日期:2014-05-17  浏览次数:21155 次

怎么读取MBR扇区
各位好:

     下面是一段在内核读取U盘扇区的代码,它只能读到DBR信息,怎么能读到MBR的信息呢?

      读取的时机是U盘MOUNT的时候。

       storageStackDeviceObject = irpSp->Parameters.MountVolume.Vpb->RealDevice;//

       BusType = BusType(storageStackDeviceObject);//获取总线类型

       if (7 == BusType)
       {
int i = 0;
UCHAR buffer[512] = {0};
TyReadSectorZero(storageStackDeviceObject,buffer,512);
       }
//FUNCTION

      NTSTATUS TyReadSectorZero_1(PDEVICE_OBJECT DeviceObject, PVOID Buffer,ULONG Length)
{
KEVENT event;
NTSTATUS ntstatus = STATUS_SUCCESS;
//初始化事件
KeInitializeEvent(&event, NotificationEvent, FALSE);

//取得中断级别,判断是否可用IoBuildSynchronousFsdRequest
if(KeGetCurrentIrql() <= APC_LEVEL)
{
PIRP pReadIrp;
LARGE_INTEGER lioffset = {0};
IO_STATUS_BLOCK ioblock = {0};

//调用IoBuildSynchronousFsdRequest构造IRP包,返回值即为指向IRP的指针.
pReadIrp = IoBuildSynchronousFsdRequest(IRP_MJ_READ, 
                                                           DeviceObject,
                                                           Buffer, 
                                                           Length, 
                                                           &lioffset, 
                                                           &event,
                                                           &ioblock);
//构造IRP包失败
if(0 == pReadIrp)
{
KdPrint(("IoBuildSynchronousFsdRequest fail! \n"));
goto _end;
}

//发送IRP
ntstatus&nb