[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
% d6 i7 e1 ^5 Z6 t8 R#include <stdio.h>
7 Q, @7 |  o, R, H2 c$ y
% r8 R7 ]2 a; T# n7 u4 m4 x' P2 e#pragma inline
* n. p! a  U! e1 s" N0 i//---------------------------------------------------------------------------
0 ^( d5 X' i! a; \3 W// IDE NT/2000/XP专用变量
$ P6 F% h/ O+ b0 ?3 y9 J#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
- r7 v" `. R# U" C: m+ l3 ], m#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
6 y: y# W2 y8 `- i4 l5 J6 x#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
) T3 D7 X; P. v, Q  o$ ]7 Gconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

const int MAX_IDE_DRIVES = 4;

// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
2 G+ D3 S8 W6 _0 g* k% Kconst DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
0 G3 W* v2 q2 z: i$ Z7 a' fconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

5 w# \* D* q% {( Ztypedef struct _SRB_IO_CONTROL
& r" y) D$ F3 o9 e- e% o) [{
   ULONG HeaderLength;
2 f+ F" {+ b3 t% i% G- \( H; c3 B    UCHAR Signature[8];
   ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
3 a( M- t4 J% A6 d    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

' a: o& ^4 f% u0 N$ Q2 u9 ]+ a// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
// NT/2000/XP函数
. x: I- E7 o6 i& h' O1 O' nvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
( ~! `2 d5 ?8 p9 d9 _bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
! _8 r# Z$ H  b4 i  [6 r        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
       BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
& n) l; P" w" \# i( @// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
* u/ I8 M/ S* g, c! Avoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
3 m3 F, [3 ?% H3 w        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);
9 A! O% Z8 C' b/ h  C* A1 q
4 P: T% {2 K' t; U. z; ~+ }// SCSI读取函数(for NT/2000/XP)
7 c% k0 R9 g" b6 @, T2 K+ T4 hString __fastcall ReadIDEDriveAsScsiDriveOnNT();
- P9 m4 D4 E% e& j//---------------------------------------------------------------------------
0 j; t9 d- K; u4 D, C: N. T// ReadPhysicalDrive
1 x. ]& H8 y: q7 _8 V: Avoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
/ Z/ a, T, a8 u2 C, S{
+ E  w) T7 E% P    switch(Win32Platform)
" q" n; f( d8 N, Y9 k3 S1 S7 Y$ }    {
' w2 ~4 ^/ ~2 l# }/ g/ _* ^        case VER_PLATFORM_WIN32_WINDOWS:
           ReadPhysicalDriveOnW9X(pSerList, pModeList);
2 u1 }3 `: B' Z# f7 p) L# q  A3 L            break;
3 {) h& h' k- p+ w4 H5 D9 \% K        case VER_PLATFORM_WIN32_NT:
* K, ?1 t0 {) P. \; V. p; _& D            ReadPhysicalDriveOnNT(pSerList, pModeList);
           break;
       default:
           break;
* H: B  ^4 x! p: x  |6 D* t    }
}
& Q6 h. r7 q3 K' t; x; F* q//---------------------------------------------------------------------------
// ConvertToString
. o1 F- y9 F; ^* j) X( m6 cchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
: i& \* E/ a4 W/ I/ ]    static char szResBuf[1024];
   int nIndex = 0;
   int nPosition = 0;

4 t* L( [. [% l. p    // Each integer has two characters stored in it backwards
& M6 j0 z2 H; M  v% e& w) E    for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
9 W: q: _' D" b7 `    {
       // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

% Q4 F& A, |. H! R; ^  @        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
( Q' M2 j0 ^* d9 e7 I    }
) f4 t% x' m' K/ U% K& L# a
   // End the string
   szResBuf[nPosition] = '\0';

   // Cut off the trailing blanks
   for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
# @0 r$ I" u0 s
   return szResBuf;
1 F( O2 p. X+ F}
: l& E; `! _- ?0 X9 w//---------------------------------------------------------------------------
// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
4 o8 w2 Y% \9 l& n4 `7 N// ReadPhysicalDriveOnNT
# z: @! t- D. `) _6 @- I. `; n0 l( lvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
8 X+ J' o* g$ W% B# g8 f0 H/ N5 r    {
; u; `+ g, l# {        HANDLE hPhysicalDriveIOCTL;
- i! ^6 v$ l  z        char szDriveName[32];

1 u% C$ m2 e9 C# v: f" b        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
( q5 f1 E4 H7 w: [4 N+ M                        OPEN_EXISTING, 0, NULL);

       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
. L( z) [: C% C  M            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));
: i, d  e6 d1 c0 Y1 p& ~2 K" K# D
0 _7 M+ Y% ~* \2 u5 o$ k# }  }' c$ t            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
% }: {+ a2 `& ]4 T                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
- `  h9 W! n! y( Q+ W& o7 t                continue;
$ [% r7 q1 C8 v/ @" R            }
7 O% R: x) \2 ~
; U  h6 r; k! D% m2 W& _+ |5 o6 H' Y            if(gvopVersionParams.bIDEDeviceMap > 0)
           {
               // IDE or ATAPI IDENTIFY cmd
& e5 g  _& K+ @' g) g                BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
& I. ~. ^, d/ ~' N. `                // Now, get the ID sector for all IDE devices in the system.
- T0 G; [+ N1 c+ W" W" ?& R" U9 i                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
$ _4 C& o9 U7 w$ @( x/ B7 C                // otherwise use the IDE_ATA_IDENTIFY command
% A+ n+ @* P( ]1 O                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
6 K7 d/ y2 [6 r! q/ D3 }. P                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
7 \6 Z2 ^, x( J$ S7 H% q                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
, w8 k: O* c6 o% a, j2 `. k5 p! K                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
  z* e5 j9 e) a# K. ^" X
               if(DoIdentify(hPhysicalDriveIOCTL,
3 W- E  O6 p  N" E0 L                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
5 O+ s5 G# _. S                    DWORD dwDiskData[256];
" c. b" y) k2 Y6 Z# A- r                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
8 A4 ~; o; W! {* T9 M                    char szSerialNumber[21];
; R: D9 B3 l/ F# K                    char szModelNumber[41];

' n$ ]1 n5 c2 ]9 i7 _+ E5 `9 h                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
  i' @; N, L/ J: q8 t0 U6 y. r                    for(int i=0; i < 256; i++)
0 k# j) D+ x. e+ z                        dwDiskData = pIDSector;
% i# K# x. ~2 O" h6 I  X5 U                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

4 r; i  T) Y2 {( M5 l4 p7 A5 t0 ]                    // 取模型号
                   ZeroMemory(szModelNumber, sizeof(szModelNumber));
                   strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
6 |7 o4 j: l3 w
3 m7 L3 F! G! [& s3 |# w: N5 c# n: |                    pSerList->Add(szSerialNumber);
. s. K8 n* |8 @* s1 w                    pModeList->Add(szModelNumber);
8 K# m+ j. {5 c4 n$ Z; w                }
           }
           CloseHandle (hPhysicalDriveIOCTL);
       }
   }
' \8 O+ ?: N' B" Q! |}
//---------------------------------------------------------------------------
5 Q0 D: @. }9 Y$ K! h6 y+ c0 p// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
, d7 c0 e  F! R1 z; Q$ r6 e% V              PDWORD pdwBytesReturned)
{
, T- e0 H( @2 R/ I    // Set up data structures for IDENTIFY command.
! p$ G4 B. e$ [+ J, r    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
5 a+ D2 n$ z8 }& E) P( c    pSCIP->irDriveRegs.bFeaturesReg = 0;
   pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
# J7 T! g8 ?3 x$ v    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
6 E! x' d' h$ H9 P
   // The command can either be IDE identify or ATAPI identify.
. }. B% v. N. ~8 r- J: k7 k    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
% R7 c" w3 o2 I6 O: h2 F+ [) i    pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
% L; h& x+ T# ]
5 ?6 E) X. t% B% p7 X    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
/ S- F& F7 j# K           (LPVOID)pSCIP,
+ ~  _% o( C0 p' v           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
3 G% P$ v1 X8 E: H. U# Q( A5 S0 `           pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
- ^( g3 Z( j( ?: G" Z// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
# F4 \" F2 {  E8 Z{
- F, g5 M! a" h) N5 G, W, a2 X    WORD wOutData[256];
& A4 r: o( x; {: w5 Y    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
: G# k' M3 o! j: _: c    {
3 ~+ [+ t$ a( I. P        WORD dwBaseAddress;
, ~' x* C4 b: g) q! W        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool IsDiskExist;
+ s# F) b& M+ [3 m& v
       switch(nDrive / 2)
       {
+ H5 ?$ W3 M5 V0 {            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }
" P0 P2 l! A4 B# T! |) k
; b# C$ Q9 t2 K: _. x" y& ?        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
5 q% y' i: F5 l) F
2 f; u, K- r$ P8 i6 h# Y7 B' T* Z        // 进入Ring0
6 H4 {! ~" Q* I. R3 r  J        ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
9 u5 s' N% p9 E) P) T                bIsIDEExist, IsDiskExist, wOutData);
$ n6 g$ w$ O' r& t) {. S; `    }

0 |/ t: ^3 \2 z/ s" K1 M: C    // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
: }7 B( d' R7 g% S& i/ |    {
       WORD dwBaseAddress;
$ z, o- E5 Q) F& c2 v, S        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
: s& ]' \$ t$ ~. h: W        switch(nDrive / 2)
       {
( h7 o5 b1 ^# H, {. ]8 M0 q            case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
7 h3 b4 u- H" f4 f2 K, X! H5 _        }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

       // 进入Ring0
5 K0 x& e- m: L6 H7 m4 k3 Z- [; W        bIsIDEExist  = false;
       bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
8 @$ V8 X  k: I5 M( R! T
       ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
/ ^. ~7 y1 Q/ P4 F2 `                bIsIDEExist, bIsDiskExist, wOutData);
1 u9 ^7 f" S1 ?, s) I% b: r
       if(bIsIDEExist && bIsDiskExist)
       {
           DWORD dwDiskData[256];
' }, O+ P; W$ o2 J% X            char  szSerialNumber[21];
           char  szModelNumber[41];
) }' r# l- m# q$ G  R0 v9 O
. u" @1 H& c0 ]5 y+ D            for(int k=0; k < 256; k++)
7 A) O7 V  {' K& f, B                dwDiskData[k] = wOutData[k];

           // 取系列号
9 S$ m, v7 @; V' M            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
& _6 r6 |3 B( I            strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
1 k, C7 L5 K: E8 n
$ L$ b' ~4 ~' x; K4 @8 b$ u            // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));

           pSerList->Add(szSerialNumber);
. ?0 M/ i1 X" B! w& Q: u$ R% t# R            pModeList->Add(szModelNumber);
       }
0 `% Q, }4 o6 [% X    }
   SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
7 d1 G% U- z7 w}
//---------------------------------------------------------------------------
7 t$ i) s4 g9 v// ReadPhysicalDriveOnW9X_Ring0()
8 \7 g! ?6 _! S" ~, G//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
* M+ t+ {& C4 _// btMasterSlave = Master(0xA0) Or Slave(0xB0)
9 H9 {" }$ {2 \6 \& g9 j" D/ }2 B2 n" ^//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
# C- }; Z9 X+ k        BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
& r9 y7 z2 k, D4 B% i! W8 n# b( S    const int nHookExceptionNo = 5;
/ r% X  r7 d- _/ p; M. W
# x* @7 D+ l) ?    BYTE  btIsIDEExist = 0;
. l) L& E! k2 X; N0 _0 m* r) h  Y    BYTE  btIsDiskExist = 0;
2 i& M" Q9 `' g+ y- ~    WORD  wOutDataBuf[256];

   BYTE  btIsFirst = (BYTE)bIsFirst;
' z0 g, {8 k7 R& J( c
! R/ ~5 w1 ]3 a! E1 E* K! c    const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
/ Q7 g: N3 ~; Z# X" J    const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
$ K# F8 ]7 e2 i9 h- b7 E4 Q    // const BYTE btERR  = btBit00;
" [6 i9 f  \' q7 F/ P7 ]. }    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
% o. |5 O, ]' S+ _7 |) ]0 w
   __asm
   {
       // 必须先执行这条语句
, _: x+ r7 Q' @3 U3 _, t        JMP EnterRing0
; f3 k% g9 E+ v6 q$ E
       // 定义过程
5 ^6 V: \2 K' W        // 等待IDE设备直到其不为忙为止
5 u# r3 H& [% U2 ~6 t        WaitWhileBusy proc
' N) m6 K$ S0 S
       MOV  EBX, 100000
  T* E. m5 U( ~) e& t2 @8 \. L        MOV  DX, dwBaseAddress
       ADD  DX, 7
0 D0 A# e* A4 ~( f+ o
0 y6 X1 I( ^8 n* w! [7 `        LoopWhileBusy:
. d5 V" J% c4 L2 T- q' G
       DEC  EBX
* ]/ k3 P. k. S* J6 k( u        CMP  EBX, 0
       JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
1 K- E, w* Q" h$ _. M8 U        JNZ  LoopWhileBusy
* {: V* E0 {* N# n1 Z9 |7 d        JMP  DriveReady

* w- M* _( a% L; b+ k; M/ a7 T        // 超时，直接退出
; H4 I7 L- a: W        Timeout:
; y0 u% X6 h. z, }        JMP  LeaveRing0
1 w' y( ~9 ^; U/ B' i        DriveReady:
+ n$ g8 Q) f" n        RET
& ]" t5 F# D7 u$ y5 s        ENDP   // End of WaitWhileBusy Procedure

       // 设置主盘和从盘标志
       SelectDevice proc

       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
4 S- C5 ?2 |1 B
- H8 Q: S/ x1 U- @, O  f" `+ T; E        out  DX, AL
       RET
) D' ?* m. z/ f; @+ W7 [
       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
       SendCmd proc
- q: g/ \; A5 A7 i, M7 t- g
       MOV DX, dwBaseAddress
       ADD DX, 7
8 S9 \. w! J2 P4 s# @- s        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
       RET
       ENDP  // End of SendCmd Procedure

- f. r: w  H, v        // Ring0代码
       Ring0Proc:
) _3 Z- d! B: m$ g+ E" V! R        PUSHAD
       // 查询IDE设备是否存在
       MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
. p5 O5 a. Y8 ~+ r, X  r
7 a6 k1 ?$ D  x# z* U: B1 D        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
9 w2 f! M( @: a% B        JZ  LeaveRing0
5 A1 W* |1 u2 h, J5 g# T6 Q! \        CMP AL, 0x7F
       JZ  LeaveRing0
2 _, B% o  ], q3 I+ n
& s" _* B* v2 G" Q) \$ o/ p        // 设置IDE设备存在标志
  N5 U/ ^$ B5 }+ D) }) C$ b4 e        MOV btIsIDEExist, 1

" b. p& e( Z3 ]# p        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
       CALL WaitWhileBusy
       CALL SelectDevice
* w( ?2 O0 Y4 u: G# O4 `
: H$ J, x5 w- x& {  h        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
) h* w5 N; I5 ?1 }        CMP  btIsFirst, 1
       JZ   LeaveRing0

( n& W  `4 v# p- p        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
/ z9 u7 ?8 f/ o" B5 @        CALL WaitWhileBusy

' j0 Q- ~+ Z. Z) e/ I        // AL的值等于cBit06时，不存在驱动器，直接返回
) H( d/ l& @% I4 y0 T; j        TEST AL, btBit06
7 j: A2 E/ Q$ ?* f; d$ k1 U+ C        JZ   LeaveRing0
- }. x- S0 B% R
# h5 R" b1 y" W- Z4 d0 G        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
, o. [9 f/ @7 n$ e! D( K
       // 发送存取端口命令
0 a: d, T3 Y/ i2 k& j' o5 o        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
/ n: x5 g) p! c) }% ?% g+ ?1 M6 \1 `        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
8 P; V% `7 Z2 Z7 [! b        MOV  BL, btAtaCmd      // 发送读取命令
! L2 t9 n* r% p  H. U. z' I        CALL SendCmd
" I! x( `* N" s% @( \4 Q        CALL WaitWhileBusy

  \' x8 O- i# e0 w        // 检查是否出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7

       in   AL, DX

6 L( ?) c' K% `5 I& E" D        TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
$ h( [/ ]/ H: Q: p( I+ s( ^, w        CALL WaitWhileBusy
) S7 N8 [# o; R, N+ ]0 c        CALL SelectDevice
# O$ ^0 e' L+ y, m2 o        MOV  BL, btAtapiCmd
       CALL SendCmd
7 O- E9 ?. F$ G2 y' z5 m( s  u        CALL WaitWhileBusy

! ~: c% S: m- B6 B        // 检查是否还出错
' k6 @; [# J! [- x        MOV  DX, dwBaseAddress
       ADD  DX, 7
* r5 p2 K' V4 V8 p8 q& h, ^        in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
8 r7 x3 O( M9 ^0 L/ z        JMP  LeaveRing0     // 如果还是出错，直接返回
; z% p* g4 W& @, Z# S. b) H
       // 读取数据
       RetrieveInfo:
- x* G2 E0 `& U. V* Q9 d! N
       LEA  EDI, wOutDataBuf
& Y, O8 o$ i9 K9 }        MOV  ECX, 256
) O: L! K0 @# w: w        MOV  DX, dwBaseAddress
       CLD

1 j% W+ `, b' s% v) g- a        REP  INSW

       // 退出Ring0代码
/ w; o) G' G; v& I7 ~        LeaveRing0:
1 `' L2 D0 o9 {8 Y# r
* f. V7 C0 J0 v. Y3 l2 }3 y" w        POPAD
       IRETD

       // 激活Ring0代码
9 I" I& |3 [/ m        EnterRing0:

* v: F4 W5 L2 n  s) t( d3 S5 r        // 修改中断门
  c7 V- c4 N/ W+ L  s( P3 n0 d- d        SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
# I% c9 @5 S) v4 o        ADD EAX, nHookExceptionNo * 08h + 04h
. Q3 q0 ?0 O& h0 W0 N4 n1 w$ W        CLI

2 m5 ]) l! N) g9 ~        // 保存原异常处理例程入口
/ e% j! D+ S% a. Y1 v+ E) l        MOV ECX, DWORD PTR [EAX]
$ o7 F1 m3 c; [3 u# |        MOV CX, WORD PTR [EAX-04h]
6 w! }( b' N% S$ C, E- W" S9 G        MOV dwOldExceptionHook, ECX

# r& j$ ^2 Z# m' u. v) ?        // 指定新入口
       LEA EBX, Ring0Proc
4 p' S3 d' U3 r5 R        MOV WORD PTR [EAX-04h],BX
. j4 ?6 ~, D" ^  y% x9 S1 W        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
) H! s; W1 n* Q/ U! k
. y6 ~% g/ o6 ~% T% e( z0 K4 _        // 激活Ring0代码
       INT nHookExceptionNo

. G  d5 S$ \8 ]! F* ?7 e, w        // 复原入口
       MOV ECX,dwOldExceptionHook
$ ?: L! A3 x7 E5 ~        MOV WORD PTR[EAX-04h], CX
4 d: y& U5 ^0 r. [        SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
. s; O, z1 Z& Z' `    }
$ G4 L. Z! V6 p8 _9 U3 _, C+ N% s    if(!bIsFirst)
: ?' o9 R4 q, }' ?/ ~    {
       bIsIDEExist  = (bool)btIsIDEExist;
" R  k3 ]  a2 a        bIsDiskExist = (bool)btIsDiskExist;
; W, n7 d  `$ k5 s        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
7 I. U2 h+ Q! v" N    }
5 ?  H3 u( }/ @" @/ l1 M}
' n( N2 a3 H) j- N0 G' i" O//---------------------------------------------------------------------------
+ {; K& W$ [, O  ^/ z// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
{
   ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}