windows在加载一个之前从未加载过的分区时，首先要将这个分区的设备序号信息记录在注册表里，如果对这个分区进行了盘符(或路径)分配，那么在下次加载这个分区的时候就不用再次指定盘符(或路径)了。
这些信息记录在：[HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices]键值下，内容大致为(从我的电脑里导出的)：附件１
这里面重要的是这几个：
"\\DosDevices\\R:"=hex:eb,f8,b2,92,00,7e,00,00,00,00,00,00
上面的R:表示盘符为R，后面的HEX值中分成两个部分，第一部分是前４个HEX值，表示R分区所属硬盘的序号，后面８个HEX表示R分区在这个硬盘的偏移起始位置，以字节为单位。对照上面的R，看一下R分区所属的硬盘的０扇区：
Offset 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
000000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04
000000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5
000000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B
000000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88
000000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B
000000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83
000000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB
000000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0
000000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56
0000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC
0000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56
0000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C
0000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A
0000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD
0000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60
000000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A
000000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B
000000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61
000000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61
000000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E
000000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74
000000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61
000000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00
000000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001B0 00 00 00 00 00 2C 44 63 EB F8 B2 92 00 00 00 01
0000001C0 01 00 07 FE FF FF 3F 00 00 00 3F F5 7F 0C 00 00
0000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
000000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04
000000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5
000000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B
000000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88
000000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B
000000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83
000000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB
000000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0
000000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56
0000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC
0000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56
0000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C
0000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A
0000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD
0000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60
000000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A
000000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B
000000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61
000000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61
000000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E
000000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74
000000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61
000000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00
000000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001B0 00 00 00 00 00 2C 44 63 EB F8 B2 92 00 00 00 01
0000001C0 01 00 07 FE FF FF 3F 00 00 00 3F F5 7F 0C 00 00
0000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
图中偏移为0x1B8~0x1BB，内容为HEX:EB F8 B2 92就是注册表中记录的R分区的硬盘序号。而从偏移0x1be~0x1ce中的第一组分区表可以看出，唯一的分区起始位置为0x3F，以扇区为单位，换成字节就是0x3F*0x200=0x7E00,如果用８字节的６４位值表示，HEX就是00 7E 00 00 00 00 00 00 ,就是注册表中记录的键值的后半部分。
没有评论:
发表评论