[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
% k& d: C8 P- X! N! k#include <stdio.h>
+ A4 C0 {) L: }. K
6 o# f  \/ S1 N! @, o3 C#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
* `% `9 }8 L. H( J1 `" \#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
2 z5 q9 j( U6 g" {# A* ]) ]
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
/ @7 o6 q& s7 [const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

# ]( q% j+ k! W* s! p8 fconst int MAX_IDE_DRIVES = 4;
, b3 Z8 K- l% i
2 V1 j: y( B( {. }% q8 M: O2 E- Z! n// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
- G8 M6 g% B' T+ j( a4 R+ i) lconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
) z9 x% V& o: Y) y, }const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
+ u8 s8 a7 `' W4 x6 z. G$ A7 a( {const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
7 ^" q0 \, K  U& P
, s+ f4 F; T- H; q3 c4 m( g  Z6 ctypedef struct _SRB_IO_CONTROL
4 e9 S# }' c3 v0 T' O' ^7 Y+ t{
   ULONG HeaderLength;
/ y' j2 S# k) ?7 H1 C8 A: i    UCHAR Signature[8];
7 n8 b+ A, ~1 A* F  h6 C; G4 x    ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
   ULONG Length;
6 i8 {4 b! a# y. a! F3 i+ G}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
/ O! @; i1 n" G6 w
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

// 辅助函数
% P$ j2 F2 K$ `) H' i, i: Ochar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
' Z. e, J. m+ d$ ^% \// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
' R2 N; d# ^. l6 E& d  Abool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
) o; C% f1 G  T) x        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

1 V7 N' W" V: [2 f2 s// SCSI读取函数(for NT/2000/XP)
2 e8 j- i+ l- j4 F" q- @String __fastcall ReadIDEDriveAsScsiDriveOnNT();
4 @: R* V+ o3 `4 v, S//---------------------------------------------------------------------------
// ReadPhysicalDrive
' R( R; E- B) a! L  Xvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
+ C# d& C2 b8 c: F    switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
0 T# P5 B- u% I( g' N1 f5 w        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
7 ~1 v; w. c, }, x            break;
       default:
6 e/ j1 F: L" ]  e( e$ p7 h" i7 v            break;
: _! K4 D& r9 P5 \6 H6 v; Y# k, T6 y+ j    }
}
//---------------------------------------------------------------------------
// ConvertToString
5 M( t6 T* Z4 |3 k% P. j; Lchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
% y+ \% S8 x! H" w9 S1 V{
   static char szResBuf[1024];
5 F+ o3 r8 ~+ P7 ]    int nIndex = 0;
7 I9 K' k6 H) d& {# C    int nPosition = 0;

   // Each integer has two characters stored in it backwards
* t% C: l' l& q# [" C9 }    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
# B) @. G) n' n+ O% M+ e    {
2 @( r7 F! o/ y7 D/ c+ C4 N" |        // Get high BYTE for 1st character
+ b7 j1 [" e8 E, p' L: A        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
% U1 i4 |! u4 _, g7 I        nPosition++;
, w* b" S# C9 e8 T- g' q- ^- L
' e4 a1 T/ `% B8 n5 k4 b7 a        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
/ b# o& |" y' P7 `        nPosition++;
; L7 G( F) n% S+ [; E    }

# a2 e: r% M3 q: V    // End the string
& B* W  a0 v( ?" z+ n    szResBuf[nPosition] = '\0';
  ]/ p/ a/ M# v' c0 I6 I3 o  T( I
: h3 J8 F9 m2 Q    // Cut off the trailing blanks
# k* F( `+ q$ u: l    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
$ N8 a3 `$ ^% w, n6 i}
//---------------------------------------------------------------------------
4 `  p8 }6 y6 W. q4 g, t6 V// Winndows NT4/2000/XP 代码
. f- }. Z- e4 Q5 {( s9 }//---------------------------------------------------------------------------
2 P5 \, M. o  W) `' s// ReadPhysicalDriveOnNT
. d# ]. e1 L' J# ]void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
' {. w& k5 N# B+ o& R0 T& `8 Z9 E{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
5 X+ d5 l( z% _& v2 h5 u    {
6 i$ U4 U5 _# @. C        HANDLE hPhysicalDriveIOCTL;
' P7 A- H  d3 T; `& y        char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
! @, v# H" F" r# k3 [  w# ]                        OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
; W3 \$ N; r$ U4 E& Y        {
. T- I/ N6 J: W' ~. f- i" M5 q            DWORD dwBytesReturned = 0;
7 u: B# B1 T- G- s! S* r            GETVERSIONOUTPARAMS gvopVersionParams;

2 ?1 P+ S* I) [2 t            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
" v/ I7 M3 @/ {& c; S# x
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
/ I  F- |( Q7 x8 p/ v# }                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
, F: f! _$ O/ D7 L5 I6 K5 M8 d            {
9 A+ Q/ t( r1 p- \                continue;
           }
" M% `! W5 r# D$ D2 P$ q8 E5 ]
  I+ ]* r) z% O" J' Q            if(gvopVersionParams.bIDEDeviceMap > 0)
" A2 W' R' A4 J$ Q" _: ], q            {
/ C1 |: l! }) B& u                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
* B# t9 b$ u  Y                SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
3 q) X2 }# }6 v7 f, O) K( u                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
+ F% p8 O2 b# [8 }, k                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
5 V& Y. L0 L, p: o% d" c                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
$ M9 h* w: D( e' j+ v& C                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

               if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
: Y, u2 H, x9 }: G8 }  M                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
$ V- C$ v' b" a$ f5 r( }" b                {
  m$ u  D/ X, ?* j: j: X                    DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
  b4 ?0 b. c6 T                    char szSerialNumber[21];
4 v3 c1 P0 n& Z                    char szModelNumber[41];
. ]' l: e2 t# @
% q# {2 e8 v6 B, ?. w1 A                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
$ V7 p8 U. ]" u9 P- r" t                    for(int i=0; i < 256; i++)
4 T7 o2 p9 h* a/ o                        dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
+ E1 ?, s+ T6 q% d+ f                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
2 @- ]$ n* l+ q7 i                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
* A% B1 {4 q6 h" J4 C
: @% F; J$ n3 L1 A1 L                    pSerList->Add(szSerialNumber);
$ K+ I! q7 a8 K% s3 I3 X# |                    pModeList->Add(szModelNumber);
; S+ F$ ?. h+ L' E7 q: A( T                }
  X, ]& w6 w6 y6 ]( h! g* K            }
( M! I: _  u3 e2 n; M$ L            CloseHandle (hPhysicalDriveIOCTL);
       }
2 C3 c( S5 g7 K" ?4 d    }
. b& y+ P% |" Q3 C3 o}
, {6 a, y5 a. v2 Q7 _2 m//---------------------------------------------------------------------------
+ J' q8 a% \1 f: u// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
- ^; a, Q, o; h% b! ?; C+ T              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
4 R8 e- N" t; k5 u# ]7 R              PDWORD pdwBytesReturned)
2 K1 w6 U0 h  O% `5 b* z& i4 r# V, H{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
# _3 D; k4 |" Q5 H/ [, D% m    pSCIP->irDriveRegs.bSectorCountReg  = 1;
8 w$ `6 r- t* [" P7 l  @- v    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
' U9 ^  o/ b9 W" ^
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
' T% G! R2 D& t5 m
   // The command can either be IDE identify or ATAPI identify.
: U  r9 `& ^4 M) x9 e2 ~    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
* {: c- Q, H+ f. m; \5 K5 Q' ^! e    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
  L- ]# a: A% E# ?           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
3 }) V" S3 b+ K% f& B           (LPVOID)pSCOP,
% j) x% O7 d0 d+ O. t8 D           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
2 s0 p8 f* t/ Q, R' r           pdwBytesReturned, NULL);
) |- {/ [1 y4 V7 }3 p1 s}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
. D: r/ b$ A0 e* _1 n5 \1 B//---------------------------------------------------------------------------
2 b) P7 T. n. {8 M9 p- Z# y* q! K0 T// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
" W1 S9 i; g. m! L$ Q8 c; a    WORD wOutData[256];
+ p/ b- e4 _# d) o    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
/ g/ }4 t9 g+ \
+ C- o* F8 W$ J# w. [+ s    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
+ X! M0 H! j. ^$ q! J    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
/ q* k$ F- n9 J9 j; w; f, s    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
4 |4 V, k9 |; E- s# O. G, U    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
8 v- i& D* c( z% K% k        bool bIsIDEExist;
+ }$ s9 W7 [! o( a3 P$ c        bool IsDiskExist;
+ i' N9 \/ i0 R; y; c4 ?
       switch(nDrive / 2)
0 e  l  i1 D- m# G        {
, E; d+ c" m0 {4 `1 I' ]: ~0 H0 H            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
* T0 W7 X2 i* i0 `0 l            case 3: dwBaseAddress = 0x0168; break;
5 o0 Y- I5 B1 k1 \) Q- p        }
9 y( ]- _6 X8 L" e( k) F# C
& R, q: u' ]$ G; a# t! |        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
$ j" Y* w' }0 r: d7 E        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
/ C; a) k4 Q; v' I) E4 t    }

' {  [' D. C  W+ Q    // 开始读取
; M8 k) _' p2 w  R    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
: n- @+ B$ ^8 \0 n        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
- O9 X7 ]5 z5 Y6 v& E& B. P        bool bIsDiskExist;
       switch(nDrive / 2)
8 O8 c; m2 d7 p) M' k        {
( a3 j9 C: a8 |0 i) y& s8 ~/ A            case 0: dwBaseAddress = 0x01F0; break;
$ T. o* [: M& X3 }9 r. {            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
2 }' R$ A2 [! k, S8 H4 b. C/ N        }
" t  v7 b' W# W  O
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
2 R9 l3 ~$ H# ?) L( [7 V
       // 进入Ring0
+ X% c3 y4 b4 u$ b/ W        bIsIDEExist  = false;
1 T8 `, R% `; I6 X5 \. x        bIsDiskExist = false;
; F% b: P2 H  |; k6 y  ]! @        ZeroMemory(wOutData, sizeof(wOutData));
: g) r7 c/ M4 V. h0 k0 h; g- A
: c6 r0 {0 y& _0 V$ B  o6 Y        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
; C% V$ j& y% \( B" H                bIsIDEExist, bIsDiskExist, wOutData);

: S, `. N; [( g% |        if(bIsIDEExist && bIsDiskExist)
5 T( s# P' |2 L1 o* a        {
           DWORD dwDiskData[256];
8 y7 p& L$ {  k& g! I            char  szSerialNumber[21];
           char  szModelNumber[41];
, X3 h1 n# }' S, r  w+ v
           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

           // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
/ A! q' K; S3 f- f% j" \1 G
* Y4 z3 a$ n8 X7 m  G- c* o+ w' N            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
' P! j+ B1 U# R7 T* V# ?2 ^% d            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
' H1 X5 f0 g* N  i$ o
1 G$ l( B+ Y& t/ ]9 C/ \& r            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
0 G7 D% {- ?6 p2 S$ m# ~# j7 N" f        }
; a3 T( }- e! |: A' c. |6 l$ m* t    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
; F5 L5 J7 J9 R4 I; w: Q}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
: T5 T% _1 w1 p# D//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
9 x. P" }& {9 b& {//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
, n, M. Q9 M" d8 \        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
5 F% s2 N- m" }) ]! r. X{
7 i0 a# U9 d2 k6 F    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
; y, O' F& g& I2 H) ~
' x$ d3 g$ D1 P8 ~: N9 o    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
9 U! Z% l' L. J$ t5 c4 x; W% o    WORD  wOutDataBuf[256];
8 n1 d9 `% J4 a% ?
' G- D8 K! u4 J7 i! U: \    BYTE  btIsFirst = (BYTE)bIsFirst;
+ e) }0 f" W: ^6 J1 t! _/ P
3 A9 k9 A+ t: p5 x/ Y    const BYTE btBit00 = 0x01;
" q6 W: i3 [: h& O3 I  a+ j& A    // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
, t: g: T/ N  q& n0 g    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

4 h4 }; h! `/ c    __asm
   {
       // 必须先执行这条语句
8 |' L) j/ Y( Y# Q; @" }  z- S        JMP EnterRing0

       // 定义过程
       // 等待IDE设备直到其不为忙为止
" S2 m" {' ]! P5 ^: I0 G: G) n        WaitWhileBusy proc

       MOV  EBX, 100000
       MOV  DX, dwBaseAddress
2 b: f8 I1 I' H5 k6 i        ADD  DX, 7

       LoopWhileBusy:

       DEC  EBX
% U% g9 a. ]1 T1 r$ t        CMP  EBX, 0
* v3 z( X6 B1 h: z  k( V8 n7 T, L        JZ   Timeout
       in   AL, DX
0 {& T, s& {. m        TEST AL, btBusy
       JNZ  LoopWhileBusy
+ P+ o7 l; q3 Y# B. t7 h        JMP  DriveReady
% n8 N7 c( B- b6 J/ y& W( j
       // 超时，直接退出
       Timeout:
       JMP  LeaveRing0
       DriveReady:
6 P' `0 V! m1 Q- l; \& T        RET
' \2 Z0 `; J% z7 `" D# t        ENDP   // End of WaitWhileBusy Procedure
) N6 L5 ^, {8 Y! X' H+ N: m& @- q
       // 设置主盘和从盘标志
" W3 l4 e6 U* c7 x        SelectDevice proc

4 w# F: t3 h5 G2 ~( u        MOV  DX, dwBaseAddress
& h. M1 Y) l% |# S; _0 b% j7 N; h: Y        ADD  DX, 6
+ f1 O8 `. `* q  Q# [' Y! r        MOV  AL, btMasterSlave

. V2 _( o; P8 A: O% w; v        out  DX, AL
       RET

1 E" X" j2 I% y* j& |& g* \        ENDP  // End of SelectDevice Procedure
7 A  F( q4 x( v. T: v: R* L( k
       // 向IDE设备发送存取指令
  m2 Y8 \1 r  G0 J, h  C5 k# _        SendCmd proc

  w$ j' ]( p" p9 Z) I        MOV DX, dwBaseAddress
6 q4 V/ X9 U4 @0 K        ADD DX, 7
3 [' e9 L. {& W  v        MOV AL, BL // BL是主从盘标识，在过程外设置
9 e% }# ^" L- g6 t2 R        out DX, AL
       RET
       ENDP  // End of SendCmd Procedure
; n& d6 q& D9 l$ q& m, ^
       // Ring0代码
       Ring0Proc:
" q! @/ u4 G7 X5 \) @! z* b4 K        PUSHAD
( r- s, |  e2 E" P* C8 s" A* J! [! c        // 查询IDE设备是否存在
5 d5 A0 u/ `; }% P% p3 a" v- j        MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
/ N. s* c) Z6 w8 `, q* F+ }9 f
# Y* H5 [2 C) ]        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
/ T% [8 @2 S/ e! j! j: I; D: f        CMP AL, 0x7F
       JZ  LeaveRing0

; f1 X5 D( c  |& y) H        // 设置IDE设备存在标志
5 i/ f2 u2 R! }; u# B0 L- @        MOV btIsIDEExist, 1
; M8 L* s/ N' j8 ?5 J% P) C
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
% }3 n: f; f% @  b: ?* [        JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
0 K" S0 }& z7 @9 {1 Z2 F# I5 M        TEST AL, btBit06
       JZ   LeaveRing0

, u9 U3 d& A- S  N3 k: e) V" D        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

( P4 j  S1 g2 b9 z- d5 M        // 发送存取端口命令
& V9 [5 U* T& i+ u% O4 ], c        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
5 _0 y) ~4 L1 h' Y+ O* a        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
" y5 y) ~$ b" t, Q5 m% R- n9 q9 l        MOV  BL, btAtaCmd      // 发送读取命令
$ U% B  N( J1 ?7 M6 E6 w& S  U        CALL SendCmd
8 Q! r% V0 j/ L+ G; Q        CALL WaitWhileBusy
( E% v4 Z0 F2 y; `% |
       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7

       in   AL, DX

       TEST AL, btBit00
8 L; M1 b2 k3 {- {$ c8 Y% I- o3 j        JZ   RetrieveInfo   // 没有错误时则读数据
( p- T! q4 N4 h" V3 G# y
       // 如果出错，则进一步尝试使用ATAPI设备命令
7 s8 l& U& b# @. p        CALL WaitWhileBusy
+ K3 \/ M9 D* k, e3 X6 `1 ~" A        CALL SelectDevice
/ b- [. J1 u) ^' j4 A        MOV  BL, btAtapiCmd
       CALL SendCmd
& L3 p8 @! b- \+ p4 B# b: B        CALL WaitWhileBusy
: Y+ l& z- F/ y+ ?
4 K- j/ q0 x0 W4 I$ l        // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
. D. S) r% |" x/ r        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
2 x4 K5 z6 d9 J! j1 K4 _* e  r
       // 读取数据
       RetrieveInfo:

       LEA  EDI, wOutDataBuf
  R, V7 \5 z/ ]0 Z( Q        MOV  ECX, 256
       MOV  DX, dwBaseAddress
$ O( D: w# K: a; `- S; O        CLD

       REP  INSW

       // 退出Ring0代码
# b; a- D8 Q4 V- l2 P        LeaveRing0:
6 z% q- P. g2 b( I$ ^
       POPAD
       IRETD

       // 激活Ring0代码
$ @0 w: n/ K% h5 {- C$ ~% P        EnterRing0:

       // 修改中断门
       SIDT FWORD PTR btIDTR1
) e# f8 N* V) r) t6 w& v        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
1 P$ j% N1 |& V        CLI

( q- L% @$ }0 Y4 y1 g5 X        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
! M* _1 N$ I! D        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
) T: G0 D  S  G
  H8 S' C5 F1 Q. V% L        // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
* B: ~3 Y) g7 Y2 g2 O* V; |. E
       // 激活Ring0代码
       INT nHookExceptionNo
4 f; O! r7 \9 S1 N
8 H$ D: g/ B' y$ ?7 u        // 复原入口
       MOV ECX,dwOldExceptionHook
4 b. A' k# e. s0 D        MOV WORD PTR[EAX-04h], CX
0 r: a5 Q( h1 K* I+ e        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
( v3 q9 `* n1 v    }
' \0 m: {* w7 v1 E2 i+ P    if(!bIsFirst)
5 \2 G: P' L  E) h1 B" o* i* @    {
       bIsIDEExist  = (bool)btIsIDEExist;
/ g+ E" u; N2 d        bIsDiskExist = (bool)btIsDiskExist;
! F! ~( ^8 ?7 M" n$ b/ L7 p/ @- _9 ~        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
2 q+ _4 }  A/ L" P6 V% ~    }
! I$ t  h1 O3 n2 s9 c}
* ~- M& @3 f" F- e4 x  K//---------------------------------------------------------------------------
5 z9 p- f: s) K& l6 b3 g// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
1 i8 _; N6 ~5 E" _+ O% W/ y{
2 A$ q) C7 u, J* G    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
6 E8 t5 l7 n7 B; j}