MBR解析

先推广一下QQ群：61618925。欢迎各位爱好编程的朋友加入。

一、程序界面

二、关键部分代码：

1.数据结构定义

#define MBRSIZE 512

#define BOOTRECORDSIZE 440

#define DISKSIGNEDSIZE 4

#define RESERVESIZE 2

#define DPTNUMBER 4

#define DPTSIZE 16

#define ENDSIGNSIZE 2

typedef struct tagBOOTRECORD

{

    UCHAR szBootRecord[BOOTRECORDSIZE];

}BOOTRECORD, *PBOOTRECORD;

typedef struct tagDPT

{

    UCHAR szBootSign;            //引导标志，0x80表示活动分区，0x00表示非活动分区

    UCHAR szStartHeadNumber;    //起始磁头号

    UCHAR szStartSectorNumber;    //起始扇区号，低6位

    UCHAR szStartCylinderNumber;//起始柱面号，起始扇区号的高2位+起始柱面号

    UCHAR szPartitionType;        //分区类型，0x00表示该分区未使用（即未指定）,0x06表示FAT16基本分区，0x0B表示FAT32基本分区，0x05表示拓展分区,0x07表示NTFS分区，0x0F表示（LBA模式）拓展分区（0x83为Linux分区等）。

    UCHAR szEndHeadNumber;        //结束磁头号

    UCHAR szEndSectorNumber;    //结束扇区号，低6位

    UCHAR szEndCylinderNumber;    //结束柱面号，结束扇区号的高2位+结束柱面号

    ULONG ulSectorsPreceding;    //本分区之前使用的扇区数

    ULONG ulSectorsInPartition;    //分区的总扇区数

}DPT, *PDPT;

typedef struct tagMBR

{

    BOOTRECORD BootRecord;//引导程序

    UCHAR ulSigned[DISKSIGNEDSIZE];        //Windows磁盘签名

    UCHAR szReserve[RESERVESIZE];        //保留位

    DPT Dpt[DPTNUMBER];            //分区表

    UCHAR szEndSign[ENDSIGNSIZE];        //结束标志

}MBR, *PMBR;

2.关键程序实现

void CMBRInfoDlg::InitMBRTree(void)

{

    HTREEITEM hParentItem = m_ctrlMBRTree.InsertItem(_T("引导程序"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("Windows磁盘签名"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("保留位"));

    hParentItem = m_ctrlMBRTree.InsertItem(_T("分区表"));

    HTREEITEM hChildItem = m_ctrlMBRTree.InsertItem(_T("第一分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第二分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第三分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hChildItem = m_ctrlMBRTree.InsertItem(_T("第四分区表"), hParentItem);

    m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);

    m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);

    hParentItem = m_ctrlMBRTree.InsertItem(_T("结束标志"));

    m_ctrlMBRTree.SetBkColor(RGB(, , ));

}

void CMBRInfoDlg::ShowMBR()

{

    DWORD dwRead = ;

    DWORD dwError = ;

    CString strError = _T("");

    UCHAR szMBRInfo[MBRSIZE];

    ZeroMemory(szMBRInfo, MBRSIZE * sizeof(UCHAR));

    if (!ReadFile(m_hDevice, (LPVOID)szMBRInfo, MBRSIZE * sizeof(UCHAR), &dwRead, NULL))

    {

        dwError = GetLastError();

        strError.Format(_T("ReadFile Error : %d"), dwError);

        AfxMessageBox(strError);

        CloseHandle(m_hDevice);

        m_hDevice = INVALID_HANDLE_VALUE;

        return;

    }

    memcpy(m_Mbr.BootRecord.szBootRecord, szMBRInfo, BOOTRECORDSIZE * sizeof(UCHAR));

    memcpy(m_Mbr.ulSigned, &szMBRInfo[BOOTRECORDSIZE], DISKSIGNEDSIZE);

    memcpy(m_Mbr.szReserve, &szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE], RESERVESIZE);

    for (int i = ; i < ; ++i)

    {

        m_Mbr.Dpt[i].szBootSign = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE];

        m_Mbr.Dpt[i].szStartHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szStartSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szStartCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szPartitionType = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].szEndCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];

        m_Mbr.Dpt[i].ulSectorsPreceding = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);

        m_Mbr.Dpt[i].ulSectorsInPartition = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);

    }

    memcpy(m_Mbr.szEndSign, &szMBRInfo[MBRSIZE - ENDSIGNSIZE], ENDSIGNSIZE);

    UCHAR szTemp[];

    CString strTemp = _T("");

    for (int i = ; i < MBRSIZE; i++)

    {

        ZeroMemory(szTemp,  * sizeof(UCHAR));

        wsprintf((LPTSTR)szTemp, _T("%02X"), szMBRInfo[i]);

        strTemp = szTemp;

        m_strMBRInfo += strTemp;

        if ((i + ) %  == )

        {

            m_strMBRInfo += _T("\r\n");

        }

        else

        {

            m_strMBRInfo += _T("  ");

        }

    }

    m_ctrlMBREdit.SetWindowText(m_strMBRInfo);

}

void CMBRInfoDlg::OnTvnSelchangedTreeMbr(NMHDR *pNMHDR, LRESULT *pResult)

{

    LPNMTREEVIEW pNMTreeView = reinterpret_cast<LPNMTREEVIEW>(pNMHDR);

    // TODO: 在此添加控件通知处理程序代码

    HTREEITEM hItem = m_ctrlMBRTree.GetSelectedItem();

    CString strItemText = m_ctrlMBRTree.GetItemText(hItem);

    if (strItemText == _T("引导程序"))

    {

        m_ctrlMBREdit.SetSel(,  * BOOTRECORDSIZE - );

        m_strTips = _T("引导程序占440字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("Windows磁盘签名"))

    {

        m_ctrlMBREdit.SetSel( * BOOTRECORDSIZE,  * (BOOTRECORDSIZE + DISKSIGNEDSIZE) - );

        m_strTips = _T("Windows磁盘签名占4个字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("保留位"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE) - );

        m_strTips = _T("保留位占2个字节");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTNUMBER * DPTSIZE) - );

        m_strTips = _T("分区表总占64个字节，系统最多有4个主分区。双击分区表节点可以展开下一级节点查看各个分区的具体信息。");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束标志"))

    {

        m_ctrlMBREdit.SetSel( * (MBRSIZE - ENDSIGNSIZE),  * MBRSIZE - );

        m_strTips = _T("结束标志占2个字节。[55 AA]为正常结束标志");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第一分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE) - );

        m_strTips = _T("每一个分区表占16个字节，双击第一分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第二分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第二分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第三分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第三分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("第四分区表"))

    {

        m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );

        m_strTips = _T("每一个分区表占16个字节，双击第四分区表节点可以展开查看该分区的具体信息");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("引导标志"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            if (m_Mbr.Dpt[].szBootSign == 0x80)

            {

                m_strTips = _T("活动分区");

            }

            else if (m_Mbr.Dpt[].szBootSign == 0x00)

            {

                m_strTips = _T("非活动分区");

            }

            else

            {

                m_strTips = _T("未知分区");

            }

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("起始磁头号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        m_strTips = _T("起始磁头号");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("起始扇区号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("起始柱面号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("分区类型"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        int iPartitionType = ;

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            iPartitionType = m_Mbr.Dpt[].szPartitionType;

        }

        switch (iPartitionType)

        {

        case 0x00:

            m_strTips = _T("该分区未使用");

            break;

        case 0x05:

            m_strTips = _T("拓展分区");

            break;

        case 0x06:

            m_strTips = _T("FAT16基本分区");

            break;

        case 0x07:

            m_strTips = _T("NTFS分区");

            break;

        case 0x0B:

            m_strTips = _T("FAT32基本分区");

            break;

        case 0x0F:

            m_strTips = _T("（LBA模式）拓展分区");

            break;

        case 0x83:

            m_strTips = _T("Linux分区");

            break;

        default:

            m_strTips = _T("未知分区");

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束磁头号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

        }

        m_strTips = _T("结束磁头号");

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("结束扇区号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);

            m_ctrlTips.SetWindowText(m_strTips);

        }

    }

    if (strItemText == _T("结束柱面号"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("本分区前使用的扇区数"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    if (strItemText == _T("本分区的总扇区数"))

    {

        HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);

        CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);

        if (strParentText == _T("第一分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第二分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第三分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        if (strParentText == _T("第四分区表"))

        {

            m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ),  * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE *  + ) - );

            m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 *  /  /  / );

        }

        m_ctrlTips.SetWindowText(m_strTips);

    }

    *pResult = ;

}

HBRUSH CMBRInfoDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor)

{

    //HBRUSH hbr = CDialog::OnCtlColor(pDC, pWnd, nCtlColor);

    // TODO:  在此更改 DC 的任何属性

    pDC->SetBkMode(TRANSPARENT);

    if (pWnd == GetDlgItem(IDC_EDIT_MBR))

    {

        return CreateSolidBrush(RGB(, , ));

    }

    else

    {

        return CreateSolidBrush(RGB(, , ));

    }

    // TODO:  如果默认的不是所需画笔，则返回另一个画笔

    //return hbr;

}

BOOL CMBRInfoDlg::OpenDevice(void)

{

    DWORD dwError = ;

    CString strError = _T("");

    m_hDevice = CreateFile(_T("\\\\.\\PhysicalDrive0"), GENERIC_READ,

        FILE_SHARE_READ, NULL, OPEN_EXISTING, , NULL);

    if (INVALID_HANDLE_VALUE == m_hDevice)

    {

        dwError = GetLastError();

        strError.Format(_T("CreateFile Error : %d"), dwError);

        AfxMessageBox(strError);

        return FALSE;

    }

    return TRUE;

}

三、程序下载地址

http://pan.baidu.com/s/1jGKCa94

MBR解析的更多相关文章

主引导扇区MBR的解析
http://blog.chinaunix.net/uid-24774106-id-3340397.html 最近排查一个USB相关的故障,由于信息安全就不多说工作上的事情了,顺路学习了MBR的相关知 ...
MBR结构解析与fdisk的bash实现
一.MBR结构解析首先我们先介绍一些MBR的基本知识基础,再晾图片分析. MBR主要分为三大块各自是: 1.载入引导程序(446K) 2.分区表(64k) 3.标志结束位(2k) 载入引导程序:内容 ...
病毒木马查杀实战第024篇：MBR病毒之编程解析引导区
前言通过之前的学习,相信大家已经对磁盘的引导区有了充分的认识.但是我们之前的学习都是利用现成的工具来对引导区进行解析的,而对于一名反病毒工程师而言,不单单需要有扎实的逆向分析功底,同时也需要有很强的 ...
病毒木马查杀实战第023篇：MBR病毒之引导区的解析
前言引导型病毒指寄生在磁盘引导区或主引导区的计算机病毒.这种病毒利用系统引导时,不对主引导区的内容正确与否进行判别的缺点,在引导系统的过程中入侵系统,驻留内存,监视系统运行,伺机传染和破坏.按照引导 ...
MBR主引导扇区解析
最近在制作镜像的时候由于需要简单研究了下MBR主引导扇区的结构,这里记录下便于后期温习,下面就直接进入正题: MBR主引导扇区位于磁盘的第一个扇区,即0号扇区,主要由引导代码.分区表.结束标志三部分构 ...
MBR内容解析
原先博客放弃使用,几篇文章搬运过来 MBR(Master Boot Record)即主引导记录. 使用Winhex打开,磁盘的第一扇区: 黄色部分(000H-1B7H):引导分区作用:在主板BIOS ...
MBR主引导扇区解析2
unsigned AnsiChar data[] = { 0x33, 0xC0, 0x8E, 0xD0, 0xBC, 0x00, 0x7C, 0x8E, 0xC0, 0x8E, 0xD8, 0xBE, ...
地理围栏算法解析（Geo-fencing）
地理围栏算法解析 http://www.cnblogs.com/LBSer/p/4471742.html 地理围栏(Geo-fencing)是LBS的一种应用,就是用一个虚拟的栅栏围出一个虚拟地理边界 ...
如何将硬盘GPT分区转换为MBR分区模式
现在新出的笔记本普遍自带WIN8系统,硬盘分区一般都采用GPT格式,但是包括WIN7及以下的系统都无法安装在GPT格式的硬盘上,因此,如果我们需要安装WIN7系统,需要将硬盘分区从GPT转换成MBR格 ...

随机推荐

unity jiaoben
transform.Translate(Input.GetAxis("Horizontal")*Time.deltaTime,0,0); 移动 transform.Translat ...
php启动时候提示PHP startup的解决方法
最近在学习php,配置好php环境后,每次开机都有警告提示说 PHP startup.如下图: 显然这是个小问题,是关于php配置的. 解决这个问题很简单只需要在php.ini 文件中修改 exten ...
JAVA如何将PDF转换SWF格式的FLASH
1. 需要用到的工具 SWFTools 下载地址 http://www.swftools.org/download.html,下载完成以后,直接安装就行 2.下面就是重点喽,详见Java代码解析附 ...
《一课经济学》书摘笔记II
假设有位制衣商了解到,有种机器可以用以往一半的人力生产男式和女式大衣.于是,他购置了这种机器,并且裁掉了一半的员工.这位制衣商由于节省开支而获得了以前没有的利润.他从制衣工人直接工资那里节省下来的每一 ...
sql执行返回值存储
List<Map> list = SqlRunner.queryMapList(sql); if(list != null && !list.isEmpty()){ Has ...
转载cocos2dx的各种动作用法
以下内容来源于:http://www.cnblogs.com/linux-ios/archive/2013/04/06/3001946.html 转载时请保留以上链接. bool HelloWorld ...
checkbox与文字的间距
1. checkbox在更换了图片后, 与文字的距离有问题, 建议修改background为@null, 去除占据的位置. 2. checkbox的paddingleft可以控制图片和文字的间距.
OS X 升级 Yosemite 后，Intellij IDEA 与 VirtualBox 启动失败
报错: Dyld Error Message: Symbol not found: _CGContextSetAllowsAcceleration Referenced from: /Library/ ...
SQL在指定列后添加新的列
ALTER TABLE `MR_CustomerShopFuture` ADD COLUMN `ProcessID` INT(11) DEFAULT '0' COMMENT '审核流程ID';
cocos2d-x中false，setSwallowTouches，stopPropagation的区别
研究到cocos2d-x触摸这一块了,3.0和2.0相比已经有了很大的不同,使用更加方便和容易理解了. 直接进入正题,解释下,标题中3个用法的区别通常来说,应用程序中更多使用的是单点触摸,为了简化单 ...

MBR解析

MBR解析的更多相关文章

随机推荐

热门专题