[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

7 |( X& a6 Z# k% r#pragma inline
9 {- t2 c6 w0 O3 N+ B9 o//---------------------------------------------------------------------------
/ h* n3 J  ^; l0 U' B( |) Q// IDE NT/2000/XP专用变量
9 K" Y$ c: ^# X* I7 S# M4 b#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
& @4 E( V$ O! M5 k
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
6 A6 R7 h- U( J, Q/ aconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
9 |% K* a9 K0 M* H
const int MAX_IDE_DRIVES = 4;
0 F# M6 y9 @4 D+ |. u
// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
& R0 j" O$ [- i! cconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
. G' z7 p( k2 w$ k" ~9 ~# \3 yconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
+ A3 k1 F4 t! g) E
6 Z" w* `  d% Q1 H% Rtypedef struct _SRB_IO_CONTROL
/ R( @" e' G  ~! O/ m{
4 C+ }0 G% Q( }; U4 _# N    ULONG HeaderLength;
/ e6 x( T$ I- i    UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
. u+ ~# Y' m% ]. m4 \: }    ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
! Q" P% N5 [, M9 E" _5 q3 y
) d: x" e: s+ M// 读取的主函数
1 \7 J) }: a2 g5 O6 Wvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
0 U, E7 Z- t) M& d# n8 s
$ R4 R5 [. X0 B3 H. b// 辅助函数
$ }  B* a; H& T6 P: f1 T7 ?char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
# C1 |1 z3 F6 z6 A// NT/2000/XP函数
# C- \0 U6 B/ @' m- L& Lvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
3 p7 W$ i  T% ubool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
, W+ I1 b2 _5 E% m: P        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
9 o* O  G% t) P& Z/ v! U// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
, r: X- ^' g% Z/ q% L5 h8 Fvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
4 B; t" q$ u5 |. ?4 u        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
) G+ Y6 t1 h: z9 F
// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
* P7 A4 g' Q5 k4 Y// ReadPhysicalDrive
- y: z% n+ K# b. gvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
! W+ s% G6 ?" A, A8 P" `) F{
   switch(Win32Platform)
   {
4 A+ w- z7 U) E, k3 X& s& U; l        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
' k( ^  h& \1 ~3 U1 n  `( U! X- L            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
! Q% `" Z" ~# ?& p! q: ]# H* E5 k2 I            break;
1 p/ N0 Z8 c1 F- @1 O: ^; Y    }
}
//---------------------------------------------------------------------------
6 R0 s$ \! D( q// ConvertToString
4 }( ]8 Q; Q) h, s6 X6 u9 schar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
; \  ?% ~2 [+ m# p4 R  i/ e5 q{
4 C2 f/ z% G3 Y    static char szResBuf[1024];
6 u7 T  j0 l% x$ n! i) O    int nIndex = 0;
   int nPosition = 0;

- y4 m  n! ]' [" {4 B    // Each integer has two characters stored in it backwards
& V( `6 Q1 J  h. E) l7 T    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
. V( ^5 w) C- W4 m" h1 C! n        // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

       // Get low BYTE for 2nd character
9 b0 y, b$ A( ?- n: B        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
3 ~% W8 {( o! Z. R9 i: t    }
8 C! L. k* n' ]
   // End the string
( q- ^0 e' r+ x' C    szResBuf[nPosition] = '\0';

   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
}
4 m  o1 y  Y5 ?. |//---------------------------------------------------------------------------
: b" k1 T% u! z" g// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
& R9 j" B) W9 Y$ {: q# x$ |* f// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
' V  F( E* ~+ I# F  q
- X: Z# S) c: G# q, [! p5 ^& K    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
6 C3 g3 o/ e9 ^' H1 S( v5 P  K% w    {
- L: O* n+ V; }# ?: k3 Z        HANDLE hPhysicalDriveIOCTL;
2 Q! V; Q% z) }  f, q  h. Q        char szDriveName[32];

( O7 l# G, s2 j! V0 _, x        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);

3 B6 i5 _3 s6 Z, f1 b3 f        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
+ y  ]8 J' N# b* T3 ?        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
8 O7 H3 c+ ]0 t4 m" \; u
0 Q, N9 _6 g& K" J  N            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
' u( g# Y% X$ W4 t  q, V$ L
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
2 N, m9 x% O  r" p& g# N                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
               continue;
           }
9 M" Q# p! \6 q5 e5 X
1 C% J; V& h/ d' ?            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
. i- R; I8 U8 x% V6 z$ E$ n                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
( a" u% O: e- l# U( L                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
8 V  Q9 ?/ @. Y) E                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
: ?* `& \% B0 Y9 E, {! ?8 D& B                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
9 E! F& ]* _9 e                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
) G6 F$ o7 c- W4 y8 p0 P6 C) N
0 W/ ^9 j, a4 M8 c; Q" t: V                if(DoIdentify(hPhysicalDriveIOCTL,
% N: @  L: a0 l                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
8 m1 u8 P' V( A( O" N/ d% o8 C5 u                {
& r, x$ [2 h6 u# }% S$ r/ R                    DWORD dwDiskData[256];
1 ^+ L, W  n/ ~- V8 V                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
9 M6 q9 o+ |7 Q                    char szModelNumber[41];

) H/ U- m1 B: l3 D) t2 l* }; P                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
  o5 _4 H( m( h3 y9 g  r                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
4 t0 t; e  d4 ?3 b5 S3 v                    pModeList->Add(szModelNumber);
               }
6 x$ n- m: }) I- q/ ^* l            }
           CloseHandle (hPhysicalDriveIOCTL);
       }
8 d7 @& v! u1 e: v) G    }
}
//---------------------------------------------------------------------------
! z- M2 }5 a$ I, t// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
3 `6 Y: J- c+ Q! o0 B' S- L4 @1 B              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
7 V8 d6 h6 G6 d3 b# F- l{
3 w9 q  k- f# C0 a4 A    // Set up data structures for IDENTIFY command.
. c0 R4 V5 r: C) P    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
, T7 e% g/ |7 t7 a4 n4 ?; H( }& `    pSCIP->irDriveRegs.bSectorCountReg  = 1;
0 _7 Q2 x( l* \    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
9 b4 ~7 p( t7 Z+ a    pSCIP->irDriveRegs.bCylHighReg = 0;
9 Y9 d' o$ P/ x( R% r# n
+ C& A/ a6 O% t8 r# p- u. d    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
3 |, ~5 X& G/ }* T
   // The command can either be IDE identify or ATAPI identify.
2 ?  \5 K, |6 @0 z8 i    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
* ~2 u% t. I. T3 e0 w' ^    pSCIP->bDriveNumber = btDriveNum;
6 w. \8 Z, p7 [/ O    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

! r1 Y; ^9 N1 q. l6 ?  e- u    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
' X5 R1 X7 g: b7 _4 {           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
- a$ q- }8 k1 i9 D8 r           pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
% F( H# P* L$ X; }+ E+ F7 N// Windows 95/98/ME 代码
% Z: z& O8 W) y//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
$ ^( x8 U! k: t$ g    WORD wOutData[256];
2 a7 ^  L7 |6 o    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
) }! _' c) g- X
, A% ?- ^3 P5 q3 P/ k    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
" v  m$ k( c& ^6 }/ L, F* o    {
& q* `0 y" C1 @  q" l. ~        WORD dwBaseAddress;
% R* ^. N2 P6 r5 l% a        BYTE btMasterSlave;         // Master Or Slave
+ s5 L% A4 r* C1 S' G% U; g  u        bool bIsIDEExist;
5 d& E2 E0 C* y8 {% m$ z        bool IsDiskExist;
, |! ^5 L# x6 Q4 R/ ]5 ?! ?# s
7 C% ~* n8 D7 |3 F8 B1 i) ?( G        switch(nDrive / 2)
       {
  d  `2 X6 r- m" P2 O$ Y: K            case 0: dwBaseAddress = 0x01F0; break;
! S6 ]  @5 o8 v' {1 w# u( e            case 1: dwBaseAddress = 0x0170; break;
7 S# b4 u% S6 t2 S. n9 O& N            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
5 g. q" a: O5 H( |' L5 w
; \" y) c- I! N        // 进入Ring0
8 n. F# a) _' _        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

1 a' v" g6 r- J. ^    // 开始读取
% Z3 `% X/ e& i2 M    for(int nDrive = 0; nDrive < 8; nDrive++)
6 d4 g# y8 Z! L) C% Y    {
9 O9 Z  `: x6 g" f% w' i$ N( v4 h        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
* J& u9 N. A. s# M  X* Y- O! E        bool bIsIDEExist;
$ d# ~0 W" w+ S. s; I( N+ K7 e        bool bIsDiskExist;
       switch(nDrive / 2)
       {
" F; l2 S# L1 `7 ]. B/ E! K            case 0: dwBaseAddress = 0x01F0; break;
: g$ c- Q: \. Z/ r            case 1: dwBaseAddress = 0x0170; break;
4 `3 A' z( H6 I( s$ W9 b            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
) ~: g- \; H5 h$ W9 {2 L        }

( g: R  Q; X! n        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
4 F1 p0 a( K  Z1 w4 L  C! W
       // 进入Ring0
/ ~( }& [) {- {  l) v) A        bIsIDEExist  = false;
! G9 d7 d. w  Q" ^4 m* r) t        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

. t. z4 `/ y+ G7 `6 p2 {        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
5 K% S$ H+ [/ S% J4 E2 R
       if(bIsIDEExist && bIsDiskExist)
, R( P1 |6 l& ], D6 c        {
: [+ j8 @2 v- N& q+ Q  g0 O# U+ G            DWORD dwDiskData[256];
+ u; r, }5 h2 S% d0 S& T            char  szSerialNumber[21];
- c; V2 R- I! U. N/ @. m            char  szModelNumber[41];
4 _% G: Q' F2 ?1 w, {
0 N( t  h3 [  S( `- {+ C            for(int k=0; k < 256; k++)
2 h- {( ^( \" ?+ K. Q& b, F                dwDiskData[k] = wOutData[k];

% Y# j, i2 g4 M& J" K1 G            // 取系列号
5 x! J+ n) q: Y2 `; _            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
+ o0 c0 p' u' _& H" q            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
4 L& x$ h* ?2 L
           // 取模型号
! a' }* j: V) z* o) h- {            ZeroMemory(szModelNumber, sizeof(szModelNumber));
" j$ Z% N/ N! i" f8 R            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
$ N# a3 a" C' U0 `' k
           pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
& Y0 p# I/ [5 O1 T% q4 v        }
7 n) O* p9 Q- J8 u, ]3 H% m, f, {    }
* |: D" \5 n6 b    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
) y9 @( w! ]( T}
//---------------------------------------------------------------------------
( I# a! p! f. g/ @// ReadPhysicalDriveOnW9X_Ring0()
* Y: |' E. s% K//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
6 U5 |4 g# g8 q( A0 \//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
, z& ]7 R: ]: a' O, {/ k{
" a1 Q% B9 X5 q0 P  V2 I! O, q    BYTE  btIDTR1[6];
0 @* v7 ]( m7 L& P' {  r- W8 s# v    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;

. W8 S( J  {% X6 D    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
2 P3 i6 t6 F5 ?
   BYTE  btIsFirst = (BYTE)bIsFirst;
# a/ E" e8 U6 n5 r$ W
  q1 K4 X+ _& }  R, _0 x  L    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
0 `; @; U# _6 z3 F* F1 @    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
2 t% l0 p- Q8 c7 y1 p8 L    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
8 K$ U9 C# d9 y8 |  w! T3 w    const BYTE btAtapiCmd = 0xA1;
9 r# O8 I% f* n+ [/ q2 n
3 U) c$ A0 J9 R* I7 s    __asm
   {
. w! |# R$ M. D        // 必须先执行这条语句
       JMP EnterRing0

2 C% F, F& F# O$ N% B  e+ |# G        // 定义过程
4 |/ O1 B( l5 Y. b3 I        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

" l0 ^& H3 w  ]4 i) V) y% t        MOV  EBX, 100000
, j0 Q* c) R( g! E        MOV  DX, dwBaseAddress
       ADD  DX, 7

       LoopWhileBusy:
% T' ?5 g1 ]- ?: d* g9 S6 g
       DEC  EBX
       CMP  EBX, 0
& r& p  k$ E; \/ i* B        JZ   Timeout
       in   AL, DX
* T; m. l0 [% @3 Y        TEST AL, btBusy
& {4 |3 m. y/ T+ c3 h        JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
       Timeout:
       JMP  LeaveRing0
       DriveReady:
0 i2 _9 q* x" ^7 o        RET
  ]; Y+ {+ N3 n: l6 n5 X' b$ X        ENDP   // End of WaitWhileBusy Procedure
, o6 ?+ M& }' l0 r
       // 设置主盘和从盘标志
       SelectDevice proc
, I  x; X- |& z8 e
       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave

       out  DX, AL
       RET

+ q5 m  e3 h3 _5 S        ENDP  // End of SelectDevice Procedure
, H( k7 `  ^1 N6 a4 Y
       // 向IDE设备发送存取指令
       SendCmd proc

) p) @  Z( A  x! R5 {        MOV DX, dwBaseAddress
1 H* w  U3 j' \, `6 q/ U. @! M        ADD DX, 7
% q& M; `1 ]" k  @% ~' v2 i1 [        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
6 ^- a* w+ r; R' e5 J1 K' e; `        RET
       ENDP  // End of SendCmd Procedure
. W. O. t3 t7 S/ E2 Y# M
       // Ring0代码
       Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
       ADD DX, 7
, x* U6 h! d1 @        in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
1 {8 W4 G: S3 Q' f        CMP AL, 0x7F
       JZ  LeaveRing0

' k1 V4 V9 j) ]$ Q. h        // 设置IDE设备存在标志
9 k$ T( k) Z& Q' ?  U5 v9 L8 w+ E        MOV btIsIDEExist, 1
' X' \2 {; [2 {) Q
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
4 e; a2 S. R* U2 ]6 s. w        CALL WaitWhileBusy
       CALL SelectDevice

4 ]3 K: t2 y, d7 z, d9 @        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0

3 s$ T. G: g* r3 A5 m9 J9 R6 z$ Y        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
# H# u# T' g0 O! Q! d        TEST AL, btBit06
* p; M* I' d5 c        JZ   LeaveRing0

       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
& Y) S- i# Y3 O4 h, G% O* u        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
0 T) ~, C& n4 u7 c# w9 k5 q        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
$ V, I9 n% x8 t7 @* O1 t        MOV  BL, btAtaCmd      // 发送读取命令
/ o; g1 X+ x' q) W. f# r2 g+ @& U        CALL SendCmd
7 S4 p& `& x0 s. N0 S* {; t4 X3 b        CALL WaitWhileBusy
5 s, g8 i$ V3 t/ |6 _
       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
0 E6 J9 N" E3 }0 m; Y
; n3 W& w4 J) {        in   AL, DX
& T/ _# h. ?9 U/ f9 ~
! Z8 X: b) ?8 T& l) o  U* l7 I        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
4 A' V, D' n" o9 S0 w! k  i
3 M5 W5 S: H6 E- O! z        // 如果出错，则进一步尝试使用ATAPI设备命令
7 M1 Y+ j- z( x' U        CALL WaitWhileBusy
! E0 g8 \$ E% _2 X, U# b' a        CALL SelectDevice
& `$ Z) L) A0 q* B8 O" R4 _        MOV  BL, btAtapiCmd
! z! ^6 Q  c0 o5 f3 e        CALL SendCmd
       CALL WaitWhileBusy
* o3 k# A( b! w
       // 检查是否还出错
       MOV  DX, dwBaseAddress
/ H& g6 h0 y/ o2 x1 W0 ~        ADD  DX, 7
0 ]& F& K! G/ O! ~+ g. P( Y3 k        in   AL, DX
& z7 l5 {4 H7 F3 x; f# w' A) E        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
4 \! e0 A8 S- y" h        JMP  LeaveRing0     // 如果还是出错，直接返回
5 y7 K9 d3 @) g1 f
# F0 Y  {) P7 C/ p& N( r        // 读取数据
       RetrieveInfo:
9 S2 b+ i7 a) r  M: y5 @* d
: t. }2 R! X# l% Y% W9 g. R- B        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
- R( |; r  }. ]( M+ E        MOV  DX, dwBaseAddress
       CLD
4 A5 u( I1 A  u! Z1 z, Q7 i! ?
. j. r+ ?* N' e' o        REP  INSW
$ ~& a' |# Y: R( Z9 [
       // 退出Ring0代码
, S; L+ ?/ C, E! T! `- ~- z$ x8 d        LeaveRing0:
/ }2 @  j0 X* s; d7 p
! L/ z' [5 g3 ?; s        POPAD
       IRETD
9 x0 I1 d( n2 C4 b7 {8 G- L
       // 激活Ring0代码
       EnterRing0:

7 Q- A7 c1 f% D3 V        // 修改中断门
       SIDT FWORD PTR btIDTR1
) U' f" c) O6 H& x. M        MOV EAX, DWORD PTR btIDTR1 + 02h
% j+ [$ _: e! \+ E7 |) ^  Q        ADD EAX, nHookExceptionNo * 08h + 04h
  D, ~& @& `1 `) K. u4 r        CLI

/ `' v4 S% m  X% I        // 保存原异常处理例程入口
- k& F: r; t  e: K* H6 T        MOV ECX, DWORD PTR [EAX]
2 o# w9 W, q( h        MOV CX, WORD PTR [EAX-04h]
+ I. T0 x+ Y! V, l" P( ?, v5 n        MOV dwOldExceptionHook, ECX
$ W; Z- p- j" ^: [/ v& ~
       // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
" Y' B+ c$ }% r& D" x* n/ t        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

4 M5 i0 `* B3 [2 r, Z( N        // 激活Ring0代码
       INT nHookExceptionNo
( g/ ?( k; ~4 {. a4 W
       // 复原入口
       MOV ECX,dwOldExceptionHook
% c( R- W3 x& T" d# }        MOV WORD PTR[EAX-04h], CX
8 O) o3 `" A; U        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
3 h% p) b$ M( U) A- M- {8 o        STI
   }
   if(!bIsFirst)
   {
       bIsIDEExist  = (bool)btIsIDEExist;
7 y" B- K; F% k5 w. s4 a        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
5 n9 K2 `% `# g/ j. B8 n! {//---------------------------------------------------------------------------
- s1 ]. D& f- ^2 d" ~. c* x// 调用方法：
5 I( [' z+ V4 vvoid __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
, I& U. o0 V* z/ e}