[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
#include <stdio.h>

#pragma inline
//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
4 g" {- ?; g2 w7 d+ {4 f  K#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
2 U7 Q( {0 ]& w% s$ m#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
6 f. t; C0 k+ ?2 K  e
4 B9 H% V# K. U# A1 dconst int MAX_IDE_DRIVES = 4;

" T7 f1 r( V; _+ x. Q1 ]0 p// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
2 Z; \7 _# r! T7 X: Dconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
7 p4 }  x7 O/ a& [- |
, V$ `1 S; E0 \' O9 ]0 btypedef struct _SRB_IO_CONTROL
, e# B# B$ U+ x5 r0 l! u5 l& f{
   ULONG HeaderLength;
   UCHAR Signature[8];
/ Q6 @$ ^" p6 C# {" |  G2 i4 v    ULONG Timeout;
   ULONG ControlCode;
1 R7 a# Y5 F6 x, g/ v    ULONG ReturnCode;
   ULONG Length;
4 m0 ^7 L' o' x7 f* M1 g4 w0 q}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
# ]0 d& n2 h9 R1 L- u/ U
// 读取的主函数
' @. D' H8 P0 X' I& {7 pvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
! t0 Y) N6 X/ X& S
5 J6 _/ Y8 |) H7 c// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
2 g, _9 q* k4 {void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
9 T' I1 l' R! U9 }, A# Pbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
1 E: t6 i- ^. _/ `& z        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
/ e/ p* @- N4 z; Q+ tvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
1 x" A# ]0 n( x& g) l% e( A        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

1 B+ s) N! @# z8 j1 m// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
' K* k1 j1 d& ]& G) x9 L//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
1 C4 L, J! f+ {( L2 d9 X    switch(Win32Platform)
* D! f  I9 S" d! G) p    {
- \- O1 t; z1 Y) j& V        case VER_PLATFORM_WIN32_WINDOWS:
- N, ]/ r) t) o1 J            ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
2 e' f3 P' n$ n2 y8 q' \        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
  p5 Q5 }* N/ B6 q. K+ A4 u6 g. v% T        default:
           break;
   }
. C1 j% t# D( f( p$ r}
( c5 B: U! V# S+ ^) Z0 c//---------------------------------------------------------------------------
' v2 N  P& b/ h4 H, _  e1 v. I// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
4 m  a9 r5 g- d' q* o& m1 y{
   static char szResBuf[1024];
   int nIndex = 0;
5 ]7 s% h2 v, b+ ~; E    int nPosition = 0;
$ H0 S" w+ E$ k" R
0 Z/ n. X2 s- S0 k) T4 L+ e7 x4 y    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
. g8 q, i# e* F: V0 a. ~    {
) H1 D- E" s2 P: Y        // Get high BYTE for 1st character
9 f0 z. v2 k% ]        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

       // Get low BYTE for 2nd character
7 p6 ]. x+ C5 `' _3 L7 w( Q, |: x0 S        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
; v  u, U* W4 B  p' e; k        nPosition++;
/ Y0 L1 T& |" W5 G% p4 }    }
* @7 m) p" M. Z6 x
   // End the string
- t% s# ]3 |* f    szResBuf[nPosition] = '\0';

3 l. ]* S1 [- S    // Cut off the trailing blanks
  Y% O% I6 C9 L# o    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

   return szResBuf;
}
//---------------------------------------------------------------------------
8 B/ A6 A; v1 C, u// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
; d1 R8 }8 ?3 A; N! x1 H" C! |// ReadPhysicalDriveOnNT
: O4 X/ |# }: Z9 x$ rvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
) F/ U7 |( [+ I6 o1 x/ e  W    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
3 z4 z/ x5 u' O# o: N    {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
7 b5 S: R7 t5 s5 J' P) e  G% v                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
) }4 t3 o4 |# F% H' X9 l- I                        OPEN_EXISTING, 0, NULL);
! t" b+ ]5 z7 X* j
) Z+ W" ]9 m$ Z% b5 U0 e        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
9 J  T3 \5 o. G, g2 ]            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

7 ?' v  U# |; J5 O/ k8 \$ B# V3 H            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
6 G' X: F; `/ {5 Q3 _! e) N
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
! F- @- u+ u. n: u* ?                    &dwBytesReturned, NULL))
           {
               continue;
/ w& R" C) p+ x( Y            }

; K/ n; S4 M+ g; L2 E8 h2 O            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
( E. ~7 M. ?7 _8 ^9 K                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
- R( O/ e# Z' l' D                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
' \0 g! J3 K. y  D' Q( ^4 v                // 具体所得结果请参考头文件中的说明
2 d3 b' _/ s( L) p( K* C9 F6 q                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
1 o# C: r! K* s5 g! V% S                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
" \) R2 |5 {6 B                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
% v8 u* f4 J* ]0 X9 T# O
, f/ i7 g8 o8 t% U2 `                if(DoIdentify(hPhysicalDriveIOCTL,
9 u8 X* T1 @$ z' w% U5 H& I4 I                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
) a$ [- d/ e* ?1 R: B! W                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
9 ^8 r8 `2 O: I: G8 q                {
                   DWORD dwDiskData[256];
5 U2 J  C- {* _1 S+ Z                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
! `( f. z. R' O                    char szSerialNumber[21];
4 x. d; O, W& f( s- }2 M9 y! T                    char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
; [) V- l  R6 t, D5 v                    // 取系列号
* F4 M, M' ?$ ]2 w( z% y$ n                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

) n% \  R/ l% A                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
' g" V+ K. ?! r+ V% N" N% @$ o3 j4 M& M                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
& o3 b6 j5 F6 t( N
7 W3 N( j, M4 L) L4 {5 {* s                    pSerList->Add(szSerialNumber);
4 d; S# L, c. q! J; D" _                    pModeList->Add(szModelNumber);
               }
# ~* g4 f  k2 f  s* I) {1 H  [            }
           CloseHandle (hPhysicalDriveIOCTL);
: ?2 f& t- x. m% B8 e$ Z$ p* V. X        }
9 E: M6 B. A5 v( |& n5 o) m: \    }
+ X  E6 M- ?/ Z4 m0 z$ I8 q}
- ~% i8 _! s$ u//---------------------------------------------------------------------------
// DoIdentify
  L" R  s% N3 K+ K6 q+ bbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
: G- }8 e2 Q+ k! u( S% q              PDWORD pdwBytesReturned)
5 a# t5 L4 j& ^( f{
   // Set up data structures for IDENTIFY command.
# I" _3 J% a3 i' y0 K. a4 v+ T    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
) {6 G# {1 T0 d- K! K* a( P    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
8 g$ G& ?0 Y2 Y1 |    pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
' h# z3 C: Y( x; t    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
: ?9 H- u6 a3 K7 }
   // The command can either be IDE identify or ATAPI identify.
, `$ c, r1 M# u4 U+ M    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
8 a6 V, E& t1 ^" }
/ K8 F! b$ V9 \, Q) T    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
: ^$ n( p' r" U1 _# n           (LPVOID)pSCIP,
8 x% u3 Z- D4 s% g           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
0 X' y7 l& f! I) l2 e6 E           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
  j! f8 U( q2 q$ T: t$ z* `           pdwBytesReturned, NULL);
( ]8 w; I! v. Q3 L1 V}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
6 x" C& [: `/ Y2 n+ r1 H//---------------------------------------------------------------------------
, R9 A( @* V; m: j// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
& R& \" {! O" @* J1 z& D& D    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
/ s1 o- q/ ?7 E2 R7 p& Q0 P. d2 i
5 C$ A. V, N0 e! N; t+ e    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
. x/ k. d) p6 v; j    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
/ x( A2 `7 v% s/ Y. k    // 避免蓝屏的出现。（期待高人能指出原因）
& e# o8 b. A5 t    for(int nDrive = 0; nDrive < 8; nDrive++)
/ n8 z. z3 Y# u" a! {; c# n    {
" _5 Z5 [2 X3 }; L+ l7 s3 P        WORD dwBaseAddress;
& j% z. {; v+ f' H( E$ C( q        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;

0 o- ?6 D/ B8 f; \+ G. G# S/ y        switch(nDrive / 2)
' @! ]0 k; E( O' F3 j        {
5 w4 v0 ?5 O) B/ I            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
+ i7 v, N1 N5 q; j  t            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }
* e0 X- M' i! x  U, {( k
! w% j  M0 L# x8 `- H: w/ p        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
* n7 Y- E0 g/ K( _4 f; Q& ~2 h$ n. s
       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
" U: [- t2 b6 e, B" r* [# t/ U) M6 m                bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
, H; ~# ~, ?  P/ q9 [$ N+ C    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
$ D  O, O$ F+ K  ]/ m3 k1 h9 S& A        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
2 P( G7 j- ?, b        bool bIsIDEExist;
8 b' N- D* x1 U8 u        bool bIsDiskExist;
       switch(nDrive / 2)
       {
8 E6 B3 g3 \$ H            case 0: dwBaseAddress = 0x01F0; break;
" |' s( d& O/ `! G% Q            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
& [' e. I- R. L; m: |            case 3: dwBaseAddress = 0x0168; break;
) X9 r  v) _1 T/ V8 t        }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
, q% b% U8 F0 O( d
. h3 `6 r9 C+ H4 F        // 进入Ring0
       bIsIDEExist  = false;
* j7 J4 u7 s: F- m% e        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
( O9 b1 B9 ?& q& C, H, k+ y0 F
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
; ~4 b0 z3 D, g/ \* \" ~' R                bIsIDEExist, bIsDiskExist, wOutData);
% @5 f7 z8 h7 l+ j& |" J4 v: o
0 v3 o! w7 h4 c' c  P' h; U        if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
           char  szSerialNumber[21];
           char  szModelNumber[41];

1 m* y1 ]# `3 R2 u            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

           // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
2 q6 A3 {" z. J+ t; f! Y            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
3 S* e  r+ s1 `5 E7 p
" s& U2 w0 I0 H            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
+ u$ P0 V, v3 s$ o; r: s3 r/ K! @
5 l7 w8 n, w2 r: G6 q' Z            pSerList->Add(szSerialNumber);
- }2 m6 A: j4 U3 t) I; t  W            pModeList->Add(szModelNumber);
       }
$ e# W4 z0 D! F/ a6 X    }
6 Z% f- {. E1 x; Z: |    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
+ N, S3 S3 [" ?: j. @3 `4 C//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
4 y. t& P& J4 E# Y2 B! O( c% @//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
0 j! `1 L( k, T. Y' m8 ^) |% v        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
" O( x" ?* A: C" R  r, Z0 h% c    DWORD dwOldExceptionHook;
6 d& n6 i) |! x& K    const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
# H/ W! p  [) T# Y0 [
   BYTE  btIsFirst = (BYTE)bIsFirst;
7 a7 v+ y# t( }2 Q( n. e; R
2 e6 s! J4 ^7 s6 q, W! O    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
) S- W9 _, l1 E8 `( I" r) l    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
# s6 j- s0 b3 X3 i- W    const BYTE btAtapiCmd = 0xA1;

1 [' \& R% X! d" M& l& c6 v) r    __asm
   {
; p) ]: L3 @1 P) A        // 必须先执行这条语句
/ |1 D$ w$ i5 |. O: h        JMP EnterRing0
8 w& o. n+ R- `0 A& t5 c
" `0 _6 p1 r+ `6 m- G  [        // 定义过程
       // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

       MOV  EBX, 100000
4 B( {$ v$ j( p7 P# S& d8 f$ H3 x        MOV  DX, dwBaseAddress
       ADD  DX, 7
1 S! ]" W! P, z- w9 N
; i0 q: Q: s. Q! \) O6 Q0 [        LoopWhileBusy:

       DEC  EBX
$ H8 f0 d; K* D$ o" I' G        CMP  EBX, 0
& X9 S" ]6 w$ G" L: G        JZ   Timeout
% i  k- y8 X" v2 c( ]* V        in   AL, DX
       TEST AL, btBusy
1 [3 S. N+ L. Q6 b- i        JNZ  LoopWhileBusy
       JMP  DriveReady
8 Y# j% }7 b6 E, E& |+ w
       // 超时，直接退出
       Timeout:
       JMP  LeaveRing0
       DriveReady:
       RET
+ D6 F0 a5 V8 \: ?! y6 w        ENDP   // End of WaitWhileBusy Procedure
" O6 p/ [5 Y  t$ [) k
) m/ i% x, a) y# }  l        // 设置主盘和从盘标志
2 `( ~' J* i9 D7 Z" F3 S" J8 d        SelectDevice proc
% Q, p/ L& U9 j1 x8 e+ \
       MOV  DX, dwBaseAddress
       ADD  DX, 6
* L* u1 g2 k0 ~, g& R8 B/ T        MOV  AL, btMasterSlave

       out  DX, AL
7 \8 F5 E2 W& w! h2 W+ H% b, L        RET
5 M& y6 j2 R3 w: C+ Z
) |' ?2 @& K, `+ o7 U4 Z5 f& Z        ENDP  // End of SelectDevice Procedure
4 t+ O: ^' N8 l* E% t4 d
$ A3 o- d" x) L' Q* _0 h        // 向IDE设备发送存取指令
  K$ F0 L0 d$ N3 `        SendCmd proc
$ O$ B* s( m$ {+ B( g$ n5 l
       MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
' {$ l7 b" q$ s( ]( \% ^        out DX, AL
       RET
       ENDP  // End of SendCmd Procedure
) v* J: m7 k7 h/ K' R7 V( c3 @8 A  K/ W
       // Ring0代码
       Ring0Proc:
3 O1 I4 r1 L  Z2 |6 a5 {9 ]        PUSHAD
/ U) S' D* {# }3 j! n        // 查询IDE设备是否存在
5 D# X1 ~2 C2 e& F2 ~        MOV DX, dwBaseAddress
8 l) X$ ?# {% S) M5 t$ S. ]/ l        ADD DX, 7
       in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
$ H6 f9 S8 C+ @7 y        CMP AL,0xFF
0 f- [# S* @  W! U        JZ  LeaveRing0
5 t  t, K  J- c" q/ Y" c7 r% _3 a        CMP AL, 0x7F
       JZ  LeaveRing0

6 m$ j' V  w! `, X/ }5 O        // 设置IDE设备存在标志
0 y# ~  s. x! l" ~# q) P        MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
* L0 N  N% ~" B, U, I7 u6 i2 Q2 n        CALL SelectDevice
; O2 V* |! K" V5 J' ~
       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
5 P+ Q& x3 \$ C2 w        JZ   LeaveRing0
9 W6 @. @$ w8 u+ T/ ]1 p
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
- p+ @- J/ R  X        CALL WaitWhileBusy

" ], L9 M1 k- a. C7 b8 H        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0

       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1

       // 发送存取端口命令
# r; ^. ~4 C3 U5 T        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
" \9 z) c% a/ V        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
( Q/ V3 O! `. I. S        CALL WaitWhileBusy
* a  P0 q% x/ ]$ J, y        CALL SelectDevice    // 设置主从盘标识
5 R) i, U5 }9 _2 n        MOV  BL, btAtaCmd      // 发送读取命令
5 {, K2 ]% ^7 H! K! C        CALL SendCmd
       CALL WaitWhileBusy

" s% v2 ^* Z+ C- b1 I9 ^4 ?" R        // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
1 q/ r! j: u; L2 n8 ?) b
       in   AL, DX
; z. k7 n% `9 D
       TEST AL, btBit00
# _+ O2 U. N) d! O- J! M# I        JZ   RetrieveInfo   // 没有错误时则读数据

3 P) w# a5 U+ \/ |1 m9 L  ]        // 如果出错，则进一步尝试使用ATAPI设备命令
' A, G. G8 J: K3 r8 P        CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
, D6 t3 ~1 d+ I( |# T; t8 b4 J1 R        CALL WaitWhileBusy

; P0 A/ W) V! b+ h) M4 p; R        // 检查是否还出错
       MOV  DX, dwBaseAddress
" K0 H' s4 w% S  x        ADD  DX, 7
       in   AL, DX
* u  A7 V2 c* o        TEST AL, btBit00
0 l# J) S! r# G, e# E' e& Z2 z5 ^        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

, g2 J, j% \0 g1 |$ u+ j        // 读取数据
' ^8 G0 ]; p0 j/ F        RetrieveInfo:
4 u- p  }7 k6 W/ T
& ]' b: u4 u, H4 N# ?. E        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
2 g6 p# J2 U- `9 g0 Z        CLD

       REP  INSW

' Q" p5 G3 ]0 g( @% l        // 退出Ring0代码
$ v, X: f# s$ B5 b7 K1 o) p        LeaveRing0:
: A1 Q. Y8 g/ z. B& B
7 [7 ]: V+ v- ^        POPAD
       IRETD

9 t/ G$ @5 i: h/ k; f5 y& t3 {% m        // 激活Ring0代码
       EnterRing0:

       // 修改中断门
7 c; d0 c2 }% ?* K, F        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
2 E# z  D0 M  e/ ^" w- @( e        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

4 T$ _: J) \# B: U* p' p* Z3 ^        // 保存原异常处理例程入口
; u! I, Q4 B7 y" Z! r8 O& e        MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
$ u) f# m7 c7 I! v( |        MOV dwOldExceptionHook, ECX
' I  k' x3 ~! ?0 |! J
       // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
- J7 j9 x0 E! I, Q0 G        MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
       INT nHookExceptionNo

  j/ Q% s( A" c        // 复原入口
1 E3 F5 C: m, C& a7 g        MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
8 N" o5 h* D( Z. ^) c7 D* B8 z        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
; e( O7 J8 l: y+ f4 c        STI
   }
   if(!bIsFirst)
   {
+ h% T; S' o  a9 r% o/ U; a: T4 |8 g: K        bIsIDEExist  = (bool)btIsIDEExist;
. R# j" x0 r$ J) R        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
# X5 N( ^9 {% u3 Z) \! ]* i    }
}
' R4 q- b$ t7 ]+ E. n" g//---------------------------------------------------------------------------
# S- p: B" o* y9 n, j// 调用方法：
9 Z- ?6 L' {/ d$ g, T% {! x5 Vvoid __fastcall TForm1::Button1Click(TObject *Sender)
, h; k9 O9 a3 C1 n! l{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
* Z; W  N+ ^3 W8 Y* X}