[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
: z5 {; E; S9 @8 {3 Z#include <stdio.h>

2 E) w6 ]; e6 y#pragma inline
" s, v& _) L3 x: e6 C& a//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
! E% k- N2 ~  t) J6 r: O/ Z6 o#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
7 ~( s4 [. w6 U, i& _#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
* j0 n5 S! g5 k  F# I#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
, d; b& p+ [) Y: S& r9 {# Q/ s- Q# y/ K
/ N) {2 w2 f8 ^* a5 f! y/ cconst int MAX_IDE_DRIVES = 4;
  l$ X5 H, |7 z! z6 P# F
+ e( l& W4 s2 z, c0 a// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
6 @; U# p- D! O  D, F3 t" [8 kconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
) Y, L0 J9 E+ o2 b; [/ o3 h{
   ULONG HeaderLength;
   UCHAR Signature[8];
, X# c; m6 n8 @. T# `3 u    ULONG Timeout;
8 R7 Q. l* d- K% f" c    ULONG ControlCode;
8 e/ C0 r% N! ?6 O9 D! J  p3 p    ULONG ReturnCode;
9 s& r$ Y+ ]! G4 A& c( C8 n" @. r! l    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
) u) v: k  `  V" B5 Q
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
% D& s1 V, ~2 _0 x  p1 y2 T
// 辅助函数
+ E6 X. m; L' [& T0 h0 G- e6 \char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
1 c! _& d) ]+ ^8 O2 w- g% S& I        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
7 d# S( V* e3 s! l, I2 v0 G9 n; evoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
1 F$ ^( h5 y# W9 t& f" ivoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

) C. v, b; e  e6 S4 V// SCSI读取函数(for NT/2000/XP)
, a( n$ o) Q; B$ J3 {: lString __fastcall ReadIDEDriveAsScsiDriveOnNT();
' q- B4 p# J5 M1 w//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
0 u8 Z5 w+ v$ D9 X: F2 r3 L( L    switch(Win32Platform)
   {
( v9 o( ~% o0 c* g5 Q8 y        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
4 n. L6 e( s6 N! A0 T' b2 T5 @            break;
4 u- w* a/ M' |  m8 }% a* D( U! B        case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
/ g% }7 w. t3 E; h4 ^        default:
; s5 C# P) _8 D& T            break;
: n  A7 T+ W2 m  u    }
) f3 X% ]+ [  i9 L' c& N! J5 T+ b: A}
! k0 |3 J- ~1 K$ w//---------------------------------------------------------------------------
// ConvertToString
& F/ P  U" [/ i7 a7 ochar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
   int nIndex = 0;
  s$ W9 @6 S0 u) _    int nPosition = 0;
0 N2 l) ^' i3 B2 q8 z; T% j
   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
3 Q5 \* A0 H- Z        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
" F9 @. _/ R" X' s+ d. W        nPosition++;

2 i; l9 H/ t+ |) M        // Get low BYTE for 2nd character
' R) [9 m  s" z# {! I        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
   }

; e' N( K, @. v6 @: G+ a    // End the string
$ x9 J" Z4 M; E" B, [* J. K    szResBuf[nPosition] = '\0';

) x  C- g+ T: A5 \8 s8 w5 i% `    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
! \! t" S; R" D9 n; F+ a$ J        szResBuf[nIndex] = '\0';

2 z' [0 n* z" k& P1 a. S: ^4 ?    return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
; M/ n) G/ F+ ?$ ~3 A, `: N+ k4 g( H  _//---------------------------------------------------------------------------
' h" T8 @2 ~7 @$ _2 y: Q// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
4 Z" s" A/ M" V0 J1 [- a{
   // 输出参数
8 x4 e6 }1 @9 ^$ _. x6 v    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
& F2 K/ T' M0 ?" H/ E2 @
- t! d+ f  h5 L; \- b9 C# T5 L5 b    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];
+ D  F5 i$ y* E+ N
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
' m& q" n* G/ E        hPhysicalDriveIOCTL = CreateFile(szDriveName,
/ C* b2 {: X( v/ @) S0 `                        GENERIC_READ | GENERIC_WRITE,
& B. \8 V6 j; d2 e) h' I/ N                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
5 n5 p! e! E% i- P2 A3 C1 |3 m# p
# |4 S# W. ?! C& q5 u# R4 J        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
* Y, a2 ?5 ^, _; `8 q6 b% t- r        {
$ ]* `. G( Y; k! f- Q  V            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

8 R& e  U" Q8 y$ K            // Get the version, etc of PhysicalDrive IOCTL
3 y" }" e; m' T9 \3 m            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
3 f) F( ?9 Z7 b+ a6 F
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
! D: b* `1 l( \0 k  ~, P' j8 i            {
) T% T; Z+ Y; R7 K. T                continue;
           }
  g5 h, K7 {* ]4 @: I$ ^+ _
' w5 v# D2 Y9 V1 p            if(gvopVersionParams.bIDEDeviceMap > 0)
) \$ ~2 K& Q* Y" w" J' h            {
6 q6 Q/ C( m5 h& R" Q                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
8 n* y5 y& m) t% k6 I* U                SENDCMDINPARAMS InParams;
7 `6 W* B* L% N! i) }, p% ~+ e; U5 f, a                // Now, get the ID sector for all IDE devices in the system.
$ t5 S# s& g; }- \- f                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
# b* [7 m4 g" y( V9 B/ ~3 O$ a                // otherwise use the IDE_ATA_IDENTIFY command
4 ]' D) {5 F; ]9 I, L/ s: }                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

  w# X# }9 g8 D4 ^                if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
3 V* e/ o! b) f& C, m" j( I                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
6 L+ ~' i* f& }3 r4 U; o                {
                   DWORD dwDiskData[256];
  x+ P# h, w" l, U# x                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
. N/ J& R; M, b( H+ t                    char szSerialNumber[21];
! m# U1 g- ^/ C) v                    char szModelNumber[41];
" G% Z2 V5 R. q
" F  S. Y3 ]. b7 x                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
3 ~+ X, k$ p. O* K# X; [9 t5 D4 e7 g, W                    for(int i=0; i < 256; i++)
9 W6 j& Y3 ]$ P+ X$ i4 P# j                        dwDiskData = pIDSector;
                   // 取系列号
6 f$ ~9 u( s" a/ J                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
7 u6 }; }7 @# C. W! p+ j                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
7 y# V5 B- j& I* M
                   // 取模型号
% S, J( k; i9 n; Z) ]% N" D                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

8 R: C7 r$ M6 h" I& g5 o% s                    pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
               }
           }
           CloseHandle (hPhysicalDriveIOCTL);
       }
5 `/ R% Q1 m% R: e* t; e    }
}
) D. z" j! _0 k/ f9 y7 m//---------------------------------------------------------------------------
0 R6 p9 H; Y& t% f1 s. G// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
6 ~# d0 {2 B/ @; K* o8 e: {              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
{
. L/ X$ c* c5 L2 ^8 \- O# f2 n7 Y    // Set up data structures for IDENTIFY command.
% O+ D: b+ k: L8 o$ M4 X    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
   pSCIP->irDriveRegs.bFeaturesReg = 0;
, `/ j8 {2 V4 j* ]9 ]) U    pSCIP->irDriveRegs.bSectorCountReg  = 1;
5 o2 [& U3 a/ E1 d5 @# B9 `    pSCIP->irDriveRegs.bSectorNumberReg = 1;
  U0 j3 {" V2 W; B2 Y    pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
# J/ f. _. S' U
. U7 Q2 i  z% T1 p6 E    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
4 e2 W% [- e" X6 M. t& ~4 t. [
   // The command can either be IDE identify or ATAPI identify.
# s$ A; l) _: n3 E+ }1 R; z1 m  [4 _    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
8 O7 t! n, X  q# q, ]    pSCIP->bDriveNumber = btDriveNum;
/ q; t$ L7 \1 p! g    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
! ?1 p  W& O" j) w7 X8 ~4 R
; |- U+ D- g+ r* T    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
# O2 V0 {. ]' `8 L3 `6 u           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
- w5 u. Y, j7 w* I) W//---------------------------------------------------------------------------
; `4 F5 P6 b4 j1 z' v* _// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
, W+ k+ g3 ?' C  {0 T( Jvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
# U1 i1 l; S; z& Q2 m" H    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
" i8 D. b# I  J* K/ S
   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
1 u- T5 K6 Y! W4 a% v. j) f3 h    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
$ L8 S  q; z* D2 o    {
8 E; ?5 V1 Z& l        WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
) A$ A- h( s6 Z5 y4 g        bool bIsIDEExist;
; W9 g) T9 l# _7 Z, |0 S# a        bool IsDiskExist;

       switch(nDrive / 2)
       {
" J$ k& ~7 E2 t2 u; v  y9 f            case 0: dwBaseAddress = 0x01F0; break;
2 \% h; @  m. @) B9 N) F" F            case 1: dwBaseAddress = 0x0170; break;
" Y) v& ?7 M3 L0 p5 o* G0 {0 c( x            case 2: dwBaseAddress = 0x01E8; break;
4 I6 N* q8 G3 b& m            case 3: dwBaseAddress = 0x0168; break;
       }
* G$ W' j% x' w6 k) t6 ^
/ X) Q) r* J3 |* z/ J  l0 a- T        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
" g" _. c2 Z$ q8 v: ]/ X& f        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
  B& i9 B. ]- f" T) b                bIsIDEExist, IsDiskExist, wOutData);
( d& g% K% b8 c5 _8 B3 C    }

3 Y2 {  X/ R3 O) D    // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
  t8 @/ w7 j. t6 U9 K; r8 [    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
( @% b# j' T8 O( w% g; H1 U        bool bIsIDEExist;
# h0 q& x9 s1 b9 N& V2 o/ Y        bool bIsDiskExist;
( t9 X  A5 _! k9 k        switch(nDrive / 2)
       {
8 f2 Q4 m  z) d2 w" _# {            case 0: dwBaseAddress = 0x01F0; break;
$ G# n3 |* @0 o- _            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }
- P1 C+ U, W4 ?6 n5 X$ \5 F0 B* j
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
4 N) g6 J1 \5 _
       // 进入Ring0
" w5 G0 D+ O# t$ X        bIsIDEExist  = false;
3 \8 n2 _/ v3 f* y! K  X6 b. O, c        bIsDiskExist = false;
3 {% Y& H- u7 v; z& `- m( h; U$ G        ZeroMemory(wOutData, sizeof(wOutData));

       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
       {
4 u  }% g6 C. f6 {0 v( h" M            DWORD dwDiskData[256];
           char  szSerialNumber[21];
& C- K; S0 R. Z" D. l, B: j            char  szModelNumber[41];

6 j0 ~  y& {. r: C) D            for(int k=0; k < 256; k++)
6 u. a+ R" u- {8 j                dwDiskData[k] = wOutData[k];
6 [5 G5 P. o4 o) s
- K% [# I" y1 R. S3 X            // 取系列号
* `5 k- {/ J3 Q/ ]            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
' o) X* w3 Y$ w8 _8 m            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

2 x5 Y( J: L" i9 d            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
! ]3 n" z1 D" B" }
           pSerList->Add(szSerialNumber);
* s0 d$ p7 X. ?            pModeList->Add(szModelNumber);
: ?) I0 \  |7 S' d        }
0 N) D: ]4 a# d# M( o$ ]    }
& p4 [4 X2 g5 f1 g( C    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
//
1 I' q1 T& I+ F8 V. p3 l. y+ E" R// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
& v8 P$ z1 |9 p7 e//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
1 U  R4 V/ a7 t  _' F9 i        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
6 R1 J: w# u' J- G{
   BYTE  btIDTR1[6];
0 z$ Y9 a2 ?4 {% b3 G% |" z: ^    DWORD dwOldExceptionHook;
4 [0 F9 e8 {$ X0 C/ m! R    const int nHookExceptionNo = 5;

   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;

6 P6 a+ k0 Z% e/ P    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
6 H' O7 K3 N7 Z. [( h; R+ ^# f    const BYTE btBit06 = 0x40;
0 v6 l1 q$ F* P1 H/ r1 S4 B    const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
+ v! b: @3 ?! l& v( ~; z9 u7 @    const BYTE btBusy = btBit07;
- `# N& l7 y( ]) Z3 I1 ^) {    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

/ {( _1 Z$ ?2 I    __asm
   {
" V6 p) ?7 }+ v, m        // 必须先执行这条语句
$ R2 h0 ?  L; ^9 S: W        JMP EnterRing0

       // 定义过程
  a. {6 Q7 Q/ [# S        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc
9 R) |! @4 M9 z$ N4 J! O% ?
       MOV  EBX, 100000
$ v/ ^( `3 y# G' l        MOV  DX, dwBaseAddress
       ADD  DX, 7

       LoopWhileBusy:
3 {3 ?, j2 |; X% U4 G: p0 E
       DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
$ e/ X2 W4 H# u. m: ^        in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
+ W! r0 g1 B0 e/ k1 s* D0 k) K3 |3 m        JMP  DriveReady
0 l+ |! c8 C  O. C+ l$ ], W' n8 F* a
       // 超时，直接退出
* I! M1 G( {6 K* {& L" e        Timeout:
" {' {* x8 T2 g; I# R; O0 A        JMP  LeaveRing0
       DriveReady:
       RET
       ENDP   // End of WaitWhileBusy Procedure
! A5 |# y0 i/ r* O
1 v0 k3 M  U" _) G. Z" }! Y( \8 M* e! w        // 设置主盘和从盘标志
/ }; E  d) s! O5 P( b* c        SelectDevice proc
, R/ u6 B( e1 g% `% n' T
. c4 m4 n1 S: I; b2 Q$ P, }* q        MOV  DX, dwBaseAddress
       ADD  DX, 6
1 Y7 Y) F# N( I6 x        MOV  AL, btMasterSlave

( I5 n0 Y, ^7 o. H: D        out  DX, AL
; Y3 Z+ R" j4 W; Z6 ~* {4 {* N' z4 l        RET

& L) F- E6 t! v6 d" S: a2 z        ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
8 J5 G5 I5 Y" v8 n# H8 ?) S        SendCmd proc

! o( W/ O$ K- H& Y        MOV DX, dwBaseAddress
( ?( {& E# Y. ]& a' U( N        ADD DX, 7
7 d: {& T; Z. v; g% F        MOV AL, BL // BL是主从盘标识，在过程外设置
- g0 e% r0 F8 z7 [' E        out DX, AL
       RET
       ENDP  // End of SendCmd Procedure
' v$ H+ b, ^6 e. W4 e# G
" H7 m" f- s# x. T4 p; t        // Ring0代码
. \! f& L5 T! e/ p/ V/ Z- g        Ring0Proc:
& J0 I" ~; r" _/ w7 a" r6 I+ w        PUSHAD
       // 查询IDE设备是否存在
0 _# k* E0 i8 x  ?        MOV DX, dwBaseAddress
) T( X( Z' L+ z/ u& k9 G/ k        ADD DX, 7
" P& \- E! ^% z0 Q8 [2 {  t        in  AL,DX

# z3 a" o" z( H: `        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
& p$ x, \7 s3 L        CMP AL, 0x7F
       JZ  LeaveRing0

       // 设置IDE设备存在标志
' Q8 b! L  y6 F) f        MOV btIsIDEExist, 1
0 l8 H& P; Y. Q' G( \
* ]$ k" D; f* P) ^# _7 y1 y        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
  ?) S1 S3 v( h7 u% k0 K        CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
       JZ   LeaveRing0
- ?2 U$ @8 e4 l, ~& ~
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

       // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
) F4 k  j5 o, F( ?" b/ m        JZ   LeaveRing0
/ w& a& j1 j; O, R' S
       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
* ]% H/ {* L8 w0 T: Z1 j* u
/ D: k! \- u7 a2 @: p% x& @        // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
, ^& L* N; P* R$ `6 @        CALL SelectDevice    // 设置主从盘标识
" ~+ l/ l- p: f' E4 l) b) z        MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
8 @/ n, X+ d7 b; r# S$ B8 o        CALL WaitWhileBusy
, W; G0 b% ~3 {- {
8 u* I: w  H* `8 S1 ~+ ?5 A        // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
! t! h; Y1 y+ c  j8 |
       in   AL, DX

       TEST AL, btBit00
$ e1 ^3 }0 V9 V* N; x  t0 Q        JZ   RetrieveInfo   // 没有错误时则读数据
" r* m9 O- R2 \" \' J* N+ s( e
5 h8 _% |. _2 n& J        // 如果出错，则进一步尝试使用ATAPI设备命令
. O4 b- S$ I% w- A        CALL WaitWhileBusy
. B7 F" ^: a' ^7 T        CALL SelectDevice
       MOV  BL, btAtapiCmd
$ ]) b4 i5 I% R7 ]) S% h        CALL SendCmd
+ e: j# I3 p% e' a        CALL WaitWhileBusy
. R: t8 q# L9 I: T3 [  d( y
       // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

8 M* i: G3 l' o) V6 Y3 T( g  U        // 读取数据
       RetrieveInfo:

       LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
4 s% @, M7 g! f        CLD
* Z0 N0 `4 f, u4 O
       REP  INSW
) P. J! U0 Y  `  J$ x* N/ p
       // 退出Ring0代码
       LeaveRing0:

       POPAD
3 r4 A+ r. o; z& [  M9 M' u1 J% U        IRETD
4 f1 p6 y6 }. V+ k) u6 P
4 R& Q5 N, L- @1 `$ e: \2 U5 e        // 激活Ring0代码
% ~8 c0 N9 P" }        EnterRing0:

0 Q  w5 G; I9 q+ N8 N! c        // 修改中断门
       SIDT FWORD PTR btIDTR1
, t+ Q+ o' {% R& T) k/ A        MOV EAX, DWORD PTR btIDTR1 + 02h
$ }5 _8 l6 W+ Z- G        ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX
- c& g0 `$ F/ L  R
! z- [, _  v( w/ M2 w" F- M, s        // 指定新入口
: W/ ~5 t0 J% J8 e# K. n        LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

* S  N! K+ n9 [$ R' C        // 激活Ring0代码
       INT nHookExceptionNo
# l3 M# e; ?4 G  ^. }! o3 ]
* o/ V& Q. a; z3 d4 e        // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
: m7 k- T) |% Y' Q: z) {        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
   }
8 E9 i6 }' R/ F% @2 V    if(!bIsFirst)
* y0 [$ m6 H: Q4 k    {
9 h' f+ W* i) f  q  A( c        bIsIDEExist  = (bool)btIsIDEExist;
2 H/ L8 `4 ~6 a0 ~; w        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
//---------------------------------------------------------------------------
// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
" O; H1 e& y3 B! U{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
' }, s* U, }4 g, X6 }4 `6 }5 F}