获得驱动器信息卷设备&&Ring3得到磁盘文件系统（NTFS WIN10）

Posted 2020-10-09 生如逆旅 一苇以航

 1 // GetLogicalDriveStrings.cpp : 定义控制台应用程序的入口点。
 2 //
 3 
 4 #include "stdafx.h"
 5 #include <Windows.h>
 6 #include <iostream>
 7 
 8 using namespace std;
 9 
10 void Sub_1();//枚举计算机的卷--->磁盘 &&  NTFS(win10)
11 
12 
13 int main()
14 {
15 
16     Sub_1();
17 
18     return 0;
19 }
20 
21 void Sub_1()
22 {
23     char    VolumeDeviceString[0x500] = { 0 };
24     // 前一个字节为消息类型，后面的52字节为驱动器跟相关属性
25     BYTE    BufferData[0x1000] = { 0 };
26     char    FileSystem[MAX_PATH] = { 0 };
27     char    *Travel = NULL;
28     
29     GetLogicalDriveStrings(sizeof(VolumeDeviceString), VolumeDeviceString);
30 
31 
32     //获得驱动器信息
33     /*
34     0x001FF228  43 3a 5c 00 45 3a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  C:\.E:\.............
35     */
36 
37     //0018F460  43 3A 5C 00 44 3A 5C 00 45 3A 5C 00 46 3A  C:\.D:\.E:\.F:
38     //0018F46E  5C 00 47 3A 5C 00 48 3A 5C 00 4A 3A 5C 00  \.G:\.H:\.J:\.
39     Travel = VolumeDeviceString;
40 
41     DWORD Offset = 0;
42     for (Offset = 1; *Travel != ‘\0‘; Travel += lstrlen(Travel) + 1)   //这里的+1为了过\0
43     {
44         memset(FileSystem, 0, sizeof(FileSystem));  //文件系统 NTFS
45 
46                                                     // 得到文件系统信息及大小
47         GetVolumeInformation(Travel, NULL, 0, NULL, NULL, NULL, FileSystem, MAX_PATH);
48         ULONG    FileSystemLength = lstrlen(FileSystem) + 1;
49 
50         int a = 0;
51     }
52 
53 
54 }