MBR解析
先推广一下QQ群：61618925。欢迎各位爱好编程的朋友加入。
一、程序界面
二、关键部分代码：
1.数据结构定义
#define MBRSIZE 512
#define BOOTRECORDSIZE 440
#define DISKSIGNEDSIZE 4
#define RESERVESIZE 2
#define DPTNUMBER 4
#define DPTSIZE 16
#define ENDSIGNSIZE 2 typedef struct tagBOOTRECORD
{
UCHAR szBootRecord[BOOTRECORDSIZE];
}BOOTRECORD, *PBOOTRECORD; typedef struct tagDPT
{
UCHAR szBootSign; //引导标志，0x80表示活动分区，0x00表示非活动分区
UCHAR szStartHeadNumber; //起始磁头号
UCHAR szStartSectorNumber; //起始扇区号，低6位
UCHAR szStartCylinderNumber;//起始柱面号，起始扇区号的高2位+起始柱面号
UCHAR szPartitionType; //分区类型，0x00表示该分区未使用（即未指定）,0x06表示FAT16基本分区，0x0B表示FAT32基本分区，0x05表示拓展分区,0x07表示NTFS分区，0x0F表示（LBA模式）拓展分区（0x83为Linux分区等）。
UCHAR szEndHeadNumber; //结束磁头号
UCHAR szEndSectorNumber; //结束扇区号，低6位
UCHAR szEndCylinderNumber; //结束柱面号，结束扇区号的高2位+结束柱面号
ULONG ulSectorsPreceding; //本分区之前使用的扇区数
ULONG ulSectorsInPartition; //分区的总扇区数
}DPT, *PDPT; typedef struct tagMBR
{
BOOTRECORD BootRecord;//引导程序
UCHAR ulSigned[DISKSIGNEDSIZE]; //Windows磁盘签名
UCHAR szReserve[RESERVESIZE]; //保留位
DPT Dpt[DPTNUMBER]; //分区表
UCHAR szEndSign[ENDSIGNSIZE]; //结束标志
}MBR, *PMBR;
2.关键程序实现
void CMBRInfoDlg::InitMBRTree(void)
{
HTREEITEM hParentItem = m_ctrlMBRTree.InsertItem(_T("引导程序"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("Windows磁盘签名"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("保留位"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("分区表"));
HTREEITEM hChildItem = m_ctrlMBRTree.InsertItem(_T("第一分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第二分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第三分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第四分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hParentItem = m_ctrlMBRTree.InsertItem(_T("结束标志"));
m_ctrlMBRTree.SetBkColor(RGB(, , ));
} void CMBRInfoDlg::ShowMBR()
{
DWORD dwRead = ;
DWORD dwError = ;
CString strError = _T(""); UCHAR szMBRInfo[MBRSIZE];
ZeroMemory(szMBRInfo, MBRSIZE * sizeof(UCHAR));
if (!ReadFile(m_hDevice, (LPVOID)szMBRInfo, MBRSIZE * sizeof(UCHAR), &dwRead, NULL))
{
dwError = GetLastError();
strError.Format(_T("ReadFile Error : %d"), dwError);
AfxMessageBox(strError);
CloseHandle(m_hDevice);
m_hDevice = INVALID_HANDLE_VALUE;
return;
} memcpy(m_Mbr.BootRecord.szBootRecord, szMBRInfo, BOOTRECORDSIZE * sizeof(UCHAR));
memcpy(m_Mbr.ulSigned, &szMBRInfo[BOOTRECORDSIZE], DISKSIGNEDSIZE);
memcpy(m_Mbr.szReserve, &szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE], RESERVESIZE);
for (int i = ; i < ; ++i)
{
m_Mbr.Dpt[i].szBootSign = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE];
m_Mbr.Dpt[i].szStartHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szStartSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szStartCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szPartitionType = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].ulSectorsPreceding = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);
m_Mbr.Dpt[i].ulSectorsInPartition = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);
}
memcpy(m_Mbr.szEndSign, &szMBRInfo[MBRSIZE - ENDSIGNSIZE], ENDSIGNSIZE); UCHAR szTemp[];
CString strTemp = _T("");
for (int i = ; i < MBRSIZE; i++)
{
ZeroMemory(szTemp, * sizeof(UCHAR));
wsprintf((LPTSTR)szTemp, _T("%02X"), szMBRInfo[i]);
strTemp = szTemp;
m_strMBRInfo += strTemp;
if ((i + ) % == )
{
m_strMBRInfo += _T("\r\n");
}
else
{
m_strMBRInfo += _T(" ");
}
} m_ctrlMBREdit.SetWindowText(m_strMBRInfo);
} void CMBRInfoDlg::OnTvnSelchangedTreeMbr(NMHDR *pNMHDR, LRESULT *pResult)
{
LPNMTREEVIEW pNMTreeView = reinterpret_cast<LPNMTREEVIEW>(pNMHDR);
// TODO: 在此添加控件通知处理程序代码
HTREEITEM hItem = m_ctrlMBRTree.GetSelectedItem();
CString strItemText = m_ctrlMBRTree.GetItemText(hItem);
if (strItemText == _T("引导程序"))
{
m_ctrlMBREdit.SetSel(, * BOOTRECORDSIZE - );
m_strTips = _T("引导程序占440字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("Windows磁盘签名"))
{
m_ctrlMBREdit.SetSel( * BOOTRECORDSIZE, * (BOOTRECORDSIZE + DISKSIGNEDSIZE) - );
m_strTips = _T("Windows磁盘签名占4个字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("保留位"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE) - );
m_strTips = _T("保留位占2个字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTNUMBER * DPTSIZE) - );
m_strTips = _T("分区表总占64个字节，系统最多有4个主分区。双击分区表节点可以展开下一级节点查看各个分区的具体信息。");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束标志"))
{
m_ctrlMBREdit.SetSel( * (MBRSIZE - ENDSIGNSIZE), * MBRSIZE - );
m_strTips = _T("结束标志占2个字节。[55 AA]为正常结束标志");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE) - );
m_strTips = _T("每一个分区表占16个字节，双击第一分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第二分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第三分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第四分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("引导标志"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("起始磁头号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
m_strTips = _T("起始磁头号");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("起始扇区号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("起始柱面号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("分区类型"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
int iPartitionType = ;
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
switch (iPartitionType)
{
case 0x00:
m_strTips = _T("该分区未使用");
break;
case 0x05:
m_strTips = _T("拓展分区");
break;
case 0x06:
m_strTips = _T("FAT16基本分区");
break;
case 0x07:
m_strTips = _T("NTFS分区");
break;
case 0x0B:
m_strTips = _T("FAT32基本分区");
break;
case 0x0F:
m_strTips = _T("（LBA模式）拓展分区");
break;
case 0x83:
m_strTips = _T("Linux分区");
break;
default:
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束磁头号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
m_strTips = _T("结束磁头号");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束扇区号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("结束柱面号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("本分区前使用的扇区数"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("本分区的总扇区数"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
m_ctrlTips.SetWindowText(m_strTips);
}
*pResult = ;
} HBRUSH CMBRInfoDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor)
{
//HBRUSH hbr = CDialog::OnCtlColor(pDC, pWnd, nCtlColor); // TODO: 在此更改 DC 的任何属性
pDC->SetBkMode(TRANSPARENT);
if (pWnd == GetDlgItem(IDC_EDIT_MBR))
{
return CreateSolidBrush(RGB(, , ));
}
else
{ return CreateSolidBrush(RGB(, , ));
}
// TODO: 如果默认的不是所需画笔，则返回另一个画笔
//return hbr;
} BOOL CMBRInfoDlg::OpenDevice(void)
{
DWORD dwError = ;
CString strError = _T(""); m_hDevice = CreateFile(_T("\\\\.\\PhysicalDrive0"), GENERIC_READ,
FILE_SHARE_READ, NULL, OPEN_EXISTING, , NULL);
if (INVALID_HANDLE_VALUE == m_hDevice)
{
dwError = GetLastError();
strError.Format(_T("CreateFile Error : %d"), dwError);
AfxMessageBox(strError);
return FALSE;
}
return TRUE;
}
三、程序下载地址
http://pan.baidu.com/s/1jGKCa94
MBR解析的更多相关文章
- 主引导扇区MBR的解析
http://blog.chinaunix.net/uid-24774106-id-3340397.html 最近排查一个USB相关的故障,由于信息安全就不多说工作上的事情了,顺路学习了MBR的相关知 ...
- MBR结构解析与fdisk的bash实现
一.MBR结构解析 首先我们先介绍一些MBR的基本知识基础,再晾图片分析. MBR主要分为三大块各自是: 1.载入引导程序(446K) 2.分区表(64k) 3.标志结束位(2k) 载入引导程序:内容 ...
- 病毒木马查杀实战第024篇：MBR病毒之编程解析引导区
前言 通过之前的学习,相信大家已经对磁盘的引导区有了充分的认识.但是我们之前的学习都是利用现成的工具来对引导区进行解析的,而对于一名反病毒工程师而言,不单单需要有扎实的逆向分析功底,同时也需要有很强的 ...
- 病毒木马查杀实战第023篇：MBR病毒之引导区的解析
前言 引导型病毒指寄生在磁盘引导区或主引导区的计算机病毒.这种病毒利用系统引导时,不对主引导区的内容正确与否进行判别的缺点,在引导系统的过程中入侵系统,驻留内存,监视系统运行,伺机传染和破坏.按照引导 ...
- MBR主引导扇区解析
最近在制作镜像的时候由于需要简单研究了下MBR主引导扇区的结构,这里记录下便于后期温习,下面就直接进入正题: MBR主引导扇区位于磁盘的第一个扇区,即0号扇区,主要由引导代码.分区表.结束标志三部分构 ...
- MBR内容解析
原先博客放弃使用,几篇文章搬运过来 MBR(Master Boot Record)即主引导记录. 使用Winhex打开,磁盘的第一扇区: 黄色部分(000H-1B7H):引导分区 作用:在主板BIOS ...
- MBR主引导扇区解析2
unsigned AnsiChar data[] = { 0x33, 0xC0, 0x8E, 0xD0, 0xBC, 0x00, 0x7C, 0x8E, 0xC0, 0x8E, 0xD8, 0xBE, ...
- 地理围栏算法解析（Geo-fencing）
地理围栏算法解析 http://www.cnblogs.com/LBSer/p/4471742.html 地理围栏(Geo-fencing)是LBS的一种应用,就是用一个虚拟的栅栏围出一个虚拟地理边界 ...
- 如何将硬盘GPT分区转换为MBR分区模式
现在新出的笔记本普遍自带WIN8系统,硬盘分区一般都采用GPT格式,但是包括WIN7及以下的系统都无法安装在GPT格式的硬盘上,因此,如果我们需要安装WIN7系统,需要将硬盘分区从GPT转换成MBR格 ...
随机推荐
- JS的Data类型格式化(转)
// 对Date的扩展,将 Date 转化为指定格式的String // 月(M).日(d).小时(h).分(m).秒(s).季度(q) 可以用 1-2 个占位符, // 年(y)可以用 1-4 个占 ...
- iOS 批量打包--Shell脚本
由于公司有批量打包的需要,只是渠道号不一样,网上搜索一番,大致有两个方式:a) 从源程序一次性打出所有渠道的ipa包,大概的思路就是利用脚本循环执行打包过程,而每次打包前都通过脚本修改项目中存放渠道号 ...
- 服务器压力测试 ab
1.ab命令原理 Apache自带的ab命令模拟多线程并发请求,测试服务器负载压力,也可以测试nginx.lighthttp.IIS等其它Web服务器的压力(测试其它服务器时需单独下载ab压力测试工具 ...
- C++学习7 构造函数
当创建一个对象时,往往需要做一些初始化工作,例如对数据成员赋值等.为了解决这个问题,C++提供了构造函数. 构造函数(Constructor)是一种特殊的成员函数,它的名字和类名相同,没有返回值,不需 ...
- Java中的装箱拆箱
一) 装箱与拆箱 Java中有概念是一切皆对象,因为所有的类都默认继承自Object.但是,对于数据类型是个例外,如short,int,long,float,double, byte,char,bo ...
- ext 3.2 tree 在IE10中点击事件失效的bug
ext3.2 中的tree在IE中进行兼容性测试,遇到IE10时,无法点击,其他版本的IE(7.8.9.11)均正常.此bug是由于ext-all.js中的getAttributeNS方法不能兼容IE ...
- 采用p6spy完整显示hibernate的SQL语句
虽然在hibernate中有show_sql选项,但是显示出来的语句大多类似 select * from xxx where value=? 但是有时候我们需要得到完整的SQL语句,怎么办呢?使用P6 ...
- Adobe AIR socket complicating 导致 socket RST
基于socket实现HTTP协议 并发请求AB,A为HTTP请求,B为socket请求. A的请求服务器返回数据很短,包体长度只有35,且客户端收到包头后就断开连接,同时A连接的服务器也断开了连接, ...
- Codeforces 665D Simple Subset [简单数学]
题意: 给你n个数,让你从中选一个子集要求子集中的任何两个数相加都是质数. 思路: 一开始把自己坑了,各种想,后来发现一个简单的性质,那就是两个数相加的必要条件是这两个数之中必定一个奇数一个偶数,(除 ...
- java爬虫实战
1.下载jxl.jar包,网上多的是 2.编写如下代码: package com.beyond.url; import java.io.BufferedReader;import java.io.Fi ...