[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
, u3 u' O' z- `( p- N2 s#include <stdio.h>

#pragma inline
//---------------------------------------------------------------------------
. p4 w1 H: r! N; V2 ]// IDE NT/2000/XP专用变量
4 y' V' g" v1 q  d& M: ?#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
4 V+ T& C/ m% M% q, w. }7 p#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

! _9 A& r' w( l- h  N1 Oconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
+ |9 r2 j0 W: \4 z7 \! }* c: c+ @# Z
const int MAX_IDE_DRIVES = 4;
* R" p8 ^9 f! Y! g! y1 e
) V! ^. s' h8 V4 C& ^4 o/ R! z// SCSI专用变量
* N9 }: x$ @7 V) i% {0 U  Dconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
: p6 b3 {! j) ]$ V  o8 Hconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
0 b# |; v2 X: O$ vconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
$ v4 V' f9 T3 s{
   ULONG HeaderLength;
   UCHAR Signature[8];
1 Z# w& H" m3 K6 k    ULONG Timeout;
% P' \0 j1 c0 O" G    ULONG ControlCode;
: B, H/ b9 p/ Y" u    ULONG ReturnCode;
# M  X1 T( @: a+ ]    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
! e) I5 u8 Q. P% x; B3 W# v" m; I
7 A. D. H( {  ~4 {+ A9 \5 \// 读取的主函数
/ Z) G  \% @. {  D( Q& Jvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
# H: X" A; B' a4 o$ k$ i2 w6 z
// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
3 j7 _# M, z$ b2 \; e( z7 r// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
; Q$ r! F; O1 X1 H% z& Ibool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
& N2 g# P/ v6 u% t) Xvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
+ X( m, S( D8 ?% ?0 _  ~: k        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
* N+ a0 J2 c3 @//---------------------------------------------------------------------------
0 @" s: [% }9 ^4 H. Y// ReadPhysicalDrive
( n2 b$ x: b1 G5 X% {9 cvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
( M) f# J8 d; ^% E    switch(Win32Platform)
  E+ f9 n' u7 g2 c% ^    {
       case VER_PLATFORM_WIN32_WINDOWS:
+ N# k/ g6 F' v3 q            ReadPhysicalDriveOnW9X(pSerList, pModeList);
4 d- B/ ^9 O& \3 l+ b* p            break;
       case VER_PLATFORM_WIN32_NT:
* c  E8 @& g) C' P0 n& }3 P# H            ReadPhysicalDriveOnNT(pSerList, pModeList);
3 r/ ]+ d) ^  g8 |: g/ c+ k            break;
       default:
* l0 o% I( e  {- J" Q! k: s            break;
   }
4 j0 }3 q7 n7 c$ M}
& H% T. v& p3 ]//---------------------------------------------------------------------------
! i! j- g& E4 d7 N& P// ConvertToString
( w% \0 o- u, V3 b/ Z6 e/ @: Y" Tchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
: _" {) x7 k5 B/ }- k+ D/ q{
& S: E  O& Y7 j2 ]    static char szResBuf[1024];
. {8 L% [( n8 b- V' E    int nIndex = 0;
   int nPosition = 0;
" E% A! r7 l/ K5 r9 K
   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
% G. J  B& J5 s        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
: \4 ^' E, R9 E5 L0 b9 K% L        nPosition++;
9 U+ @! Q8 ]- I' R. d5 p
, c5 C% b. C5 y: R; g3 W2 c        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

" J1 c  M) @; z" R6 l    // End the string
& j  P0 ^& E; t4 v! p    szResBuf[nPosition] = '\0';

8 D9 v" X& a1 r- @% G7 E    // Cut off the trailing blanks
" [- {! K# }& }6 J* j0 i! D    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

3 P5 K+ l" P8 N$ ?1 ^    return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
3 Y; D- E+ P8 P//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
: p2 R  b: S  ?7 F! i- T' R{
   // 输出参数
  v4 O! w5 @) {& z1 V# N    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
6 R2 t! @; R( \+ X" i9 T" T& x        char szDriveName[32];
% m. K* w' p' \7 s5 ]( }5 K# `
' ~% t, B: T; F        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
1 K+ y1 J5 P! v, |* u                        OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

8 y. `0 T, w/ C            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
               continue;
) s/ E$ q$ t# S* c/ o            }

           if(gvopVersionParams.bIDEDeviceMap > 0)
' J: J4 r/ J1 o$ _1 \( R% f            {
               // IDE or ATAPI IDENTIFY cmd
* H$ L+ [3 r4 _, G5 M                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
  @$ q0 N3 S' W' a4 j/ ~                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
% d' P. m; d8 I* h9 M& w  F                // otherwise use the IDE_ATA_IDENTIFY command
+ T2 Q" Z& P" C5 O# i  Q                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
9 N+ O4 b6 E+ W/ |                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
- G6 ^- S0 h" T                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

: U! h( A8 G6 K0 V! g, ~7 x                if(DoIdentify(hPhysicalDriveIOCTL,
' M0 A' r3 `: r( C7 y4 |5 D; S  ]                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
                   DWORD dwDiskData[256];
0 U. a  N, ~  _                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
' O7 ^* R% D$ h3 f" J# H+ Y                    char szSerialNumber[21];
                   char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
3 z6 W: k/ g+ D8 d1 l6 o                    for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
3 H% a  D, ~: c/ {3 t% g0 `7 b                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
$ b+ m, y7 Y; @: Q% t                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
3 O2 C) s/ e8 x) ]3 f                    pModeList->Add(szModelNumber);
, q  N  S2 n/ R2 `( C8 l& h                }
+ a4 w) R6 n4 Z/ D, J            }
  E! X" R6 d$ S- J$ ]+ K            CloseHandle (hPhysicalDriveIOCTL);
       }
% S) k0 X* ?' U/ u    }
}
+ _) N8 Q: m, N) u. o. _: }# Z//---------------------------------------------------------------------------
// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
/ v; h) B2 L" |) l7 Q  F( }, {0 a              PDWORD pdwBytesReturned)
8 X  `6 ~0 i  e, X* T& g5 O8 Z, F{
& K+ E' ]: e4 f7 X$ c  _" ?) q    // Set up data structures for IDENTIFY command.
5 \0 y8 V8 D9 o2 h$ {% Q# `    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
) d" E& w' J6 ]0 O. K- L2 f    pSCIP->irDriveRegs.bSectorNumberReg = 1;
' G. Z- h7 w% N% |) d; q( x; y# D+ n    pSCIP->irDriveRegs.bCylLowReg  = 0;
9 y  P6 `: \4 q- ~' w    pSCIP->irDriveRegs.bCylHighReg = 0;
0 l& k, J7 U) P: l. I1 Y- Z: R
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
" }0 Y; Y7 o9 a& H    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
1 @) d4 l$ a8 Q' c. w4 }    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

! m: \& Z1 j2 _+ Q9 |: o' Z    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
5 g/ q7 w: `4 q' ~- J+ P           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
" r+ a" _3 N- x( \, G, F           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
* R6 d3 E& i7 r, C, O9 f" b  L7 m- q}
! D7 B! E; P+ ~4 s/ ~. h7 [2 _( D//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
+ Z$ y0 M# Q/ K, e8 p  }void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
  m2 d, y( C' x. w{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

) {- Y, X" d7 y) i+ g3 A    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
9 v0 Z& \7 t* Q    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
1 m( Q1 I7 Y2 v6 D. H" C8 Y    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
& u- Q" s! G/ F* D    {
( C2 E( y4 T, i+ Q        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;
9 c2 s# e) }! V
& ^7 q  u3 S4 C9 ?' O  g, t        switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
) h2 u7 f- p- t. ~& o3 w: u) k            case 2: dwBaseAddress = 0x01E8; break;
1 v; F: `* `/ l2 a$ b: |! }, h! E/ M0 P            case 3: dwBaseAddress = 0x0168; break;
       }

2 S1 i# s3 }* `) h" H" H4 x        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

0 x7 k  N# T$ [7 `7 o        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
8 o) p5 c3 h) T! V6 q. q                bIsIDEExist, IsDiskExist, wOutData);
! k9 U. S4 r" ^( r    }

   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
( l7 y7 i, l2 R+ o! i; T9 K3 h    {
0 k- c( V2 b, w0 O$ r5 |2 @! H0 C) e        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
2 H- {2 C7 g+ s: \        bool bIsIDEExist;
  @) a- |/ U! `7 r        bool bIsDiskExist;
       switch(nDrive / 2)
# x& Z: \* |9 A4 U        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
! C3 o( L' o$ j, ^& c' M' c            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
! K# q9 U9 _. O- X; s& ?' J0 z( E2 m        }
0 W; l& O( e  L+ D( U( f5 |1 G
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
5 @* E: \- m% W8 h- j/ u
  l- m6 C0 ]) C        // 进入Ring0
- c4 T, a# L4 l        bIsIDEExist  = false;
- U( ~( U. ?- Q1 w# \# g        bIsDiskExist = false;
" A% _) J; O9 p2 C/ Y0 e        ZeroMemory(wOutData, sizeof(wOutData));
, s" p: k: Z, d
1 @& N2 y# v: e3 P2 c; b        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
1 Z* t& n# O% C; g2 |& C                bIsIDEExist, bIsDiskExist, wOutData);
" b/ V5 F' ?/ ^
       if(bIsIDEExist && bIsDiskExist)
! k7 ]; _$ X9 x0 t; J        {
           DWORD dwDiskData[256];
           char  szSerialNumber[21];
           char  szModelNumber[41];

5 I& L4 g4 n& C+ F( k. A            for(int k=0; k < 256; k++)
" S- `) E6 k3 o. x! f) y- a                dwDiskData[k] = wOutData[k];

( Q% T+ `2 j( g            // 取系列号
5 S) f2 b- i$ |1 Z$ Z. r* ~8 ~+ o1 Q            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

7 Y1 o0 X3 H0 o' B            // 取模型号
4 j1 w  a% {0 ]( n1 u* o5 G) S! K            ZeroMemory(szModelNumber, sizeof(szModelNumber));
8 h8 X; _6 `  R/ T/ f            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

. l" V' E) O5 i" C3 ?, E            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
# j( w4 V3 H& W- @" ^        }
/ }4 y) z" E8 K8 t. O    }
# |/ d1 ]  e) E9 V) u    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
7 j: {! _. _1 Y}
//---------------------------------------------------------------------------
. g8 H, o& ?% ?' A' _// ReadPhysicalDriveOnW9X_Ring0()
, N: e/ T5 D5 A9 q. F! Y: t; P//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
1 h- C& C, b8 \% c  R5 g' H; ^3 e{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
6 h" r- U  t+ Y$ j6 g: }    const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
  X5 h1 h" H. C8 Z0 }5 \
( W, X/ _, Y, `    BYTE  btIsFirst = (BYTE)bIsFirst;
% i4 }  f" ?( K4 j1 {. d
   const BYTE btBit00 = 0x01;
. e( L" W- o' I    // const BYTE btBit02 = 0x04;
; A% b/ e0 C: N/ ?# r    const BYTE btBit06 = 0x40;
. [* {+ ?3 s. Q, \& N    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
( r/ K8 H# p7 E. ^) _    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
  L4 Q! e0 u8 P) S( V& |
   __asm
   {
; \$ `8 Y$ L2 y# F' ^# Y9 ~6 b        // 必须先执行这条语句
! t; A% I/ j2 C1 |" b) ?% F        JMP EnterRing0
+ U! S7 N8 o) L; z) b5 H* y" A1 X
       // 定义过程
       // 等待IDE设备直到其不为忙为止
0 K4 I0 C3 L- t        WaitWhileBusy proc
+ `4 C5 o8 F& d3 o1 `& H
* R+ q1 F7 T  r( [        MOV  EBX, 100000
       MOV  DX, dwBaseAddress
5 _, b- q5 q' I        ADD  DX, 7

       LoopWhileBusy:

4 J9 U6 Z& A7 x, o        DEC  EBX
& I' e3 D8 r0 Z% Q1 M# s        CMP  EBX, 0
# I9 Z6 E1 [* r4 ?, |        JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
7 O( x+ v: C' G- v3 E, y; o        JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
       Timeout:
       JMP  LeaveRing0
       DriveReady:
, l/ o- a8 G' _8 ?8 n+ H( }        RET
4 Q5 w5 f1 M9 F7 I# r        ENDP   // End of WaitWhileBusy Procedure
1 n: S0 [8 U. D6 K* X! |
       // 设置主盘和从盘标志
       SelectDevice proc
8 R( V* ]/ a- A0 O% E. |
9 v' J$ ~% j! Y: F2 x        MOV  DX, dwBaseAddress
" ?+ @# e7 S5 {; s, p8 F# H        ADD  DX, 6
       MOV  AL, btMasterSlave
/ ~, c, h% _% v4 d& f+ c
       out  DX, AL
5 u. h! A; H0 U% V; `# H) y        RET

       ENDP  // End of SelectDevice Procedure
; j( f  t: c: B% o7 o* w
       // 向IDE设备发送存取指令
       SendCmd proc

  M5 L$ a/ d4 ?+ o+ B5 c        MOV DX, dwBaseAddress
       ADD DX, 7
7 k% r0 t4 a2 N2 G        MOV AL, BL // BL是主从盘标识，在过程外设置
, V2 O- r; ]: `9 d  x8 i  F) Q        out DX, AL
! D0 B8 [7 K/ d' s        RET
       ENDP  // End of SendCmd Procedure
/ k- D6 r; q, }8 i6 F9 N$ h7 e
       // Ring0代码
       Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
6 `' U! [: m& ?/ h        ADD DX, 7
       in  AL,DX
# ^0 P7 y# M2 b, y7 j  R. B
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
       CMP AL, 0x7F
1 b- a5 c, r  k9 i) m0 U        JZ  LeaveRing0
& [" M4 O& @. d9 J+ l5 o! n4 o; ^
       // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

/ ~( S2 O& D# Y7 {' m        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
' }+ U. F4 h( L) F1 M. N  w        CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
" Y* o! k# ~4 O5 H, v$ n        CMP  btIsFirst, 1
       JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

) \: ?( Q7 |3 |        // AL的值等于cBit06时，不存在驱动器，直接返回
8 F6 U! f6 Z, E  ]. g. Z) d* D  e        TEST AL, btBit06
       JZ   LeaveRing0

' c' T- x5 E5 t5 h: q# w        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
5 R! L2 O5 g" U
5 e- }' _7 L/ b9 V7 D! P        // 发送存取端口命令
' h" w; d9 N" u6 L        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
( b1 N. k/ H6 ?) e        CALL WaitWhileBusy
/ S( s; I* x4 X        CALL SelectDevice    // 设置主从盘标识
4 z! K3 t  [3 t5 i" K8 n2 I, ]8 X' b        MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
- I0 q/ E% V" I) [" J- i# O        CALL WaitWhileBusy
& Z1 T) I( l5 `: e4 z4 j4 ]1 l
       // 检查是否出错
8 X6 N# E  i6 Z( f/ Z! M$ F/ f4 T        MOV  DX, dwBaseAddress
9 e8 T2 b* b" `' Q        ADD  DX, 7
5 o' s; T' \4 L0 |' y6 G
$ h+ |0 g+ q8 J3 c8 q0 J0 m. p* o  S        in   AL, DX
' ^7 r  u/ U4 z; y( N6 b
% @5 p8 W4 w9 _$ j2 |        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
) _$ c  V! E3 w7 c$ g        CALL SendCmd
5 h" Z/ K2 b* A$ q        CALL WaitWhileBusy
# k, n: m9 m9 e; w+ }# D
       // 检查是否还出错
  Q* J0 H& j9 N3 Q; L% r4 _        MOV  DX, dwBaseAddress
% M5 B  T7 V# \        ADD  DX, 7
       in   AL, DX
  \4 m8 l2 H! t& @0 ]        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
6 {' H1 }+ c1 g+ t: ~# x+ b7 d        JMP  LeaveRing0     // 如果还是出错，直接返回

       // 读取数据
% k! m6 k" J# z& o        RetrieveInfo:

' k3 i. A7 c- S8 d6 O+ v        LEA  EDI, wOutDataBuf
9 Q5 \  g$ I1 K, i+ x, @2 o1 f4 A2 e        MOV  ECX, 256
       MOV  DX, dwBaseAddress
; u+ }7 A1 R" R' M# A4 C7 r        CLD
5 _: n( H- z0 H
8 E+ L2 T) @9 v" R2 e1 T$ a/ \        REP  INSW
' ]' z8 ]2 u* m  M( r# T
       // 退出Ring0代码
       LeaveRing0:
% n7 |- }; C! c- B
- V6 S5 f. L7 A% ^! n6 e        POPAD
1 G5 `4 J- K" y' k  t2 P/ \5 y: {        IRETD

. F7 S% _' V! F5 `! A/ n4 v( k4 R        // 激活Ring0代码
; i5 r. F* O/ l        EnterRing0:
; c& t3 V0 ?  M: M( X" ~5 ~7 v
) h3 ]% [; M: f9 s8 Y) M, `9 c6 x2 C2 V        // 修改中断门
9 O1 D4 j2 h. D6 U        SIDT FWORD PTR btIDTR1
' d% q4 A, L% Y: y; i        MOV EAX, DWORD PTR btIDTR1 + 02h
6 ~! @1 U* M0 F0 R- G        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
: M+ K/ z( Q; N/ I
       // 保存原异常处理例程入口
! |0 m0 {- _( j* W# R8 i5 t        MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
% E: [, s, P$ P1 `        MOV dwOldExceptionHook, ECX
3 g0 s6 V$ A2 ^4 N" s6 f- A
6 w' f( i5 S* L6 x7 Y! _        // 指定新入口
3 K! V8 W7 e; I" @) d! f  F# L        LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
. J0 h: W$ A: u
       // 激活Ring0代码
7 |9 Q  b. \5 f: y" v( X% c        INT nHookExceptionNo

       // 复原入口
  g1 a4 u% C4 o8 b& ~& N        MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
) _5 d1 b; ]% ?! L% X/ {        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
6 g, y! q0 h, {# \/ B    }
   if(!bIsFirst)
   {
/ Q# G, S$ f& Q4 ~1 S$ s        bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
6 K) e; f) p$ J  b    }
}
) {. |% [; O! G6 {9 p% Q5 P//---------------------------------------------------------------------------
' ]9 M2 u- Q/ |% g6 y: ^// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
4 j% B+ _8 L  R4 K9 {' {# h{
3 G1 p+ t$ ^; F- n/ ]2 w4 F6 \    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}