[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
# v# W/ X% a# t2 Y6 E+ T+ p6 X#include <stdio.h>

2 |- h7 L  k$ i#pragma inline
//---------------------------------------------------------------------------
+ Q0 r2 A0 E! U: G3 d// IDE NT/2000/XP专用变量
#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
+ h" R  Y% s. ~& d( O
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

+ m  G1 e- M4 w+ ?" \1 x" _' bconst int MAX_IDE_DRIVES = 4;

# G6 |  [8 p0 i5 V$ M9 D- D7 k// SCSI专用变量
2 J0 X2 G: b" E& f1 M3 g9 vconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
0 }0 H( z. W* zconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
" J, }7 P: E$ x+ \. I0 rconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;
! C* V- V4 J: G6 t
0 X# [7 Q+ ^8 T$ D' Ctypedef struct _SRB_IO_CONTROL
4 ?( Y0 r& T* N1 h& \* ?" V{
   ULONG HeaderLength;
* C/ X# k3 ^. T3 q: v0 ]% J) T    UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
; o% g4 c% g1 B) H    ULONG ReturnCode;
2 Y' R" n* v* \4 j4 n    ULONG Length;
% L# w! m( W1 o5 f: f5 \}SRB_IO_CONTROL, *PSRB_IO_CONTROL;
3 R- m( @/ u* I% J4 ^  _
* ~. l. L' I* ~' `$ r7 w// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

. w. B# D+ U) e3 v6 A// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
% P2 o& i+ `/ s; e7 R5 T, O) Q        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
" a* b8 n% s) p6 l        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
( ~4 o7 L9 X! Gvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
/ V5 n; Y( \. D3 Q        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
7 K0 n' l  ^; x5 u( @
6 W( e1 p5 q) k: c1 X// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
6 r0 `& ?# ?" p0 M//---------------------------------------------------------------------------
9 J% P2 F: \7 U1 T/ ]% j. O// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
{
4 y. \4 s" W3 a' U5 b    switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
4 ]) n" x. i5 M1 R7 K( N( R            ReadPhysicalDriveOnNT(pSerList, pModeList);
; Y# c* m6 K7 y7 g* ]& Z            break;
       default:
           break;
   }
}
//---------------------------------------------------------------------------
8 N( V0 ~! ?$ f; u' I/ p// ConvertToString
/ o2 J- S% z* X0 V$ s; jchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
9 o$ T0 @0 H$ A: a7 _    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;
5 U2 D0 y1 V$ e# |* r" {7 j
' t! }+ @, e" l    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
1 H# [- m& @( |9 f, e    {
  F$ _! S- _: D% m8 u        // Get high BYTE for 1st character
. d! d* T8 V' i. l4 k! J9 S        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

3 Q( k% r0 m4 F" Y5 F8 Z, A/ v  V        // Get low BYTE for 2nd character
. r/ k, D- m1 Y! x; d/ i9 Z        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
# H: d" u5 a+ c: T        nPosition++;
   }
: H8 |* i* H3 W. t
* H) m1 {/ e, E: w0 J( V. l$ k1 ~    // End the string
) E. _2 u5 n5 w; Q( |2 A    szResBuf[nPosition] = '\0';
0 E. @2 _% Q, I- q0 c( j( Z
   // Cut off the trailing blanks
. c6 f; x6 K% @6 [/ _  k  T    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
2 x# \) W4 S4 R
   return szResBuf;
}
2 l/ A2 M/ l% \//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
9 _% s, ]1 v0 b/ q% Y8 T  C// ReadPhysicalDriveOnNT
void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
/ F& l8 Z7 b6 a6 q    // 输出参数
$ ]- {+ j+ K& ~! r- t, i, Y    BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

8 e! G! _2 @- c9 [8 }& ?" ]    for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
; T0 |/ w$ J+ m        HANDLE hPhysicalDriveIOCTL;
       char szDriveName[32];

       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
% X+ Y7 M# u& X+ |/ F/ S% C$ ?! R% H        hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
: |: Y- e! ?& `+ _; Y                        OPEN_EXISTING, 0, NULL);
* `+ }5 j. _" G! B7 t" b
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;
( M  r. C. F" V6 D
: I, V2 a1 G& t0 a! I2 X            // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
" n  ?! c% q% N! Y, u. G
           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
  L  t1 j! e6 ~1 G/ o                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
8 S9 ^7 Y' E) l) ~" X1 u# i; g                    &dwBytesReturned, NULL))
           {
               continue;
           }

           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
+ s. p& A# _, z/ T5 l                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
               // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
* X/ b$ u' O8 Y- A5 ^5 h- g                // 具体所得结果请参考头文件中的说明
" o" i/ T7 a, D- g1 T  G                btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
( v6 f7 ?8 j8 O( [, z/ }0 S                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
               ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
4 t4 Z- L. h' r                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
3 Q4 _5 c+ @7 w
               if(DoIdentify(hPhysicalDriveIOCTL,
1 i9 h( q$ {% B% l' z2 o                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
& j$ n1 b) f) q5 \, p                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
0 S3 b3 Q. v2 C2 A4 @. I- n2 V; J& S                    DWORD dwDiskData[256];
                   USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
- J6 e- f8 m# [5 _3 `                    char szSerialNumber[21];
( g9 {# B" _% h: s8 \/ V1 l# K6 T2 b                    char szModelNumber[41];

2 v/ d: x7 ~% O+ h6 A' j+ c                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
4 o6 Y& o. G0 I                    strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
4 ^: _3 @8 {, z3 I1 a, z: {
                   // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

& \) M4 W. @% p, _" U                    pSerList->Add(szSerialNumber);
0 c5 S8 R* B) F3 c4 W- {                    pModeList->Add(szModelNumber);
) \  T8 i. U1 U; I! T0 Q. ]                }
           }
" J6 T% z7 H5 y+ v* q6 R            CloseHandle (hPhysicalDriveIOCTL);
       }
   }
}
//---------------------------------------------------------------------------
0 j( J& B5 H5 `+ n7 u8 l' t9 ^// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
6 H2 J" t$ O8 I$ o' A% W: J              PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
  E! m" c/ L: s* K1 A1 H5 `              PDWORD pdwBytesReturned)
8 A; D: d# A6 C( Q1 n) W{
   // Set up data structures for IDENTIFY command.
7 c) c7 G, w( ^2 ~& u! {1 |    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
4 n6 C. c1 O* ~" q+ d" b    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
' {' T1 a* H2 j. d/ n" ^    pSCIP->irDriveRegs.bSectorNumberReg = 1;
2 e8 `  `( I6 h" [    pSCIP->irDriveRegs.bCylLowReg  = 0;
   pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
* `$ m- g& x5 H" j$ h
   // The command can either be IDE identify or ATAPI identify.
   pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
9 e# E( x( u! Y5 U
0 l) @1 b( z2 y/ F    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
' n6 l9 {# I* d" N- a! W% m4 y2 R1 }           (LPVOID)pSCIP,
, V. {- C9 |: n- ~: u! F           sizeof(SENDCMDINPARAMS) - 1,
& ]2 E" c. r: y' k$ S+ S           (LPVOID)pSCOP,
/ b* d3 r8 X' |           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
: x3 q$ Z, S  z  W$ J+ i4 j2 T// Windows 95/98/ME 代码
* p" T" @$ d1 F8 {& W2 D//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
! M( u3 I# _8 w    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
# B8 e5 o, X+ m' ]4 e# Y
5 D( ]$ s6 S1 n' o9 j+ @    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
- U; B4 O- O* Y6 ]  P" j8 s  J. c9 B        WORD dwBaseAddress;
; i) v$ \, p# b        BYTE btMasterSlave;         // Master Or Slave
8 N4 q4 Y& Z0 A* p( V7 a        bool bIsIDEExist;
       bool IsDiskExist;

       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
, |6 g9 [  f* x) c& D; d( P$ o            case 1: dwBaseAddress = 0x0170; break;
8 e! @" K; l# M$ E- e            case 2: dwBaseAddress = 0x01E8; break;
% ?* M6 t0 q" R( f+ m" n! W            case 3: dwBaseAddress = 0x0168; break;
1 H8 T6 b7 N) ~# T* W2 Q/ L0 l        }
/ O  a: R1 s' W! J' C6 d  f
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
3 x3 F6 _  d" v, J( Q  @3 J; O# r
# D# v! Q3 O+ t. _1 W) x        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
& t0 {8 j. f. C1 N  k* j+ ^                bIsIDEExist, IsDiskExist, wOutData);
& ?2 y2 A* a) h    }

   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
7 }* p6 `. l: k( D  e$ b; v/ S    {
+ O0 I3 z6 I& y        WORD dwBaseAddress;
7 d) g+ Q0 h/ g, n1 R2 j        BYTE btMasterSlave;         // Master Or Slave
* ?% H9 R* R+ u        bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
, R- P, @( i% n' _& k% O5 h3 q        {
           case 0: dwBaseAddress = 0x01F0; break;
2 e5 L" x0 s7 L            case 1: dwBaseAddress = 0x0170; break;
! _6 G" ^/ |/ v; p+ h3 G            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
4 O" y( B% g" ]        }
, J) H, K' V4 `3 N1 z9 O
3 B: j/ S& z  g4 R4 [        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
  B) o4 e3 o6 v* q& H
4 H0 M2 U" {# v9 `( c- j! A& g8 r! E        // 进入Ring0
       bIsIDEExist  = false;
3 M# t- T6 @2 o3 b2 p        bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
9 y" g* U6 v+ Y* E7 M7 R
2 r; f! O7 J; [3 Z# o        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
               bIsIDEExist, bIsDiskExist, wOutData);

       if(bIsIDEExist && bIsDiskExist)
+ A* `; Y8 U3 ]$ d% m" d        {
           DWORD dwDiskData[256];
           char  szSerialNumber[21];
           char  szModelNumber[41];

, D0 G9 t1 e  D5 C1 U            for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];

           // 取系列号
8 x! u( _0 I5 |# i            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
( M* x3 _" f5 l- D, z$ n- d
! W3 h# w4 l7 q            // 取模型号
+ D9 Q& h2 |0 x$ G2 h            ZeroMemory(szModelNumber, sizeof(szModelNumber));
4 g6 _  {3 Q  {5 @. _            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
$ Z- Y5 x- Q7 X4 v- I3 r% v
  g$ d6 J% K) {; K- Y            pSerList->Add(szSerialNumber);
           pModeList->Add(szModelNumber);
6 T, @4 n" I* t: w) N        }
9 A5 N% {9 A, z    }
7 V( }0 }2 z7 t3 K. c4 Q$ M    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
" f2 G- ^  X; I3 j6 I3 m// ReadPhysicalDriveOnW9X_Ring0()
7 L: T4 U9 z4 m  }" _//
. V; y% ?/ i& j; H/ `// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
, N2 Y- U. L* P2 c. ~// btMasterSlave = Master(0xA0) Or Slave(0xB0)
& D, g& y0 I1 I7 {//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
, k% \9 W6 j" y8 w' v$ u! z" e6 K' S        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
: k: h  {( E$ R$ S  A9 X{
   BYTE  btIDTR1[6];
7 G% D$ t. }# X0 [; z4 m, }    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;

" R1 P/ h2 A$ ~    BYTE  btIsIDEExist = 0;
6 S9 q$ F* Y* P* Q6 c$ _  \1 Y: k    BYTE  btIsDiskExist = 0;
# T8 b' ~' o3 x# [' i1 M    WORD  wOutDataBuf[256];

6 K; B6 `4 r) z6 Z7 l- U    BYTE  btIsFirst = (BYTE)bIsFirst;
5 E3 r: g% r) g: [: t& H
   const BYTE btBit00 = 0x01;
7 I7 Z' V1 f) w2 R7 D- x/ P    // const BYTE btBit02 = 0x04;
- E3 f# K: O( W    const BYTE btBit06 = 0x40;
: `# O8 G. {* K6 d# }! l* w7 j" W    const BYTE btBit07 = 0x80;
" [, a( X! U/ y' [/ D' N' g2 e    // const BYTE btERR  = btBit00;
7 J  S& c! |" y6 e    const BYTE btBusy = btBit07;
2 P- O2 ^8 _  G( N    const BYTE btAtaCmd   = 0xEC;
3 Z0 X6 h7 z7 V) N% i% l- L    const BYTE btAtapiCmd = 0xA1;

. d8 y9 `. D, |+ v' k4 ^    __asm
- |6 V" v! s$ P+ I2 {9 x    {
5 u1 @! r4 ^+ Q; I1 M* k        // 必须先执行这条语句
& Z4 Z5 F6 ?( \! ^9 M# m9 n        JMP EnterRing0
: A  s2 Z  Z' j, _) v- a1 D
  o2 Z% l% W# k4 o; L        // 定义过程
* y/ Z) D8 k5 f! X( `" e        // 等待IDE设备直到其不为忙为止
       WaitWhileBusy proc

       MOV  EBX, 100000
  M9 R+ F2 `3 q0 c3 h        MOV  DX, dwBaseAddress
- q2 [$ k( f1 f' R+ `) }        ADD  DX, 7
$ E  w+ U, a4 x4 c" n, u
       LoopWhileBusy:

1 C( e8 _5 c2 b  ~        DEC  EBX
       CMP  EBX, 0
  E6 a7 Q/ n" `9 Z  D8 e8 @; C        JZ   Timeout
' d$ E' Q# c# {) }, a; M) N- d7 ~        in   AL, DX
0 g! M' T: k* j- A' M7 Y, ~. [% m        TEST AL, btBusy
       JNZ  LoopWhileBusy
$ _2 y; p6 u% ]% X" d5 z        JMP  DriveReady
. p: d  Y* U% X  M- `- T$ R
       // 超时，直接退出
3 ?1 }% I' Y8 C% e* _  F6 K# W( G  Z        Timeout:
       JMP  LeaveRing0
1 X1 a$ t$ t& [. v        DriveReady:
       RET
       ENDP   // End of WaitWhileBusy Procedure

- d# w0 h! f7 ]        // 设置主盘和从盘标志
       SelectDevice proc

       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
9 v, {+ U1 K- \- V. g& X
       out  DX, AL
3 Y' S( a, Q$ R% Y        RET
1 I' x& w* N9 A7 S! o- a% Z
       ENDP  // End of SelectDevice Procedure

- l1 Q  w, o' S; H, y! J; X1 A* V8 Q        // 向IDE设备发送存取指令
       SendCmd proc
+ y& k+ _0 z8 |7 a, [: u2 w1 B
1 e( t% r6 A& \$ G        MOV DX, dwBaseAddress
* A4 K3 y  n/ ~+ O        ADD DX, 7
9 z# l& z% `1 ~        MOV AL, BL // BL是主从盘标识，在过程外设置
5 n# e* W  U' Z/ `& M1 V        out DX, AL
8 |0 g2 v" P+ @$ o+ {. ?- e( Q        RET
       ENDP  // End of SendCmd Procedure

) v. Q6 y* X8 a+ I        // Ring0代码
       Ring0Proc:
+ F1 S; L8 ?1 g8 O! j- `        PUSHAD
  e8 ]; Y7 _- H9 ^        // 查询IDE设备是否存在
! C- x! l0 G4 Q1 N* M& w        MOV DX, dwBaseAddress
8 o- C, N; U$ C2 Q, P2 i        ADD DX, 7
       in  AL,DX

' ~/ l! J" a. N1 {' Z# W# B        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
% H7 p8 d* l: M6 b, g        JZ  LeaveRing0
4 X; H( j* t+ e5 H& c        CMP AL, 0x7F
8 }% ]7 K" r1 h- a        JZ  LeaveRing0
$ T& p9 p0 W, [
# U( ?9 H. s" E5 m8 ]( R5 s; |        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

( Q* f9 y. i/ w; a- f        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
, n0 R4 {2 B3 Y: J( `5 K        CALL SelectDevice
0 ^2 ~5 ~: [! v$ i0 W* l. M/ @
; s+ R* ^! j, r/ N9 }        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
. y# ]+ @$ Z1 ^$ }2 l        CMP  btIsFirst, 1
$ h4 @, k. A/ }: E0 k( |4 d* a        JZ   LeaveRing0

       // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
       CALL WaitWhileBusy

8 B" R0 l% `5 B6 Z" e0 U3 M" {        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
       JZ   LeaveRing0

. g& S4 ?2 f& ]        // 设置驱动器存在标志
9 g4 K- F- S& e6 v" E1 v5 _+ U        MOV  btIsDiskExist, 1

/ X6 _- \5 A4 E( a        // 发送存取端口命令
       // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
2 j% R. e/ b% d. ?: ]9 R0 A& f2 E3 ^        CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
, T8 W' r/ o! M- K0 [8 K        MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
       CALL WaitWhileBusy
* Z8 b2 ?' X" \
       // 检查是否出错
0 \3 g5 i) ^4 T3 o- P& q        MOV  DX, dwBaseAddress
       ADD  DX, 7

, [0 n$ E5 M+ H* M3 v) P5 ~        in   AL, DX
5 j( ]9 y* Z, ]% r  ]" V8 S
       TEST AL, btBit00
9 f, B% C1 Q8 \, U* h' I' Q# u        JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
( y9 v( E' p. J* O8 N        CALL WaitWhileBusy
& N( j4 l& y3 w6 f$ Y- V( b$ T        CALL SelectDevice
" L3 ~- X2 I, c+ t  |+ w        MOV  BL, btAtapiCmd
       CALL SendCmd
7 i/ f- j, s) O4 I% S/ V, D. D        CALL WaitWhileBusy
7 Y5 _$ \# k3 i8 f" e" D
2 V1 k' E1 I; u1 V        // 检查是否还出错
( X9 O0 Q- a$ {5 [9 Y/ H6 {        MOV  DX, dwBaseAddress
       ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
( h  M  A& P' r1 e  d% C" R. |        JZ   RetrieveInfo   // 没有错误时则读数据
       JMP  LeaveRing0     // 如果还是出错，直接返回
  ?$ I% A/ M. {" y; M
6 ^! B, {3 b& h( S: h# r( a        // 读取数据
; w' h9 ^5 d8 t# M        RetrieveInfo:

/ c6 z; ^) p" v3 Y9 C        LEA  EDI, wOutDataBuf
       MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD

       REP  INSW
" ~# ?; c2 p  A
       // 退出Ring0代码
       LeaveRing0:
3 m4 A! e7 o. R& d  |
       POPAD
2 ?- _) l" g# N, @$ x        IRETD

3 C/ l6 y( [8 H        // 激活Ring0代码
+ V+ L% T% x; f  F* A        EnterRing0:
  c3 V/ G+ ]/ h; K  {# `
" Y% y0 v5 @+ o        // 修改中断门
1 v* v* {: U; H+ `" g        SIDT FWORD PTR btIDTR1
6 w0 ^! N' I: f        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI
9 k+ `7 }5 n; u% W
       // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
1 B; S4 B& Q6 X5 A* A$ `9 N        MOV dwOldExceptionHook, ECX
  a( W* \2 Z2 `$ e9 j/ t$ u
       // 指定新入口
       LEA EBX, Ring0Proc
& D! j, A  K# j! @, C  z        MOV WORD PTR [EAX-04h],BX
% }  J; T8 Y  S; J- ?, O        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
  b+ S# D/ M5 g& E6 i+ Z
       // 激活Ring0代码
' k" n2 z7 l: @4 h$ ]2 _+ H        INT nHookExceptionNo

       // 复原入口
1 W+ d1 d% K' r1 W        MOV ECX,dwOldExceptionHook
) k: f' o( x8 |" d0 B" l% e        MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
+ ?2 j, L' a8 o/ X/ o4 T& ]' A        MOV WORD PTR[EAX+02h], CX
       STI
   }
   if(!bIsFirst)
8 u& C. Y; i, f. p6 j9 x3 }    {
/ N0 E; [1 U+ C# I  y$ K        bIsIDEExist  = (bool)btIsIDEExist;
* [5 k- |4 q9 t        bIsDiskExist = (bool)btIsDiskExist;
: L" [7 Z4 O5 i4 A        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
1 v4 f7 Q  l% j2 S( o" c    }
) J0 h2 _3 ^0 Q1 m9 h}
//---------------------------------------------------------------------------
! Z. f! P, q$ v0 @+ a// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
{
2 w4 b& L+ z+ i+ e; g- g    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}