获取网卡MAC、硬盘序列号、CPU_ID、BIOS编号

抄来的

  获取网卡MAC、硬盘序列号、CPU ID、BIOS编号
本文中所有原理及思想均取自网络，有修改。其中获取硬盘序列号、获取CPU编号、获取BIOS编号的原始代码的著作权归各自作者所有。 

　　 以下代码可以取得系统特征码（网卡MAC、硬盘序列号、CPU ID、BIOS编号）

    BYTE szSystemInfo[]; // 在程序执行完毕后，此处存储取得的系统特征码
    UINT uSystemInfoLen = ; // 在程序执行完毕后，此处存储取得的系统特征码的长度

    // 网卡 MAC 地址，注意: MAC 地址是可以在注册表中修改的
    {
        UINT uErrorCode = ;
        IP_ADAPTER_INFO iai;
        ULONG uSize = ;
        DWORD dwResult = GetAdaptersInfo( &iai, &uSize );
        if( dwResult == ERROR_BUFFER_OVERFLOW )
        {
            IP_ADAPTER_INFO* piai = ( IP_ADAPTER_INFO* )HeapAlloc( GetProcessHeap( ), , uSize );
            if( piai != NULL )
            {
                dwResult = GetAdaptersInfo( piai, &uSize );
                if( ERROR_SUCCESS == dwResult )
                {
                    IP_ADAPTER_INFO* piai2 = piai;
                    while( piai2 != NULL && ( uSystemInfoLen + piai2->AddressLength ) < 4096U )
                    {
                        CopyMemory( szSystemInfo + uSystemInfoLen, piai2->Address, piai2->AddressLength );
                        uSystemInfoLen += piai2->AddressLength;
                        piai2 = piai2->Next;
                    }
                }
                else
                {
                    uErrorCode = 0xF0000000U + dwResult;
                }
                VERIFY( HeapFree( GetProcessHeap( ), , piai ) );
            }
            else
            {
                return FALSE;
            }
        }
        else
        {
            uErrorCode = 0xE0000000U + dwResult;
        }
        if( uErrorCode != 0U )
        {
            return FALSE;
        }
    }

    // 硬盘序列号，注意：有的硬盘没有序列号
    {
        OSVERSIONINFO ovi = {  };
        ovi.dwOSVersionInfoSize = sizeof( OSVERSIONINFO );
        GetVersionEx( &ovi );

        if( ovi.dwPlatformId != VER_PLATFORM_WIN32_NT )
        {
            // Only Windows 2000, Windows XP, Windows Server 2003...
            return FALSE;
        }
        else
        {
            if( !WinNTHDSerialNumAsPhysicalRead( szSystemInfo, &uSystemInfoLen,  ) )
            {
                WinNTHDSerialNumAsScsiRead( szSystemInfo, &uSystemInfoLen,  );
            }
        }
    }

    // CPU ID
    {
        BOOL bException = FALSE;
        BYTE szCpu[]  = {  };
        UINT uCpuID     = 0U;

        __try
        {
            _asm
            {
                mov eax,
                cpuid
                mov dword ptr szCpu[], ebx
                mov dword ptr szCpu[], edx
                mov dword ptr szCpu[], ecx
                mov eax,
                cpuid
                mov uCpuID, edx
            }
        }
        __except( EXCEPTION_EXECUTE_HANDLER )
        {
            bException = TRUE;
        }

        if( !bException )
        {
            CopyMemory( szSystemInfo + uSystemInfoLen, &uCpuID, sizeof( UINT ) );
            uSystemInfoLen += sizeof( UINT );

            uCpuID = strlen( ( char* )szCpu );
            CopyMemory( szSystemInfo + uSystemInfoLen, szCpu, uCpuID );
            uSystemInfoLen += uCpuID;
        }
    }

    // BIOS 编号，支持 AMI, AWARD, PHOENIX
    {
        SIZE_T ssize; 

        LARGE_INTEGER so;
        so.LowPart=0x000f0000;
        so.HighPart=0x00000000;
        ssize=0xffff;
        wchar_t strPH[]=L\\device\\physicalmemory; 

        DWORD ba=;

        UNICODE_STRING struniph;
        struniph.Buffer=strPH;
        struniph.Length=0x2c;
        struniph.MaximumLength =0x2e; 

        OBJECT_ATTRIBUTES obj_ar;
        obj_ar.Attributes =;
        obj_ar.Length =;
        obj_ar.ObjectName=&struniph;
        obj_ar.RootDirectory=;
        obj_ar.SecurityDescriptor=;
        obj_ar.SecurityQualityOfService =; 

        HMODULE hinstLib = LoadLibrary("ntdll.dll");
        ZWOS ZWopenS=(ZWOS)GetProcAddress(hinstLib,"ZwOpenSection");
        ZWMV ZWmapV=(ZWMV)GetProcAddress(hinstLib,"ZwMapViewOfSection");
        ZWUMV ZWunmapV=(ZWUMV)GetProcAddress(hinstLib,"ZwUnmapViewOfSection"); 

        //调用函数，对物理内存进行映射
        HANDLE hSection;
        if(  == ZWopenS(&hSection,,&obj_ar) &&
             == ZWmapV(
            ( HANDLE )hSection,   //打开Section时得到的句柄
            ( HANDLE )0xFFFFFFFF, //将要映射进程的句柄，
            &ba,                  //映射的基址
            ,
            0xFFFF,               //分配的大小
            &so,                  //物理内存的地址
            &ssize,               //指向读取内存块大小的指针
            ,                    //子进程的可继承性设定
            ,                    //分配类型
                                 //保护类型
            ) )
        //执行后会在当前进程的空间开辟一段64k的空间，并把f000:0000到f000:ffff处的内容映射到这里
        //映射的基址由ba返回,如果映射不再有用,应该用ZwUnmapViewOfSection断开映射
        {
            BYTE* pBiosSerial = ( BYTE* )ba;
            UINT uBiosSerialLen = FindAwardBios( &pBiosSerial );
            if( uBiosSerialLen == 0U )
            {
                uBiosSerialLen = FindAmiBios( &pBiosSerial );
                if( uBiosSerialLen == 0U )
                {
                    uBiosSerialLen = FindPhoenixBios( &pBiosSerial );
                }
            }
            if( uBiosSerialLen != 0U )
            {
                CopyMemory( szSystemInfo + uSystemInfoLen, pBiosSerial, uBiosSerialLen );
                uSystemInfoLen += uBiosSerialLen;
            }
            ZWunmapV( ( HANDLE )0xFFFFFFFF, ( void* )ba );
        }
    }
    // 完毕， 系统特征码已取得。

　以下是其中用到的某些结构及函数的定义:

#define  FILE_DEVICE_SCSI              0x0000001b
#define  IOCTL_SCSI_MINIPORT_IDENTIFY  ( ( FILE_DEVICE_SCSI << 16 ) + 0x0501 )

#define  IOCTL_SCSI_MINIPORT 0x0004D008  //  see NTDDSCSI.H for definition

#define  IDENTIFY_BUFFER_SIZE  512
#define  SENDIDLENGTH  ( sizeof( SENDCMDOUTPARAMS ) + IDENTIFY_BUFFER_SIZE )

#define  IDE_ATAPI_IDENTIFY  0xA1  //  Returns ID sector for ATAPI.
#define  IDE_ATA_IDENTIFY    0xEC  //  Returns ID sector for ATA.
#define  DFP_RECEIVE_DRIVE_DATA   0x0007c088

typedef struct _IDSECTOR
{
    USHORT  wGenConfig;
    USHORT  wNumCyls;
    USHORT  wReserved;
    USHORT  wNumHeads;
    USHORT  wBytesPerTrack;
    USHORT  wBytesPerSector;
    USHORT  wSectorsPerTrack;
    USHORT  wVendorUnique[];
    CHAR    sSerialNumber[];
    USHORT  wBufferType;
    USHORT  wBufferSize;
    USHORT  wECCSize;
    CHAR    sFirmwareRev[];
    CHAR    sModelNumber[];
    USHORT  wMoreVendorUnique;
    USHORT  wDoubleWordIO;
    USHORT  wCapabilities;
    USHORT  wReserved1;
    USHORT  wPIOTiming;
    USHORT  wDMATiming;
    USHORT  wBS;
    USHORT  wNumCurrentCyls;
    USHORT  wNumCurrentHeads;
    USHORT  wNumCurrentSectorsPerTrack;
    ULONG   ulCurrentSectorCapacity;
    USHORT  wMultSectorStuff;
    ULONG   ulTotalAddressableSectors;
    USHORT  wSingleWordDMA;
    USHORT  wMultiWordDMA;
    BYTE    bReserved[];
} IDSECTOR, *PIDSECTOR;

typedef struct _DRIVERSTATUS

{
    BYTE  bDriverError;  //  Error code from driver, or 0 if no error.
    BYTE  bIDEStatus;    //  Contents of IDE Error register.
    //  Only valid when bDriverError is SMART_IDE_ERROR.
    BYTE  bReserved[];  //  Reserved for future expansion.
    DWORD  dwReserved[];  //  Reserved for future expansion.
} DRIVERSTATUS, *PDRIVERSTATUS, *LPDRIVERSTATUS;

typedef struct _SENDCMDOUTPARAMS
{
    DWORD         cBufferSize;   //  Size of bBuffer in bytes
    DRIVERSTATUS  DriverStatus;  //  Driver status structure.
    BYTE          bBuffer[];    //  Buffer of arbitrary length in which to store the data read from the                                                       // drive.
} SENDCMDOUTPARAMS, *PSENDCMDOUTPARAMS, *LPSENDCMDOUTPARAMS;

typedef struct _SRB_IO_CONTROL
{
    ULONG HeaderLength;
    UCHAR Signature[];
    ULONG Timeout;
    ULONG ControlCode;
    ULONG ReturnCode;
    ULONG Length;
} SRB_IO_CONTROL, *PSRB_IO_CONTROL;

typedef struct _IDEREGS
{
    BYTE bFeaturesReg;       // Used for specifying SMART "commands".
    BYTE bSectorCountReg;    // IDE sector count register
    BYTE bSectorNumberReg;   // IDE sector number register
    BYTE bCylLowReg;         // IDE low order cylinder value
    BYTE bCylHighReg;        // IDE high order cylinder value
    BYTE bDriveHeadReg;      // IDE drive/head register
    BYTE bCommandReg;        // Actual IDE command.
    BYTE bReserved;          // reserved for future use.  Must be zero.
} IDEREGS, *PIDEREGS, *LPIDEREGS;

typedef struct _SENDCMDINPARAMS
{
    DWORD     cBufferSize;   //  Buffer size in bytes
    IDEREGS   irDriveRegs;   //  Structure with drive register values.
    BYTE bDriveNumber;       //  Physical drive number to send
    //  command to (0,1,2,3).
    BYTE bReserved[];       //  Reserved for future expansion.
    DWORD     dwReserved[]; //  For future use.
    BYTE      bBuffer[];    //  Input buffer.
} SENDCMDINPARAMS, *PSENDCMDINPARAMS, *LPSENDCMDINPARAMS;

typedef struct _GETVERSIONOUTPARAMS
{
    BYTE bVersion;      // Binary driver version.
    BYTE bRevision;     // Binary driver revision.
    BYTE bReserved;     // Not used.
    BYTE bIDEDeviceMap; // Bit map of IDE devices.
    DWORD fCapabilities; // Bit mask of driver capabilities.
    DWORD dwReserved[]; // For future use.
} GETVERSIONOUTPARAMS, *PGETVERSIONOUTPARAMS, *LPGETVERSIONOUTPARAMS;

//////////////////////////////////////////////////////////////////////

//结构定义
typedef struct _UNICODE_STRING
{
    USHORT  Length;//长度
    USHORT  MaximumLength;//最大长度
    PWSTR  Buffer;//缓存指针
} UNICODE_STRING,*PUNICODE_STRING; 

typedef struct _OBJECT_ATTRIBUTES
{
    ULONG Length;//长度 18h
    HANDLE RootDirectory;//  00000000
    PUNICODE_STRING ObjectName;//指向对象名的指针
    ULONG Attributes;//对象属性00000040h
    PVOID SecurityDescriptor;        // Points to type SECURITY_DESCRIPTOR，0
    PVOID SecurityQualityOfService;  // Points to type SECURITY_QUALITY_OF_SERVICE，0
} OBJECT_ATTRIBUTES;
typedef OBJECT_ATTRIBUTES *POBJECT_ATTRIBUTES; 

//函数指针变量类型
typedef DWORD  (__stdcall *ZWOS )( PHANDLE,ACCESS_MASK,POBJECT_ATTRIBUTES);
typedef DWORD  (__stdcall *ZWMV )( HANDLE,HANDLE,PVOID,ULONG,ULONG,PLARGE_INTEGER,PSIZE_T,DWORD,ULONG,ULONG);
typedef DWORD  (__stdcall *ZWUMV )( HANDLE,PVOID); 

BOOL WinNTHDSerialNumAsScsiRead( BYTE* dwSerial, UINT* puSerialLen, UINT uMaxSerialLen )
{
    BOOL bInfoLoaded = FALSE;

    for( int iController = ; iController < ; ++ iController )
    {
        HANDLE hScsiDriveIOCTL = ;
        char   szDriveName[];

        //  Try to get a handle to PhysicalDrive IOCTL, report failure
        //  and exit if can't.
        sprintf( szDriveName, "\\\\.\\Scsi%d:", iController );

        //  Windows NT, Windows 2000, any rights should do
        hScsiDriveIOCTL = CreateFile( szDriveName,
            GENERIC_READ | GENERIC_WRITE,
            FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
            OPEN_EXISTING, , NULL);

        // if (hScsiDriveIOCTL == INVALID_HANDLE_VALUE)
        //    printf ("Unable to open SCSI controller %d, error code: 0x%lX\n",
        //            controller, GetLastError ());

        if( hScsiDriveIOCTL != INVALID_HANDLE_VALUE )
        {
            int iDrive = ;
            for( iDrive = ; iDrive < ; ++ iDrive )
            {
                char szBuffer[sizeof( SRB_IO_CONTROL ) + SENDIDLENGTH] = {  };

                SRB_IO_CONTROL* p = ( SRB_IO_CONTROL* )szBuffer;
                SENDCMDINPARAMS* pin = ( SENDCMDINPARAMS* )( szBuffer + sizeof( SRB_IO_CONTROL ) );
                DWORD dwResult;

                p->HeaderLength = sizeof( SRB_IO_CONTROL );
                p->Timeout = ;
                p->Length = SENDIDLENGTH;
                p->ControlCode = IOCTL_SCSI_MINIPORT_IDENTIFY;
                strncpy( ( char* )p->Signature, "SCSIDISK",  );

                pin->irDriveRegs.bCommandReg = IDE_ATA_IDENTIFY;
                pin->bDriveNumber = iDrive;

                if( DeviceIoControl( hScsiDriveIOCTL, IOCTL_SCSI_MINIPORT,
                    szBuffer,
                    sizeof( SRB_IO_CONTROL ) + sizeof( SENDCMDINPARAMS ) - ,
                    szBuffer,
                    sizeof( SRB_IO_CONTROL ) + SENDIDLENGTH,
                    &dwResult, NULL ) )
                {
                    SENDCMDOUTPARAMS* pOut = ( SENDCMDOUTPARAMS* )( szBuffer + sizeof( SRB_IO_CONTROL ) );
                    IDSECTOR* pId = ( IDSECTOR* )( pOut->bBuffer );
                    if( pId->sModelNumber[] )
                    {
                        if( * puSerialLen + 20U <= uMaxSerialLen )
                        {
                            // 序列号
                            CopyMemory( dwSerial + * puSerialLen, ( ( USHORT* )pId ) + ,  );

                            // Cut off the trailing blanks
                            for( UINT i = ; i != 0U && ' ' == dwSerial[* puSerialLen + i - ]; -- i )
                            {}
                            * puSerialLen += i;

                            // 型号
                            CopyMemory( dwSerial + * puSerialLen, ( ( USHORT* )pId ) + ,  );
                            // Cut off the trailing blanks
                            for( i = ; i != 0U && ' ' == dwSerial[* puSerialLen + i - ]; -- i )
                            {}
                            * puSerialLen += i;

                            bInfoLoaded = TRUE;
                        }
                        else
                        {
                            ::CloseHandle( hScsiDriveIOCTL );
                            return bInfoLoaded;
                        }
                    }
                }
            }
            ::CloseHandle( hScsiDriveIOCTL );
        }
    }
    return bInfoLoaded;
}

BOOL DoIdentify( HANDLE hPhysicalDriveIOCTL, PSENDCMDINPARAMS pSCIP,
                 PSENDCMDOUTPARAMS pSCOP, BYTE bIDCmd, BYTE bDriveNum,
                 PDWORD lpcbBytesReturned )
{
    // Set up data structures for IDENTIFY command.
    pSCIP->cBufferSize                  = IDENTIFY_BUFFER_SIZE;
    pSCIP->irDriveRegs.bFeaturesReg     = ;
    pSCIP->irDriveRegs.bSectorCountReg  = ;
    pSCIP->irDriveRegs.bSectorNumberReg = ;
    pSCIP->irDriveRegs.bCylLowReg       = ;
    pSCIP->irDriveRegs.bCylHighReg      = ;

    // calc the drive number.
    pSCIP->irDriveRegs.bDriveHeadReg = 0xA0 | ( ( bDriveNum &  ) <<  );

    // The command can either be IDE identify or ATAPI identify.
    pSCIP->irDriveRegs.bCommandReg = bIDCmd;
    pSCIP->bDriveNumber = bDriveNum;
    pSCIP->cBufferSize = IDENTIFY_BUFFER_SIZE;

    return DeviceIoControl( hPhysicalDriveIOCTL, DFP_RECEIVE_DRIVE_DATA,
        ( LPVOID ) pSCIP,
        sizeof( SENDCMDINPARAMS ) - ,
        ( LPVOID ) pSCOP,
        sizeof( SENDCMDOUTPARAMS ) + IDENTIFY_BUFFER_SIZE - ,
        lpcbBytesReturned, NULL );
}

BOOL WinNTHDSerialNumAsPhysicalRead( BYTE* dwSerial, UINT* puSerialLen, UINT uMaxSerialLen )
{
#define  DFP_GET_VERSION          0x00074080
    BOOL bInfoLoaded = FALSE;

    for( UINT uDrive = ; uDrive < ; ++ uDrive )
    {
        HANDLE hPhysicalDriveIOCTL = ;

        //  Try to get a handle to PhysicalDrive IOCTL, report failure
        //  and exit if can't.
        char szDriveName [];
        sprintf( szDriveName, "\\\\.\\PhysicalDrive%d", uDrive );

        //  Windows NT, Windows 2000, must have admin rights
        hPhysicalDriveIOCTL = CreateFile( szDriveName,
            GENERIC_READ | GENERIC_WRITE,
            FILE_SHARE_READ | FILE_SHARE_WRITE, NULL,
            OPEN_EXISTING, , NULL);

        if( hPhysicalDriveIOCTL != INVALID_HANDLE_VALUE )
        {
            GETVERSIONOUTPARAMS VersionParams = {  };
            DWORD               cbBytesReturned = ;

            // Get the version, etc of PhysicalDrive IOCTL
            if( DeviceIoControl( hPhysicalDriveIOCTL, DFP_GET_VERSION,
                NULL,
                ,
                &VersionParams,
                sizeof( GETVERSIONOUTPARAMS ),
                &cbBytesReturned, NULL ) )
            {
                // If there is a IDE device at number "i" issue commands
                // to the device
                if( VersionParams.bIDEDeviceMap !=  )
                {
                    BYTE             bIDCmd = ;   // IDE or ATAPI IDENTIFY cmd
                    SENDCMDINPARAMS  scip = {  };

                    // Now, get the ID sector for all IDE devices in the system.
                    // If the device is ATAPI use the IDE_ATAPI_IDENTIFY command,
                    // otherwise use the IDE_ATA_IDENTIFY command
                    bIDCmd = ( VersionParams.bIDEDeviceMap >> uDrive & 0x10 ) ? IDE_ATAPI_IDENTIFY : IDE_ATA_IDENTIFY;
                    BYTE IdOutCmd[sizeof( SENDCMDOUTPARAMS ) + IDENTIFY_BUFFER_SIZE - ] = {  };

                    if( DoIdentify( hPhysicalDriveIOCTL,
                        &scip,
                        ( PSENDCMDOUTPARAMS )&IdOutCmd,
                        ( BYTE )bIDCmd,
                        ( BYTE )uDrive,
                        &cbBytesReturned ) )
                    {
                        if( * puSerialLen + 20U <= uMaxSerialLen )
                        {
                            CopyMemory( dwSerial + * puSerialLen, ( ( USHORT* )( ( ( PSENDCMDOUTPARAMS )IdOutCmd )->bBuffer ) ) + ,  );  // 序列号

                            // Cut off the trailing blanks
                            for( UINT i = ; i != 0U && ' ' == dwSerial[* puSerialLen + i - ]; -- i )  {}
                            * puSerialLen += i;

                            CopyMemory( dwSerial + * puSerialLen, ( ( USHORT* )( ( ( PSENDCMDOUTPARAMS )IdOutCmd )->bBuffer ) ) + ,  ); // 型号

                            // Cut off the trailing blanks
                            for( i = ; i != 0U && ' ' == dwSerial[* puSerialLen + i - ]; -- i )  {}
                            * puSerialLen += i;

                            bInfoLoaded = TRUE;
                        }
                        else
                        {
                            ::CloseHandle( hPhysicalDriveIOCTL );
                            return bInfoLoaded;
                        }
                    }
                }
            }
            CloseHandle( hPhysicalDriveIOCTL );
        }
    }
    return bInfoLoaded;
}

UINT FindAwardBios( BYTE** ppBiosAddr )
{
    BYTE* pBiosAddr = * ppBiosAddr + 0xEC71;

    BYTE szBiosData[];
    CopyMemory( szBiosData, pBiosAddr,  );
    szBiosData[] = ;

    int iLen = lstrlen( ( char* )szBiosData );
    if( iLen >  && iLen <  )
    {
        //AWard:         07/08/2002-i845G-ITE8712-JF69VD0CC-00
        //Phoenix-Award: 03/12/2002-sis645-p4s333
        if( szBiosData[] == '/' && szBiosData[] == '/' )
        {
            BYTE* p = szBiosData;
            while( * p )
            {
                if( * p < ' ' || * p >=  )
                {
                    break;
                }
                ++ p;
            }
            if( * p ==  )
            {
                * ppBiosAddr = pBiosAddr;
                return ( UINT )iLen;
            }
        }
    }
    return ;
}

UINT FindAmiBios( BYTE** ppBiosAddr )
{
    BYTE* pBiosAddr = * ppBiosAddr + 0xF478;

    BYTE szBiosData[];
    CopyMemory( szBiosData, pBiosAddr,  );
    szBiosData[] = ;

    int iLen = lstrlen( ( char* )szBiosData );
    if( iLen >  && iLen <  )
    {
        // Example: "AMI: 51-2300-000000-00101111-030199-"
        if( szBiosData[] == '-' && szBiosData[] == '-' )
        {
            BYTE* p = szBiosData;
            while( * p )
            {
                if( * p < ' ' || * p >=  )
                {
                    break;
                }
                ++ p;
            }
            if( * p ==  )
            {
                * ppBiosAddr = pBiosAddr;
                return ( UINT )iLen;
            }
        }
    }
    return ;
}

UINT FindPhoenixBios( BYTE** ppBiosAddr )
{
    UINT uOffset[] = { 0x6577, 0x7196, 0x7550 };
    for( UINT i = ; i < ; ++ i )
    {
        BYTE* pBiosAddr = * ppBiosAddr + uOffset[i];

        BYTE szBiosData[];
        CopyMemory( szBiosData, pBiosAddr,  );
        szBiosData[] = ;

        int iLen = lstrlen( ( char* )szBiosData );
        if( iLen >  && iLen <  )
        {
            // Example: Phoenix "NITELT0.86B.0044.P11.9910111055"
            if( szBiosData[] == '.' && szBiosData[] == '.' )
            {
                BYTE* p = szBiosData;
                while( * p )
                {
                    if( * p < ' ' || * p >=  )
                    {
                        break;
                    }
                    ++ p;
                }
                if( * p ==  )
                {
                    * ppBiosAddr = pBiosAddr;
                    return ( UINT )iLen;
                }
            }
        }
    }
    return ;
}