VC++信息安全编程（１3）Windows2000/xp/vista/7磁盘扇区读写技术

               

有些时候，我们读取磁盘文件，会被hook.我们读到的可能并非实际的文件。

我们直接读取磁盘扇区获取数据。

实现磁盘数据的读写，不依赖WindowsAPI。

 

void CSectorEdit2000Dlg::OnView() { UpdateData(TRUE); if (m_uTo < m_uFrom)  return;  char cTemp[1]; memcpy(cTemp, m_DrvListBoxSResult.Left(1), 1); UINT uDiskID = cTemp[0] - 64; DWORD dwSectorNum = m_uTo - m_uFrom + 1; if (dwSectorNum > 100)  return; unsigned char* bBuf = new unsigned char[dwSectorNum * 512];  if (ReadSectors(uDiskID, m_uFrom, (UINT)dwSectorNum, bBuf) == FALSE) {  MessageBox("所选磁盘分区不存在！", "错误", MB_OK | MB_ICONERROR);  return; }  char* cBuf = new char[dwSectorNum * 5120]; memset(cBuf, 0, sizeof(cBuf)); for (DWORD i = 0; i < dwSectorNum * 512; i++) {  sprintf(cBuf, "%s%02X ", cBuf, bBuf[i]);  if ((i % 512) == 511)   sprintf(cBuf, "%s\r\n第%d扇区\r\n", cBuf, (int)(i / 512) + m_uFrom);  if ((i % 16) == 15)   sprintf(cBuf, "%s\r\n", cBuf);  else if ((i % 16) == 7)   sprintf(cBuf, "%s- ", cBuf); } SetDlgItemText(IDC_DATA, cBuf); delete[] bBuf; delete[] cBuf;}void CSectorEdit2000Dlg::OnCleardata() { UpdateData(TRUE); char cTemp[1]; memcpy(cTemp, m_DrvListBoxSResult.Left(1), 1); UINT uDiskID = cTemp[0] - 64; if (uDiskID > 2) {  if (MessageBox("要清理的是硬盘分区，请确认是否继续？", "提示", MB_YESNO | MB_ICONWARNING) != 6)   return;  if (uDiskID == 3)  {   if (MessageBox("要清理的是系统分区，请再次确认是否继续？", "提示", MB_YESNO | MB_ICONWARNING) != 6)    return;  } }  unsigned char bBuf[512]; UINT i = 0; BOOL bRet = TRUE; while (m_bAllDisk)   {  memset(bBuf, 0xFF, sizeof(bBuf));  bRet = WriteSectors(uDiskID, i, 1, bBuf);  memset(bBuf, 0, sizeof(bBuf));  bRet = WriteSectors(uDiskID, i, 1, bBuf);    if (bRet == FALSE)  {   if (i == 0)    MessageBox("所选磁盘分区不存在！", "错误", MB_OK | MB_ICONERROR);   else    MessageBox("磁盘数据擦除完毕！", "错误", MB_OK | MB_ICONERROR);   return;  }  i++; }  if (m_bAllDisk == FALSE) {  for (DWORD i = m_uFrom; i <= m_uTo; i++)  {   memset(bBuf, 0xFF, sizeof(bBuf));   bRet = WriteSectors(uDiskID, i, 1, bBuf);   memset(bBuf, 0, sizeof(bBuf));   bRet = WriteSectors(uDiskID, i, 1, bBuf);   if (bRet == FALSE)   {    if (i == 0)     MessageBox("所选磁盘分区不存在！", "错误", MB_OK | MB_ICONERROR);    else     MessageBox("磁盘数据擦除完毕!", "提示", MB_OK | MB_ICONINFORMATION);    return;   }  } }}void CSectorEdit2000Dlg::OnBackup() { UpdateData(TRUE); if (m_uTo < m_uFrom)  return; CFileDialog fileDlg(FALSE, "*.sec", "*.sec", OFN_HIDEREADONLY | OFN_OVERWRITEPROMPT, "磁盘扇区数据(*.sec)|*.sec||", NULL); CFile file; if (fileDlg.DoModal() != IDOK)  return;  file.Open(fileDlg.GetPathName(), CFile::modeCreate | CFile::modeReadWrite); char cTemp[1]; memcpy(cTemp, m_DrvListBoxSResult.Left(1), 1); UINT uDiskID = cTemp[0] - 64; DWORD dwSectorNum = m_uTo - m_uFrom + 1; unsigned char* bBuf = new unsigned char[dwSectorNum * 512];  if (ReadSectors(uDiskID, m_uFrom, (UINT)dwSectorNum, bBuf) == FALSE) {  MessageBox("所选磁盘分区不存在！", "错误", MB_OK | MB_ICONERROR);  return; } file.Write(bBuf, dwSectorNum * 512); file.Close(); delete[] bBuf; MessageBox("数据备份完毕!", "提示", MB_OK | MB_ICONINFORMATION);}void CSectorEdit2000Dlg::OnRestore() { UpdateData(TRUE);  char cTemp[1]; memcpy(cTemp, m_DrvListBoxSResult.Left(1), 1); UINT uDiskID = cTemp[0] - 64; CFileDialog fileDlg(TRUE, "*.sec", "*.sec", OFN_HIDEREADONLY | OFN_OVERWRITEPROMPT, "磁盘扇区数据(*.sec)|*.sec||", NULL); CFile file; if (fileDlg.DoModal() != IDOK)  return; file.Open(fileDlg.GetPathName(), CFile::modeReadWrite); DWORD dwSectorNum = file.GetLength(); if (dwSectorNum % 512 != 0)  return; dwSectorNum /= 512; unsigned char* bBuf = new unsigned char[dwSectorNum * 512]; file.Read(bBuf, dwSectorNum * 512); if (WriteSectors(uDiskID, m_uFrom, (UINT)dwSectorNum, bBuf) == FALSE) {  MessageBox("所选磁盘分区不存在！", "错误", MB_OK | MB_ICONERROR);  return; } file.Close(); delete[] bBuf; MessageBox("数据恢复完毕!", "提示", MB_OK | MB_ICONINFORMATION);}BOOL CSectorEdit2000Dlg::WriteSectors(BYTE bDrive, DWORD dwStartSector, WORD wSectors, LPBYTE lpSectBuff){ if (bDrive == 0)  return 0; char devName[] = "\\\\.\\A:"; devName[4] ='A' + bDrive - 1; HANDLE hDev; if(m_bPhysicalDisk==false) {  hDev = CreateFile(devName, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); } else  hDev = CreateFile("\\\\.\\PhysicalDrive0", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); if (hDev == INVALID_HANDLE_VALUE)  return 0; SetFilePointer(hDev, 512 * dwStartSector, 0, FILE_BEGIN); DWORD dwCB; BOOL bRet = WriteFile(hDev, lpSectBuff, 512 * wSectors, &dwCB, NULL); CloseHandle(hDev); return bRet;}BOOL CSectorEdit2000Dlg::ReadSectors(BYTE bDrive, DWORD dwStartSector, WORD wSectors, LPBYTE lpSectBuff){ if (bDrive == 0)  return 0; char devName[] = "\\\\.\\A:"; devName[4] ='A' + bDrive - 1; HANDLE hDev; if(m_bPhysicalDisk==false)  hDev = CreateFile(devName, GENERIC_READ, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); else  hDev = CreateFile("\\\\.\\PhysicalDrive0", GENERIC_READ, FILE_SHARE_WRITE, NULL, OPEN_EXISTING, 0, NULL); if (hDev == INVALID_HANDLE_VALUE)  return 0; SetFilePointer(hDev, 512 * dwStartSector, 0, FILE_BEGIN); DWORD dwCB; BOOL bRet = ReadFile(hDev, lpSectBuff, 512 * wSectors, &dwCB, NULL); CloseHandle(hDev); return bRet;}void CSectorEdit2000Dlg::OnSelchangeComboDrive() { // TODO: Add your control notification handler code here int s; s = m_DrvListBox.GetCurSel(); if( s != CB_ERR )  m_DrvListBoxSResult = ( const char * )m_DrvListBox.GetItemDataPtr( m_DrvListBox.GetCurSel());}void CSectorEdit2000Dlg::OnCheck() { // TODO: Add your control notification handler code here m_bPhysicalDisk=!m_bPhysicalDisk; if(m_bPhysicalDisk==true) {  GetDlgItem( IDC_COMBO_DRIVE)->EnableWindow( false ); } if(m_bPhysicalDisk==false) {  GetDlgItem( IDC_COMBO_DRIVE)->EnableWindow( true ); } }

 

           

再分享一下我老师大神的人工智能教程吧。零基础！通俗易懂！风趣幽默！还带黄段子！希望你也加入到我们人工智能的队伍中来！https://blog.csdn.net/jiangjunshow