[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

( B, y& I. H- b" Q/ `#pragma inline
//---------------------------------------------------------------------------
6 B* Y2 H) R$ W) }% Z7 I: H6 Z// IDE NT/2000/XP专用变量
8 X5 Y" l# n2 V( o: Q  @- g#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
6 d8 u/ V4 W9 x5 M& k% e#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
. X3 A) D" X: d
const int MAX_IDE_DRIVES = 4;
3 Q% h! b$ I! E1 w* F
( D3 U$ U1 Y! d" K% N/ y1 c// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
3 A+ B  X6 K1 Q+ i  T% y8 y9 E4 cconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
) Q1 n! i+ O, P$ Mconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
{
# l1 I! o# Q  g1 L( d    ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

1 c3 R7 r; m1 _# c( r( Z7 F5 u// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
, \5 c- p$ a$ }# D, R
, F0 E: J3 {4 s* r1 _% t4 z" [// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
  J# [2 z6 \  A9 S# K4 Xbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
& \+ k8 i7 a/ Y" N+ s. E        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
+ @) ~( [/ }( Z" I6 W        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
6 \2 C2 {0 P1 ^8 g" Y0 w// Windows 9X函数
4 I2 I3 j0 U4 h( `7 j: Bvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
% P; c, O' q; I# |. |void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

3 K0 ~( I. _. b3 u6 g// SCSI读取函数(for NT/2000/XP)
8 x9 b4 X0 H  iString __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
! c5 l9 R2 {: a% f2 u// ReadPhysicalDrive
# G' }- t. x9 g% e" |; Ovoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
/ k, {  `& m1 n1 F6 P0 M{
   switch(Win32Platform)
. d& ], b% Y0 ?. U/ @5 `/ j    {
! h/ |: _7 [* @! P        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
$ @) P. T3 x4 J4 ^- J& A4 k            break;
, g, V) M2 b' T+ u. h        case VER_PLATFORM_WIN32_NT:
9 J0 f0 g# [/ `  h; _- t# T            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
  s" Z! p; A( w% K8 d$ K( M        default:
           break;
! ^/ S! B: l) O# U- H    }
0 z& f' Z. C$ i: E3 F8 h}
//---------------------------------------------------------------------------
1 ]1 \6 g+ e  q' N) H1 w// ConvertToString
1 l! s$ ~: r& ?2 B- S: l1 Schar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
# J& x$ G) w; h    static char szResBuf[1024];
   int nIndex = 0;
( J  B; o* R- D  ~8 i% S3 c: A    int nPosition = 0;
5 ^; N7 @/ [- `2 W
# J7 q) o7 T; I    // Each integer has two characters stored in it backwards
8 h- [! q0 K- O' W" E" c5 J/ d7 O: l    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
4 f3 m" Y9 _% i        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
' l$ X4 Y" f$ Z8 s9 a( N2 M$ ?        nPosition++;

       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
/ k; [3 ^1 M. b' ]) k        nPosition++;
   }

7 \& g( {( n' ^6 B5 X( n: U    // End the string
   szResBuf[nPosition] = '\0';
$ C. y9 m7 ~3 j! u7 l3 Q; ?. ?
2 ]0 [6 \" F9 c5 ]    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
' h" U( y+ `$ o& u, d' @1 y
2 H7 J# G1 _5 H0 B& m    return szResBuf;
}
4 ^  d; Q9 c; o0 U' }3 k6 U# R4 t//---------------------------------------------------------------------------
+ r6 v6 T8 X& N9 v2 n" z( [// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
5 n7 |8 l1 m( W$ H5 xvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
2 o9 G1 D7 [$ C+ c    // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
- Q) D& S5 r0 f
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
: K- q, n+ y$ T" p; N        char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
' O5 M6 m2 W+ r4 R3 S) Y$ R                        OPEN_EXISTING, 0, NULL);
" m$ b$ K5 M0 C2 C# U  E; N
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

0 M+ {" J# n- s1 [" \' x0 G6 J! U            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
% G3 T+ J. E/ ^9 [7 N) q7 O                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
3 W; p% [3 k8 t1 v! {: i3 d            {
8 ~0 r; w8 q$ z9 c                continue;
           }
* m' b1 }; N( [5 l* ~
           if(gvopVersionParams.bIDEDeviceMap > 0)
, l+ {; c* y; s7 t. R1 [) E, u8 \, F            {
               // IDE or ATAPI IDENTIFY cmd
! W4 a5 ]- ?/ N/ E2 W, k                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
# G4 t3 ^' h' w4 S0 V$ ~" ~; J
               if(DoIdentify(hPhysicalDriveIOCTL,
( A/ g+ l. K9 W+ \/ [; A                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
+ o! Z9 \% S3 r5 G! N+ R" j$ ~3 E                    DWORD dwDiskData[256];
" I! c! i5 s1 e# U- ^                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];
3 k1 p' P) R9 r
( {2 M- R, X$ ^! _1 P$ Y1 ~                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
/ M1 \4 H* r7 {: L  z                    for(int i=0; i < 256; i++)
3 `* H, P% q# p( p' L                        dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
2 g. e6 T1 @3 v& N8 b% S4 j
                   // 取模型号
( N! W3 Q! ~( Y" f  V                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
& J6 n) a" z! @* Q- x& C                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

: p: _; R. N- o4 }                    pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
5 N. d& |' l% u1 w# b& ~* Y                }
$ h7 \; t$ Z3 T# s$ r            }
, m. R3 n6 o+ M8 [% P            CloseHandle (hPhysicalDriveIOCTL);
       }
! x+ p+ ?& e: B) {1 c    }
}
8 r* v, R: k/ a//---------------------------------------------------------------------------
// DoIdentify
7 S+ w/ Y! V; V2 Abool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
  |' B$ T# F- ]- Y+ K1 i5 |4 `4 C              PDWORD pdwBytesReturned)
{
   // Set up data structures for IDENTIFY command.
% T2 @- N% A  c    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
8 `( Q1 P3 ^0 h$ m( |    pSCIP->irDriveRegs.bFeaturesReg = 0;
' {7 `8 \7 T: ?- j    pSCIP->irDriveRegs.bSectorCountReg  = 1;
0 @5 U: C, }0 k5 V3 s    pSCIP->irDriveRegs.bSectorNumberReg = 1;
6 p) k0 `) b. b$ F    pSCIP->irDriveRegs.bCylLowReg  = 0;
! o9 w$ z0 ^9 [1 f% E% N    pSCIP->irDriveRegs.bCylHighReg = 0;
3 M) G; L8 k9 i. m2 u4 w0 N
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
8 Q- M! W8 |; `9 v: i    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

9 ?5 F) U$ V, ~* {1 D' P2 T. M; a    // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
3 ?, S2 ?* F; N  l1 h* h" P6 ]    pSCIP->bDriveNumber = btDriveNum;
  Z6 Q; s% M! o1 O  B( W, R7 p& ]    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
4 K: S0 Y' t* G& Q           sizeof(SENDCMDINPARAMS) - 1,
+ u/ Z$ h, @" j0 x1 I           (LPVOID)pSCOP,
  i5 J( F9 h# Q! u. f# D5 K           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
# U6 K/ H& A: N" v}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
$ ~+ l9 h( X" Z//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
! `3 y' s& ~  S; k2 O2 q3 H) B. Tvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
6 R; ?$ I! A- P2 b$ }, l/ t2 S    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
* w; T  @0 e3 b# q+ L
4 W" t. l% X& k3 M0 \    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
& l2 O( P! ^5 R8 _+ i5 Y    // 避免蓝屏的出现。（期待高人能指出原因）
2 q6 C8 g+ e$ u  C6 ?8 H1 A  S( g    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
5 J+ }5 E' ]7 _% ~1 C        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
' m0 Y. U7 T3 }' n# p+ U0 T  A( m7 Y, z        bool bIsIDEExist;
0 ]! R, r$ x. @/ a/ X0 S- o5 I  v        bool IsDiskExist;
6 E  c  _% s+ G, l- M7 J  l
       switch(nDrive / 2)
7 G, f5 c, H0 k3 Q% V( ?        {
           case 0: dwBaseAddress = 0x01F0; break;
' G+ y" J' _$ p. c            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
2 Y. T3 y6 b6 R            case 3: dwBaseAddress = 0x0168; break;
! O4 L4 X7 t8 ^% S        }
. d* K1 V6 p9 r
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
- q  o1 z, N  s) ~3 |        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
3 G  L( t2 n$ C$ W7 D$ @( _    }
& u# V: \$ q% Y7 N7 o( }' Q+ y; Z
   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
  Y- f- F: `0 w! f4 N        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
, `/ C2 D' z% f: i/ l        bool bIsDiskExist;
" D0 X9 v  |* ?# W        switch(nDrive / 2)
8 L0 X9 S3 l. B' M9 B8 L        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
5 p! W( b3 z0 _! q, B            case 2: dwBaseAddress = 0x01E8; break;
) {2 J6 H7 J. k7 e! F- Q# f            case 3: dwBaseAddress = 0x0168; break;
       }
& o; S( B: O/ P2 v
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
4 A% v9 M! K0 _( g! m: ?" L
       // 进入Ring0
       bIsIDEExist  = false;
) u9 g6 E5 J: l7 @% O, k        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
" V2 y% }( Z4 t% X/ m
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

1 o0 T$ E( Y% T2 }5 w+ R, Y& y        if(bIsIDEExist && bIsDiskExist)
# F8 m, y9 e) g, k* G4 ]2 D        {
           DWORD dwDiskData[256];
, C' C2 K3 q$ `! i7 L            char  szSerialNumber[21];
           char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

7 X2 Z! j! A3 j            // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
$ y4 s# T6 m( V, v  {& u            ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
( @- A" s! s# l- b6 S) Q2 P            pModeList->Add(szModelNumber);
       }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
3 `: V$ a2 I3 U( T6 a$ i//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
6 U1 {2 S& e& ?7 W, z7 m// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
# _5 U( K/ V( K7 T, `( S9 B& Z' r// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
; h+ v7 M5 Q! ^( R, a6 svoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
+ }! l" R# u% j3 G    DWORD dwOldExceptionHook;
7 ^* ]# f/ s) X  m: Y7 C    const int nHookExceptionNo = 5;
/ z0 }8 F( f9 B. d
0 V4 R1 q4 `* q4 C/ l6 ?0 _5 i8 `/ U    BYTE  btIsIDEExist = 0;
4 w) X9 X. P* I# A3 b9 f0 N    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

. i/ h: v, S7 f    BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
/ N  k* p9 w5 v! r$ @$ x6 w    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
4 P* Y" t! S$ f! Y% p7 `* o* u9 N    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
. q8 I$ C$ |* E- e
   __asm
  ~+ n; I) E3 H- d: w% p    {
       // 必须先执行这条语句
/ S$ r- |1 \# {; s        JMP EnterRing0

       // 定义过程
       // 等待IDE设备直到其不为忙为止
0 e0 l& x9 v1 P8 T4 P0 q        WaitWhileBusy proc

- K  P6 H7 S" q! h4 ]5 |        MOV  EBX, 100000
  K. C, @( |* w' V# O! W2 Z" ?& k        MOV  DX, dwBaseAddress
       ADD  DX, 7

       LoopWhileBusy:

       DEC  EBX
+ Z$ s$ i/ G; x5 }        CMP  EBX, 0
) g( {5 ^' A) ~3 v2 \        JZ   Timeout
' r- a# l5 b: m; ]" }$ _        in   AL, DX
3 q& P& t; N5 s/ W4 L- c4 x        TEST AL, btBusy
       JNZ  LoopWhileBusy
0 {7 j& \: K8 V# V. ^8 @; }        JMP  DriveReady
4 `! r( }; N3 w: n+ F- f+ W
7 ^( _4 U! l; v        // 超时，直接退出
$ h0 o- w& O* F6 y& B$ ^        Timeout:
       JMP  LeaveRing0
, x9 a* j- Z2 s" j, ~, E        DriveReady:
0 q' o3 F2 j4 d9 |( B# K" j        RET
       ENDP   // End of WaitWhileBusy Procedure
' y$ R$ `. _- N( K  w: |
       // 设置主盘和从盘标志
       SelectDevice proc
! }5 \+ P8 A% y, r# |0 L+ P
/ I/ P( `" ~! Z! g' ]7 q- Q/ E        MOV  DX, dwBaseAddress
       ADD  DX, 6
/ ]$ D8 n8 o/ ]/ q3 w        MOV  AL, btMasterSlave

       out  DX, AL
       RET

       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc
0 Z; f$ x0 W1 r# C* ]' G$ }
7 ?  @& y8 X2 P        MOV DX, dwBaseAddress
- [. G- e6 x( \4 a( h        ADD DX, 7
/ z) I" O7 E2 i! q$ O& i        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
       ENDP  // End of SendCmd Procedure

       // Ring0代码
  |% m- d# h# S+ }8 G, _+ A        Ring0Proc:
       PUSHAD
- o0 f1 s# }6 w  `2 P        // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
: B1 d0 B+ S% P1 u+ L% U/ u  a        ADD DX, 7
( z1 M( ?% O5 P- M  L* m        in  AL,DX

  b4 T$ U- ?' E( T' B- Z        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
- `" Q! _3 X9 H( [* u# F) ]+ x        JZ  LeaveRing0
/ z8 S" @' d( f  K) s
       // 设置IDE设备存在标志
       MOV btIsIDEExist, 1
9 ~5 X$ I! B5 y4 {- I
$ ]3 G: G9 T1 k- f; i        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
& ~# l/ C1 E/ \3 K. E        CALL WaitWhileBusy
       CALL SelectDevice
# e8 z3 f7 O. M2 v' \4 |
       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
: V( `. ~' ~; b0 N        CMP  btIsFirst, 1
       JZ   LeaveRing0

# Z. i) X, {* Q% d' n4 x, k) R        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
, F$ w; ]: p" e$ ]3 q. b        CALL WaitWhileBusy

9 e9 j" o6 }5 t3 a, E  N$ ^4 J1 G& d        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0
: A5 k% u# n2 n4 C# U
% C/ G; w: H0 l; Y9 m1 U        // 设置驱动器存在标志
; q2 v. V1 X7 l$ C# t' j/ O        MOV  btIsDiskExist, 1

       // 发送存取端口命令
# d$ }$ P3 l, `9 l        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
$ k& i" m4 D, E- ~; L$ P" w0 Q& J4 M        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
3 @+ ^5 X+ V# b( m2 u        MOV  BL, btAtaCmd      // 发送读取命令
, u9 U: D, u3 Z        CALL SendCmd
; w/ J7 n* x/ ?, P5 h        CALL WaitWhileBusy
+ s7 _* J- B& B2 B( J* C
6 T/ {" @; \" a8 G8 ^' G% t) g        // 检查是否出错
       MOV  DX, dwBaseAddress
( i- V: ]! T% N. r/ h, f        ADD  DX, 7
: t: ^+ P; ?( m8 Q; i7 b/ W
       in   AL, DX

6 D- Z- k* R$ `0 \1 f1 Z' U  m        TEST AL, btBit00
) H/ y: A! `+ j) P        JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
+ G7 J. R6 y3 O$ z; L        CALL WaitWhileBusy
7 ]- J7 R4 N8 M5 _7 T! G        CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
* ^, f: L5 c1 \        CALL WaitWhileBusy

8 u7 q( o; r0 T- I" F4 V8 f        // 检查是否还出错
/ T' w, t1 _+ p1 L8 C        MOV  DX, dwBaseAddress
       ADD  DX, 7
       in   AL, DX
1 N- z9 o5 U  F        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
9 w) Y2 e. s. a% h4 _# b
       // 读取数据
9 o* c- T' c+ Q7 k        RetrieveInfo:
; Y9 L$ u) Z& C! ~7 ], O0 Y4 o5 K* q
6 t2 g0 n; ?0 \        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
  Z% L# X  n7 i$ B% Z        MOV  DX, dwBaseAddress
& B" r2 @/ f( s4 K. _        CLD

7 g# ?$ C7 M- ]        REP  INSW
; n# m7 R( v. M
       // 退出Ring0代码
1 q5 S+ m; L0 S        LeaveRing0:
9 p0 F2 i* j" M. g
) k* v& \6 h5 D! j3 @; K        POPAD
       IRETD
( i' I' J9 {" e9 R4 [+ m6 S! M
       // 激活Ring0代码
       EnterRing0:
* ]& Y. P- f: Z1 P, y0 j- E
- t. R3 v, o* G% u  w! Y; b        // 修改中断门
       SIDT FWORD PTR btIDTR1
( ?  Z  H7 D# p( B( Z# r3 [" W! L: o        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
9 ]& A5 G9 W5 B& o, m        CLI
! s! \$ _4 N2 h% J
       // 保存原异常处理例程入口
8 [% O7 j, v4 u, C  \; Q        MOV ECX, DWORD PTR [EAX]
+ t, N/ k/ x' r- X2 I        MOV CX, WORD PTR [EAX-04h]
3 \7 L, X7 {3 G  L        MOV dwOldExceptionHook, ECX
1 ~& |4 K0 q8 U& n/ t. S/ H/ k
1 o! E6 a* M8 K' s0 x        // 指定新入口
# k7 q5 Z6 B+ [% E        LEA EBX, Ring0Proc
. B" `1 |  Y* |% N7 v+ S! o8 C: D        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
3 u$ t6 ]6 U9 |0 S, {        MOV WORD PTR[EAX+02h], BX
1 }" I5 D8 \: \
% B7 ~9 i. ]# [        // 激活Ring0代码
       INT nHookExceptionNo
. O/ z: T! b6 W8 F1 L
5 y0 M3 `. c% C5 a! m        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
) G- g$ _+ N3 }% i( {! L: |, O        STI
   }
1 ?' f+ k" n3 I5 s+ c, o3 j# h' b& S    if(!bIsFirst)
* \( Q  D+ p2 l; J" R/ r  N    {
' K- a$ C4 Q; _+ `3 V7 B. K        bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
" z5 a. ]. r; ?6 _0 `7 u$ P    }
6 [: v! q3 {. J* ^, L% v5 o. a' D: U}
+ M% I) i: b" J, M5 s, u//---------------------------------------------------------------------------
' s0 w5 {9 `% G! T! @8 H* d// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
, F, `% @- j3 q5 P- ]{
9 E6 @# T) M$ c# ~, V3 i* w    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
$ H5 Q1 @, G+ Q8 @6 e}