试图设计低级硬盘操作程序 [英] Trying to design low level hard disk manipulation program

问题描述

我在comp.lang.asm.x86上发布了这个，alt.os.development，comp.arch，

comp.lang.c ++


我正在使用Windows XP专业版，NTFS和编程与

MASM，c ++（免费编译器）或visual basic 6.0

===问题1


主要是我试图设计一个完全控制

硬盘的程序。它需要做的是找出什么行业没有写入并且能够在那里写任何东西，但是不计算

对磁盘空间的影响，IOW数据是用户定义的垃圾没有

后果如果被覆盖。


作为开放空间硬盘扫描的非常口香糖和创可贴的想法，

我可以简单地创建一个文件大小剩余数据的硬盘


===问题2


其次是完全删除，因此文件的位置现在只是

零。为此，如果我打开任何给定语言的文件

特定''打开''methood用确切的数据重写开放数据

长度为零然后重新保存它，那将完成这项任务吗？或者

将数据保存在新的扇区中，并指出

原始数据完好无损但无法实现？

IOW如果你打开来自硬盘的文件进行更改并保存，

它是否保存到文件所从的相同物理位置？


==我是在正确的轨道上？


我在网上搜索得不太成功。我正在努力的是使用NTFS的主记录表（MRT）

并查看我是否可以

找到不写入和写入的扇区那里有主要的

任务并按照指针写在那里进行次要任务。

有没有人有关于如何以编程方式访问MRT的参考？


我也遇到了BIOS功能INT 13H这是低级别磁盘

操作。这似乎有所帮助，有没有人成功使用

呢？


感谢您的帮助。


Jesse

I posted this on comp.lang.asm.x86, alt.os.development, comp.arch,
comp.lang.c++

Im working with windows xp professional, NTFS and programming with
MASM, c++ (free compiler) or visual basic 6.0

=== question 1

Primarily Im trying to design a program that has full control over a
hard disk. What it needs to do is find out what sectors haven''t been
written to and be able to write anything there, but doesn''t count
towards disk space, IOW the data is user defined garbage with no
consequense if overwritten.

As a very gum-and-bandaid idea for an open space hard drive sweep,
could i simply create a file the size of the remaining data in the hard
drive save it then delete it? Would this in effect fill all available
space with user defined garbage? Although ideally Id like to pinpoint
empty sectors and write to them.

=== question 2

Secondarily make a full delete, thus where a file was is now just
zeros. For this, if I were to open a file with any given language
specific ''open'' methood re-write the open data with the exact data
length of zeros then resave it, would that accomplish this task? Or
would the data be saved in a new sector and pointed to that leaving the
original data intact but unattainable?
IOW if you open a file from the hard disk make changes and save it,
does it save to the same physical location the file was pulled from?

== am i on the right track?

I''ve scoured the web with little success. What i am working towards is
using the Master Record Table (MRT) of the NTFS and seeing if i can
find the sectors that aren''t written to and write there for the primary
task and follow the pointers and write there for the secondary task.
Does anyone have a reference on how to programmatically access the MRT?

Ive also come across BIOS function INT 13H which is low level disk
operations. This seems to be of help, has anyone had success in using
it?

Thanks for any help.

Jesse

推荐答案

我正在使用windows xp professional，NTFS和编程

尝试第一次工作使用FAT32 for HDD如果你可以重新分区（PartitionMagic）

或FAT12使用FDD）导致一些人可能知道NTFS内部但很像

像我这样只看了FAT＃ #FS和unix / linux FSs ...使用FDD更好，因为你只需要开始以1.14MB的比例查看磁盘

和你的硬盘分区是不是99.999％这个文件已经满了

EatUpFreeSpace.dat太大了（很多MB）要读（你作为一个人[使用

HEX编辑器]首先，你可以编写程序来读取它）群集

链看看所有那些EatUpFreeSpace.dat扇区在哪里......

Im working with windows xp professional, NTFS and programming with
Try first working with FAT32 for HDD if you can repartition(PartitionMagic)
or FAT12 using FDD) cause some here may know NTFS internals but like many
like me have only looked into FAT## FS and unix/linux FSs... Using FDD is
better cause you only have to start looking at the disk at a 1.14MB scale
and since your HDD partition isn''t near 99.999% full this file
EatUpFreeSpace.dat will be too big(many MBs) to read(you as a human[using
HEX editor] at first before you can code the program to read it) the cluster
chain to see where all those EatUpFreeSpace.dat sectors are...

作为非常的口香糖d-bandaid想法用于开放空间硬盘扫描，

我可以简单地创建一个文件大小剩余数据的硬盘

驱动器保存它然后删除它？这实际上会用用户定义的垃圾填充所有可用的空间吗？虽然理想情况下我想确定空扇区并写入它们。

As a very gum-and-bandaid idea for an open space hard drive sweep,
could i simply create a file the size of the remaining data in the hard
drive save it then delete it? Would this in effect fill all available
space with user defined garbage? Although ideally Id like to pinpoint
empty sectors and write to them.

另请注意，clustors和扇区可能因FS而异，所以

## K（FAT32 / NTFS）大小cluter可能占用＃ ＃* 1024个扇区，只有部分

前1个扇区可能真的被使用。示例Windows由于某种原因需要

将clustor分配给文件##，###，### bytes和Windows然后发现

所有的clustors 349个字节，因此Window分配了一个大小## K

并且保存了349个字节，其余的clustor是浪费的空间[（## *

1024） - 1个扇区永远不会被删除以保持直到该文件是

已删除，Windows稍后分配clustors] ...

Also note clustors and sectors can be different depending to FS so
##K(FAT32/NTFS) size cluter can take up ## * 1024 sectors and only part the
first 1 sector may really be used. Example Windows for some reason needed to
allocate clustor to a file ##,###,### bytes and Windows went thur and found
many clustors for all but 349 bytes so Window allocates one more of size ##K
and and saves the 349 bytes and the rest of clustor is wasted space [(## *
1024) - 1 sectors never getting anymore delete to hold untill the file is
deleted and Windows later allocate clustors]...

其次是完整的删除，因此文件的位置现在只是

零。为此，如果我打开一个任何给定语言的文件

Secondarily make a full delete, thus where a file was is now just
zeros. For this, if I were to open a file with any given language

这样做只会使得写入零在EatUpFreeSpace.dat扇区

actucally包含文件数据任何clustors（我认为只有最后一个）
分配给EatUpFreeSpace.dat的
可能包含浪费的空间[（## * 1024） - 1

在我的前例中持有349个字节的扇区。填充EatUpFreeSpace.dat

用零填充所有其他分配的clustor零和最后一个零

349字节...所以浪费的空间现在包含之前的内容

一个驱动格式化程序写入的ASCII格式charatcer或随机的

数据曾经在EatUpFreeSpace.dat之前删除的旧文件中有效

被创建了......

Doing this does will only make write zeros where EatUpFreeSpace.dat sectors
actucally contained the files data any clustors(I think only the last one)
allocated to EatUpFreeSpace.dat may contain wasted space [(## * 1024) - 1
sectors] in my prev example holding 349 bytes. Filling EatUpFreeSpace.dat
with zeros fills all the other allocated clustor with zero and the last zero
the 349 bytes... So the wasted space now contains what was there before
either an ASCII format charatcer that some drive formatters write or random
data the used to be valid in a old file deleted before EatUpFreeSpace.dat
was created...

将数据保存在一个新的扇区中，并指出

原始数据完好无损但无法实现？

IOW如果你从硬盘上打开一个文件进行更改并保存它，

是否保存到文件被拉出的同一物理位置？

would the data be saved in a new sector and pointed to that leaving the
original data intact but unattainable?
IOW if you open a file from the hard disk make changes and save it,
does it save to the same physical location the file was pulled from?

我不知道这个...

I don''t know this...

我已经在网上搜索过了没什么成功。我正在努力的是使用NTFS的主记录表（MRT）

并查看我是否可以

找到不写入和写入的扇区那里有主要的

任务并按照指针写在那里进行次要任务。

有没有人有关于如何以编程方式访问MRT的参考？

I''ve scoured the web with little success. What i am working towards is
using the Master Record Table (MRT) of the NTFS and seeing if i can
find the sectors that aren''t written to and write there for the primary
task and follow the pointers and write there for the secondary task.
Does anyone have a reference on how to programmatically access the MRT?

我不知道这个...就像我说的那样FAT12或FAT32比公众中的NTFS更为人所知

。所以寻找主引导记录（MBR - 仅硬盘）和

引导参数块（FDD引导扇区中的BPB和每个硬盘的引导扇区
MBR指向的
分区）...

I don''t know this... Like I say FAT12 or FAT32 is more well known interally
than NTFS in the public. So look for Master Boot Record(MBR - HDD only) and
Boot Parameter Block(BPB in the bootsector of FDD and bootsector of each HDD
partition pointed to by the MBR)...

我也遇到了BIOS功能INT 13H这是低级别磁盘

操作。这似乎有所帮助，有没有人成功使用过

呢？

Ive also come across BIOS function INT 13H which is low level disk
operations. This seems to be of help, has anyone had success in using
it?

我不知道这个...

I don''t know this...

" ragtag99" < sp ****** @ crayne.orgwrites：

"ragtag99" <sp******@crayne.orgwrites:

我在comp.lang.asm.x86，alt.os.development，comp上发布了这个。 arch，

comp.lang.c ++


我正在使用windows xp professional，NTFS和编程

MASM，c ++（免费编译器）或visual basic 6.0

===问题1

主要是我试图设计一个完全控制

硬盘。它需要做的是找出什么行业没有写入并且能够在那里写任何东西，但是不计算

对磁盘空间的影响，IOW数据是用户定义的垃圾，没有

后果如果被覆盖。

I posted this on comp.lang.asm.x86, alt.os.development, comp.arch,
comp.lang.c++

Im working with windows xp professional, NTFS and programming with
MASM, c++ (free compiler) or visual basic 6.0

=== question 1

Primarily Im trying to design a program that has full control over a
hard disk. What it needs to do is find out what sectors haven''t been
written to and be able to write anything there, but doesn''t count
towards disk space, IOW the data is user defined garbage with no
consequense if overwritten.

因此，如果它根本不写，那就没有任何后果。

因此，你的解决方案就是不这样做。


菲尔

-

家庭录音带来了巨大的商业利润。我们把这边留空了

所以你可以帮忙。 - Dead Kennedys，写在B-side of tapes

/ In God We Trust，Inc. /。

So there''s no consequence if it''s not written at all.
Your solution is therefore to simply not do this.

Phil
--
"Home taping is killing big business profits. We left this side blank
so you can help." -- Dead Kennedys, written upon the B-side of tapes of
/In God We Trust, Inc./.

哦，我的，在一个帖子中有这么多nonos :-)

ragtag99写道：

Oh my, so many nonos in one post :-)

ragtag99 wrote:

我在comp上发布了这个。 lang.asm.x86，alt.os.development，comp.arch，

comp.lang.c ++

I posted this on comp.lang.asm.x86, alt.os.development, comp.arch,
comp.lang.c++

crossposting很棒。尝试发布超过50个组以获得更好的结果

结果。

crossposting is great. Try posting in more than 50 groups for better
results though.

我正在使用windows xp professional，NTFS并使用

MASM，c ++（免费编译器）或visual basic 6.0

Im working with windows xp professional, NTFS and programming with
MASM, c++ (free compiler) or visual basic 6.0

精彩。我们对您的

计划的VB部分特别感兴趣。

wonderful. We would be especially interested in the VB parts of your
program.

主要是我试图设计一个完全控制a的程序

硬盘。它需要做的是找出什么行业没有写入并且能够在那里写任何东西，但是不计算

对磁盘空间的影响，IOW数据是用户定义的垃圾，没有

后果如果被覆盖。

Primarily Im trying to design a program that has full control over a
hard disk. What it needs to do is find out what sectors haven''t been
written to and be able to write anything there, but doesn''t count
towards disk space, IOW the data is user defined garbage with no
consequense if overwritten.

如果你想隐藏某种类型的恶意软件，听起来像是一个特别有用的功能。我们总是对这样的实现感兴趣，因为

用< fstreamgets做事的标准方式真的很无聊

时间。

Sounds like an especially useful feature if you want to hide some kind
of malware. We are always interested in implementations like this, as
the standard way of doing things with <fstreamgets really boring over
time.

其次是完全删除，因此文件现在只是

零。为此，如果我打开任何给定语言的文件

特定''打开''methood用确切的数据重写开放数据

长度为零然后重新保存它，那将完成这项任务吗？

Secondarily make a full delete, thus where a file was is now just
zeros. For this, if I were to open a file with any given language
specific ''open'' methood re-write the open data with the exact data
length of zeros then resave it, would that accomplish this task?

也许。当然，这在很大程度上取决于具体实施

/ OS / fs的细节。由于我们总是试图不过分关注C ++

特定问题，这是一个很好的问题。

Perhaps. Of course this would depend largely on implementation specific
/ OS / fs details. As we always try to not focus too much on C++
specific issues, this is a perfect question to ask here.

我也来了跨BIOS功能INT 13H这是低级磁盘

操作。这似乎有所帮助，有没有人成功使用过

呢？

Ive also come across BIOS function INT 13H which is low level disk
operations. This seems to be of help, has anyone had success in using
it?

感谢您使用BIOS。由于Linux和Windows PC都有BIOS，因此这就像是独立的平台一样。好

工作。

Thanks for bringing the BIOS into play. This qualifies as being kind of
plattform independent, as both Linux and Windows PC''s have a BIOS. Good
job.

感谢您的帮助。

Thanks for any help.

Im *真的*抱歉我帮不了多。


祝你好运，Felix

Im *really* sorry I couldn''t help more.

Best luck, Felix

这篇关于试图设计低级硬盘操作程序的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！