MBR解析
先推广一下QQ群：61618925。欢迎各位爱好编程的朋友加入。
一、程序界面
二、关键部分代码：
1.数据结构定义
#define MBRSIZE 512
#define BOOTRECORDSIZE 440
#define DISKSIGNEDSIZE 4
#define RESERVESIZE 2
#define DPTNUMBER 4
#define DPTSIZE 16
#define ENDSIGNSIZE 2 typedef struct tagBOOTRECORD
{
UCHAR szBootRecord[BOOTRECORDSIZE];
}BOOTRECORD, *PBOOTRECORD; typedef struct tagDPT
{
UCHAR szBootSign; //引导标志，0x80表示活动分区，0x00表示非活动分区
UCHAR szStartHeadNumber; //起始磁头号
UCHAR szStartSectorNumber; //起始扇区号，低6位
UCHAR szStartCylinderNumber;//起始柱面号，起始扇区号的高2位+起始柱面号
UCHAR szPartitionType; //分区类型，0x00表示该分区未使用（即未指定）,0x06表示FAT16基本分区，0x0B表示FAT32基本分区，0x05表示拓展分区,0x07表示NTFS分区，0x0F表示（LBA模式）拓展分区（0x83为Linux分区等）。
UCHAR szEndHeadNumber; //结束磁头号
UCHAR szEndSectorNumber; //结束扇区号，低6位
UCHAR szEndCylinderNumber; //结束柱面号，结束扇区号的高2位+结束柱面号
ULONG ulSectorsPreceding; //本分区之前使用的扇区数
ULONG ulSectorsInPartition; //分区的总扇区数
}DPT, *PDPT; typedef struct tagMBR
{
BOOTRECORD BootRecord;//引导程序
UCHAR ulSigned[DISKSIGNEDSIZE]; //Windows磁盘签名
UCHAR szReserve[RESERVESIZE]; //保留位
DPT Dpt[DPTNUMBER]; //分区表
UCHAR szEndSign[ENDSIGNSIZE]; //结束标志
}MBR, *PMBR;
2.关键程序实现
void CMBRInfoDlg::InitMBRTree(void)
{
HTREEITEM hParentItem = m_ctrlMBRTree.InsertItem(_T("引导程序"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("Windows磁盘签名"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("保留位"));
hParentItem = m_ctrlMBRTree.InsertItem(_T("分区表"));
HTREEITEM hChildItem = m_ctrlMBRTree.InsertItem(_T("第一分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第二分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第三分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hChildItem = m_ctrlMBRTree.InsertItem(_T("第四分区表"), hParentItem);
m_ctrlMBRTree.InsertItem(_T("引导标志"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("起始柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("分区类型"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束磁头号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束扇区号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("结束柱面号"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区前使用的扇区数"), hChildItem);
m_ctrlMBRTree.InsertItem(_T("本分区的总扇区数"), hChildItem);
hParentItem = m_ctrlMBRTree.InsertItem(_T("结束标志"));
m_ctrlMBRTree.SetBkColor(RGB(, , ));
} void CMBRInfoDlg::ShowMBR()
{
DWORD dwRead = ;
DWORD dwError = ;
CString strError = _T(""); UCHAR szMBRInfo[MBRSIZE];
ZeroMemory(szMBRInfo, MBRSIZE * sizeof(UCHAR));
if (!ReadFile(m_hDevice, (LPVOID)szMBRInfo, MBRSIZE * sizeof(UCHAR), &dwRead, NULL))
{
dwError = GetLastError();
strError.Format(_T("ReadFile Error : %d"), dwError);
AfxMessageBox(strError);
CloseHandle(m_hDevice);
m_hDevice = INVALID_HANDLE_VALUE;
return;
} memcpy(m_Mbr.BootRecord.szBootRecord, szMBRInfo, BOOTRECORDSIZE * sizeof(UCHAR));
memcpy(m_Mbr.ulSigned, &szMBRInfo[BOOTRECORDSIZE], DISKSIGNEDSIZE);
memcpy(m_Mbr.szReserve, &szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE], RESERVESIZE);
for (int i = ; i < ; ++i)
{
m_Mbr.Dpt[i].szBootSign = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE];
m_Mbr.Dpt[i].szStartHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szStartSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szStartCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szPartitionType = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndHeadNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndSectorNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].szEndCylinderNumber = szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ];
m_Mbr.Dpt[i].ulSectorsPreceding = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);
m_Mbr.Dpt[i].ulSectorsInPartition = *((int*)&szMBRInfo[BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + i * DPTSIZE + ]);
}
memcpy(m_Mbr.szEndSign, &szMBRInfo[MBRSIZE - ENDSIGNSIZE], ENDSIGNSIZE); UCHAR szTemp[];
CString strTemp = _T("");
for (int i = ; i < MBRSIZE; i++)
{
ZeroMemory(szTemp, * sizeof(UCHAR));
wsprintf((LPTSTR)szTemp, _T("%02X"), szMBRInfo[i]);
strTemp = szTemp;
m_strMBRInfo += strTemp;
if ((i + ) % == )
{
m_strMBRInfo += _T("\r\n");
}
else
{
m_strMBRInfo += _T(" ");
}
} m_ctrlMBREdit.SetWindowText(m_strMBRInfo);
} void CMBRInfoDlg::OnTvnSelchangedTreeMbr(NMHDR *pNMHDR, LRESULT *pResult)
{
LPNMTREEVIEW pNMTreeView = reinterpret_cast<LPNMTREEVIEW>(pNMHDR);
// TODO: 在此添加控件通知处理程序代码
HTREEITEM hItem = m_ctrlMBRTree.GetSelectedItem();
CString strItemText = m_ctrlMBRTree.GetItemText(hItem);
if (strItemText == _T("引导程序"))
{
m_ctrlMBREdit.SetSel(, * BOOTRECORDSIZE - );
m_strTips = _T("引导程序占440字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("Windows磁盘签名"))
{
m_ctrlMBREdit.SetSel( * BOOTRECORDSIZE, * (BOOTRECORDSIZE + DISKSIGNEDSIZE) - );
m_strTips = _T("Windows磁盘签名占4个字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("保留位"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE) - );
m_strTips = _T("保留位占2个字节");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTNUMBER * DPTSIZE) - );
m_strTips = _T("分区表总占64个字节，系统最多有4个主分区。双击分区表节点可以展开下一级节点查看各个分区的具体信息。");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束标志"))
{
m_ctrlMBREdit.SetSel( * (MBRSIZE - ENDSIGNSIZE), * MBRSIZE - );
m_strTips = _T("结束标志占2个字节。[55 AA]为正常结束标志");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE) - );
m_strTips = _T("每一个分区表占16个字节，双击第一分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第二分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第三分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ) - );
m_strTips = _T("每一个分区表占16个字节，双击第四分区表节点可以展开查看该分区的具体信息");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("引导标志"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
if (m_Mbr.Dpt[].szBootSign == 0x80)
{
m_strTips = _T("活动分区");
}
else if (m_Mbr.Dpt[].szBootSign == 0x00)
{
m_strTips = _T("非活动分区");
}
else
{
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("起始磁头号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
m_strTips = _T("起始磁头号");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("起始扇区号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szStartSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("起始柱面号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("起始柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szStartSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szStartCylinderNumber);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("分区类型"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
int iPartitionType = ;
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
iPartitionType = m_Mbr.Dpt[].szPartitionType;
}
switch (iPartitionType)
{
case 0x00:
m_strTips = _T("该分区未使用");
break;
case 0x05:
m_strTips = _T("拓展分区");
break;
case 0x06:
m_strTips = _T("FAT16基本分区");
break;
case 0x07:
m_strTips = _T("NTFS分区");
break;
case 0x0B:
m_strTips = _T("FAT32基本分区");
break;
case 0x0F:
m_strTips = _T("（LBA模式）拓展分区");
break;
case 0x83:
m_strTips = _T("Linux分区");
break;
default:
m_strTips = _T("未知分区");
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束磁头号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
}
m_strTips = _T("结束磁头号");
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("结束扇区号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束扇区号为该字节的低六位，这里的具体值是：%02X"), m_Mbr.Dpt[].szEndSectorNumber & 0x3F);
m_ctrlTips.SetWindowText(m_strTips);
}
}
if (strItemText == _T("结束柱面号"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("结束柱面号为起始扇区号的高2位+起始柱面号，这里的具体值是：%004X"), ((int)(m_Mbr.Dpt[].szEndSectorNumber & 0xC0) << ) + m_Mbr.Dpt[].szEndCylinderNumber);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("本分区前使用的扇区数"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区前扇区数：%08X"), m_Mbr.Dpt[].ulSectorsPreceding);
}
m_ctrlTips.SetWindowText(m_strTips);
}
if (strItemText == _T("本分区的总扇区数"))
{
HTREEITEM hParentItem = m_ctrlMBRTree.GetParentItem(hItem);
CString strParentText = m_ctrlMBRTree.GetItemText(hParentItem);
if (strParentText == _T("第一分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第二分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第三分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
if (strParentText == _T("第四分区表"))
{
m_ctrlMBREdit.SetSel( * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ), * (BOOTRECORDSIZE + DISKSIGNEDSIZE + RESERVESIZE + DPTSIZE * + ) - );
m_strTips.Format(_T("本分区扇区数：%08X.本分区的大小为：%lfG"), m_Mbr.Dpt[].ulSectorsInPartition, m_Mbr.Dpt[].ulSectorsInPartition * 1.0 * / / / );
}
m_ctrlTips.SetWindowText(m_strTips);
}
*pResult = ;
} HBRUSH CMBRInfoDlg::OnCtlColor(CDC* pDC, CWnd* pWnd, UINT nCtlColor)
{
//HBRUSH hbr = CDialog::OnCtlColor(pDC, pWnd, nCtlColor); // TODO: 在此更改 DC 的任何属性
pDC->SetBkMode(TRANSPARENT);
if (pWnd == GetDlgItem(IDC_EDIT_MBR))
{
return CreateSolidBrush(RGB(, , ));
}
else
{ return CreateSolidBrush(RGB(, , ));
}
// TODO: 如果默认的不是所需画笔，则返回另一个画笔
//return hbr;
} BOOL CMBRInfoDlg::OpenDevice(void)
{
DWORD dwError = ;
CString strError = _T(""); m_hDevice = CreateFile(_T("\\\\.\\PhysicalDrive0"), GENERIC_READ,
FILE_SHARE_READ, NULL, OPEN_EXISTING, , NULL);
if (INVALID_HANDLE_VALUE == m_hDevice)
{
dwError = GetLastError();
strError.Format(_T("CreateFile Error : %d"), dwError);
AfxMessageBox(strError);
return FALSE;
}
return TRUE;
}
三、程序下载地址
http://pan.baidu.com/s/1jGKCa94
MBR解析的更多相关文章
- 主引导扇区MBR的解析
http://blog.chinaunix.net/uid-24774106-id-3340397.html 最近排查一个USB相关的故障,由于信息安全就不多说工作上的事情了,顺路学习了MBR的相关知 ...
- MBR结构解析与fdisk的bash实现
一.MBR结构解析 首先我们先介绍一些MBR的基本知识基础,再晾图片分析. MBR主要分为三大块各自是: 1.载入引导程序(446K) 2.分区表(64k) 3.标志结束位(2k) 载入引导程序:内容 ...
- 病毒木马查杀实战第024篇：MBR病毒之编程解析引导区
前言 通过之前的学习,相信大家已经对磁盘的引导区有了充分的认识.但是我们之前的学习都是利用现成的工具来对引导区进行解析的,而对于一名反病毒工程师而言,不单单需要有扎实的逆向分析功底,同时也需要有很强的 ...
- 病毒木马查杀实战第023篇：MBR病毒之引导区的解析
前言 引导型病毒指寄生在磁盘引导区或主引导区的计算机病毒.这种病毒利用系统引导时,不对主引导区的内容正确与否进行判别的缺点,在引导系统的过程中入侵系统,驻留内存,监视系统运行,伺机传染和破坏.按照引导 ...
- MBR主引导扇区解析
最近在制作镜像的时候由于需要简单研究了下MBR主引导扇区的结构,这里记录下便于后期温习,下面就直接进入正题: MBR主引导扇区位于磁盘的第一个扇区,即0号扇区,主要由引导代码.分区表.结束标志三部分构 ...
- MBR内容解析
原先博客放弃使用,几篇文章搬运过来 MBR(Master Boot Record)即主引导记录. 使用Winhex打开,磁盘的第一扇区: 黄色部分(000H-1B7H):引导分区 作用:在主板BIOS ...
- MBR主引导扇区解析2
unsigned AnsiChar data[] = { 0x33, 0xC0, 0x8E, 0xD0, 0xBC, 0x00, 0x7C, 0x8E, 0xC0, 0x8E, 0xD8, 0xBE, ...
- 地理围栏算法解析（Geo-fencing）
地理围栏算法解析 http://www.cnblogs.com/LBSer/p/4471742.html 地理围栏(Geo-fencing)是LBS的一种应用,就是用一个虚拟的栅栏围出一个虚拟地理边界 ...
- 如何将硬盘GPT分区转换为MBR分区模式
现在新出的笔记本普遍自带WIN8系统,硬盘分区一般都采用GPT格式,但是包括WIN7及以下的系统都无法安装在GPT格式的硬盘上,因此,如果我们需要安装WIN7系统,需要将硬盘分区从GPT转换成MBR格 ...
随机推荐
- error-iis-Service Unavailable
Service Unavailable Service Unavailable HTTP Error 503. The service is unavailable.
- Python中if __name__ == "__main__": 的作用
在很多python脚本中在最后的部分会执行一个判断语句if __name__ == "__main__:",之后还可能会有一些执行语句.那添加这个判断的目的何在? 在python编 ...
- [Java] File类的常用操作
package test.file; import java.io.File; import java.io.IOException; public class TestFile { public s ...
- clipse在编写JSP时没有代码提示
alt /不会出提示按照下面步骤做 1.菜单window- >Preferences- >Java- >Editor- >Content Assist- >Enable ...
- C语言中的atan和atan2（转）
在C语言的math.h或C++中的cmath中有两个求反正切的函数atan(double x)与atan2(double y,double x) 他们返回的值是弧度 要转化为角度再自己处理下. 前者 ...
- jdk1.6官方下载地址
jdk1.6: http://www.oracle.com/technetwork/java/javasebusiness/downloads/java-archive-downloads-javas ...
- java枚举使用
1.开发中如何使用枚举,一般在开发中使用消息提示.枚举可以继承,实现接口等.public enum Result { SUCCESS(1,"201 ok") { @Override ...
- convert NameValueCollection/Dictionary<string, object> to JSON string
public static class WebExtension { public static T Decode<T>(this RequestBase res) { Type type ...
- Caught exception while loading file struts-default.xml 错误
严重: Exception starting filter struts2 Caught exception while loading file struts-default.xml - [unkn ...
- 使用kendoui对grid指定行变色
关键点在于绑定数据源后进行判断,可直接获取当前绑定对象的属性 dataBound: function () { dataView = this.dataSource.view(); ; i < ...