[收藏]在Win9x/NT下获取硬盘物理序列号

天云上人

  #include <WinIOCtl.h>
. N/ {, C4 L/ A: z7 y; O#include <stdio.h>

#pragma inline
7 C( s) `, @6 \. n  V8 a6 D//---------------------------------------------------------------------------
// IDE NT/2000/XP专用变量
  C% `4 U. i& {# P) Y; t#define GETVERSIONOUTPARAMS     GETVERSIONINPARAMS
$ t9 z0 {7 j# F4 f0 @#define DFP_GET_VERSION         SMART_GET_VERSION
#define DFP_SEND_DRIVE_COMMAND  SMART_SEND_DRIVE_COMMAND
# _# i4 U5 j8 ]& i& [#define DFP_RCV_DRIVE_DATA      SMART_RCV_DRIVE_DATA
  V0 Y: M' Q" t8 ~& I: K! G
const WORD IDE_ATAPI_IDENTIFY = 0xA1;   // 读取ATAPI设备的命令
5 q0 E9 r1 T- F1 n* w( qconst WORD IDE_ATA_IDENTIFY   = 0xEC;   // 读取ATA设备的命令
# j  n( \7 Y; ^1 p  e# A
, c& E- n6 A1 I" G; ~- pconst int MAX_IDE_DRIVES = 4;
& T# q4 k; F4 E4 N( x4 T
// SCSI专用变量
const DWORD FILE_DEVICE_SCSI             = 0x0000001B;
const DWORD IOCTL_SCSI_MINIPORT_IDENTIFY = ((FILE_DEVICE_SCSI << 16) + 0x0501);
3 D$ e& r) ^" j# n! hconst DWORD IOCTL_SCSI_MINIPORT          = 0x0004D008; // see NTDDSCSI.H for definition
  d& s; r  B5 w* l. _const DWORD SENDIDLENGTH  = sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE;

9 L% P+ O( Y* y4 Rtypedef struct _SRB_IO_CONTROL
{
   ULONG HeaderLength;
   UCHAR Signature[8];
2 B! L# n, m6 A( T( W( T& w" R) N+ V    ULONG Timeout;
   ULONG ControlCode;
   ULONG ReturnCode;
; Q: a! t. g: m) o; V    ULONG Length;
}SRB_IO_CONTROL, *PSRB_IO_CONTROL;

4 f" Z" V% M, X" H+ u' K% J! p// 读取的主函数
void __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList);

// 辅助函数
, [5 M: ?2 x! o' M! M; O3 schar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex);
/ J1 ~+ \" z! Y// NT/2000/XP函数
- D* m9 w/ R+ hvoid __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList);
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
       PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd,
$ B( ?( Z3 Q' r- N$ n        BYTE btDriveNum, PDWORD lpcbBYTEsReturned);
// Windows 9X函数
void __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList);
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool IsFirst, WORD BaseAddress,
       BYTE MoS, bool &IsIDEExist, bool &IsDiskExist, WORD *OutData);

// SCSI读取函数(for NT/2000/XP)
String __fastcall ReadIDEDriveAsScsiDriveOnNT();
  b1 G# P; S* ^2 C" V8 z  {//---------------------------------------------------------------------------
// ReadPhysicalDrive
4 {! q( Z; t  G$ p- i" T2 Vvoid __fastcall ReadPhysicalDrive(TStrings *pSerList, TStrings *pModeList)
. C  A8 Y3 M; S) |' h{
7 T/ s( y( K$ d    switch(Win32Platform)
2 n9 A% g4 D6 A$ y! l    {
" a4 R1 h7 ]" b7 s* S        case VER_PLATFORM_WIN32_WINDOWS:
. D6 l' M9 O% `: j$ E! b. x            ReadPhysicalDriveOnW9X(pSerList, pModeList);
           break;
       case VER_PLATFORM_WIN32_NT:
           ReadPhysicalDriveOnNT(pSerList, pModeList);
/ B+ w9 M% t' ~/ h" r# @            break;
       default:
0 X4 D: {! n9 Z$ f. ]% f7 Z' f            break;
, ?2 H$ W4 P" C    }
% K/ ^8 t8 ]6 w6 ]" L- B}
. ?0 W  j) t& A4 ^6 P- W//---------------------------------------------------------------------------
1 g9 I6 p% p& b/ J6 y// ConvertToString
% ]! _: |1 m2 c8 jchar *__fastcall ConvertToString(DWORD dwDiskData[256], int nFirstIndex, int nLastIndex)
7 Z  w0 Y0 w3 T% Z; D6 M{
   static char szResBuf[1024];
! i1 G" w$ {  H' W5 y: O) h    int nIndex = 0;
" L9 e( }6 s' @( [3 z+ t    int nPosition = 0;

' b/ Y) f  J! `! R$ U' t4 Z    // Each integer has two characters stored in it backwards
   for(nIndex = nFirstIndex; nIndex <= nLastIndex; nIndex++)
   {
       // Get high BYTE for 1st character
+ W) I2 S& C" t5 ^( Z1 W        szResBuf[nPosition] = (char)(dwDiskData[nIndex] / 256);
       nPosition++;

7 x) E  w3 k' @" N5 f        // Get low BYTE for 2nd character
       szResBuf[nPosition] = (char)(dwDiskData[nIndex] % 256);
2 Z8 A9 T% z: J# L' X        nPosition++;
/ [) j& c- ~$ ^' B! l    }

2 B9 [+ x6 h8 _( E' [. J6 h" g    // End the string
" `" j- p( ~6 |    szResBuf[nPosition] = '\0';
  p3 S. s% L3 `6 i4 \
4 s! y/ B5 `/ x1 g    // Cut off the trailing blanks
5 q2 p' Q" d; z8 C3 \. l    for(nIndex = nPosition - 1; nIndex > 0 && ' ' == szResBuf[nIndex]; nIndex--)
       szResBuf[nIndex] = '\0';

! q' A6 _. G; i8 z- D& A    return szResBuf;
}
//---------------------------------------------------------------------------
1 @7 t! O3 d! h6 v) x// Winndows NT4/2000/XP 代码
( \9 `0 g8 |8 Z$ h7 c  s) W//---------------------------------------------------------------------------
// ReadPhysicalDriveOnNT
0 p% L7 w  J2 i3 g) \  P" h- F- [void __fastcall ReadPhysicalDriveOnNT(TStrings *pSerList, TStrings *pModeList)
{
   // 输出参数
   BYTE btIDOutCmd[sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1];

   for(int nDrive=0; nDrive < MAX_IDE_DRIVES; nDrive++)
+ Q4 S' h9 ]; O+ [$ I    {
$ u& y5 b3 ]+ M+ [' N        HANDLE hPhysicalDriveIOCTL;
9 j* H( v$ {( K/ f" ~- b        char szDriveName[32];
4 F, U* _* z6 v8 N0 A7 ?
       sprintf(szDriveName, "\\\\.\\PhysicalDrive%d", nDrive);
       hPhysicalDriveIOCTL = CreateFile(szDriveName,
                       GENERIC_READ | GENERIC_WRITE,
& G5 e# x4 w/ _: d6 f4 W# X                        FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
                       OPEN_EXISTING, 0, NULL);
' G% U- ]+ L5 {; c$ Z  x
       if(hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE)
       {
: x- d' f+ W% x            DWORD dwBytesReturned = 0;
           GETVERSIONOUTPARAMS gvopVersionParams;

           // Get the version, etc of PhysicalDrive IOCTL
% C( ]! P- n! ?2 ~* h2 L            ZeroMemory(&gvopVersionParams, sizeof(GETVERSIONOUTPARAMS));

9 X/ Z  D9 f% V; X) g& n            if(!DeviceIoControl(hPhysicalDriveIOCTL, DFP_GET_VERSION,
                   NULL, 0, &gvopVersionParams, sizeof(gvopVersionParams),
                   &dwBytesReturned, NULL))
           {
, e) r9 u$ K' D                continue;
# k3 n7 {9 [; x5 N' w9 t            }

           if(gvopVersionParams.bIDEDeviceMap > 0)
           {
' J: _! y  p7 t9 T                // IDE or ATAPI IDENTIFY cmd
               BYTE btIDCmd = 0;
$ F8 N; `4 |- g                SENDCMDINPARAMS InParams;
2 \! N: F9 w  h  _2 X$ f                // Now, get the ID sector for all IDE devices in the system.
               // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
: o3 n* \+ h! ]! p" R6 I                // otherwise use the IDE_ATA_IDENTIFY command
               // 具体所得结果请参考头文件中的说明
               btIDCmd = (gvopVersionParams.bIDEDeviceMap >> nDrive & 0x10) ?
  N0 Q7 B' C& n! i! D8 X                        IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
3 A; a& g+ o3 z6 l( D& _                ZeroMemory(&InParams, sizeof(SENDCMDINPARAMS));
( W& u5 E: A, @) A/ l  C                ZeroMemory(btIDOutCmd, sizeof(btIDOutCmd));
5 ?* U2 G; \! o- @& w8 R& t
               if(DoIdentify(hPhysicalDriveIOCTL,
                    &InParams, (PSENDCMDOUTPARAMS)btIDOutCmd,
                    (BYTE)btIDCmd, (BYTE)nDrive, &dwBytesReturned))
) c' P; }2 C' D2 Z5 b                {
                   DWORD dwDiskData[256];
: |* N4 I0 U. T- r/ U% x2 N; b" U                    USHORT *pIDSector; // 对应结构IDSECTOR，见头文件
                   char szSerialNumber[21];
                   char szModelNumber[41];
3 i2 m/ b+ J9 e8 C
                   pIDSector = (USHORT*)((SENDCMDOUTPARAMS*)btIDOutCmd)->bBuffer;
# u) x& C" T# u                    for(int i=0; i < 256; i++)
                       dwDiskData = pIDSector;
                   // 取系列号
3 G8 q2 S* i) P" e! n( k/ e1 D                    ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
                   strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));
! F4 u& W: |' {  G& c( E) D( _$ g
' y4 g% X* o( W- B4 r4 _& _                    // 取模型号
) ^) G) }5 A) y- Q( A' m& l' y                    ZeroMemory(szModelNumber, sizeof(szModelNumber));
% ^# o6 T0 z. H9 T  C2 z/ r                    strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
  z4 d8 n* J3 N) J* m" W
4 n: U: Z6 Y* e, I8 X( y                    pSerList->Add(szSerialNumber);
5 u0 @7 ^6 L4 [' c                    pModeList->Add(szModelNumber);
+ G3 |' y, }4 [& G                }
# N3 y8 e! S7 T/ V- E            }
2 Q% k1 k- H' A$ [; N1 A' B  K* d! i( A  \            CloseHandle (hPhysicalDriveIOCTL);
       }
   }
" X  d4 Q% M! A0 k+ }}
//---------------------------------------------------------------------------
; A. L! ~; \0 P: }3 W% j// DoIdentify
bool __fastcall DoIdentify(HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
             PSENDCMDOUTPARAMS pSCOP, BYTE btIDCmd, BYTE btDriveNum,
1 B" s" m" E7 f# ]! ~  x) p              PDWORD pdwBytesReturned)
" P( i* G9 ]. K{
   // Set up data structures for IDENTIFY command.
  Z% U, n2 W& y  b8 t    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;
6 j6 u: @4 H0 S) C    pSCIP->irDriveRegs.bFeaturesReg = 0;
! Q8 c8 j5 _+ y2 M+ e    pSCIP->irDriveRegs.bSectorCountReg  = 1;
   pSCIP->irDriveRegs.bSectorNumberReg = 1;
# X; T/ R: E! d" j, b4 F1 r    pSCIP->irDriveRegs.bCylLowReg  = 0;
6 K- K+ R. P7 t& H. |+ Z1 A    pSCIP->irDriveRegs.bCylHighReg = 0;

   // Compute the drive number.（主盘和从盘所对应的值是不一样的）
   pSCIP->irDriveRegs.bDriveHeadReg = (btDriveNum & 1) ? 0xB0 : 0xA0;

   // The command can either be IDE identify or ATAPI identify.
9 C: J$ c6 U) x4 x! u+ K    pSCIP->irDriveRegs.bCommandReg = btIDCmd;
- Z* R; j, e5 W) ^. E3 R' R    pSCIP->bDriveNumber = btDriveNum;
: @! s( s: |4 S2 I! j  a    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

   return DeviceIoControl(hPhysicalDriveIOCTL, DFP_RCV_DRIVE_DATA,
          (LPVOID)pSCIP,
* o3 j' |" L+ E- @( _5 a           sizeof(SENDCMDINPARAMS) - 1,
          (LPVOID)pSCOP,
& q& Z5 ~6 ]( [3 L2 k' x9 z4 `           sizeof(SENDCMDOUTPARAMS) + IDENTIFY_BUFFER_SIZE - 1,
          pdwBytesReturned, NULL);
}
//---------------------------------------------------------------------------
& z$ ?& o: m& c% ~0 G3 d  \// Windows 95/98/ME 代码
) [& f1 e) _# ~! {//---------------------------------------------------------------------------
3 e6 D. h' F' d( ^. X9 P' ], E// ReadPhysicalDriveOnW9X
7 e# }  [. p' V2 Ivoid __fastcall ReadPhysicalDriveOnW9X(TStrings *pSerList, TStrings *pModeList)
{
& r+ z* u' D* L* r' m    WORD wOutData[256];
   SetPriorityClass(GetCurrentProcess(), REALTIME_PRIORITY_CLASS);
& O" \' k, {+ {7 {
   // 经过测试，发现第一次调用而且Drive >= 2时会在Ring0代码中出现错误，导致蓝屏。
   // 经过N（N > 15）次的蓝屏后仍找不到原因：（，不得不在这里增加一段无用代码以
   // 避免蓝屏的出现。（期待高人能指出原因）
% o1 z/ F; M9 O5 w    for(int nDrive = 0; nDrive < 8; nDrive++)
* B9 }5 j6 {) W6 c( d    {
       WORD dwBaseAddress;
       BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
& Q6 x6 Z9 G; O8 F7 U        bool IsDiskExist;
( c- U: i# S& F! }, I
       switch(nDrive / 2)
       {
; Z. z% \# x: {  f) F+ ~            case 0: dwBaseAddress = 0x01F0; break;
( N! R: ]" V! }( ]            case 1: dwBaseAddress = 0x0170; break;
, A7 U7 Y. ~) r% k8 L& C            case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);

. @" m1 {0 G' c2 ?6 J        // 进入Ring0
       ReadPhysicalDriveOnW9X_Ring0(true, dwBaseAddress, btMasterSlave,
               bIsIDEExist, IsDiskExist, wOutData);
   }
2 ^8 p: T5 Y* I3 I' g
   // 开始读取
   for(int nDrive = 0; nDrive < 8; nDrive++)
   {
       WORD dwBaseAddress;
5 j8 w: K+ _+ [# ]) a/ F        BYTE btMasterSlave;         // Master Or Slave
       bool bIsIDEExist;
       bool bIsDiskExist;
       switch(nDrive / 2)
8 E/ k( l6 I0 M! j9 V8 Q        {
           case 0: dwBaseAddress = 0x01F0; break;
           case 1: dwBaseAddress = 0x0170; break;
           case 2: dwBaseAddress = 0x01E8; break;
           case 3: dwBaseAddress = 0x0168; break;
       }

       btMasterSlave = (BYTE)(((nDrive % 2) == 0) ? 0xA0 : 0xB0);
7 Z0 z6 d( j* A' Q
       // 进入Ring0
% a4 [' H4 Z) X) k        bIsIDEExist  = false;
. x: n  u7 F. G4 i: ^        bIsDiskExist = false;
( Z3 r5 W/ x: r! J' g" e        ZeroMemory(wOutData, sizeof(wOutData));
) M( e6 F& r) l2 [( _2 G
" H2 I% w) F( }, C6 {; N* O+ [/ b        ReadPhysicalDriveOnW9X_Ring0(false, dwBaseAddress, btMasterSlave,
( r! G4 \- |& p3 w4 }  q0 a. ?                bIsIDEExist, bIsDiskExist, wOutData);
6 }8 R$ s3 O6 e! i7 Y& r' z1 S
       if(bIsIDEExist && bIsDiskExist)
. n! B' u1 H0 K0 ?        {
; I- W4 w; K- ?; H& A9 n1 u            DWORD dwDiskData[256];
           char  szSerialNumber[21];
0 S* V1 x: m0 b+ _' A$ x$ @            char  szModelNumber[41];

           for(int k=0; k < 256; k++)
               dwDiskData[k] = wOutData[k];
  J7 q/ D% {& x: J8 \! p4 T
           // 取系列号
           ZeroMemory(szSerialNumber, sizeof(szSerialNumber));
           strcpy(szSerialNumber, ConvertToString(dwDiskData, 10, 19));

: |6 [( I5 ~" c  f            // 取模型号
4 [- w3 x' U, P, p1 X( k            ZeroMemory(szModelNumber, sizeof(szModelNumber));
5 n2 U4 a! Z, o, o; ~0 E6 V            strcpy(szModelNumber, ConvertToString(dwDiskData, 27, 46));
( p( x) ~* I1 J" N) f
, u3 G/ a3 [5 p% y7 }  W% t            pSerList->Add(szSerialNumber);
0 X& {4 J1 g4 L4 d8 l2 W            pModeList->Add(szModelNumber);
       }
   }
* B# f- [% W7 A/ K& [" M5 U2 m    SetPriorityClass(GetCurrentProcess(), NORMAL_PRIORITY_CLASS);
' ^  ^" h  J! d, r# F7 U}
//---------------------------------------------------------------------------
5 j2 d$ J7 R- F! S// ReadPhysicalDriveOnW9X_Ring0()
//
// dwBaseAddress = IDE(0,1,2,3) : 1F0h, 170h, 1E8h, 168h
: J2 ^9 Q! P* s" G& G// btMasterSlave = Master(0xA0) Or Slave(0xB0)
//---------------------------------------------------------------------------
void __fastcall ReadPhysicalDriveOnW9X_Ring0(bool bIsFirst, WORD dwBaseAddress,
       BYTE btMasterSlave, bool &bIsIDEExist, bool &bIsDiskExist, WORD *pOutData)
{
. @. J5 N, p* Y$ W" l! r1 @    BYTE  btIDTR1[6];
   DWORD dwOldExceptionHook;
0 {) t$ g  l+ Q9 c( d+ D5 X" i! Q7 g    const int nHookExceptionNo = 5;
5 E9 D/ l1 d# e. U! A. X" O
   BYTE  btIsIDEExist = 0;
   BYTE  btIsDiskExist = 0;
) }$ M% }, G  u    WORD  wOutDataBuf[256];
/ C- u9 p# T% s
   BYTE  btIsFirst = (BYTE)bIsFirst;

   const BYTE btBit00 = 0x01;
   // const BYTE btBit02 = 0x04;
   const BYTE btBit06 = 0x40;
   const BYTE btBit07 = 0x80;
   // const BYTE btERR  = btBit00;
" P$ A) Z: T0 a5 k# A1 \9 D0 X    const BYTE btBusy = btBit07;
   const BYTE btAtaCmd   = 0xEC;
   const BYTE btAtapiCmd = 0xA1;

3 c; M. Q( ~! `/ A    __asm
5 G8 q  T- i; v+ z/ H7 V    {
       // 必须先执行这条语句
$ [3 r/ N! n" n* x' F        JMP EnterRing0
0 T: R& F) E3 ?& t2 R$ l& v6 J
       // 定义过程
" F. ^. ~4 S* {3 G, x2 V        // 等待IDE设备直到其不为忙为止
7 u5 M$ o+ {7 W1 X$ Z# w% `        WaitWhileBusy proc
8 i- L% Z1 ?: E  T( u- o
4 H: Y+ r& y( x" R        MOV  EBX, 100000
       MOV  DX, dwBaseAddress
; u- d$ u; I  o        ADD  DX, 7

( `# i, H3 E7 O" n+ W        LoopWhileBusy:

       DEC  EBX
       CMP  EBX, 0
       JZ   Timeout
& K2 h4 q8 `! x  V        in   AL, DX
       TEST AL, btBusy
       JNZ  LoopWhileBusy
       JMP  DriveReady

       // 超时，直接退出
* ?; U! ~& U7 [4 N        Timeout:
) j9 F/ K& E6 w% T+ X        JMP  LeaveRing0
$ A8 C& K; a+ S9 `! w8 e        DriveReady:
& D& L/ U7 o  f, ]; c. E        RET
       ENDP   // End of WaitWhileBusy Procedure
6 r6 W; a6 ~/ C. N& m
7 F6 Q; P0 k) [( b. H) v8 ~9 i6 {. N        // 设置主盘和从盘标志
       SelectDevice proc

       MOV  DX, dwBaseAddress
       ADD  DX, 6
       MOV  AL, btMasterSlave
3 O' s3 P) F& y% S
       out  DX, AL
       RET

( v( \1 E$ j8 L9 \0 C$ N7 m  {        ENDP  // End of SelectDevice Procedure
) l( ^* S8 s# p. p: Y4 c6 r* X4 |
       // 向IDE设备发送存取指令
       SendCmd proc
2 w- O. ^5 W5 W  L
' \* f" W  `- _) x: A& U- {        MOV DX, dwBaseAddress
       ADD DX, 7
5 _9 b. Z; {! X* G! u        MOV AL, BL // BL是主从盘标识，在过程外设置
  C6 C: L3 j  H, P: Y) A; ]        out DX, AL
       RET
8 p0 @. B( F7 `- u$ R        ENDP  // End of SendCmd Procedure
2 X8 e  c* R; S2 s" E) k3 p  ]( @
/ S0 K$ k, K6 d, t: `7 \$ W        // Ring0代码
$ d, L" j7 i! {+ P% A4 X        Ring0Proc:
       PUSHAD
) J2 Z" G2 n: R# ~% J& x! n8 i: {$ u        // 查询IDE设备是否存在
& G% o& v% J/ Y2 L( a* N        MOV DX, dwBaseAddress
       ADD DX, 7
       in  AL,DX
( C/ q; M7 V* S
       // 当AL的值是0xFF或者0x7F时，IDE设备不存在，这时候直接返回
       CMP AL,0xFF
5 F$ ?! l$ s  f4 }4 }$ d# P* z4 i        JZ  LeaveRing0
       CMP AL, 0x7F
       JZ  LeaveRing0

       // 设置IDE设备存在标志
+ F% D3 P5 {* o6 R. X3 B' c, ^        MOV btIsIDEExist, 1

       // 查询IDE设备上的驱动器是否存在（有IDE插槽在主板上，但是却不一定有硬盘插在上面）
8 R  t) {$ w" |0 P. \        CALL WaitWhileBusy
       CALL SelectDevice
- q& ?3 H2 w/ Q3 x: F0 n8 U0 c. J
1 s/ O7 V4 A7 z        // 如果是第一次调用，则直接返回，否则执行下行语句时会出现蓝屏
$ p7 \3 L) S$ E        CMP  btIsFirst, 1
0 u" V8 C, ^7 W6 L/ A( ~! S1 R1 R        JZ   LeaveRing0
' h' ~0 J/ w, S, H( h
% o' E. V, h" R! H        // 第一次调用时，如果执行这行语句会导致蓝屏，Why？？？
- M3 f( J, ]0 o& E; j/ r        CALL WaitWhileBusy

6 U5 h, a! `7 e        // AL的值等于cBit06时，不存在驱动器，直接返回
       TEST AL, btBit06
# |# A& T& y7 Z# z' @; W$ _        JZ   LeaveRing0

9 N! r/ m7 `5 v; b) F- d8 Z        // 设置驱动器存在标志
       MOV  btIsDiskExist, 1
- T1 @: S6 v! F) O% g- r7 U
       // 发送存取端口命令
6 k  \% X0 y( C5 G        // 无法像NT/2000/XP那样可以通过查询VERSION的值得到驱动器的类型，
; Z- A  V% B% ~; u        // 所以只能一步一步地测试，如果不是ATA设备，再尝试使用ATAPI设备命令
- z8 I( ?+ i$ b; D        CALL WaitWhileBusy
2 ]9 Z1 Y" K1 h        CALL SelectDevice    // 设置主从盘标识
       MOV  BL, btAtaCmd      // 发送读取命令
       CALL SendCmd
, N5 r+ `8 F$ `        CALL WaitWhileBusy
5 x( n# r4 A$ p! h
       // 检查是否出错
# n+ {8 U* n1 j6 j        MOV  DX, dwBaseAddress
9 a; @* X2 {+ w! r" `        ADD  DX, 7

8 f. p" @; h4 O        in   AL, DX

       TEST AL, btBit00
6 q7 U% Z* |& z. M4 Y. u        JZ   RetrieveInfo   // 没有错误时则读数据
  U! }) [) R/ `( G1 e
' f, a  |( G& k+ X) S9 w        // 如果出错，则进一步尝试使用ATAPI设备命令
       CALL WaitWhileBusy
9 o8 b; C# C4 {7 i4 U9 F        CALL SelectDevice
       MOV  BL, btAtapiCmd
       CALL SendCmd
/ e" c; ?/ M- M" E! q        CALL WaitWhileBusy

       // 检查是否还出错
       MOV  DX, dwBaseAddress
: @* H7 ~7 A7 d# D        ADD  DX, 7
       in   AL, DX
       TEST AL, btBit00
+ N! h6 p  a" V9 r        JZ   RetrieveInfo   // 没有错误时则读数据
# c8 [6 l6 j8 F9 P3 a        JMP  LeaveRing0     // 如果还是出错，直接返回

       // 读取数据
       RetrieveInfo:
' ?* g/ Q# y# r/ J2 a) r2 x+ }
& T9 j" S- w8 y$ m4 @4 O3 m: ^        LEA  EDI, wOutDataBuf
# M3 V- s) p5 J- f; V( u8 m        MOV  ECX, 256
       MOV  DX, dwBaseAddress
       CLD

5 X8 S  C* }, |6 W& \2 s        REP  INSW
3 m( t# _  X/ x( B* u, G
% Q, j1 x6 h7 ~        // 退出Ring0代码
       LeaveRing0:
9 Y( ^% R2 d  c" I  N' e( W
       POPAD
$ p$ z$ N5 U' ]- T4 |2 F/ z3 m7 B. E        IRETD

       // 激活Ring0代码
9 b+ c7 f; {" v* @8 ^$ z        EnterRing0:
6 A) u; i" b& L) l$ J
       // 修改中断门
& r" R( H; ^  N0 [6 E$ ?1 R9 n        SIDT FWORD PTR btIDTR1
- b- C) X6 Q4 U' v2 q3 c        MOV EAX, DWORD PTR btIDTR1 + 02h
       ADD EAX, nHookExceptionNo * 08h + 04h
       CLI

5 r* _# X+ |8 j$ G        // 保存原异常处理例程入口
       MOV ECX, DWORD PTR [EAX]
       MOV CX, WORD PTR [EAX-04h]
       MOV dwOldExceptionHook, ECX

       // 指定新入口
       LEA EBX, Ring0Proc
       MOV WORD PTR [EAX-04h],BX
, v4 |- F4 T* h' p; b- k        SHR EBX, 10h
       MOV WORD PTR[EAX+02h], BX
* ~0 n$ v3 c% d% m9 f; B4 p! o
       // 激活Ring0代码
, e2 P" S2 y; n        INT nHookExceptionNo
5 o1 |5 T) P: j: a4 c- U- @
       // 复原入口
       MOV ECX,dwOldExceptionHook
       MOV WORD PTR[EAX-04h], CX
) k& @) H' U  m: ]/ J2 c        SHR ECX,10h
6 E5 Q& h& B" C( Z7 \        MOV WORD PTR[EAX+02h], CX
       STI
   }
- |# W5 f! a2 \* P4 Z    if(!bIsFirst)
; x% p* S) b- _- p$ @/ D    {
3 G4 ]7 f, m( f9 G        bIsIDEExist  = (bool)btIsIDEExist;
       bIsDiskExist = (bool)btIsDiskExist;
) b3 ^% G# h  s9 L        CopyMemory(pOutData, wOutDataBuf, sizeof(wOutDataBuf));
9 Q/ ?. y/ p9 K    }
}
//---------------------------------------------------------------------------
( T" D5 M. d$ B* X9 Z: m// 调用方法：
void __fastcall TForm1::Button1Click(TObject *Sender)
{
( n( L/ s3 m* t' w7 o8 D( q* e" q0 j    ReadPhysicalDrive(Memo1->Lines, Memo2->Lines);
}