[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
: S, d( k0 Z# A) O! f#include <stdio.h>
& v# |2 c2 F6 m. |8 s3 I. J
3 T0 C- v* Y9 {* l) {! c' Q#pragma inline
7 X4 R% G" h( e1 ], z0 M//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
1 G9 H5 s" b+ q, U& r& p: N#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
& S- R: C7 z& s9 Y5 o
- K* D3 T- F( k. |/ e7 E  Zconst WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

; y6 Z! D: T5 M/ I1 f# |const int MAX_IDE_DRIVES = 4;

" k1 f. x8 ?# y  W) ?// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

, }6 q/ Q# ?% @* ]0 f9 p2 i- Ptypedef struct _SRB_IO_CONTROL
+ G" g6 R( z$ O: |! ?; B( W3 e" r{
. z6 j6 Q+ A$ p6 v    ULONG HeaderLength;
   UCHAR Signature[8];
4 j$ D8 a& ~; a" v+ I6 n2 w    ULONG Timeout;
9 O8 u2 W) P" W/ F+ ^( ~7 B    ULONG ControlCode;
   ULONG ReturnCode;
6 }" V, A7 ?! t; Y5 S    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
; O% ~0 A% o# q
// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);
% |9 Y  x5 c  ~' [- K; a# a; ?$ s
* j4 [9 `2 ^6 x6 x// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
. r, V7 e5 d  P5 s$ H1 jvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
. |! D4 K1 R7 T        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
" G, y* N/ W" P6 y  {* H3 _// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
' [+ h; h9 J7 G3 @' Yvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
7 s, K, E+ f  Y) `$ R8 D        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
% ]% v  n: ^+ n2 w/ h  H  b
// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
; n  C" |/ i, q7 p( j//---------------------------------------------------------------------------
) a6 l# Y( N+ l6 w// ReadPhysicalDrive
0 j. _1 N; \7 e  O* p+ Q$ \/ [void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
( o/ S5 L, J5 {$ T7 e{
   switch(Win32Platform)
; n' D' l- x' j1 t6 P- S2 ~    {
2 E0 H; |+ E/ P$ H        case VER_PLATFORM_WIN32_WINDOWS:
' P0 Y3 G  u$ d! ~; |  J: J            ReadPhysicalDriveOnW9X(pSerList, pModeList);
9 T% O$ ~$ p- X3 i8 I            break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
           break;
   }
}
: n7 X, r& z) {+ L# K7 a//---------------------------------------------------------------------------
// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
2 [7 y( M' A& t+ ]& s+ X
   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
" U& A. ]) t( a( ~3 `5 C; c' ]% V    {
       // Get high BYTE for 1st character
$ n  S) Q% ]) `/ n, [2 r# B+ n        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

       // Get low BYTE for 2nd character
& S  @3 Z& B* _  y* C        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
; j! m: N6 N8 C- g# N! z6 i8 d        nPosition++;
  y, k2 f9 Y$ Q, U% K    }

   // End the string
   szResBuf[nPosition] = '\0';
( n4 t/ B% G; C  p9 r" J; e. W+ t
- G& e9 z3 k& y, m! S    // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
4 C& Q& ]9 L6 }4 L; a' J. L        szResBuf[nIndex] = '\0';
+ Q+ O' Z( t9 p7 g$ Q( h
! |6 _7 L( w3 @    return szResBuf;
}
9 y1 C& n: X) j9 w//---------------------------------------------------------------------------
; }! e  K# j5 r" r9 }% K( X2 e// Winndows NT4/2000/XP 代码
" c, K5 |: m3 R2 q//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
$ p: |1 J' P2 w4 @{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

5 }  a7 n! V8 b* k    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
7 u( `1 S, V  W) A) n% @        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
3 E- w  V- o# \0 G, ~
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
' ?1 W$ ^% L$ N+ l- i        {
* f$ ?2 h5 M" @/ l6 i            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
: I0 k- Z8 ?! {3 P" B' h
           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
; N, m% l* w5 Q* z, s$ d1 S
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
0 i0 `1 m. F, A- L9 ?3 T. m0 {                    &dwBytesReturned, NULL))
           {
               continue;
4 _4 M  }+ a+ S( n            }

* T* t. D0 F& `1 e            if(gvopVersionParams.bIDEDeviceMap > 0)
" h3 i" q) E  |            {
6 h) u) d0 u8 ^" c                // IDE or ATAPI IDENTIFY cmd
* _' j# u2 H" j1 `                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
* |. Z* k' M# \' n# e( e# R- e( Z                // Now, get the ID sector for all IDE devices in the system.
9 z( X$ h! n  M0 j: _8 ~                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
: T' s0 U! o0 q" f                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
. v4 Q4 k' Y5 N8 Y                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
! W4 X  m2 H: n) n0 U                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
, l0 f2 h+ e. {' I1 T0 n
               if(DoIdentify(hPhysicalDriveIOCTL,
4 t4 {5 Q/ t) h% L                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
7 T0 a1 T8 v4 V' \6 z/ F3 f                {
+ b. F: g  a; D; \' s3 F                    DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
/ U- h) {3 T' L' n0 R; f6 E                    char szSerialNumber[21];
                   char szModelNumber[41];

' b' u8 @* r: X2 w. a* q) m                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
. Q3 @  c0 t, \- e9 Q                    // 取系列号
  F' Y4 a3 ~5 V* [                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
( l7 S+ Z3 X3 e' v                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
* }# v, T: K* o3 y                    pModeList->Add(szModelNumber);
+ T) A1 u7 j! S                }
           }
           CloseHandle (hPhysicalDriveIOCTL);
1 K$ C. u) C' x' x, q  p4 o' ]        }
8 f0 ^  F9 ^# R. ~    }
& [3 j# R8 Z& M1 U; [: g( \7 V* N}
//---------------------------------------------------------------------------
// DoIdentify
! _9 e8 u+ U$ K- F; J7 k! ?bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
             PDWORD pdwBytesReturned)
( g+ d8 U5 l0 y) K' |( i7 L{
   // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
" I) [  C' V/ u- o  E    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
' \* {1 Q+ X& @; ]& O( m    pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;
0 `( {9 _2 H: r+ s3 e0 i2 I
   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
1 M: t0 C* n" E' u; W: B& ]    pSCIP->bDriveNumber = btDriveNum;
  u# ?- [2 m" `  Y2 D8 y9 b" {    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
; d5 |6 F) f7 ?* s: c& I- k
   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
" M4 s/ T% T; U) M3 M           (LPVOID)pSCIP,
/ K$ L2 B; f: u8 X           sizeof(SENDCMDINPARAMS) - 1,
/ h0 ?6 C) W: n" _, L  N" @           (LPVOID)pSCOP,
' g' q2 Z0 Z4 B" Q; T           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
7 Y: {2 G) L* v  R, ~( R- D% r           pdwBytesReturned, NULL);
}
: W6 U- K3 w( i% K% M5 }//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
' \) L7 v: ]) L// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
  P6 F0 T4 s! V# w{
   WORD wOutData[256];
# m8 ]. {% g4 X4 K8 s    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
/ u) W4 I2 \1 U: }+ F
( h* u" b4 K/ z* A    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
/ }* R, K, R7 v1 R0 M. E4 S+ ]    {
       WORD dwBaseAddress;
+ `% o7 ], Z. |- A/ e2 P# y0 ]! n        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;

3 \+ Z6 m3 ?& f/ l2 q        switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
, q; I# ?  v- x- j9 T            case 1: dwBaseAddress = 0x0170; break;
% P# l. ]) ^( A3 B  f: o  F' V            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
  S! ^$ Q+ D) l5 ^, t        }
0 `/ F/ Q  K- n. Z. R. f+ S
+ C0 o% s1 p+ x- Q        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
+ h% c( C1 |# |/ R' a- @
       // 进入Ring0
0 Z# [5 J* ?1 ]4 b1 S        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
, s7 E4 O8 ^- P# l* C2 S                bIsIDEExist, IsDiskExist, wOutData);
+ X5 \0 e/ ]* j$ _, A$ v4 I5 j& I    }
8 ]$ N& I9 w% M" L0 y9 r4 |
   // 开始读取
9 w" L; J& l. }# f1 x0 ?7 Z    for(int nDrive = 0; nDrive < 8; nDrive++)
5 I* K  F2 O: v    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
0 E: E. i& j' j% M" _! g1 E- R        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
4 q4 v9 k7 M' ^9 l1 B            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
% t6 Z3 l. \) J# Q2 J            case 3: dwBaseAddress = 0x0168; break;
       }
2 n2 u1 \8 S/ W$ p  V
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

$ h& G2 d% P; Q9 L' x        // 进入Ring0
       bIsIDEExist  = false;
; w: E* N/ H) G& L9 c- l        bIsDiskExist = false;
; e8 t( Z4 T7 r, g        ZeroMemory(wOutData, sizeof(wOutData));

' ^$ m  J, m" s        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);
6 r8 r' L& m6 m5 L
7 i5 F! J: d7 J5 x  ]9 n7 O. Y  I        if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
) Q" k0 _; j" C4 }7 a% P            char  szSerialNumber[21];
           char  szModelNumber[41];
! M, S. i& _: c: S6 K. t
           for(int k=0; k < 256; k++)
, \" q/ s3 s$ j: o                dwDiskData[k] = wOutData[k];
, W% H* `/ L, |+ k
           // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
- p/ k2 p2 v- }, `8 z+ x            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
0 B0 q. Z6 P  u7 m, v7 c3 Y( _( y
3 N# z& f. T9 h' F            // 取模型号
) Q6 _% `3 w4 Y            ZeroMemory(szModelNumber, sizeof(szModelNumber));
3 x& P. s4 q6 [0 [# Y7 ]            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

  ^# c. Y) C$ c  L- N6 W7 F# h            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
$ B5 e' {& m1 _9 B- b4 f) z( h        }
' g& O8 D8 t# C    }
+ O' }7 G5 b5 Z; a2 L    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
* C: L; Z5 a. v  ~3 o7 N}
* j% v% l$ A1 f( {7 q% z- S: q//---------------------------------------------------------------------------
$ \6 S3 X! Q9 \( X7 t// ReadPhysicalDriveOnW9X_Ring0()
1 A- \6 b; U: J8 d3 I//
) W. j. r! l% \% ~! g5 _) g* c. ?// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
7 ^* U$ l$ |3 Q// btMasterSlave = Master(0xA0) Or Slave(0xB0)
4 m, W& N9 ]% p//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
5 W) G- F! x! l9 {# ]) a% o        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
+ L6 ~8 X9 A! @    const int nHookExceptionNo = 5;
5 x4 S8 ], U% _( `1 L# |
9 w7 ^% t+ _; @, m* {4 n    BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

1 @  n; a2 ~, k! C8 l, e    BYTE  btIsFirst = (BYTE)bIsFirst;

& H3 C6 K- P$ D3 i" s8 W/ a3 f1 \    const BYTE btBit00 = 0x01;
9 O3 P0 D! {: N' S    // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
- y: }1 s6 O6 v! }! h* m& q! a# g    const BYTE btAtaCmd   = 0xEC;
9 B1 H% V% V) c+ W6 o+ p0 V    const BYTE btAtapiCmd = 0xA1;

   __asm
   {
       // 必须先执行这条语句
. b. b! S2 @) G) y; {        JMP EnterRing0
5 F2 @1 j9 e; q" a$ M
       // 定义过程
8 J) I4 U& i) ?        // 等待IDE设备直到其不为忙为止
7 c9 Z3 J- Y, v/ d7 j        WaitWhileBusy proc

% b7 `" f$ l' f/ n7 D        MOV  EBX, 100000
# y* F( O2 N7 @1 U; w$ K$ j        MOV  DX, dwBaseAddress
- A( k3 i2 N0 @$ v& O* Q7 J        ADD  DX, 7
. T( B, g3 X) ]' m4 i+ n; [
  J7 x" C- p) X6 \! |        LoopWhileBusy:

       DEC  EBX
0 s; u. ?" K  {- Q  j& p7 N& d        CMP  EBX, 0
       JZ   Timeout
. P* b) Z$ T" `% {; b7 B  b        in   AL, DX
       TEST AL, btBusy
" L5 T& D9 ~; \5 ]: X' }        JNZ  LoopWhileBusy
) [: E; t1 y. D, w. j: Q        JMP  DriveReady

5 `/ |5 I3 d0 x& W  y; g1 Y        // 超时，直接退出
# s6 {5 X1 j3 F. D+ \8 f        Timeout:
3 J3 J# i$ A& E7 l/ H0 a        JMP  LeaveRing0
* ]0 L! O0 O9 U4 P& k- o. P2 d' c4 R        DriveReady:
, n0 S( _- h2 m) b        RET
9 J2 v3 P; M3 h        ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
6 g$ G+ E# ~" x+ J! o, M        SelectDevice proc

       MOV  DX, dwBaseAddress
& b0 K4 `) T! q6 \        ADD  DX, 6
4 T' i, A4 f4 L3 q" z0 }        MOV  AL, btMasterSlave

; A0 Q$ j: k7 Y9 o        out  DX, AL
6 [- D2 P' J2 C7 Y6 h        RET

2 z9 Y! ^) O! b# F, v        ENDP  // End of SelectDevice Procedure
2 j6 M( B2 R; L
       // 向IDE设备发送存取指令
       SendCmd proc

; L6 d% Q) E) l& ?& ?% @* x        MOV DX, dwBaseAddress
# A0 S  M% s* D# |( u  }        ADD DX, 7
1 l2 O, {3 G0 s" {: ~        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
% ~& y6 M- U+ D- L- p0 a        RET
       ENDP  // End of SendCmd Procedure

' \/ ~6 p) c8 \6 D/ V        // Ring0代码
       Ring0Proc:
8 N1 D* {$ P4 O# a        PUSHAD
7 V; S: O2 ^8 }& W        // 查询IDE设备是否存在
1 u+ b4 ]0 m4 K, u        MOV DX, dwBaseAddress
# f4 K) [8 }5 K  @. [' M) Q: l        ADD DX, 7
       in  AL,DX

( X8 `8 I6 R; o7 d) ~        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
0 r  M* ~5 z' [- D2 @6 Y" i        CMP AL,0xFF
) O0 b/ ]& v9 R2 ]        JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0
/ y, R0 n7 X! E5 b0 m8 Y# H
       // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice

       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
/ K  T1 f: M' |        JZ   LeaveRing0
. J9 E" u9 Q) j1 B# R( D) R
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy
/ i# A6 h! j. Q: d
  D3 h: @3 T8 N, s7 ^        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0
( I+ S$ h2 ]- [! T0 F+ t; I
; J$ }) n) D$ V5 x, }" u        // 设置驱动器存在标志
$ R' A! s2 ]" N6 l1 Y. m        MOV  btIsDiskExist, 1

/ U' w, K9 K, T. m2 p( z* c        // 发送存取端口命令
8 w6 m- s! o9 F4 b        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy
- u  s, i& `  l- U$ v$ s' w
       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
, a$ d+ P' i, H3 z
, ^  C" M: T, c) w7 C        in   AL, DX
5 B/ P/ |4 o2 K: N, T1 [
0 J; w+ ^% H6 i$ V) `$ i        TEST AL, btBit00
8 i; F% c  P% P# u        JZ   RetrieveInfo   // 没有错误时则读数据
. i6 N5 \& D( i5 O6 N1 b; h
       // 如果出错，则进一步尝试使用ATAPI设备命令
+ Q. P' R1 K- R& t        CALL WaitWhileBusy
       CALL SelectDevice
" M2 M/ F; v# F/ k7 z        MOV  BL, btAtapiCmd
       CALL SendCmd
       CALL WaitWhileBusy
6 ?7 {8 p, o, J; E0 q+ I& e
4 Y2 p: ]* k+ ~+ t7 [$ g( I        // 检查是否还出错
       MOV  DX, dwBaseAddress
( M* v! \4 d1 G2 ?# c        ADD  DX, 7
) c( [2 h8 X* ]# t. A4 c' r1 f        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

       // 读取数据
3 t* b6 v( p" S        RetrieveInfo:
+ k0 H' \( i0 ^' T% h2 x
       LEA  EDI, wOutDataBuf
, [; h+ J7 b% B  ]1 T        MOV  ECX, 256
       MOV  DX, dwBaseAddress
! V% P* Z0 ?; y% l% I7 n# |        CLD
5 l& m7 E( p9 G
! m+ [7 o# Y5 [# _$ Z1 h  }% _% ]8 n        REP  INSW

       // 退出Ring0代码
4 s. ^2 t) f- \        LeaveRing0:
3 M) q2 Z8 C# T$ U- Z( D8 e' R
       POPAD
& \8 U8 k: M3 G8 p/ A        IRETD

( I5 [* s8 V0 n; {, [        // 激活Ring0代码
       EnterRing0:

       // 修改中断门
2 K. B; h+ D$ |& c, n+ _. q8 S0 t        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
* I' N4 o1 Y6 I" r) [) \        ADD EAX, nHookExceptionNo * 08h + 04h
' y' x% X% b0 H, T( \        CLI
7 r- k2 G3 F# C% H2 q0 H  }/ E% n
+ _: ^% f3 f9 X3 u, h        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
8 c) J1 O5 K" m! q% N! A  Q        MOV dwOldExceptionHook, ECX
& Q7 g; ^& c* B) @( o8 L) }4 @# _
       // 指定新入口
       LEA EBX, Ring0Proc
6 Y3 H. |" p* N7 H  _) H        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

       // 激活Ring0代码
8 f( A0 |5 t1 j* S% y2 H; y( A        INT nHookExceptionNo

       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
   }
   if(!bIsFirst)
8 i( a( }6 E# b' ^  e    {
) a0 y- m/ W7 V( }! |        bIsIDEExist  = (bool)btIsIDEExist;
$ q. e- F% n1 c        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
}
//---------------------------------------------------------------------------
/ m+ Y& ^5 ~4 g' f4 `// 调用方法：
5 X6 a5 D/ r0 ^+ q* x7 }; ivoid __fastcall TForm1::Button1Click(TObject *Sender)
% s$ _) L. L7 q( h2 s) u, P{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}