windows读取MBR小例子

该代码示例展示了如何使用WindowsAPI加载ntdll.dll库,获取系统时间,并读取硬盘主引导记录(MBR)的相关信息,包括分区表的细节。
摘要由CSDN通过智能技术生成
#include <windows.h>
#include <stdio.h>

void KeTime(PLARGE_INTEGER);

int __cdecl main()
{
	HMODULE hNtDll=LoadLibraryA("ntdll.dll");
	if(hNtDll==0)
	{
		printf("Load Library Error!\n");
		return false;
	}
	else
	{
		printf("Load Library OK!\n");
	}

	FARPROC KeTime=GetProcAddress(hNtDll,"ZwQuerySystemTime");
	if(KeTime==0)
	{
		printf("Get Time Error!\n");
		return false;
	}
	else
	{
		printf("Get Time OK!\n");
	}



	LARGE_INTEGER KernelTime;

	//KeTime(&KernelTime);
	KernelTime.QuadPart=0;
	__asm
	{
		lea eax,KernelTime
		push eax
		call KeTime
	}

	char szBuf[0x100]={0};
	int Cnt=wsprintf(szBuf,"Total NatoSeconds from 1601/1/1 0:0:0 To Now is: %d%d",KernelTime.HighPart,KernelTime.LowPart);
	if(Cnt)
	{
		printf("Show Time Ok!\n");
	}

	FreeLibrary(hNtDll);


	// "\\\\.\\PHYSICALDIVE0"=硬盘   "\\\\.\\C:"=C:
	unsigned char MbrData [0x200]={0};
	HANDLE hDiskC=CreateFile("\\\\.\\PHYSICALDRIVE0",GENERIC_READ |GENERIC_WRITE,FILE_SHARE_READ | FILE_SHARE_WRITE,0,
		OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
	if(hDiskC==INVALID_HANDLE_VALUE)
	{
		printf("Open File Error\n");
		return false;
	}
	else
	{
		printf("Open File Success!\n");
	}

	int Result;
	long DistanceHigh=0;
	long DistanceLow=0x3f*512;
	Result=SetFilePointer(hDiskC,DistanceLow,&DistanceHigh,FILE_BEGIN);	//扇区偏移可以用文件偏移来设置
	if(Result==0)
	{
		printf("Set File Pointer Error!\n");
		getchar();
		return false;
	}

	DWORD Counter=0;
	Result=ReadFile(hDiskC,MbrData,512,&Counter,0);
	if(Result&&(Counter==512))
	{
		printf("Read File Ok!\n\n");
	}
	else
	{
		printf("Read File Error!\n");
		return false;
	}
	CloseHandle(hDiskC);

	Result=0;
	unsigned long * Pointer;
	for(Counter=0x1be;Counter<0x1fe;)
	{
		if(!((Counter-0x1be)%16))
		{
			printf("\n第%d分区:\n",Result);
			Result++;
		}
		printf("是否 活动 分区:%02X\n",MbrData[Counter++]);
		printf("分区起始磁道号:%02X\n",MbrData[Counter++]);
		printf("分区起始柱面号:%02X\n",MbrData[Counter++]);
		printf("分区起始扇区号:%02X\n",MbrData[Counter++]);
		printf("分 区 类 型 号:%02X\n",MbrData[Counter++]);		
		printf("分区结束磁道号:%02X\n",MbrData[Counter++]);
		printf("分区结束柱面号:%02X\n",MbrData[Counter++]);
		printf("分区结束扇区号:%02X\n",MbrData[Counter++]);
		Pointer=(unsigned long*)(MbrData+Counter);
		printf("分区起始绝对扇区号:%08X\n",*Pointer);
		Counter+=4;
		Pointer=(unsigned long*)(MbrData+Counter);
		printf("分区包含扇区总数:%08X\n",*Pointer);
		Counter+=4;
	}

	unsigned short * Flag=(unsigned short*)(MbrData+Counter);
	printf("\n分区标志:%08x\n",*Flag);


	getchar();
	return true;
}

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值