[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
1 a$ ]3 D& S$ I- U& Q5 u+ \#include <stdio.h>

#pragma inline
7 l* G( N% `$ v//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
( k/ z& ~; J. y7 B, c1 \2 o5 v#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
7 E* R6 A% }7 g  P3 V8 Dconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

& ^+ S* e6 |* p/ I' r0 Y# ^const int MAX_IDE_DRIVES = 4;

// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
6 ?% f3 V$ q. F/ sconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

typedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
9 e- T5 T6 P; ~; e& D& c* e6 P    UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
) e$ m) A; o4 i" {% m    ULONG ReturnCode;
' D. X; h9 T9 ^6 p: k    ULONG Length;
" b7 V* w/ L7 X9 N7 [}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

// 读取的主函数
7 f9 l% J  G6 N' Z0 ^7 e# t0 n4 uvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

* o  e/ ~9 I* o// 辅助函数
5 @' ~2 h5 l! M9 Z1 ~' N# pchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
- J3 l. q5 a, @8 G, q1 h// NT/2000/XP函数
2 d. H0 |/ o$ H: [1 ~void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
0 ~* p, _6 ~, V, Z6 Zbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
: ]7 a. [. T1 h; i# X        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
# `6 y( C9 l+ z; i3 Q0 h- W/ Uvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
( z1 ?; U; T2 ]! u" {  ^+ A: qvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
" U8 k- i& a5 J6 F        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
9 N, D0 S& L7 x4 u& U, v& F, E" d" r
) ^7 w/ \7 l4 n. P" C; q7 f1 P// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
. J" ]; ?  Q) z% _4 W8 T! X' H  }: G// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
1 }  d+ f; _  w8 i{
& X6 e4 O9 e% n1 N    switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
* I( x7 }" f/ l" ]9 G* C5 B7 ]' c            ReadPhysicalDriveOnW9X(pSerList, pModeList);
: n9 k1 o( }: C. H            break;
2 _" r$ R! ^# @2 {: ?) U        case VER_PLATFORM_WIN32_NT:
& o6 L, ]4 W3 G& i5 t            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
" H) W6 d- D+ u0 L7 b        default:
/ j4 l8 W3 Q9 d2 ^. [8 G            break;
   }
}
//---------------------------------------------------------------------------
& |- l- R% o, J* R) s3 [2 G// ConvertToString
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
1 H4 U) o* [1 y2 D& d$ Y" Z    static char szResBuf[1024];
% z2 @, T. R; c6 l+ C  P    int nIndex = 0;
1 _) q% J& ~% C    int nPosition = 0;
0 g$ }6 m3 ]8 |/ @5 c
/ k- S- f0 x! h8 c4 l    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
* [! r7 F$ e6 x: `" T  F: f    {
* r- s+ u& i. B' |9 n: R        // Get high BYTE for 1st character
' \0 e9 K0 v% _/ [( D" d        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

       // Get low BYTE for 2nd character
! n- S& e: l3 Q4 ?- j& J' L        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
$ D+ r2 Q9 R3 R: V0 {5 h1 c    }
* ~( Q/ l% A& L5 b4 C2 m4 K3 g
; H8 g+ Z; Y$ N! r9 f. }7 o3 H. S    // End the string
   szResBuf[nPosition] = '\0';
/ L& r0 ]# _6 F* M
   // Cut off the trailing blanks
' H) }* F2 p; D' W) A3 o% n) }# B    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
3 U7 J* F( F5 s        szResBuf[nIndex] = '\0';
) a$ ^* l6 a- m
5 z& e  y! U# R/ u( |5 A- z    return szResBuf;
}
//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
) b6 E, |( V7 I0 D' L//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
: R9 o. W( R1 T" }! R0 @+ X; r1 u  mvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
: h2 j& E( o; R& H5 |
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
       HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
1 L0 D1 N  m* @( \; Q( ~. `                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
0 d0 ?* R3 ?& ^/ _% a; \                        OPEN_EXISTING, 0, NULL);
  c: V/ W# J- j7 G
* q  M: }" A% k) `7 x/ T  C8 [0 }% i        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
" E1 o1 S4 G+ l% N; c0 T$ m        {
" W, q( I# J) t5 }' G' J1 n            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
( }1 |/ ]/ a  r# X            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
. `' T7 G. s7 b                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
. R' V% `5 b& ]) C$ ?1 A& E! ^            {
0 X# e( Z* e4 l* R( ?' t0 m                continue;
           }
+ o1 R( K2 |2 D7 R; d- }
           if(gvopVersionParams.bIDEDeviceMap > 0)
: U7 b9 o' B; L3 u            {
               // IDE or ATAPI IDENTIFY cmd
2 l3 N+ y4 n' s                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
2 Q4 s: V+ k- V1 f                // Now, get the ID sector for all IDE devices in the system.
, n2 m# _* W4 N9 J# M0 `8 s                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
% B; p. b) I1 O$ x9 K$ R1 J- ^0 w# Z6 m                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
                       IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
& H7 e2 a% g: s  v5 L                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
               ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

! N4 m- G/ K4 [8 x$ J                if(DoIdentify(hPhysicalDriveIOCTL,
$ \7 t3 X7 g, x7 e                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
4 n  O) T% k$ n# b                {
; t. A$ Q' N4 I2 \6 `& F                    DWORD dwDiskData[256];
( |0 L  c, w* o) @                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
) ]3 I* W$ ?4 x8 M7 V4 j* T                    char szSerialNumber[21];
$ S3 {+ o8 k. N+ ]' R                    char szModelNumber[41];

                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
9 S# C7 H0 c$ {% ]$ t  o3 u" _                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
) P* W; w: |2 k8 P8 p% o) J                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
. K* M' @, l0 O$ y/ a% G; E
                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

                   pSerList->Add(szSerialNumber);
                   pModeList->Add(szModelNumber);
) N, |  f) x+ s8 H9 n; ^$ U" V                }
* W; ~6 M$ H/ A            }
* l6 D# V. j+ n  }" K  ~7 ]            CloseHandle (hPhysicalDriveIOCTL);
! s& l. O/ c# M, ~! ?        }
8 s- U, p" Q; i8 b7 |    }
% `. i" J, M9 _6 n}
//---------------------------------------------------------------------------
// DoIdentify
6 `# x& t! L& Qbool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
! ?. K5 g8 x. q$ t/ y4 ?              PDWORD pdwBytesReturned)
{
* t7 {% @4 z& w8 i. F1 _6 N    // Set up data structures for IDENTIFY command.
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
# R/ J& C1 P  \7 w. F! M    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
/ g1 P9 ]0 J+ _" b( |4 T    pSCIP->irDriveRegs.bSectorNumberReg = 1;
' `% W' o) C& s    pSCIP->irDriveRegs.bCylLowReg  = 0;
5 @0 f& }0 ]2 r    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
  G# {3 F9 C* `    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

" q2 N- }# C- B* g3 w    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
3 I  o% O$ Y8 U1 x  ]           (LPVOID)pSCIP,
, ?0 |" b& x  U5 t( g           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
+ N4 l# B: t( L8 ?           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
5 \9 I  y, G6 e4 W+ R2 H           pdwBytesReturned, NULL);
}
# j% V! C7 n, a4 V$ w+ ^# m: D//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
* Y. K6 H# {: F) Q# G; I7 nvoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
   WORD wOutData[256];
% E( {) G, Z4 _0 o4 W8 }    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
$ l6 H! P+ u& I: }
   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
4 @( A4 W0 Q0 N) _4 K) G8 }4 A    {
       WORD dwBaseAddress;
- Q8 w8 l4 t; S" O) w1 v6 c: f2 z& A        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;
  ]! E5 M# Y% k/ q* o
       switch(nDrive / 2)
       {
" N$ T! Y8 U! O* W0 ^            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
# @1 e9 d" y0 U! F            case 2: dwBaseAddress = 0x01E8; break;
0 Y  A! i1 F$ [- V( \0 I% o            case 3: dwBaseAddress = 0x0168; break;
9 l" C3 V% O# Y9 l2 d        }

# S  l: e# U! ^- {        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
! s& @' E+ {5 y) t# S9 ~8 J        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
$ s( ]2 m; {; c. m& g  g                bIsIDEExist, IsDiskExist, wOutData);
4 q0 E. \$ S; K- u/ ?) u0 c" r, R$ T    }

8 W6 s$ p( |4 I0 ~5 g    // 开始读取
7 O" y7 `0 d3 K3 b0 w& x    for(int nDrive = 0; nDrive < 8; nDrive++)
  P7 m" D* _, n7 r8 H. p7 Q: o    {
       WORD dwBaseAddress;
" h8 |. S6 o% K2 v" o) V/ v        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
: {) S; g( ]5 w6 P+ ]4 L' F5 A8 W        bool bIsDiskExist;
# p* i$ ?, k0 B6 F6 |  q& k; l        switch(nDrive / 2)
       {
, Q5 C6 @& v4 @, E" o            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
: D7 c* Q* w' g' B0 e            case 3: dwBaseAddress = 0x0168; break;
5 z7 Z+ x- J# H/ t. x2 h' b7 j8 ~        }
4 u+ G' @3 D1 R
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
, c8 Z9 B3 Q) w  t. J; M$ h1 V/ j
       // 进入Ring0
       bIsIDEExist  = false;
$ h  ?! t0 Y7 f0 M! y        bIsDiskExist = false;
$ A* K6 Q# w) m* `" ~6 k) P# ^        ZeroMemory(wOutData, sizeof(wOutData));
7 P7 e# ~" K5 o
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
) W" K- Z6 w( c3 ]* |                bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
4 @3 z: f6 H. O9 M. N0 a        {
) |/ m/ ^# @5 L4 w' ^3 V9 H            DWORD dwDiskData[256];
/ i6 u* S4 m$ M; V! I) e% Z. L$ E6 M  ]            char  szSerialNumber[21];
) s/ X- c: z5 P6 M/ E            char  szModelNumber[41];
+ X+ W2 _; m  s5 b, v- ~; J2 F
           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
) }( [3 n6 ]% b) G+ }: ~8 O. V  Y- s! v
2 _9 s: `+ s, d6 @            // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
' `* b8 t7 ~8 N6 W  r* S            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
# U# X$ `0 H/ M+ @; R/ s            ZeroMemory(szModelNumber, sizeof(szModelNumber));
8 {/ H$ @: j# g* V# K            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

8 l% h: ^5 S4 J, ]  R. N% v* M            pSerList->Add(szSerialNumber);
7 f, k) H: w2 F0 k6 \, \' y            pModeList->Add(szModelNumber);
( q* s: k/ [- M- y" F        }
  n' K1 r) e) h$ U    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
. |5 g6 C1 n- u& ^4 i. Z}
//---------------------------------------------------------------------------
0 P) S% T8 a$ o# y7 S// ReadPhysicalDriveOnW9X_Ring0()
//
+ [3 \' I6 X  Y* {$ o// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
// btMasterSlave = Master(0xA0) Or Slave(0xB0)
3 @4 x& v+ d/ w7 @4 X2 X' Y//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
- z6 k$ z" b- Y+ B0 `, G' g{
0 K' [( x8 O* m7 I' `    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;

, ^7 z. I5 v& C* H5 D6 m( D    BYTE  btIsIDEExist = 0;
* E& j: p& ]# H& r0 m    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];

- f! o0 ?' b! I    BYTE  btIsFirst = (BYTE)bIsFirst;
4 \# a/ l: `% f8 p8 o+ |
9 B9 ~  R* S# `% \3 N2 j    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
, ]1 T5 w5 h+ s* E2 e" q    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
$ a, d; w/ }( I" Q8 k    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
. k) ~. P0 Y; L* ?    const BYTE btAtaCmd   = 0xEC;
+ u. ^: V: u0 r( K    const BYTE btAtapiCmd = 0xA1;

  ~( V$ k& ~: }' w& A    __asm
   {
  q$ a$ x2 h5 H& ~        // 必须先执行这条语句
3 H9 i, C7 @0 b' e        JMP EnterRing0
- G" p9 n: L9 F* Q' y
. n- Y0 s5 s5 P/ l% D        // 定义过程
$ N$ y. U0 h) V8 n# R        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

5 [) z) F4 c* `# S$ A' b1 o3 I* }! G        MOV  EBX, 100000
/ h/ Y) t& j* c# v7 T        MOV  DX, dwBaseAddress
       ADD  DX, 7

) f. Q) g$ K/ h9 t        LoopWhileBusy:

' w" J. Q; ^  j        DEC  EBX
8 y) `9 I% n  N6 j# @+ _        CMP  EBX, 0
       JZ   Timeout
, Z* Y9 `, `) g! K: T  R        in   AL, DX
       TEST AL, btBusy
. l" l8 |& l4 Z; A) I- }* V) P        JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
       Timeout:
' V3 P# B6 m+ r( B* T, N        JMP  LeaveRing0
       DriveReady:
" p; x; [7 j( A- b& H        RET
+ S9 O3 r# X% a' N  `1 W5 C        ENDP   // End of WaitWhileBusy Procedure
# w% [  B2 w# w) |+ k2 E+ z
, T, @5 x1 X* }* ?! \1 w7 W& _4 h3 p        // 设置主盘和从盘标志
       SelectDevice proc

$ U1 B- m& ^+ I; x% S( h& i' A        MOV  DX, dwBaseAddress
+ y  i, k  z+ R- F: u/ Z        ADD  DX, 6
       MOV  AL, btMasterSlave
0 _, A: s) X; o" D& s! `4 G! `
1 x; ~& t1 E- y4 X4 i        out  DX, AL
# Q2 Z# e% R) F: l9 T7 o/ K6 ]        RET

$ K; z# t& f* [) i1 J4 h        ENDP  // End of SelectDevice Procedure
+ F8 X, s7 T/ [: |& U) }9 t$ {
       // 向IDE设备发送存取指令
- @4 |! K: t/ R+ V        SendCmd proc

       MOV DX, dwBaseAddress
       ADD DX, 7
       MOV AL, BL // BL是主从盘标识，在过程外设置
& N: L$ w2 d: ^# |0 g        out DX, AL
       RET
/ W* m2 E9 |! x+ F! h, P        ENDP  // End of SendCmd Procedure

' P2 ?8 N* o# S        // Ring0代码
" o5 {1 v, |$ z% k8 R        Ring0Proc:
       PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
* n& |6 i3 I- P5 L9 i& t        ADD DX, 7
/ [/ O: Y5 L. z9 c8 [2 b& p+ t, y        in  AL,DX

       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
       JZ  LeaveRing0
) m3 l- I2 v* |        CMP AL, 0x7F
       JZ  LeaveRing0
" i! h7 w9 J! p; X- F* p" Q
( ~/ A; i' X1 ^8 X3 m0 t        // 设置IDE设备存在标志
, M+ f- ^' M3 |( v0 f! G2 A- b0 G        MOV btIsIDEExist, 1
3 u: F0 u. ^. E/ ?0 {/ p& K
       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
. }6 \# U7 a) T$ |2 K/ X        CALL WaitWhileBusy
: f5 U( {5 O2 t! y4 f        CALL SelectDevice
' F. c3 G% x( i0 i! M
       // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
- \, z) H6 R0 t  m0 f" N        CMP  btIsFirst, 1
       JZ   LeaveRing0
" b: s% E/ v# q) m4 r8 s: d
       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
2 g) b$ H8 k: u+ |. u8 H% L. l0 j% U4 n        CALL WaitWhileBusy

6 U/ V7 ?& H6 z& I  z; [  S        // AL的值等于cBit06时，不存在驱动器，直接返回
  K  O9 h# M7 s1 L  R& v! @2 d, p" c        TEST AL, btBit06
       JZ   LeaveRing0
' ~" b' G9 D0 U8 }* l3 Y& m2 N
       // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
! a5 D3 d( G4 ?7 a; o/ o7 C$ ~
       // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
; J) Z' ^5 h& }5 H7 @7 v        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
! b* |  \- Z3 @$ r5 x        CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy

       // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
0 B  ?8 K' o$ w' u2 K, ]6 U
  i9 V1 p2 V  @- Y5 u1 I        in   AL, DX

       TEST AL, btBit00
! l# k# D+ x' _* W! \  K) t5 w* e        JZ   RetrieveInfo   // 没有错误时则读数据
  ^6 p8 T& C3 p
9 R1 i4 @3 o" v, h# _$ g4 J. }        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice
* G  O/ P% v5 T3 }        MOV  BL, btAtapiCmd
7 M$ B! B- C8 e) }; S6 r5 i" I& X        CALL SendCmd
       CALL WaitWhileBusy

2 {$ d; B7 t, C% o6 g5 {+ J; z/ t        // 检查是否还出错
$ l$ u. C3 }& T$ P5 |( u9 ]        MOV  DX, dwBaseAddress
7 v  Q+ g. F! T  z0 j        ADD  DX, 7
6 F% V% }7 d1 B( A+ N/ G; P        in   AL, DX
1 O" Q' s+ x$ D/ `# E) ^        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回

+ [; Z8 e( G+ Y0 l0 c        // 读取数据
" {4 P/ I2 |/ {- f        RetrieveInfo:

       LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
* H  ?4 y& \; W. p3 E! G/ X( Z0 U        CLD
6 G/ Q4 d& }. t5 l  u6 u" j
* o+ t/ w6 _' R6 Q        REP  INSW
5 v4 T( _& R1 N. `, f
       // 退出Ring0代码
       LeaveRing0:

, u" r. Q. w( t5 Y" y" _" G4 m        POPAD
       IRETD

1 t1 c$ D' m# l( l1 T$ y        // 激活Ring0代码
       EnterRing0:

7 z0 d  W& P- D9 G6 _& ~' i        // 修改中断门
       SIDT FWORD PTR btIDTR1
6 o3 v* Y( T% Q8 _' S6 T        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
: j8 j( ]. U8 ?& `" `
       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
( X9 w2 g: C# [        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

       // 指定新入口
       LEA EBX, Ring0Proc
1 A# n; p( t8 B( V' X4 N        MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
* V9 T/ d9 k8 @5 \0 z+ _0 h
       // 激活Ring0代码
( B( H; ~# r3 I( b; o        INT nHookExceptionNo

       // 复原入口
       MOV ECX,dwOldExceptionHook
4 e: `4 l, x3 s" u9 }; A        MOV WORD PTR[EAX-04h], CX
  [! R6 X" k) W; ^0 r5 o        SHR ECX,10h
% M8 W4 w, q% X" C  m' l2 i& i8 c        MOV WORD PTR[EAX+02h], CX
       STI
+ t5 c: l. q5 L- t: ]2 I0 a    }
   if(!bIsFirst)
* C' Q+ F7 A4 ~' [0 F    {
+ B& _7 I" u6 Z        bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
! f) t5 {& E5 \  e/ r# C8 v- w9 K        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
$ E" W! M, _; x! B& d! H    }
}
$ J* L% n) a: @/ R$ V+ ]5 ~3 W//---------------------------------------------------------------------------
// 调用方法：
. c3 N' I. D: z* v1 i" F9 ^8 D. c$ m+ Mvoid __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}