IOCT_disk取得硬盘分区号和硬盘号,如何求得其物理顺序?

工具 DELPHI XE 10.2

参考 MSDN IOCTL_DISK相关函数;

var
hDevice:thandle; 
tempc:string;
STORAGE_DEVICE_NUMBER: TSTORAGE_DEVICE_NUMBER ;
PrtInformation:TPartitionInformationEx 
DeviceNumber:integer://硬盘号
PartitionNumber:integer;//分区号;逻辑
begin

 tempc:='\\.\'+'K:'  ;//此处求K盘,求得硬盘2和所在分区为第三个分区。

Device := CreateFile(PChar(tempc), 0, FILE_SHARE_READ or FILE_SHARE_WRITE,
                           nil, OPEN_EXISTING, 0, 0);
if hDevice <> INVALID_HANDLE_VALUE then
  begin
  if DeviceIoControl(hDevice, IOCTL_STORAGE_GET_DEVICE_NUMBER, nil, 0,
                    @STORAGE_DEVICE_NUMBER, 
                    SizeOf(STORAGE_DEVICE_NUMBER), 
                    BytesReturned, nil)=true then 
    DeviceNumber:=STORAGE_DEVICE_NUMBER.DeviceNumber;
    
    if DeviceIoControl(hDevice, IOCTL_DISK_GET_PARTITION_INFO_EX, nil, 0,
                       @PrtInformation, 
                       SizeOf(PrtInformation), 
                       BytesReturned,
                       nil) =true then
    PartitionNumber:=PrtInformation.PartitionNumber;                   
  
  end;//if hDevice <> INVALID_HANDLE_VALUE then


end;

电脑配置如下

 

程序得出K:盘 ,DeviceNumber=2 ,因为是从0开始计数,所以第二个硬盘其实是第三个硬盘。;PartitionNumber=3;

是硬盘2的第三个分区,依此类推,E:是第一个分区,T:盘是第二个分区,K:是第三个分区,X:是第四个分区。这时用GHOST命令行执行系统还原时,是没有问题的。还原命令为Ghost.exe -clone,mode=pload,src=F:\WIN7-64.gho:1,dst=3:1 -fx -sure  

命令行中的DST:=3:1代表是第二个硬盘即磁盘2;

但是当分活分区不在硬盘的第一个位置处时,如下图

 

运行以上代码可推出如下表格(右侧),

黄色方框的CF是主分区,用DeviceIoControl函数推出C:为第一个分区,F:盘为第二个分区。D:盘为第三个分区,E盘为第四个分区。

用DELPHI XE或C++用什么办法推出上图 DISKGENIUS中的系统盘(C:)正确号为3?

 

 

 

 

 

 

 

 

 

 

 

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
## Features ### Anti-debugging attacks - IsDebuggerPresent - CheckRemoteDebuggerPresent - Process Environement Block (BeingDebugged) - Process Environement Block (NtGlobalFlag) - ProcessHeap (Flags) - ProcessHeap (ForceFlags) - NtQueryInformationProcess (ProcessDebugPort) - NtQueryInformationProcess (ProcessDebugFlags) - NtQueryInformationProcess (ProcessDebugObject) - NtSetInformationThread (HideThreadFromDebugger) - NtQueryObject (ObjectTypeInformation) - NtQueryObject (ObjectAllTypesInformation) - CloseHanlde (NtClose) Invalide Handle - SetHandleInformation (Protected Handle) - UnhandledExceptionFilter - OutputDebugString (GetLastError()) - Hardware Breakpoints (SEH / GetThreadContext) - Software Breakpoints (INT3 / 0xCC) - Memory Breakpoints (PAGE_GUARD) - Interrupt 0x2d - Interrupt 1 - Parent Process (Explorer.exe) - SeDebugPrivilege (Csrss.exe) - NtYieldExecution / SwitchToThread - TLS callbacks ### Anti-Dumping - Erase PE header from memory - SizeOfImage ### Timing Attacks [Anti-Sandbox] - RDTSC (with CPUID to force a VM Exit) - RDTSC (Locky version with GetProcessHeap & CloseHandle) - Sleep -> SleepEx -> NtDelayExecution - Sleep (in a loop a small delay) - Sleep and check if time was accelerated (GetTickCount) - SetTimer (Standard Windows Timers) - timeSetEvent (Multimedia Timers) - WaitForSingleObject -> WaitForSingleObjectEx -> NtWaitForSingleObject - WaitForMultipleObjects -> WaitForMultipleObjectsEx -> NtWaitForMultipleObjects (todo) - IcmpSendEcho (CCleaner Malware) - CreateWaitableTimer (todo) - CreateTimerQueueTimer (todo) - Big crypto loops (todo) ### Human Interaction / Generic [Anti-Sandbox] - Mouse movement - Total Physical memory (GlobalMemoryStatusEx) - Disk size using DeviceIoControl (IOCTL_DISK_GET_LENGTH_INFO) - Disk size using GetDiskFreeSpaceEx (TotalNumberOfBytes) - Mouse (Single click / Double click) (todo) - DialogBox (todo) - Scrolling (todo) - Execution after reboot (todo) - Count of processors (Win32/Tinba - Win32/Dyre) - Sandbox k

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值