MBR解析

先推广一下QQ群：61618925。欢迎各位爱好编程的朋友加入。

一、程序界面

二、关键部分代码：

1.数据结构定义

#define MBRSIZE 512

#define BOOTRECORDSIZE 440

#define DISKSIGNEDSIZE 4

#define RESERVESIZE 2

#define DPTNUMBER 4

#define DPTSIZE 16

#define ENDSIGNSIZE 2

typedef struct tagBOOTRECORD

{

    UCHAR szBootRecord[BOOTRECORDSIZE];

}BOOTRECORD, *PBOOTRECORD;

typedef struct tagDPT

{

    UCHAR szBootSign;            //引导标志，0x80表示活动分区，0x00表示非活动分区

    UCHAR szStartHeadNumber;    //起始磁头号

    UCHAR szStartSectorNumber;    //起始扇区号，低6位

    UCHAR szStartCylinderNumber;//起始柱面号，起始扇区号的高2位+起始柱面号

    UCHAR szPartitionType;        //分区类型，0x00表示该分区未使用（即未指定）,0x06表示FAT16基本分区，0x0B表示FAT32基本分区，0x05表示拓展分区,0x07表示NTFS分区，0x0F表示（LBA模式）拓展分区（0x83为Linux分区等）。

    UCHAR szEndHeadNumber;        //结束磁头号

    UCHAR szEndSectorNumber;    //结束扇区号，低6位

    UCHAR szEndCylinderNumber;    //结束柱面号，结束扇区号的高2位+结束柱面号

    ULONG ulSectorsPreceding;    //本分区之前使用的扇区数

    ULONG ulSectorsInPartition;    //分区的总扇区数

}DPT, *PDPT;

typedef struct tagMBR

{

    BOOTRECORD BootRecord;//引导程序

    UCHAR ulSigned[DISKSIGNEDSIZE];        //Windows磁盘签名

    UCHAR szReserve[RESERVESIZE];        //保留位

    DPT Dpt[DPTNUMBER];            //分区表

    UCHAR szEndSign[ENDSIGNSIZE];        //结束标志

}MBR, *PMBR;

2.关键程序实现

void CMBRInfoDlg::InitMBRTree(void)

{

    HTREEITEM hParentItem = m_ctrlMBRTree.InsertItem(_T("引导程序"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("Windows磁盘签名"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("保留位"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("分区表"));

    HTREEITEM hChildItem = m_ctrlMBRTree.InsertItem(_T("第一分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第二分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第三分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第四分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hParentItem = m_ctrlMBRTree.InsertItem(_T("结束标志"));

    m_ctrlMBRTree.SetBkColor(RGB(, , ));

}

void CMBRInfoDlg::ShowMBR()

{

    DWORD dwRead = ;

    DWORD dwError = ;

    CString strError = _T("");

    UCHAR szMBRInfo[MBRSIZE];

    ZeroMemory(szMBRInfo, MBRSIZE * sizeof(UCHAR));

    if (!ReadFile(m_hDevice, (LPVOID)szMBRInfo, MBRSIZE * sizeof(UCHAR), &dwRead, NULL))

    {

        dwError = GetLastError();

        strError.Format(_T("ReadFile Error : %d"), dwError);

        AfxMessageBox(strError);

        CloseHandle(m_hDevice);

        m_hDevice = INVALID_HANDLE_VALUE;

        return;

    }

    memcpy(m_Mbr.BootRecord.szBootRecord, szMBRInfo, BOOTRECORDSIZE * sizeof(UCHAR));

    memcpy(m_Mbr.ulSigned, &szMBRInfo[BOOTRECORDSIZE], DISKSIGNEDSIZE);

    memcpy(m_Mbr.szReserve, &szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE], RESERVESIZE);

    for (int i = ; i < ; ++i)

    {

        m_Mbr.Dpt[i].szBootSign = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE];

        m_Mbr.Dpt[i].szStartHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szStartSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szStartCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szPartitionType = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].ulSectorsPreceding = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);

        m_Mbr.Dpt[i].ulSectorsInPartition = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);

    }

    memcpy(m_Mbr.szEndSign, &szMBRInfo[MBRSIZE - ENDSIGNSIZE], ENDSIGNSIZE);

    UCHAR szTemp[];

    CString strTemp = _T("");

    for (int i = ; i < MBRSIZE; i++)

    {

        ZeroMemory(szTemp,  * sizeof(UCHAR));

        wsprintf((LPTSTR)szTemp, _T("%02X"), szMBRInfo[i]);

        strTemp = szTemp;

        m_strMBRInfo += strTemp;

        if ((i + ) %  == )

        {

            m_strMBRInfo += _T("\r\n");

        }

        else

        {

            m_strMBRInfo += _T("  ");

        }

    }

    m_ctrlMBREdit.SetWindowText(m_strMBRInfo);

}

void CMBRInfoDlg::OnTvnSelchangedTreeMbr(NMHDR *pNMHDR, LRESULT *pResult)

{

    LPNMTREEVIEW pNMTreeView = reinterpret_cast<LPNMTREEVIEW>(pNMHDR);

    // TODO: 在此添加控件通知处理程序代码

    HTREEITEM hItem = m_ctrlMBRTree.GetSelectedItem();

    CString strItemText = m_ctrlMBRTree.GetItemText(hItem);

    if (strItemText == _T("引导程序"))

    {

        m_ctrlMBREdit.SetSel(,  * BOOTRECORDSIZE - );

        m_strTips = _T("引导程序占440字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("Windows磁盘签名"))

    {

        m_ctrlMBREdit.SetSel( * BOOTRECORDSIZE,  * (BOOTRECORDSIZE + DISKSIGNEDSIZE) - );

        m_strTips = _T("Windows磁盘签名占4个字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("保留位"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE) - );

        m_strTips = _T("保留位占2个字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTNUMBER * DPTSIZE) - );

        m_strTips = _T("分区表总占64个字节，系统最多有4个主分区。双击分区表节点可以展开下一级节点查看各个分区的具体信息。");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束标志"))

    {

        m_ctrlMBREdit.SetSel( * (MBRSIZE - ENDSIGNSIZE),  * MBRSIZE - );

        m_strTips = _T("结束标志占2个字节。[55 AA]为正常结束标志");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第一分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE) - );

        m_strTips = _T("每一个分区表占16个字节，双击第一分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第二分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第二分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第三分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第三分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第四分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第四分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("引导标志"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("起始磁头号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        m_strTips = _T("起始磁头号");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("起始扇区号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("起始柱面号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("分区类型"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        int iPartitionType = ;

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        switch (iPartitionType)

        {

        case 0x00:

            m_strTips = _T("该分区未使用");

            break;

        case 0x05:

            m_strTips = _T("拓展分区");

            break;

        case 0x06:

            m_strTips = _T("FAT16基本分区");

            break;

        case 0x07:

            m_strTips = _T("NTFS分区");

            break;

        case 0x0B:

            m_strTips = _T("FAT32基本分区");

            break;

        case 0x0F:

            m_strTips = _T("（LBA模式）拓展分区");

            break;

        case 0x83:

            m_strTips = _T("Linux分区");

            break;

        default:

            m_strTips = _T("未知分区");

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束磁头号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        m_strTips = _T("结束磁头号");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束扇区号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("结束柱面号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("本分区前使用的扇区数"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("本分区的总扇区数"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    *pResult = ;

}

HBRUSH CMBRInfoDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor)

{

    //HBRUSH hbr = CDialog::OnCtlColor(pDC, pWnd, nCtlColor);

    // TODO:  在此更改 DC 的任何属性

    pDC->SetBkMode(TRANSPARENT);

    if (pWnd == GetDlgItem(IDC_EDIT_MBR))

    {

        return CreateSolidBrush(RGB(, , ));

    }

    else

    {

        return CreateSolidBrush(RGB(, , ));

    }

    // TODO:  如果默认的不是所需画笔，则返回另一个画笔

    //return hbr;

}

BOOL CMBRInfoDlg::OpenDevice(void)

{

    DWORD dwError = ;

    CString strError = _T("");

    m_hDevice = CreateFile(_T("\\\\.\\PhysicalDrive0"), GENERIC_READ,

        FILE_SHARE_READ, NULL, OPEN_EXISTING, , NULL);

    if (INVALID_HANDLE_VALUE == m_hDevice)

    {

        dwError = GetLastError();

        strError.Format(_T("CreateFile Error : %d"), dwError);

        AfxMessageBox(strError);

        return FALSE;

    }

    return TRUE;

}

三、程序下载地址

http://pan.baidu.com/s/1jGKCa94

MBR解析的更多相关文章

主引导扇区MBR的解析
http://blog.chinaunix.net/uid-24774106-id-3340397.html 最近排查一个USB相关的故障,由于信息安全就不多说工作上的事情了,顺路学习了MBR的相关知 ...
MBR结构解析与fdisk的bash实现
一.MBR结构解析首先我们先介绍一些MBR的基本知识基础,再晾图片分析. MBR主要分为三大块各自是: 1.载入引导程序(446K) 2.分区表(64k) 3.标志结束位(2k) 载入引导程序:内容 ...
病毒木马查杀实战第024篇：MBR病毒之编程解析引导区
前言通过之前的学习,相信大家已经对磁盘的引导区有了充分的认识.但是我们之前的学习都是利用现成的工具来对引导区进行解析的,而对于一名反病毒工程师而言,不单单需要有扎实的逆向分析功底,同时也需要有很强的 ...
病毒木马查杀实战第023篇：MBR病毒之引导区的解析
前言引导型病毒指寄生在磁盘引导区或主引导区的计算机病毒.这种病毒利用系统引导时,不对主引导区的内容正确与否进行判别的缺点,在引导系统的过程中入侵系统,驻留内存,监视系统运行,伺机传染和破坏.按照引导 ...
MBR主引导扇区解析
最近在制作镜像的时候由于需要简单研究了下MBR主引导扇区的结构,这里记录下便于后期温习,下面就直接进入正题: MBR主引导扇区位于磁盘的第一个扇区,即0号扇区,主要由引导代码.分区表.结束标志三部分构 ...
MBR内容解析
原先博客放弃使用,几篇文章搬运过来 MBR(Master Boot Record)即主引导记录. 使用Winhex打开,磁盘的第一扇区: 黄色部分(000H-1B7H):引导分区作用:在主板BIOS ...
MBR主引导扇区解析2
unsigned AnsiChar data[] = { 0x33, 0xC0, 0x8E, 0xD0, 0xBC, 0x00, 0x7C, 0x8E, 0xC0, 0x8E, 0xD8, 0xBE, ...
地理围栏算法解析（Geo-fencing）
地理围栏算法解析 http://www.cnblogs.com/LBSer/p/4471742.html 地理围栏(Geo-fencing)是LBS的一种应用,就是用一个虚拟的栅栏围出一个虚拟地理边界 ...
如何将硬盘GPT分区转换为MBR分区模式
现在新出的笔记本普遍自带WIN8系统,硬盘分区一般都采用GPT格式,但是包括WIN7及以下的系统都无法安装在GPT格式的硬盘上,因此,如果我们需要安装WIN7系统,需要将硬盘分区从GPT转换成MBR格 ...

随机推荐

[转]Vi/Vim查找替换使用方法
vi/vim 中可以使用 :s 命令来替换字符串.该命令有很多种不同细节使用方法,可以实现复杂的功能,记录几种在此,方便以后查询. :s/vivian/sky/ 替换当前行第一个 vivian ...
SKD
1, 软件开发工具包软件开发工具包(Software Development Kit,即SDK)一般是一些被软件工程师用于为特定的软件包.软件框架.硬件平台.操作系统等建立应用软件的开发工具的集合. ...
Wix打包相关资源
1.自定义安装界面(WixUI_Custom.wxs) <?xml version="1.0" encoding="UTF-8"?> <Wix ...
BC水题--The Factor（质因分解）
网址:http://acm.hdu.edu.cn/showproblem.php?pid=5428 roblem Description There is a sequence of n positi ...
DNS拦截的处理
在用webSocket来实现长连接时,我们的链接对象使用了域名.但是再某些省份的网络下,发生了DNS拦截.踹改.导致使用某个域名链接,发生连接不上的现象.[解决方案] 在多次尝试原有域名不能使用的情况 ...
常见的MIME类型
超文本标记语言文本 .htm,.html text/html 普通文本 .txt text/plain GIF图形 .gif image/gif JPEG图形 .ipeg,.jpg image/jpe ...
PHP截取IE浏览器并缩小原图的方法
这篇文章主要介绍了PHP截取IE浏览器并缩小原图的方法,涉及PHP调用com组件实现图像截取的相关技巧,需要的朋友可以参考下本文实例讲述了PHP截取IE浏览器并缩小原图的方法.分享给大家供大家参考, ...
转载：LoadRunner11-遇到问题及解决办法
转自:http://4951507.blog.51cto.com/4941507/1108733 1.LoadRunner超时错误:在录制Web服务器端,如果超过120秒服务器协议脚本回放时超时情况经 ...
Integer cache
View.findViewById采用深度遍历,找到第一个匹配的控件 Integer Cache public static void testIntegerCache() { Class cache ...
java的文件流：字节流（FileInputStream、FileOutputStream）和字符流（FileReader、FileWriter）。
java的输入输出建立在4个抽象类的基础上:InputStream.OutputStream.Reader.Writer.InputSream和OutputStream被设计成字节流类,而Reader ...

MBR解析

MBR解析的更多相关文章

随机推荐

热门专题