diskrw1.cpp

含：分析物理磁盘的分区表和各分区的bootsector for bitlocker以及WINDOWS下设备枚举.

#include "stdafx.h"
#include "diskrw.h"
#include "windows.h"
#include <winioctl.h>
#include <setupapi.h>
#include <devguid.h>
#include <regstr.h>
#pragma comment(lib,"Setupapi.lib")
/////////////////////////////////////////////////////////////////////////////
#define DISK_PART_TABLE_NUM 4
#define RD_BUFFER_SIZE 512
#define BOOT_SECTOR_SIZE 512

#define UINT8 unsigned char
#define UINT16 unsigned short
#define UINT32 unsigned int
#define UINT64 __int64

#define uint8  unsigned char
#define uint16 unsigned short
#define uint32 unsigned int
#define uint64 __int64

#define UCHAR unsigned char
#define USHORT unsigned short
#define ULONG unsigned int
#define ULONGLONG __int64

#pragma pack(1)

typedef struct{
	UINT8 Flag;				//00h
	UINT8 StartTrack;		//01h
	UINT8 StartSector;		//02h
	UINT8 StartCylinder;	//03h
	UINT8 SysFlag;			//04h
	UINT8 EndTrack;			//05h
	UINT8 EndSector;		//06h
	UINT8 EndCylinder;		//07h
	UINT32 SectorAddress;	//08h
	UINT32 NumberOfSector;	//0ch
}DISK_PART;
typedef struct{			      //Offset Size Field Required Value for BitLocker 
	UINT8  Reserved[3];
	UINT8  Signature[8];	  //0x003 8 Signature ‘-‘,’F’,’V’,’E’,’-‘,’F’,’S’,’-‘
	UINT16 BytesPerSector;    //0x00B 2 BytesPerSector
	UINT8  SectorsPerCluster; //0x00D 1 SectorsPerCluster One of 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40 or 0x80 
	UINT16 ReservedClusters;  //0x00E 2 ReservedClusters 0x0000 
	UINT8  FatCount;          //0x010 1 FatCount 0x00 
	UINT16 RootEntries;       //0x011 2 RootEntries 0x0000 
	UINT16 Sectors;           //0x013 2 Sectors 0x0000 
	UINT8  MediaType; 	      //0x015  1 Media Type
	UINT16 SectorsPerFat;     //0x016 2 SectorsPerFat 0x0000 
	UINT16 SectorsPerTrack;   //0x018 2 SectorsPerTrack
	UINT16 NumberOfTrackHead; //0x1a 2 NumberOfTrackHead
	UINT32 NumberOfHiddenSectors; //0x1c 4 NumberOfHiddenSectors
	UINT32 LargeSectors;      //0x020 4 LargeSectors 0x00000000 
	UINT16 NumberOfPhyDriver; //0x024 2
	UINT8  SignOfExtBoot;	  //0x026 1
	UINT32 SerialOfVolume;	  //0x027 4
	UINT8  LabelOfVolume[11];   //0x02b 11
	UINT16  SerialOfFileSystem;   //0x036 2
	UINT32 MetadataLcn[2];   //0x038 8 MetadataLcn 	
}BPB;
#pragma pack()

typedef struct _DiskPartTableNode{
	DISK_PART DiskPartTable[DISK_PART_TABLE_NUM];
	struct _DiskPartTableNode *pNext[DISK_PART_TABLE_NUM];
}DiskPartTableNode;

/////////////////////////////////////////////////////////////////////////////
DISK_GEOMETRY Geometry;
DiskPartTableNode *gDiskPartTable=NULL;

char *bin2string(int length, unsigned char dat[]);


int AddDiskPartTable(DiskPartTableNode **pTable, int tableId, DISK_PART *pDiskPart)
{
	DiskPartTableNode *pNode;
	
	printf("\n\tAddDiskPartTable (%d)...", tableId);
	if(tableId<0 || tableId>DISK_PART_TABLE_NUM)
	{
		printf("Error tableId = %d !", tableId);
		return 0;
	}
		
	if(pDiskPart == NULL)
	{
		printf("AddDiskPartTable pDiskPart = NULL !");
		return 0;
	}
		
	pNode = (DiskPartTableNode *)malloc(sizeof(DiskPartTableNode));
	if(pNode == NULL)
	{
		printf("AddDiskPartTable malloc Fail!");
		return 0;
	}
	memset(pNode, 0, sizeof(DiskPartTableNode));	
	memcpy(pNode->DiskPartTable, pDiskPart, sizeof(DISK_PART)*DISK_PART_TABLE_NUM);

	if(*pTable == NULL)
	{
		*pTable = pNode;
	}
	else
	{
		(*pTable)->pNext[tableId] = pNode;
	}

#if 0
	int i;
	DISK_PART *pPart;
	for(i=0; i<DISK_PART_TABLE_NUM; i++)
	{
		pPart = &pDiskPart[i];
		{			
			printf("\n    %03d  %02Xh  %03d  %03d  %03d - %02Xh-  %03d  %03d  %03d - %8Xh %8Xh",
				i, pPart->Flag, 
				pPart->StartTrack, pPart->StartSector, pPart->StartCylinder, 
				pPart->SysFlag, 
				pPart->EndTrack, pPart->EndSector, pPart->EndCylinder, 
				pPart->SectorAddress, pPart->NumberOfSector );
		}
	}
#endif	
	return 1;
}	

int TotalPartTableNum = 0;
void dumpDiskPartTable(DiskPartTableNode *pNode)
{
	int i;
	DISK_PART *pPart;
	
	if(pNode == NULL)
		return;
		
	if(pNode == gDiskPartTable)
	{
		TotalPartTableNum = 0;
		printf("\n\n  [%3s] %s %s %s %s -%s- %s %s %s - %s %s",
			"No.", "Flag", 
			"STck", "SSec", "SCyl", 
			"SysF", 
			"ETck", "ESec", "ECyl", 
			"SectorAddr", "NumOfSector");
	}
	
	for(i=0; i<DISK_PART_TABLE_NUM; i++)
	{
		pPart = &pNode->DiskPartTable[i];
		if(pPart->SysFlag != 0)
		{			
			TotalPartTableNum++;
			printf("\n    %3d  %2Xh  %3d  %3d  %3d - %02Xh-  %3d  %3d  %3d -",
				i, pPart->Flag, 
				pPart->StartTrack, pPart->StartSector, pPart->StartCylinder, 
				pPart->SysFlag, 
				pPart->EndTrack, pPart->EndSector, pPart->EndCylinder);
			printf(" %8Xh", pPart->SectorAddress);
			printf(" %8Xh",  pPart->NumberOfSector);
			
		}	
	}
	
	for(i=0; i<DISK_PART_TABLE_NUM; i++)
		if(pNode->pNext[i] != NULL)
		{
			dumpDiskPartTable(pNode->pNext[i]);
		}	
			
	printf("\n  TotalPartTableNum = %d", TotalPartTableNum);
}


void freeDiskPartTable(DiskPartTableNode *pNode)
{
	int i;
	
	if(pNode == NULL)
		return;
		
	if(pNode == gDiskPartTable)
	{
		TotalPartTableNum = 0;
		gDiskPartTable = NULL;
	}
	
	for(i=0; i<DISK_PART_TABLE_NUM; i++)
	{
		if(pNode->pNext[i] != NULL)
		{
			freeDiskPartTable(pNode->pNext[i]);
		}
	}
	
	free(pNode);
}
/////////////////////////////////////////////////////////////////////////////
void dump(unsigned char *pBuf, int leng)
{
	int index;
	
	for(index=0; index<leng; index++)
	{
		if(index%0x10==0)
			printf("\n[%04x]: ", index);
		else if(index%8==0)
			printf("- ");
		printf("%02X ", *pBuf++);
	}
}

/****************************************************************************

****************************************************************************/
char *TpmDeviceDescript[]={
	"Trusted Platform Module",
	"BitLocker Drive Encryption Filter Driver"
};

int DetectTpmDevice(void)
{
    HDEVINFO hDevInfo;
    SP_DEVINFO_DATA DeviceInfoData;
    DWORD i;
    int j, res = 0;
 
    // Create a HDEVINFO with all present devices.
    hDevInfo = SetupDiGetClassDevs(NULL,
        0, // Enumerator
        0,
        DIGCF_PRESENT | DIGCF_ALLCLASSES );
    
    if (hDevInfo == INVALID_HANDLE_VALUE)
    {
        return -1;
    }
    
    // Enumerate through all devices in Set.    
    DeviceInfoData.cbSize = sizeof(SP_DEVINFO_DATA);
    for (i=0;SetupDiEnumDeviceInfo(hDevInfo,i,&DeviceInfoData);i++)
    {
        DWORD DataT;
        LPTSTR buffer = NULL;
        DWORD buffersize = 0;
        
        // 
        // Call function with null to begin with, 
        // then use the returned buffer size 
        // to Alloc the buffer. Keep calling until
        // success or an unknown failure.
        // 
        while (!SetupDiGetDeviceRegistryProperty(
            hDevInfo,
            &DeviceInfoData,
            SPDRP_DEVICEDESC,//SPDRP_FRIENDLYNAME,//SPDRP_HARDWAREID,//SPDRP_DEVICEDESC,
            &DataT,
            (PBYTE)buffer,
            buffersize,
            &buffersize))
        {
            if (GetLastError() == ERROR_INSUFFICIENT_BUFFER)
            {
                if (buffer) 
                	LocalFree(buffer);
                buffer = (char*)LocalAlloc(LPTR,buffersize);
            }
            else
            {
                break;
            }
        }

        for(j=0; j<sizeof(TpmDeviceDescript)/sizeof(char *); j++)
        {
        	if(!strncmp(TpmDeviceDescript[j], buffer, strlen(TpmDeviceDescript[j])))
        	{
        		res = 1;
        		goto DetectTpmDeviceEnd;
        	}
    	}        
        if (buffer) 
        	LocalFree(buffer);
    }
        
    if ( GetLastError()!=NO_ERROR &&  GetLastError()!=ERROR_NO_MORE_ITEMS )
    {
        return -1;
    }

DetectTpmDeviceEnd:    
    SetupDiDestroyDeviceInfoList(hDevInfo); 
    return res;
}    

/****************************************************************************

****************************************************************************/
char buf[256];
char hexArr[]="0123456789ABCDEF";