[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
//---------------------------------------------------------------------------
" k- [( [0 {& u7 P/ k5 g// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
; x# Z8 ?7 S9 f- I#define DFP_GET_VERSION         SMART_GET_VERSION
7 B1 O, I8 i3 p* {#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
+ t9 C! j0 U% v, N#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
$ C# x# V: a& e$ A
7 n# ?4 s* {1 q% U* Sconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

, l6 _+ M! N4 {! fconst int MAX_IDE_DRIVES = 4;
+ T4 ?; i# w1 V, ]% e! q3 |
+ O7 V8 b7 T+ n7 h3 q* `// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
8 G7 v2 {6 v. V* K8 f8 o8 Pconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
# m' H5 z% T" ?" @7 |3 z4 u- rconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
+ |) ~8 ?: J& q; w: ^/ ^const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

7 S4 N" w& H( ^# t& d0 ~7 o5 jtypedef struct _SRB_IO_CONTROL
' A5 S1 v/ c7 h, E* N4 \! l) N{
3 s: h. d" O$ V" l# P& ~    ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
# \2 w. c! a) x9 B: `1 o' W% o6 o9 R0 y    ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
3 Y' J, J/ ^8 u6 f* {/ D
// 辅助函数
4 S7 Y  x# W8 L6 _) |$ P4 ~& Rchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
6 J% g. q' b: e7 U3 y6 M* _void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
+ e! o9 \( d( `, f; V! hbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
6 r3 v; _6 ]2 `! f; c5 `. H        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
7 T$ H" Q5 u/ r6 ]  J) o0 K/ evoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
5 [: C4 I6 Q& I  e) G        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
0 c0 `. H/ a5 @4 ~String __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
; ~0 X% W, P9 a2 T' u3 B2 c{
   switch(Win32Platform)
3 A) v4 y' q; e  Y  v/ O    {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
1 n+ m. j6 C; X, \+ T7 ]        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
( z" l+ C) k6 \9 s( ?3 L" p6 k            break;
2 f* j) B1 A5 [1 @2 a        default:
           break;
2 S. H3 @/ `' ~3 C% I    }
}
3 ]' z( g4 N- g7 {8 J$ j( ~& o3 j//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
  `+ B, S( n- Z0 y4 A9 S{
   static char szResBuf[1024];
   int nIndex = 0;
2 {; n: j  J' x, W- {    int nPosition = 0;

" K; x0 p  v+ G: {" z; e: i/ q( M    // Each integer has two characters stored in it backwards
9 l* b% T" C4 a4 K  a, s7 W    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
$ a. N  B8 x* X; r( {9 m) Z( F    {
       // Get high BYTE for 1st character
9 K1 a. D& G* ~% [; T        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
$ b# z6 H/ V3 s. N3 a
       // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
9 G6 K% F- Q! {4 {  n+ z        nPosition++;
) [# W! q9 c3 o    }

   // End the string
   szResBuf[nPosition] = '\0';

   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
0 ?8 {. Z8 o- |6 ^# g        szResBuf[nIndex] = '\0';

   return szResBuf;
}
//---------------------------------------------------------------------------
+ W/ _6 z- l) j7 h; I// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
, ^% a. ^0 p3 W8 ~5 M// ReadPhysicalDriveOnNT
2 o; z% F' a0 z3 i' Nvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
$ C" ?; b9 G- E, Y; n( x{
3 ~* M2 @8 T7 j; C' K    // 输出参数
1 k$ Q; M8 n8 w1 g    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
3 f; P& H0 o; Z/ Q8 \0 I
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
# e/ j1 S& D5 p( T# Q$ D    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

5 p8 v3 r4 P8 b% l4 n( t, F( Z        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
5 j/ ]2 X: W# W; @                        OPEN_EXISTING, 0, NULL);
9 Q- E. D* Y- h
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
, u% |& }' D# i9 u8 s6 o        {
! D6 ^9 L+ B1 @+ V) q            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
4 M5 g2 B. `1 M4 o" O0 f* p% ^
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
( K) b& [* U* u0 v, Q! e" Z                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
2 X8 P6 c8 D; i, Y7 o, N+ J3 S- k                    &dwBytesReturned, NULL))
           {
               continue;
: w7 V8 L4 t4 Y' m  Q# r7 X            }
3 u6 {% n+ L5 o
5 Z, V# J% Q$ N( x, F: Z- i+ ~5 @4 Q            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
) `6 {* r: L9 ^, a4 V3 N                SENDCMDINPARAMS InParams;
9 j# K3 H5 s/ o# p9 |1 _                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
# E  ?. @5 ~; B. f                // 具体所得结果请参考头文件中的说明
, g0 l# Z; K! y- w2 v; N4 h1 h                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
, u+ k1 ~6 K/ J( X                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
; N1 G# J- `( _% V0 |                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
; a: J$ ^3 y% q: Y* d$ {+ H0 _
3 j* J0 w' E3 r  m8 E$ X- Y                if(DoIdentify(hPhysicalDriveIOCTL,
' w2 w* ]+ E/ J- V* [                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
: U* R' a  k4 `# ^' u                {
2 H2 t4 a) D# E( Q9 D                    DWORD dwDiskData[256];
6 D' d  N4 X1 T7 @* D& q2 Y                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];
1 u' \0 |8 c0 O! \$ s
' [5 c5 W& a' R% k9 H( e6 M                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
  V- ~$ p$ ~& F" \  d( y$ X* z/ F                        dwDiskData = pIDSector;
                   // 取系列号
" u, n1 ?2 `' V7 \6 O' r                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
9 z- D/ R7 d9 C3 C* D7 u* C" L# p                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
/ V- s8 d5 [* b                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
. o4 e/ Z* N' \! \' @* Z
                   pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
% f0 _* L6 s! g                }
3 c  o+ w1 I6 V- n, G, C            }
           CloseHandle (hPhysicalDriveIOCTL);
       }
& z, E1 ~8 E- U$ E! l1 W4 D% b    }
}
) E9 p' E1 B) H6 `9 F# j# j//---------------------------------------------------------------------------
// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
! F) z* w5 O, @( k, d  K! F              PDWORD pdwBytesReturned)
{
$ C6 |3 i' j" z8 }' {  d; K2 z    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
; y- \  Z) \5 ^2 _    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
- h: ]" K. V- I  J2 ~3 X' c- ^% ^
3 f* X$ D2 j( F5 Z' Q* j    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
3 L. ^8 v/ j$ F4 {" ~3 L
   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
: Y. ^8 q$ D& p+ |- `* ]    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
3 t2 Q# W! U- b
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
1 z; ^; u8 _8 G+ [- c& ]) O           sizeof(SENDCMDINPARAMS) - 1,
# l# u. t" ~1 [1 M* I           (LPVOID)pSCOP,
2 G8 m- i/ k" N4 F           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
$ X0 p) ^& L! C& s) U}
( u/ I% G, V' r1 e* g' L//---------------------------------------------------------------------------
7 r* x% ]# v9 z+ D// Windows 95/98/ME 代码
! i$ _; q" p- P0 V9 M! j1 ~2 G//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
# }) N. S1 J' a8 g{
8 [7 \' \$ u- h9 S9 N    WORD wOutData[256];
- o! R, i7 r5 h    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
7 g6 O  L* [) n6 Z( E
0 D$ f. M% `# V6 v. v, h    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
9 H/ R$ z3 N) s& \    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
) ]7 E/ v) E, |/ b6 w1 C1 W* m! A    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;
: K: e3 _( ^; y( b2 I- r1 t1 H- C% ^
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
% D9 U: j! u: t& ^7 G8 e        }

6 O3 n$ O5 h3 o% I4 v  P        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
; d, ]5 s* y- y/ E. p7 ]' |0 u- T- ?) [        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
# q4 I: i$ v; K    }
& p7 n. M% ]. A) A+ A
; ]: k+ U7 n2 ]8 A3 |# e: c2 f    // 开始读取
- ?* \( U% K7 K( A; @( E" E& @* s    for(int nDrive = 0; nDrive < 8; nDrive++)
/ T3 l) a9 `/ ^+ E6 Y" ?    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
1 t% Q+ _0 v/ g8 h/ T        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
! Z+ O0 k  \  y: C; A            case 1: dwBaseAddress = 0x0170; break;
) L) c( r' t5 C! K4 z; f            case 2: dwBaseAddress = 0x01E8; break;
  Z  W9 S4 a" U" w) F4 t            case 3: dwBaseAddress = 0x0168; break;
       }

3 @* u+ Y$ U* g5 N        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
# G7 i6 A; w4 q" g, ]% U3 M* A1 W
, [$ h- t) {# Q6 w& ^- ]7 _! L- V) R        // 进入Ring0
' W7 _, h2 a3 g1 X1 ]        bIsIDEExist  = false;
$ a$ ^" e0 n  Z        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
; Q2 o4 S7 C5 f5 ~/ y
. w" S- x: G5 X  e) @" W0 ^        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
$ R! ?. X  `2 J' ~
       if(bIsIDEExist && bIsDiskExist)
1 a* o" d. g3 [        {
           DWORD dwDiskData[256];
           char  szSerialNumber[21];
           char  szModelNumber[41];
1 E" H, f9 G' M
           for(int k=0; k < 256; k++)
4 D4 F! F$ j. ?* r3 G                dwDiskData[k] = wOutData[k];

) X2 m9 a9 l% u( k% |            // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
8 J( r+ ~* j" R! L) B) \            ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

  ]* ~; R% p( B- y, a            pSerList->Add(szSerialNumber);
/ K& |3 T2 |% W' n- B' ~1 x$ r7 V            pModeList->Add(szModelNumber);
8 r1 n$ o2 J3 h        }
   }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
# p: ^* X9 z* j3 _* Z5 W, R9 @5 N- E2 q}
# w. H- y& _9 F9 @//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
4 @- w* Z* A# [1 b2 I# `//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
) o) s0 k2 l4 L; K{
# c8 @3 i3 ^* B7 W/ x' A    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
3 D2 ~+ N9 k3 f9 i/ Y; {3 b0 }. |2 x
( N- l) M- ?5 Q; Z    BYTE  btIsIDEExist = 0;
+ s! L! h% v% o0 R" \5 X    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
1 O9 {) t; |( d" u4 I; L9 Q
5 r$ t5 N1 n8 F3 y, C% {8 O! M5 a    BYTE  btIsFirst = (BYTE)bIsFirst;
5 {' Z9 G/ ~5 _. T' f
. F: E+ X* \2 d. U$ d3 o! u3 }  i    const BYTE btBit00 = 0x01;
2 J. k7 i) S  V5 E# M. i$ ?    // const BYTE btBit02 = 0x04;
+ q: C$ A, A) f; p# p+ ^    const BYTE btBit06 = 0x40;
2 B* N2 _* O& b3 o    const BYTE btBit07 = 0x80;
- Z4 u2 r" v3 D: d% X" Z/ ~2 o    // const BYTE btERR  = btBit00;
0 x* z& G( s* N6 E    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
4 q' x0 C. G7 R& m( X    const BYTE btAtapiCmd = 0xA1;
* x& a& u$ U9 _" _' p
   __asm
   {
0 H, S% f' _* F. h+ k. Y        // 必须先执行这条语句
1 v& e4 l7 x( t        JMP EnterRing0

       // 定义过程
) ]5 o  O4 Y- Y& d- }/ l3 X  m        // 等待IDE设备直到其不为忙为止
1 ]5 w; \8 z/ h5 n2 \$ S7 w        WaitWhileBusy proc
- Z- c2 K3 Q" S2 G  ]3 y
       MOV  EBX, 100000
0 y6 i; P" ?6 d        MOV  DX, dwBaseAddress
# I% }5 ]- K8 K( I        ADD  DX, 7

       LoopWhileBusy:

       DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
8 L* E, K; n& _3 K4 ]        in   AL, DX
2 [* W; G& ?: C0 q  ]- R        TEST AL, btBusy
       JNZ  LoopWhileBusy
2 P+ _0 u: C. Z3 X0 `) f9 O        JMP  DriveReady

       // 超时，直接退出
. \8 V: o: J4 u- K; M3 G/ F        Timeout:
       JMP  LeaveRing0
       DriveReady:
4 W, ^! R: V; n; v# s! Q. ^        RET
       ENDP   // End of WaitWhileBusy Procedure

7 F+ A7 `, {: h- T        // 设置主盘和从盘标志
       SelectDevice proc
6 E# q' l( X2 f; p' A# a8 O
       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave

9 m6 A. N2 T" Q        out  DX, AL
2 [  h# P" C9 X        RET

       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
4 x# H/ K! |4 z5 Q3 G        SendCmd proc
* }" M8 {' Q1 D! S; x
' R! m! B2 c: r2 z) {5 u        MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
' U, H7 a; i, R( `        out DX, AL
1 W& v9 J; `/ j8 M8 U        RET
, _2 L1 L, ^4 e) S! ^( Q        ENDP  // End of SendCmd Procedure
2 P& L; l5 f( e. V" ~
5 T# t2 r7 @5 _5 ?1 F0 o! d& j        // Ring0代码
       Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
! S. m3 x* a. [. V# \& x        ADD DX, 7
       in  AL,DX

6 ]) e5 i6 [3 a: m        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
) E5 G6 A' }' V& S" I$ E0 o# {! h        CMP AL,0xFF
6 M% B9 D5 P6 E1 Y2 x, Z; I2 m        JZ  LeaveRing0
       CMP AL, 0x7F
+ o. u3 G2 B, M- ^5 @. c        JZ  LeaveRing0

# s  t  S- d) b, e# |4 S        // 设置IDE设备存在标志
' O4 m7 {' O, p. D: `9 j        MOV btIsIDEExist, 1
# F/ q& n* Y3 y/ Z$ j; L
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice

1 l7 a: D- r0 d. h, d        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
% _# ^. F, O8 h4 k! o( q! u        CMP  btIsFirst, 1
       JZ   LeaveRing0
- |/ @* F2 D* I
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
. H* r3 H+ O. W9 x7 d        CALL WaitWhileBusy
" y- Z- _/ M% J8 k2 U* R
' y0 B2 E( }5 x; D        // AL的值等于cBit06时，不存在驱动器，直接返回
' O9 @8 e& J4 E, ~        TEST AL, btBit06
1 N7 ~5 g1 H9 X+ T4 g! l        JZ   LeaveRing0

. b8 s- C0 U: W        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

; o: v  M" c9 w' G        // 发送存取端口命令
" A. I9 w' Z. }; p: G, r        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
! [- P7 ]( t0 J7 c4 F# u        MOV  BL, btAtaCmd      // 发送读取命令
% l2 w' Y: O4 S$ N, |  v* g! X! p        CALL SendCmd
+ l; B( J' _" R* j3 X$ Q$ F        CALL WaitWhileBusy

/ `9 ?+ K4 {0 l* s+ ^  ^* N        // 检查是否出错
+ v, Q5 S* u5 r" |; s% V        MOV  DX, dwBaseAddress
# H3 Q1 v6 ]" Q- C. `* q# N        ADD  DX, 7

' @8 z1 p1 U% {* `. t2 I        in   AL, DX
4 N# E3 [. P) ~: m2 Q, k1 o* s- M
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
: ^' h0 p/ L7 Y% ^& P; _        CALL WaitWhileBusy
: j' }" c& v$ W6 \1 D- W        CALL SelectDevice
) Q/ {) X/ G! f+ k+ T# Y        MOV  BL, btAtapiCmd
       CALL SendCmd
! _' a5 n$ D& }; m3 P        CALL WaitWhileBusy

       // 检查是否还出错
* r( Q; v& o: T' j  Z        MOV  DX, dwBaseAddress
. v# T- W! E4 B' A* r0 D1 G        ADD  DX, 7
" s0 Z! \8 B; S& o$ z3 N) H% n3 k/ o        in   AL, DX
' X# e" z% A* Y  p+ u, y  C        TEST AL, btBit00
7 n& t4 Z" |  B- g: ^- @        JZ   RetrieveInfo   // 没有错误时则读数据
7 f# k; h6 B5 l( h" b5 n        JMP  LeaveRing0     // 如果还是出错，直接返回

4 w9 n! i, M' D! Y' g6 b& T        // 读取数据
       RetrieveInfo:

       LEA  EDI, wOutDataBuf
$ c: @; n, U/ @* I1 J' {# k        MOV  ECX, 256
, ^* X8 b; p, H: D, W# O: w        MOV  DX, dwBaseAddress
5 o; u* Q8 X, J) o        CLD

8 \; Q/ ^5 L* a1 R6 S  L( f        REP  INSW

       // 退出Ring0代码
       LeaveRing0:
2 [4 d8 a  B3 h) d
       POPAD
       IRETD

! s5 E. j; V" a2 }) K        // 激活Ring0代码
       EnterRing0:

9 R' |6 A$ k- G, E& D) H3 v        // 修改中断门
: V# ?0 n  c/ V7 D) Z        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
' Q. E4 p9 |4 ]: x  b        ADD EAX, nHookExceptionNo * 08h + 04h
. L$ [3 Y8 J; U( Q9 o& U        CLI
2 w& O& O! n5 x- _
3 i! y& m% e4 H6 ?; u9 U        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
. n: Z% s2 _, g$ R        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

) y$ M$ r) g/ J        // 指定新入口
$ r, e: m+ p7 ^$ O2 f% V% w+ \        LEA EBX, Ring0Proc
3 {4 N1 n/ C) Q; N4 k2 N7 _, Z        MOV WORD PTR [EAX-04h],BX
  c( C  ]+ e. A' q# P        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
       INT nHookExceptionNo

       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
9 m0 I0 ~" {% r) F/ c0 ]        SHR ECX,10h
! [5 |# H9 S& m( s" Z        MOV WORD PTR[EAX+02h], CX
/ E7 j3 O* e% D) E6 b7 E        STI
& d& o- A( b$ b/ P    }
0 D( b9 d, d, x- J7 D    if(!bIsFirst)
- ?. H( P7 ~$ `4 n' M, o. k8 D    {
       bIsIDEExist  = (bool)btIsIDEExist;
+ m4 ~! z5 x; h, B        bIsDiskExist = (bool)btIsDiskExist;
" H' H* _+ `7 N( S& n        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
//---------------------------------------------------------------------------
$ r* F. U  v; e* u! \// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
7 ^& z* c" T3 @" A1 s/ t{
3 d# A, T* |* A    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}