[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
9 q" y& w5 `% t, T4 M4 @* e( y#include <stdio.h>
" S# P- z1 V3 c2 a, w
( B$ |$ u0 a& O6 M# R/ w#pragma inline
7 B) Q5 c" D0 k7 `9 ~& w, P. \+ w& G( z& A//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
' O9 F: Q: A3 D  T7 m* r' E/ K#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
% |% d% M- O1 Q( q, |#define DFP_GET_VERSION         SMART_GET_VERSION
& t" E) z3 v  D0 k1 Z0 S- r* R#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA

3 |$ \( p* i* Z3 |const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
const WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令

) ^( }5 m; N% k9 g- U" Gconst int MAX_IDE_DRIVES = 4;

  o% P. E  {( X3 {& n$ ~// SCSI专用变量
: G+ c. }$ F% vconst DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
: T) [, J$ l8 y# o7 `const DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
+ x4 ?% @( E  u% lconst DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

$ f4 [4 }% C$ x" |typedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
   UCHAR Signature[8];
   ULONG Timeout;
8 Z) B$ g% L; J3 {. J    ULONG ControlCode;
! l, K9 R* p, T( ^# G    ULONG ReturnCode;
   ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

" T; {7 f1 |& U; z: I! Y! q// 读取的主函数
7 h4 T# _) K. Z0 f! {  gvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

6 B' n2 h% A3 f// 辅助函数
char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
( \& G* Q, D& ^1 n6 J0 ]// NT/2000/XP函数
  g% d: G1 U3 H1 s9 xvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
* u! U( ^2 f: l6 i        PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
( `( Z0 X. b! T1 L, H        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
. a9 [- Y0 }- ~+ k// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
* |& k9 Y! u9 J) @# N8 Q( lvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
6 [' X3 K7 ^7 U, P! |. l; l        BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
0 c7 t) h5 z) O- m+ J  lString __fastcall ReadIDEDriveAsScsiDriveOnNT();
//---------------------------------------------------------------------------
// ReadPhysicalDrive
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
4 c# S% H" U/ h* k3 |9 |! Z{
' [! S+ L3 p0 K/ x% D6 g5 {    switch(Win32Platform)
   {
       case VER_PLATFORM_WIN32_WINDOWS:
) G% C- |* o0 t8 s% u            ReadPhysicalDriveOnW9X(pSerList, pModeList);
) {; \& R" F- @. E9 e2 ~            break;
9 z4 u, H( E  o        case VER_PLATFORM_WIN32_NT:
. `) r7 A( |) N+ {5 q1 S            ReadPhysicalDriveOnNT(pSerList, pModeList);
0 \2 O% Z3 p+ |( D! {            break;
       default:
0 ?& K# U+ o) F: @            break;
& s# D& L' O+ L3 }+ O    }
# t  `, a- S4 r9 w4 n. o}
//---------------------------------------------------------------------------
// ConvertToString
8 ~7 i$ O, M7 d9 R' n$ X% g0 h5 }char *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
{
   static char szResBuf[1024];
: A3 U- l% E6 b& k( u    int nIndex = 0;
* q' J* m7 N5 e& E    int nPosition = 0;
% B5 w8 @, f# A4 \/ V6 W& m/ }/ A
   // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
5 [. {1 a- c# F; V" a        nPosition++;
$ Y! o: S  ]3 K" j3 s0 j- N
       // Get low BYTE for 2nd character
' {9 N' b, d" c. a& N$ a: z        szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
       nPosition++;
. f% H/ Q1 V4 \2 }4 k; ]8 t) H    }
1 d5 A2 L! l4 _
% ^( G0 h9 ^# C+ ]' d+ z& m6 V# d    // End the string
   szResBuf[nPosition] = '\0';

+ z* ?  q" E$ Q: `2 @. H4 V) V    // Cut off the trailing blanks
/ E/ \/ s" j1 }/ Y. ~    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';
0 J1 G$ i- n* j0 ~9 y! A; d2 k+ L
# t5 D) Q( A- i3 X    return szResBuf;
' S$ t3 ]' Q- A+ B7 ^* s5 s$ g}
//---------------------------------------------------------------------------
2 ^7 r( s- ~0 Z// Winndows NT4/2000/XP 代码
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
' k" g8 T9 `: g) `1 [void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
$ P: k: O- z2 s5 i{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];
3 L0 R8 V, k5 [: K
   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
   {
" {3 }+ X% ^5 ^8 }! R  \        HANDLE hPhysicalDriveIOCTL;
; k: Q: ~6 G+ M3 T& [$ x        char szDriveName[32];
0 y# a& m3 `3 ~; D/ L0 N% s
  t7 ~5 q) u  h4 m! A% ~$ m        sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
! `  K7 _& T8 k2 g        hPhysicalDriveIOCTL = CreateFile(szDriveName,
& C# g. _) t  C2 V; ~( F                        GENERIC_READ | GENERIC_WRITE,
                       FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);

6 \+ c% P. C  T, A) X        if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
2 T& m: \4 U& K4 M  Z        {
           DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
           ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

           if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
7 N4 X$ ^6 d2 `: \  Y/ U# }: e                    NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
4 @3 J3 k! k& F: S& P            {
               continue;
( l+ M: c5 o0 I- M            }
! g4 U1 U* W$ ]. A) v8 A
5 K1 f5 `) O% m9 c- g+ d            if(gvopVersionParams.bIDEDeviceMap > 0)
1 ^% C$ }4 P# `4 H% j4 o            {
' C* u! A9 Q8 Q2 t                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
               SENDCMDINPARAMS InParams;
3 V; e8 u. I( {( k1 G+ d                // Now, get the ID sector for all IDE devices in the system.
! N2 m- D0 d" K/ N/ U, p                // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
               // otherwise use the IDE_ATA_IDENTIFY command
" G9 O, a% U, Q8 z- K/ }+ ~                // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
) x0 Y3 N( B  J" V; W                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
- H* o. G7 m' F1 y% L% x2 @' U$ o                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
$ L, d; x, v/ J/ }% w                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));

4 O$ {! P7 G" O' O5 s                if(DoIdentify(hPhysicalDriveIOCTL,
% ^+ D& {4 j$ R6 O1 ]) l                     &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
% p3 R# s/ `2 o' B' Q" \) C4 I                     (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
               {
% `; H" k' `4 Z$ C                    DWORD dwDiskData[256];
+ ?2 N/ H& D4 g3 V% e                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
% @9 q+ e  _% z4 i( V4 _* [                    char szModelNumber[41];
# O: j( L! e8 ^5 Q) ?/ a3 t
; T/ p# @% W, m# Y0 X- z& U: c                    pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
                   for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
4 L  g- P8 a' J9 N                    // 取系列号
                   ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

                   // 取模型号
( b3 Z9 z: n9 \/ P+ U( j                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
$ b5 S% Z7 L+ Q1 D' }2 m4 @) X                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
; q( p0 X# X  E& Q8 \1 U" U7 a/ d
                   pSerList->Add(szSerialNumber);
: k8 _1 Z& k. Q0 d! E                    pModeList->Add(szModelNumber);
               }
           }
           CloseHandle (hPhysicalDriveIOCTL);
4 P2 \7 d1 k2 S2 s        }
* v1 x6 S9 t, ]+ x7 ~3 H    }
}
4 e5 v" q5 I) L% q//---------------------------------------------------------------------------
- l( }: T+ H" V9 \+ @+ g. c// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
4 X7 l5 M8 J4 f5 n1 I              PDWORD pdwBytesReturned)
; L" @2 @  X  j: P{
   // Set up data structures for IDENTIFY command.
; s3 S1 _$ B( j6 a+ c& y    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
/ h! M& r; _5 z( n+ n    pSCIP->irDriveRegs.bFeaturesReg = 0;
4 G, ?6 }9 \9 b' z6 y    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
   pSCIP->irDriveRegs.bCylLowReg  = 0;
5 @" p1 n+ f+ q! x, d1 q+ K    pSCIP->irDriveRegs.bCylHighReg = 0;

, _  V/ C; S' v' i0 h* w    // Compute the drive number.（主盘和从盘所对应的值是不一样的）
& p2 L6 L0 B. ?    pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;
6 }, b2 {& w! S( z
' @/ ]' p0 N4 d8 d8 U- Y9 n    // The command can either be IDE identify or ATAPI identify.
; _; d1 f$ B8 P/ b    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
   pSCIP->bDriveNumber = btDriveNum;
   pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

7 [! a* d) ^& _7 l; `" h    return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
/ V! B. g" f+ Z  G8 Q6 ^- ?" n- P           (LPVOID)pSCIP,
          sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
          sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
" m8 a! u5 J9 w3 O% \& P+ Z// Windows 95/98/ME 代码
//---------------------------------------------------------------------------
1 `9 s0 m$ _# x// ReadPhysicalDriveOnW9X
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
, n6 o' B( B* Y8 z9 m{
% u( @& [8 M( N7 p, e- n8 ^    WORD wOutData[256];
9 z- B# s# S) o7 V    SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);

) [/ V. f( x8 h5 h+ G6 L6 E  {. |    // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
( Q6 W2 N9 W% S2 V6 i    // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
* R7 ?: ?/ v) t; b* u/ V    // 避免蓝屏的出现。（期待高人能指出原因）
   for(int nDrive = 0; nDrive < 8; nDrive++)
+ z; k5 W- h, i6 U' |) B    {
       WORD dwBaseAddress;
' W" b1 O3 b# k/ j        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
  S1 o, A" Q* y4 j4 I2 v        bool IsDiskExist;
3 s) @" ~; F+ p" E$ C" ]* Z! a
* |1 _" A2 I# h  @! c, |9 N        switch(nDrive / 2)
       {
$ d# F4 H. T0 H3 R' K. j0 N/ r" g            case 0: dwBaseAddress = 0x01F0; break;
% ^7 u$ {+ H/ j3 p- }            case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
* d6 ~  N) p0 ?+ v- w            case 3: dwBaseAddress = 0x0168; break;
       }
8 Y3 X2 S  [' E) [# r# X0 G
       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
( O; N# _0 l0 p0 }/ q5 E
       // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }

   // 开始读取
6 ^9 `* }1 g1 `  e8 j1 V( _( g    for(int nDrive = 0; nDrive < 8; nDrive++)
   {
7 w. i/ G3 S. `9 X4 G* Z        WORD dwBaseAddress;
( J. M' m. L4 [% k  R1 P        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
       {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
; m' N' U3 |+ p            case 2: dwBaseAddress = 0x01E8; break;
9 X8 C! k9 Z2 k            case 3: dwBaseAddress = 0x0168; break;
       }

+ t- G9 B4 X7 _3 R        btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
4 ]9 }% `" E6 X9 D* D$ x: m
0 U0 X$ R0 v) ?" N4 S        // 进入Ring0
7 l% c$ `8 o% @# i% e* r; v/ s        bIsIDEExist  = false;
       bIsDiskExist = false;
       ZeroMemory(wOutData, sizeof(wOutData));
0 R) N2 c5 \: c
& a/ h1 j: I$ i: \( r0 x        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
; _! Q8 f8 T' j; `( K                bIsIDEExist, bIsDiskExist, wOutData);

, {/ q. ~- A0 ?) w  q( M, W9 b        if(bIsIDEExist && bIsDiskExist)
       {
' Q# n. M+ y3 M9 G* S            DWORD dwDiskData[256];
           char  szSerialNumber[21];
           char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
( q, w0 x" ]( q! i
  B& r- j2 L' C1 h: }" j            // 取系列号
. k4 r  }) x0 N3 J* h6 b6 w; p            ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

           // 取模型号
           ZeroMemory(szModelNumber, sizeof(szModelNumber));
           strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
" B) L* ]' S, L$ E
7 f2 t: Q$ z. ^+ ~7 {$ i5 z            pSerList->Add(szSerialNumber);
, M7 n: Y2 Q' H            pModeList->Add(szModelNumber);
       }
( k1 U; Y2 \& n- J    }
  b  C  s% z: c    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
}
//---------------------------------------------------------------------------
// ReadPhysicalDriveOnW9X_Ring0()
1 l, Y# e3 U/ I//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
9 _3 P  W2 T! p% M& y7 m// btMasterSlave = Master(0xA0) Or Slave(0xB0)
- b" J: x/ k. h$ O- ]//---------------------------------------------------------------------------
9 B* w5 j0 \0 o: F- {7 Zvoid __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
   BYTE  btIDTR1[6];
* e  e2 _+ |6 k    DWORD dwOldExceptionHook;
   const int nHookExceptionNo = 5;
- F9 `5 I7 K5 k. {7 b" W& q
! F% a4 U' Z: ~    BYTE  btIsIDEExist = 0;
1 v: B9 W; g' ?' e3 T  w    BYTE  btIsDiskExist = 0;
   WORD  wOutDataBuf[256];
6 D- Q0 m! Z6 m/ }2 d  G& O
" J; g% J, j) D4 Y9 U    BYTE  btIsFirst = (BYTE)bIsFirst;
( a8 g5 g1 J2 E' p4 G
) l* _8 C( m1 W' V, P7 q    const BYTE btBit00 = 0x01;
2 l: @  k! b% Q, o    // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
! D4 O' ~( Y7 s# d- X: W% A4 r    // const BYTE btERR  = btBit00;
   const BYTE btBusy = btBit07;
$ W: x. F; b1 V7 i7 I( V/ a# \    const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;
5 P: y4 E' l( E0 S$ A9 `) b% w7 V
' K; R# ]+ h' U5 A    __asm
   {
       // 必须先执行这条语句
' T  w9 ?& Y# L        JMP EnterRing0

% ~1 _+ r! ~, t/ ?        // 定义过程
% D/ b4 U! l- B/ d- E        // 等待IDE设备直到其不为忙为止
: w  l' o5 @2 N8 B0 ]: u        WaitWhileBusy proc
% o, J0 u( H7 U" n
       MOV  EBX, 100000
4 P2 b1 }% J; P3 O& z* S6 k        MOV  DX, dwBaseAddress
2 A1 X6 {$ O" i: u# R5 ]- b* V        ADD  DX, 7

2 H1 S. F9 F. @' `7 H; L6 x4 I5 B- V        LoopWhileBusy:

6 y. d( K( q6 j$ s9 M        DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
       in   AL, DX
       TEST AL, btBusy
& k9 {0 p$ q2 A$ _) @        JNZ  LoopWhileBusy
% {' ~5 {6 w$ ^' G6 b. r0 h        JMP  DriveReady

4 f& q# F+ K! _) K/ I        // 超时，直接退出
: V$ n2 `3 c+ s3 Z, f        Timeout:
       JMP  LeaveRing0
4 Y4 F: Y7 Z: `# b        DriveReady:
       RET
/ C5 h" O& u0 W: g8 S' X        ENDP   // End of WaitWhileBusy Procedure

) r+ T1 X' g5 D        // 设置主盘和从盘标志
/ D8 C, U. {( E8 K& y        SelectDevice proc

       MOV  DX, dwBaseAddress
       ADD  DX, 6
" w7 N2 M) e  w' h0 A        MOV  AL, btMasterSlave

5 v* g' n: M# n3 N$ k        out  DX, AL
       RET
: t7 I6 c' `5 r* J5 V6 s5 w5 Z' r
       ENDP  // End of SelectDevice Procedure

       // 向IDE设备发送存取指令
  J% P/ v6 O1 ?# U- p& n/ A        SendCmd proc

0 G: B/ `( |) z8 [' s& ?/ Y        MOV DX, dwBaseAddress
       ADD DX, 7
! j% K, K+ m  z3 K        MOV AL, BL // BL是主从盘标识，在过程外设置
       out DX, AL
5 U1 d1 x) `9 f! h3 z        RET
: Z# |2 w4 _8 E' p* e2 R9 @        ENDP  // End of SendCmd Procedure
0 r& `( x3 h8 n- Y
       // Ring0代码
       Ring0Proc:
/ Q# |8 C2 f" p7 J+ U        PUSHAD
# Y  v: ?* E  r; w0 @; l        // 查询IDE设备是否存在
% i: D# C# T! J  \( U        MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX

/ _' F& S: N) c, ]! f        // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
+ @; R* _: }; {1 z* ^$ M1 U        CMP AL,0xFF
. i  v7 K0 |0 ^        JZ  LeaveRing0
       CMP AL, 0x7F
. I- a$ x7 G( M' s        JZ  LeaveRing0

; J  n  ~% y. u        // 设置IDE设备存在标志
       MOV btIsIDEExist, 1

" _0 H9 n# d+ J% h" f        // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
. R+ s. n5 M8 d% e5 J        CALL WaitWhileBusy
       CALL SelectDevice
( q1 E' R: ]& y; @2 X* V: ^+ b
# h2 V, y6 {3 [% a% L        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
       CMP  btIsFirst, 1
$ ]1 ^2 {2 @1 J, Z' \$ R5 q        JZ   LeaveRing0

, J" N9 V4 o9 n, j1 A: x- G1 l/ _        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
, P1 H6 A  J% K, _( ?( E, c6 k        CALL WaitWhileBusy
9 ]1 L# k% Z8 |
       // AL的值等于cBit06时，不存在驱动器，直接返回
! t9 J# v9 h% I        TEST AL, btBit06
       JZ   LeaveRing0

       // 设置驱动器存在标志
* c. F5 S, w( ~, B# e- v1 ?        MOV  btIsDiskExist, 1
# S/ v8 Q+ \. p  A# b) i
) Y3 o6 k/ t) J0 M6 L3 p! ^  c- o, Z        // 发送存取端口命令
' B- P; d0 h; T1 P+ |" f9 g        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
       // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
9 m" U# Q1 o# g, \" y        CALL SendCmd
       CALL WaitWhileBusy
1 E$ O: V" q6 E5 m' r9 p* r
       // 检查是否出错
       MOV  DX, dwBaseAddress
( {. ?# V2 m! S( L$ j        ADD  DX, 7
3 O7 u( d' h% j8 S- j
3 m6 `1 N' t' `: T        in   AL, DX
  F+ |9 Q9 s7 L1 q# y# A
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据

       // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
       CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
7 ?8 V0 t7 A" ]; h) u6 h; Z- G1 N1 X        CALL WaitWhileBusy
1 s+ `8 B( @! {$ l: }# S
# j0 y: |; [3 `# D; Q+ M# ~$ J        // 检查是否还出错
       MOV  DX, dwBaseAddress
       ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
       JZ   RetrieveInfo   // 没有错误时则读数据
( v/ c" C  I. M1 c: F; s        JMP  LeaveRing0     // 如果还是出错，直接返回

$ F1 I8 E" ]/ I        // 读取数据
       RetrieveInfo:
6 C# ?1 L# [) |$ }& P& @0 r
       LEA  EDI, wOutDataBuf
1 E  s% E' O3 r2 t% W8 _7 I        MOV  ECX, 256
2 e4 q; M+ H! H4 \, k/ p3 G. b        MOV  DX, dwBaseAddress
$ O, L  t* N* J5 ^& k( D. o  S        CLD

       REP  INSW

8 \# H! j9 U$ C4 l  f        // 退出Ring0代码
* n! n5 c7 i+ B: w        LeaveRing0:
$ _7 i3 I6 D+ K$ \) {
       POPAD
       IRETD
( M) z: t/ s5 t
4 N/ g8 [, f. o: p, w# R! S! H        // 激活Ring0代码
' `7 a& H0 J# B+ e$ w6 r        EnterRing0:
3 u8 s. G$ h" [/ o% Q$ \, l, B. |# I
8 o! @0 F! t4 L& e' t" e        // 修改中断门
       SIDT FWORD PTR btIDTR1
       MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
( @# F$ a: d! N- P) u1 @' [1 h        CLI

( m( ~5 y7 [. e5 y        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
9 e) _- E) k  ^  k: |        MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

0 o6 ?# ?/ F) |" W8 A. q6 F+ O        // 指定新入口
2 p0 U8 p% x' y9 L) k' x# G        LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
       SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX

# K1 u; s) S5 \        // 激活Ring0代码
$ {7 a& K& M. o# k        INT nHookExceptionNo

       // 复原入口
  }/ t5 w. ]- \7 D* {# Y        MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
       SHR ECX,10h
       MOV WORD PTR[EAX+02h], CX
       STI
   }
6 d0 [* V" y4 D; ]+ z! |1 \* ?4 H    if(!bIsFirst)
) n- q4 v7 D0 k    {
       bIsIDEExist  = (bool)btIsIDEExist;
$ |- ?# z# R( B! l! Y        bIsDiskExist = (bool)btIsDiskExist;
       CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
   }
& k  _( v5 L* M) w}
* N5 ]! {0 i; I//---------------------------------------------------------------------------
// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
- e9 z  x3 r0 b" `2 k& a/ A7 \# K: m{
  H5 o( x, C$ @+ p' u    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
# W  q- @! D" z0 G7 E}