[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
1 v8 o# M( k4 ~! @//---------------------------------------------------------------------------
% e$ ]6 L  a7 p: m" Z, a, C// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
  M& u8 ^: n6 |0 c( z' b! p#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

' F$ e+ z( k5 l. d' {8 b% yconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

const int MAX_IDE_DRIVES = 4;

0 ?) C+ ^* q8 g: n" [4 [; x% h// SCSI专用变量
. p5 U' O/ _$ U! n$ Bconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
3 e- k6 {; T  Q% Y7 Jconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
* T1 U* s, e, q- b& G  {& M
typedef struct _SRB_IO_CONTROL
{
0 h# U3 q" U- v' l7 l3 [    ULONG HeaderLength;
   UCHAR Signature[8];
! j. A, b5 M1 A    ULONG Timeout;
   ULONG ControlCode;
' s% ~- ?# _; U3 U3 v7 z7 Q    ULONG ReturnCode;
   ULONG Length;
  e9 B8 a$ }3 Q$ U2 [9 @/ J5 N. s}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
- [, b+ V8 ^! J$ U% L/ B: M
// 读取的主函数
4 \" m: ~0 c5 R/ K8 Yvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
& P8 j7 c4 ]- _! [
// 辅助函数
$ U1 Y! f7 h+ Q0 m0 Q) J( bchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
7 T- v4 H8 J; Q% y( t  b$ X        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

# f3 A7 X) ~$ h2 C5 O; g/ `// SCSI读取函数(for NT/2000/XP)
8 e$ \8 H- ~' Q1 R  a1 cString __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
7 _  y- ?' Y2 b" U( C+ j    switch(Win32Platform)
& p" V: ~9 [* t$ u8 z/ @    {
       case VER_PLATFORM_WIN32_WINDOWS:
/ K2 T! X+ a+ D, o& `. R+ ^            ReadPhysicalDriveOnW9X(pSerList, pModeList);
$ \$ D6 p' ?8 A# ^/ m8 {            break;
9 z5 I+ Y& u0 B% J7 X        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
% r# r$ k$ x2 G+ I& g5 J+ e        default:
. ]  U- C1 w& y3 K  t; U4 c1 f            break;
   }
) d* J9 k7 F3 C6 p1 V! |}
//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
& L3 H% t1 f$ \7 [) O6 W5 q+ C; ]{
2 s  Q( }& Y! ?( p9 ^" g    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
5 x3 u, C) [4 p( \% Z3 r
   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
8 N- s( r/ v# q4 r& W3 l3 U        // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;
, Y, h- Z" N5 Z, [, E+ d6 Z) }
       // Get low BYTE for 2nd character
1 O3 T8 q2 v# o6 f( a; Z. o        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }
# m, w/ J# \* e) P# O
2 m% a9 \# j& L: X/ x3 r    // End the string
   szResBuf[nPosition] = '\0';
! p( `6 U* c5 z7 ^6 g7 `. H* t0 x' j6 i
   // Cut off the trailing blanks
- E0 C( i3 G9 }6 ~6 A  s    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
' L+ V) ~8 y: N& L. R. j5 H
( f6 Y7 x, }* p# d$ P$ u    return szResBuf;
3 q* {) P8 I" }  ]; o}
/ [& T- ~: t, H; j& l' e$ T7 ?/ S" K4 Y//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
" Z7 D. X. A: x7 ~4 a2 A+ @, [//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
$ s# {- U7 i9 [" v4 S- jvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
5 p2 E0 `# q8 @0 M7 ]    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

' P9 L5 g7 r- ^7 j. ^1 |( u    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
; y7 D; ?/ K/ e2 N' t                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
. R4 b3 t% J3 L1 }2 l2 z, j
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
+ `+ o9 w" |: j# N2 K        {
           DWORD dwBytesReturned = 0;
  \! ?. N# w! x6 N3 F* d5 F            GETVERSIONOUTPARAMS gvopVersionParams;
7 {, Q+ ?. O1 ]3 a, f( }4 j
           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
* f6 B: u& Y: P; f3 |
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
- U8 Y/ N6 x8 A/ H; c: v                continue;
1 Y+ t: ^* S5 O            }
5 {; u8 ]$ o5 L. |, ~" }
4 e& I* b/ d# I* a            if(gvopVersionParams.bIDEDeviceMap > 0)
! P7 a* l- W& e0 l0 ?            {
               // IDE or ATAPI IDENTIFY cmd
4 j3 n- R3 S$ _# F/ c$ ^9 Y4 b% ~                BYTE btIDCmd = 0;
' a3 J' v9 _& w- y5 a& X6 z, v, q                SENDCMDINPARAMS InParams;
% A6 ~' d% a: R  y3 m* p                // Now, get the ID sector for all IDE devices in the system.
8 C+ x) }' U: W9 }" n2 b  j7 F                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
- ^  d* ~, ~, @4 ~                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
" ?' x* X- a* b/ q+ L/ i                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
6 U5 J8 l8 z/ Q
               if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
$ T5 c% u: `" T9 H! d( Z                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
                   DWORD dwDiskData[256];
5 w* d, P: A3 @& v                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
7 i; A0 S& `, Y4 M; s0 v5 C                    char szSerialNumber[21];
                   char szModelNumber[41];
  ?- `- s+ ]1 D" a$ V' D* [" ?, E
, U" \$ c- V) g4 u' Y                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
9 H7 k! O( I8 u                        dwDiskData = pIDSector;
                   // 取系列号
5 y% A8 f. t- t1 w3 A                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

) g" s! S+ ]7 }' w/ n9 j1 j                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
0 M% O8 P, y6 r6 C' `                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
# A/ M& j* y  h& Y! H+ P: J& Y                    pModeList->Add(szModelNumber);
: b& F  b& h2 \5 W                }
           }
8 @2 d0 l$ p0 u% C! Y7 H            CloseHandle (hPhysicalDriveIOCTL);
       }
   }
}
) U% L' `5 F1 N# r) ]* H//---------------------------------------------------------------------------
! D- e2 b8 g' S; t- @* r( J// DoIdentify
2 X4 W* A8 c; {  o5 Q: sbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
% ?1 B( ^' B! ~4 N              PDWORD pdwBytesReturned)
2 ?5 S( Q8 \7 U- l# w# S5 ^{
* K, I# ~" R* X    // Set up data structures for IDENTIFY command.
+ _8 p1 {0 m! F3 I" z& @    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
; h+ u* D0 N8 _1 T9 d; `    pSCIP->irDriveRegs.bCylHighReg = 0;
# f6 _. w- ^6 O. ~
2 w+ Z( ~# ]- A7 A& A4 ?4 C. x    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
. F$ B/ e5 S9 F
' j7 Q. a* T! u5 X8 e7 H    // The command can either be IDE identify or ATAPI identify.
5 P* N# o% S& w/ }: O2 c    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
' k# H! l1 g5 Q" Q    pSCIP->bDriveNumber = btDriveNum;
1 C0 Z+ x/ T$ c    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
! S. p7 @3 `& q) u" d$ |2 V
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
0 g; _' D" a: J8 s$ t0 p           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
! e1 p9 Z7 F5 F           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
/ Q. Q5 t' k$ r' h}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
9 O: u1 Y* J  D7 Z- J% F5 L$ M% a//---------------------------------------------------------------------------
" A3 {* D1 x# O// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
  @$ \  `$ G" O5 R! l{
   WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
# @/ Q  |! J, A# Q/ v8 B* d# n% l
3 V3 m3 x4 N3 x0 a  I& m9 F    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
# Q# ^. y  A9 A9 l7 G# Q7 E    for(int nDrive = 0; nDrive < 8; nDrive++)
) D5 F6 M3 B- t- g0 N7 x0 N# q0 U4 [    {
, s: v- U& l  A: b2 k3 D+ P( n        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
' l) o4 C. V9 e3 O4 ]        bool bIsIDEExist;
! R! o% j& K! X- `+ _( [        bool IsDiskExist;

" y0 P2 J& e* t" z9 j  G        switch(nDrive / 2)
- @+ H$ k  s8 g6 E9 i+ Q( d! t        {
           case 0: dwBaseAddress = 0x01F0; break;
- t% c. B0 D) _2 V! ?7 \            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }
4 O; ]- b; f$ ?8 u
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

3 q0 P. `( Y' j: G        // 进入Ring0
; {2 p( ?- O! n5 t" x$ t4 Y        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
; V! I; \* j0 R, P, U9 O    }

   // 开始读取
& o; |$ p: F- n# l* Y! I& j    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
/ H$ \# [' j" x        WORD dwBaseAddress;
. ?8 y2 h# V6 i) u$ `1 w2 H; s0 t* c+ E        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
# [; ]6 T$ B$ p4 S, e3 G% L- `5 q            case 2: dwBaseAddress = 0x01E8; break;
7 i$ u. o6 Q; q( X9 }4 `- l            case 3: dwBaseAddress = 0x0168; break;
       }

; J# R& j6 K* C* D7 @4 }        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
1 z5 ^4 v7 L* M6 J5 m1 X( f, v
       // 进入Ring0
. h* F1 w" d& e& x  H1 |        bIsIDEExist  = false;
       bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));

       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
7 f7 C9 S& v$ m$ U) Q' l                bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
       {
% b( `7 h! f2 _4 j            DWORD dwDiskData[256];
           char  szSerialNumber[21];
. }4 V4 o' h, ^5 R            char  szModelNumber[41];
" v: l1 g0 k9 h4 r# D
           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
- D' c; w1 g4 v7 F0 C" t! f
6 e3 b* _8 x! p6 u3 W' E  _            // 取系列号
5 y9 a9 d  p( b7 b+ i# S            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
9 }$ h- w8 \- }* ]3 w
           // 取模型号
5 _4 ]8 b6 c# i/ ~" S& ~            ZeroMemory(szModelNumber, sizeof(szModelNumber));
* g. a* D) U6 O            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
- X9 I: v' Z! u" d! u; s; D  D            pModeList->Add(szModelNumber);
7 [- C+ t2 _. r, X        }
+ n% T& B% V2 \3 w1 |  D  s5 m: ?. S    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
, [( q* ^- u- k; Z! P//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
# g/ i9 A- N8 t/ S' m//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
* {1 M, ?+ e/ [        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
0 k# ?# P: ^( Q; j, U. b{
% K* C& a) R2 H/ z3 V- B6 N    BYTE  btIDTR1[6];
7 t7 Z' n. Y0 ]3 s4 T9 K: _    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
0 K- i4 i1 u3 v/ a7 m, v6 m
' N' k$ I: w, b! Z    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
. \- N+ I9 w: G1 U! D& g; Z    WORD  wOutDataBuf[256];

  c9 M/ s7 a0 C, x3 J3 _    BYTE  btIsFirst = (BYTE)bIsFirst;
$ o8 A0 B! R0 r# b: Q
   const BYTE btBit00 = 0x01;
! @8 V7 A% V: |% o    // const BYTE btBit02 = 0x04;
* d, l; g$ I4 M5 q  A9 M5 Z& k, m! X3 H    const BYTE btBit06 = 0x40;
$ H2 x/ N9 K8 R    const BYTE btBit07 = 0x80;
% T: Y1 A3 j( w    // const BYTE btERR  = btBit00;
1 x9 _$ H  ?3 K. y1 M2 [    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

% V, ^- `: |* Y+ l' S5 N5 s    __asm
( ~- G3 q2 ^7 D7 i    {
       // 必须先执行这条语句
       JMP EnterRing0

       // 定义过程
6 ~1 D: \3 c1 N7 u9 y# l% P" c        // 等待IDE设备直到其不为忙为止
& ]; |/ W% H  c/ k        WaitWhileBusy proc
& H! N. [9 i+ b, l8 B1 R
       MOV  EBX, 100000
6 b4 @! b8 J0 b5 Z' g; [        MOV  DX, dwBaseAddress
       ADD  DX, 7
: T0 Y1 d5 ?9 E% w( s
       LoopWhileBusy:

1 Y6 t& {- M2 X; S! ]( e        DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
4 c; G9 v. F( D: w' I) Z) x& b+ v        in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady
; J  ]; q1 T3 `9 \
0 i: G/ Y% l2 ^  U3 V: o+ n        // 超时，直接退出
       Timeout:
       JMP  LeaveRing0
       DriveReady:
       RET
( @, h! J# r' U0 |' d/ B) ]        ENDP   // End of WaitWhileBusy Procedure

% t" t$ ]7 h  {# y7 D        // 设置主盘和从盘标志
       SelectDevice proc

- G! o. _; b* s, I        MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
2 h2 U! m# \" v) U  a
! o$ y) ~! O: _$ d8 J        out  DX, AL
) d' c* M4 \! x1 [. |/ B$ I9 X        RET
1 ]9 E+ Y6 b4 S" Y9 d$ A" t
) A; g! {6 D* o) q) ?* ]2 y3 w        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc
6 t6 L. k. N5 e4 Q; w
       MOV DX, dwBaseAddress
+ U4 c  ?; q0 u3 H; X        ADD DX, 7
7 r: q: J) ^7 E! u+ U8 d        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
; _% c7 W7 O7 Z7 ~& t& m        ENDP  // End of SendCmd Procedure
1 W$ \# T. ^0 E/ Q1 s- \+ L" ~2 E
/ \6 |( y! s* e4 h9 E( I        // Ring0代码
0 A% ^" F0 R* ~) V5 W/ l' U  L        Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
/ e& A: Z1 g0 s. q1 p; L9 s* u7 n        ADD DX, 7
       in  AL,DX

0 [: a- T9 D, x' Q, j; i% b1 S        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
2 \( E7 B( j4 R2 F& C6 U        CMP AL,0xFF
$ N. ?5 z- z2 h6 p$ j        JZ  LeaveRing0
9 _! x4 B6 s4 b+ z; G- _        CMP AL, 0x7F
       JZ  LeaveRing0
5 b! X. ]6 _" [  k
1 q* n' Q% ^7 K9 h- _- C  a        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1
! e! N$ e$ _6 b3 ]7 k& X' k
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
* y* D6 o# N9 N        CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0
( Q1 n" h1 z- U0 j
3 z9 t7 @( a, R; O. M) w: Q, r        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
* ?3 u2 o& s: D% [% j        CALL WaitWhileBusy
8 Y6 @9 U# `0 X1 h% b
       // AL的值等于cBit06时，不存在驱动器，直接返回
- b/ Q, @+ o9 j3 a, `- Y        TEST AL, btBit06
1 X8 T# o/ S5 @- w8 r        JZ   LeaveRing0

' m: b! x3 s3 G) H7 j; |        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

& y- T, M, q1 j) M! }& ~7 v; P        // 发送存取端口命令
7 n( Y5 ]1 k5 R8 l  C+ t        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
, X( R. B, g! m( o& b        CALL SelectDevice    // 设置主从盘标识
# ~  l! E- J0 g8 z) M; ^/ o        MOV  BL, btAtaCmd      // 发送读取命令
# q0 v* J9 ?; i9 S        CALL SendCmd
       CALL WaitWhileBusy
9 ?4 J& v7 e2 H4 w8 c, H4 D
       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
! Q3 N* R: H) f5 U7 |! J3 E
$ Q: x2 o2 x, i3 h# F( c, N; ^) \0 Y        in   AL, DX
7 S' h0 g; z4 X# l7 J% N
       TEST AL, btBit00
( `& T+ C% k9 i0 }# c4 }; Y5 @        JZ   RetrieveInfo   // 没有错误时则读数据
, p" ?% d; ?) L, k0 I3 G7 e0 t
       // 如果出错，则进一步尝试使用ATAPI设备命令
' k4 f' J# [5 y5 L4 ^6 v        CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
2 K) l: H6 f9 q+ a+ T0 y6 b& j        CALL SendCmd
       CALL WaitWhileBusy

       // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
* s# v8 p- f; m" l; {& Q. d& ?        in   AL, DX
. _) M1 ~  r% y3 [% A0 R$ V& M        TEST AL, btBit00
  |1 s9 \" z: g8 K, f( z        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
3 b4 T# j6 ~3 w. d" K  P
, J* H0 f6 Q5 y, G3 M8 ?' B, ?5 g        // 读取数据
       RetrieveInfo:

( D* d. y# z8 g" Z4 d( R        LEA  EDI, wOutDataBuf
+ t& V  X. x: R        MOV  ECX, 256
* b9 U- v! T% D, s. H$ H        MOV  DX, dwBaseAddress
       CLD

7 a& f: ?8 u3 U1 [: L* X        REP  INSW
( v1 L# {4 B: A$ W+ a
' b0 t: A+ ]) f, _7 o- S/ ]1 U        // 退出Ring0代码
       LeaveRing0:
$ e  d3 X% R5 L& G3 M% V0 S
' E3 D* R# [5 n- J        POPAD
       IRETD
# O, t5 L+ b# V) e( ?) w
       // 激活Ring0代码
       EnterRing0:
& W, @8 N# ^6 S8 O- E
       // 修改中断门
* E3 z6 i+ \6 V        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
" j" m+ {6 Y1 ^3 B        CLI
" M! Q2 E& a- A
       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
, c6 H" Y9 X# i: _        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

5 d4 Y) w  w/ e( g7 y: Y# c        // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
8 i$ U8 o) W2 S9 |% l
5 L  y7 w: ]  K$ B( [9 T( g9 x        // 激活Ring0代码
3 Q; s% B/ W2 ~% N; H' `0 K* L        INT nHookExceptionNo
! m; z. M6 s' }" p
8 g3 r$ {3 B2 t" k! ]! ^4 b1 T7 L        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
# A# t" e( p9 n+ k1 z        STI
   }
/ m& h. r% U% M; h+ U% h2 _    if(!bIsFirst)
   {
       bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
5 l: N! {6 E: F; {# {        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
! s7 F1 c- \  @; w3 w  I6 Z    }
! R) |* m( n! w! c" ]! ^3 n  x}
4 X" w( s3 Y- M+ i+ s2 q0 M//---------------------------------------------------------------------------
' ^" [1 f8 v( s6 x! n; I// 调用方法：
9 h2 _* H2 ?) K2 Qvoid __fastcall TForm1::Button1Click(TObject *Sender)
{
: g  U6 ^  Q2 a+ b0 P  Q    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}