3 ^( o, g8 J7 w7 j" y; l) V5 C: s) C8 j
) m% g/ {( h8 `        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
& q9 n% ?! O7 k0 p& y: N& H+ @3 g# x        {
, F  @- U  v: A9 O# m( q            DWORD dwBytesReturned = 0;
3 n; i1 o3 x- z: e) U3 J            GETVERSIONOUTPARAMS gvopVersionParams;

( e/ P& w! v4 @2 W7 a. y& Y; G% A            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
) K7 @) T/ ~* E8 ~# b! X% R7 z% V, L
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
0 l3 ]# t7 v. S/ `8 U                    &dwBytesReturned, NULL))
           {
6 \- p9 i+ R  u; h. u: n% L% R: `: [9 l6 U                continue;
           }

           if(gvopVersionParams.bIDEDeviceMap > 0)
! B- z% a4 B: @4 x& K$ q            {
               // IDE or ATAPI IDENTIFY cmd
7 w0 |% j3 g4 t& n$ W( @                BYTE btIDCmd = 0;
7 g9 z+ _+ E' B                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
% q, X: G/ ^. {7 L3 i                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
& F0 O8 s1 a4 {2 x1 C5 |1 B" m! f                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
: e, N; R# I0 M0 I+ @$ a$ m                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
; X8 S! h3 N$ ?
               if(DoIdentify(hPhysicalDriveIOCTL,
, r8 W* t! G& i( S" P                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
                   DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
" w: p) ^7 p" J3 a' L/ @                    char szSerialNumber[21];
/ n7 D7 v9 t/ Y5 N6 J2 c) y7 L                    char szModelNumber[41];
8 v7 g% d! s  r! ?* @/ e2 m$ p
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
( a- f: @7 ^1 _- y( k' T                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
$ z7 ?) k1 m' G- J0 c                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
( I2 a/ D4 o6 O                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
6 h+ q0 r; z* }8 ?; M
                   pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
               }
           }
6 e1 p; \$ _4 e) A            CloseHandle (hPhysicalDriveIOCTL);
       }
0 _! U% J6 w. }: l+ d    }
* T4 L$ \% y' d5 f) w/ @}
: ~& v# d+ u; M) j//---------------------------------------------------------------------------
  v# l6 w6 ?$ c7 I0 |/ w// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
{
" y& I  s! _/ C( q. G  H9 D    // Set up data structures for IDENTIFY command.
3 e7 S, k+ w  I6 k- c. t* p" _+ _( N    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
4 u" W/ B+ P# o2 B  z6 y9 k( c    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
' ^% e9 e3 A" i6 ^  l2 C- S5 h    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
! Z, D9 U7 `+ z1 @" V' }8 C1 [  y% y    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
) P: r* t1 g! @3 g' b$ l+ W  _
1 K& [3 h4 B6 ^4 W8 L% U# y1 H0 j9 K    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
  W2 T* V( F& N: ?           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
- D  \- R3 w& E) g3 M# w4 v: k6 [           (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
/ Z7 K' j2 B) K; y- u6 e! B, f// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
, U6 N8 X2 l% z/ ~5 j8 E$ n1 }) y// ReadPhysicalDriveOnW9X
1 _/ l9 g( e, I1 n' Fvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
; F5 ~# `& t: f% F7 }3 V    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
: f) e+ S( _* f  v) w- y3 I    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
& y6 C8 x' g7 k* U8 n7 l; B        bool bIsIDEExist;
; j/ {$ r- ~8 E) s1 i        bool IsDiskExist;

9 l0 w' }2 R% D6 c8 ]* }, x: `        switch(nDrive / 2)
       {
% P9 r( \% @. x5 b/ t9 F+ E3 M            case 0: dwBaseAddress = 0x01F0; break;
/ A; Q$ a# v( f6 S7 a            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
# Q  L' H. s5 m. j( r# X6 S0 A5 @            case 3: dwBaseAddress = 0x0168; break;
       }

# @6 w* I! m. F        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

9 c- e- O, j0 o% O        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
5 S9 r% ~6 R6 e$ X% }: Z; c/ L* L                bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
2 {0 y4 a( r  }5 b' x) w( o    for(int nDrive = 0; nDrive < 8; nDrive++)
* {9 e7 G5 U9 C' |: q3 X7 n    {
       WORD dwBaseAddress;
$ c& L, r  C, q4 \$ Z4 l1 m        BYTE btMasterSlave;         // Master Or Slave
; F# @* Y5 ^) a, |  s; A, @3 I8 g        bool bIsIDEExist;
- u6 l- z3 u! m* V. s  ~        bool bIsDiskExist;
       switch(nDrive / 2)
       {
' l) u  b) [8 j+ c$ G            case 0: dwBaseAddress = 0x01F0; break;
3 V0 @3 t1 b5 R            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
       bIsIDEExist  = false;
       bIsDiskExist = false;
* S) `9 B& c5 {; ?" x+ U        ZeroMemory(wOutData, sizeof(wOutData));

+ a6 U, \  S" Y1 Y3 @        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
+ z1 [  X/ |4 H                bIsIDEExist, bIsDiskExist, wOutData);

# t1 p7 f$ F9 k1 |: y, X7 _& }" g+ w        if(bIsIDEExist && bIsDiskExist)
2 J3 X! R( O! N+ W/ {        {
0 p2 `9 p% Y, b9 l7 x$ K* b: s            DWORD dwDiskData[256];
           char  szSerialNumber[21];
; C( N, `; |, [+ t" e8 A            char  szModelNumber[41];

2 b6 h. E& B% M! z2 T            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

$ N$ ?: T' H3 i2 z6 w8 _! n            // 取系列号
' E! I) B0 N5 y1 Y  _            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
. t1 D, Y/ I& {, ^
           // 取模型号
4 b* A3 G( @4 M            ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

' {  o% A: h2 x. u* N% a  `7 ^            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
       }
* ?+ ?6 u  i4 r+ O- j4 X    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
4 C# D/ @. T( k( r9 c' B: S// ReadPhysicalDriveOnW9X_Ring0()
. g) N$ W( u" i1 q7 E, k) E8 a//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
' W6 H$ l. P3 T( z6 evoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
- _8 _( h+ L. J3 l6 Q{
   BYTE  btIDTR1[6];
% ?* S, A3 \5 j, L$ w# h    DWORD dwOldExceptionHook;
3 K' [' j* J  [4 f1 }, O! Q4 y$ U3 d    const int nHookExceptionNo = 5;

# @$ d8 L2 T  ?) [% ]# Z    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

2 i9 j3 T1 t& w) {) B    BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
9 c" @' `, J0 W2 [8 c    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
& r$ I/ y: x& r( h& G    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
, |9 I& V7 \) E7 D8 J' ^, B6 Y    const BYTE btAtaCmd   = 0xEC;
7 a  Y) }" p  ]/ Q6 R5 a* t    const BYTE btAtapiCmd = 0xA1;
; T. F" w' S8 `
   __asm
   {
7 E% \8 P' R; f        // 必须先执行这条语句
       JMP EnterRing0

) b7 _( j, m: T' |. f        // 定义过程
) g+ R* q; w3 m( d" M: Y        // 等待IDE设备直到其不为忙为止
+ {6 a5 Q# T4 V% Y# D" E        WaitWhileBusy proc

2 X- y7 M. `6 F# ~$ s0 T        MOV  EBX, 100000
4 @9 i$ j' S! ~% E* b5 o        MOV  DX, dwBaseAddress
       ADD  DX, 7

       LoopWhileBusy:

3 l5 H: n, H' b% ^2 v7 V" @        DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
+ p0 L& i; }5 z7 ^/ ?1 r        in   AL, DX
. e& ]# x6 r' H* y, f        TEST AL, btBusy
& d3 u9 M) G% X        JNZ  LoopWhileBusy
2 N* _* a* B7 W$ T4 d9 E1 Q/ Z        JMP  DriveReady
2 H5 [8 A+ b7 m% ?2 C  U
! X- w( W& O  o" I9 ~7 Z& J        // 超时，直接退出
& s' s! {, ]4 P: v! p/ U  s        Timeout:
       JMP  LeaveRing0
- m$ f" a2 \- T% y        DriveReady:
& X  v7 Q, {$ z* E9 x: N( P( [        RET
% b* _; ]. z& m7 @8 S& l4 ?        ENDP   // End of WaitWhileBusy Procedure

1 t) ^2 H4 G. z6 r        // 设置主盘和从盘标志
; S  |6 E7 E3 q5 L9 J3 [# O        SelectDevice proc

# _: C9 R2 e/ M5 t: J$ ^        MOV  DX, dwBaseAddress
* C/ v, K# _5 Y9 H, R3 J# |/ M: B2 V        ADD  DX, 6
       MOV  AL, btMasterSlave

       out  DX, AL
7 M: d4 Y7 i, ~' O        RET

' C5 d7 p) ?0 Q4 |8 D3 y# c        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc

       MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
$ \# w8 d# [* o) J" w  M1 z6 R        out DX, AL
, g# A" ~9 G, f4 F" z2 o# B        RET
       ENDP  // End of SendCmd Procedure
1 n. u) n+ U5 Z; w- N# W9 i
       // Ring0代码
       Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
, p8 ~3 O' ]: P& C* X! p        ADD DX, 7
       in  AL,DX
+ P3 t& E7 K  C. @3 F* \7 [8 v
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
6 Q+ r/ x& k& E9 \- g4 b. z        CMP AL,0xFF
; x% M% F( f' b9 ?2 V        JZ  LeaveRing0
       CMP AL, 0x7F
9 }1 k3 n* J  {6 h+ Q2 _/ M7 u        JZ  LeaveRing0

- D* H3 B& I$ F7 n. T2 o1 v2 ^        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1
$ F6 X0 }0 f5 H5 h! U, h* z
, j* U) g; M0 U; R        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
1 R) y" }" o% u        CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0
+ ^' f& {" R# v$ t% ^4 y' s; V
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
" T* w, c" j. o5 a4 P        JZ   LeaveRing0
" z% i2 m( q! J2 s2 B4 \; u! R' q
6 ~6 I! P  `& Q        // 设置驱动器存在标志
  \0 N1 J6 V- K# B! ]1 ~        MOV  btIsDiskExist, 1

       // 发送存取端口命令
2 Z8 }8 c* k  e& H4 \7 e, A/ ?1 j        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
; l' R- d7 X- |, D/ T1 D- V! ~* A/ I        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
% o/ g- ]8 K. S6 x1 W, _        CALL SendCmd
       CALL WaitWhileBusy
8 E% K: q  o( u6 v, ^, n6 v0 _' Y
2 D$ E6 r8 y3 _! {4 ~        // 检查是否出错
9 |4 e9 n+ Z/ q# d& \2 i( X6 H; A        MOV  DX, dwBaseAddress
       ADD  DX, 7

# I' e8 P" n( Z# l        in   AL, DX
$ ~* G1 p# T7 g# k8 ^( o* B
       TEST AL, btBit00
8 E! g8 z0 r/ x9 D9 M3 P& a        JZ   RetrieveInfo   // 没有错误时则读数据
& [6 O0 D4 o: b% A
6 S1 B4 |, F) C/ m! `        // 如果出错，则进一步尝试使用ATAPI设备命令
6 v. I$ E, J' i/ J6 a        CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
       CALL WaitWhileBusy

$ F* ~" z) w9 Y1 C        // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
% N8 S# y" a$ e: h6 E  [        in   AL, DX
       TEST AL, btBit00
; r3 D2 G. Q& t4 V, P2 }. z! w' T' V        JZ   RetrieveInfo   // 没有错误时则读数据
9 q8 Q7 [" V1 Z$ O- ~        JMP  LeaveRing0     // 如果还是出错，直接返回
0 Y, G' v. }+ G
+ b5 |3 v6 m  m1 G3 W& v" _, |5 n# |0 z        // 读取数据
       RetrieveInfo:

       LEA  EDI, wOutDataBuf
" F2 h: w. z0 S* f' \        MOV  ECX, 256
% E; ^' a! K( n3 `        MOV  DX, dwBaseAddress
5 n1 @& z$ L. B2 Y; m        CLD

& J( u$ B/ i/ L6 K8 B        REP  INSW

! Z0 Z+ {  e" t  c        // 退出Ring0代码
$ |+ D6 H3 M3 P7 ~; v1 W        LeaveRing0:
0 `2 v* L# e: c- z( F
       POPAD
       IRETD

! g1 f! b. b5 H  i0 w$ S) g+ y        // 激活Ring0代码
       EnterRing0:
0 o( Z+ M& b- _$ z9 u$ y
4 N5 N, E6 O4 S' u        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

* z+ b! J0 A- M4 R; e8 k  |$ R        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
2 z2 x0 ?' w0 a; N3 @& d; N& \        MOV CX, WORD PTR [EAX-04h]
& a0 e" O- u/ J7 e        MOV dwOldExceptionHook, ECX
3 n6 `7 k9 P& k, {1 R$ L
       // 指定新入口
       LEA EBX, Ring0Proc
( ?5 J4 _( X, o, E, S) \: y) O  d0 ~        MOV WORD PTR [EAX-04h],BX
6 L9 @$ B% ]. {" `9 ]        SHR EBX, 10h
; J) Y0 {( j8 `        MOV WORD PTR[EAX+02h], BX

: d9 G, d; I7 U* w  l) i        // 激活Ring0代码
       INT nHookExceptionNo
3 {8 m& ^- ~, H1 L' [' @0 D
& Z* o; V1 Y5 N+ C) A4 m        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
$ Q6 d, z) B6 E( r        STI
% P; D) G- ^( H9 t& ?# w    }
   if(!bIsFirst)
   {
5 Z( R9 r% v6 p6 X        bIsIDEExist  = (bool)btIsIDEExist;
- k  N- U6 D  b! l        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
8 Z3 _0 ~+ c4 J6 m& T    }
: l4 Y& j* d$ q8 {* p- G3 V( x+ E5 g; p0 [" H}
: u: h2 w' H2 A% y. K//---------------------------------------------------------------------------
// 调用方法：
2 Z% l1 g( w& Ivoid __fastcall TForm1::Button1Click(TObject *Sender)
: k* I3 |* c& ~7 U, g{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
, v! Z5 g# Y) \- T}