win32 (Partition boot record) read/write by C++

Master boot record (FOR xp/2k)
以下是 win32 console program , 用來備份 boot sector (446 bytes) , 和寫入 boot sector.
測試環境是用 vs2005 , project property 用  /MT (靜態連結,省得 RUN-TIME-DLL 版本問題)
,用 MBCS 字集.

----------------
// bootsec.cpp : /dump to backup current harddisk boot sector to hex file, /fix to restore  from hex file
//

#include "stdafx.h"

HANDLE hDevice=NULL;
unsigned char * WriteSector(int drive, DWORD startinglogicalsector, int numberofsectors,unsigned char *buffer)
{
    SetFilePointer (hDevice, (startinglogicalsector*512), NULL, FILE_BEGIN);
    DWORD byteswrite=0;
    BOOL ret=WriteFile(hDevice,buffer,512*numberofsectors,&byteswrite,NULL);

    ret = FlushFileBuffers(hDevice);
    return buffer;
}
unsigned char * ReadSector(int drive, DWORD startinglogicalsector, int numberofsectors)
{
 // All msdos data structures must be packed on a 1 byte boundary
 #pragma pack (1)   
 struct
 {
    DWORD StartingSector ;
    WORD NumberOfSectors ;
    DWORD pBuffer;
 }ControlBlock;
 #pragma pack ()

 #pragma pack (1)
 typedef struct _DIOC_REGISTERS
 {
    DWORD reg_EBX;
    DWORD reg_EDX;
    DWORD reg_ECX;
    DWORD reg_EAX;
    DWORD reg_EDI;
    DWORD reg_ESI;
    DWORD reg_Flags;
 } DIOC_REGISTERS ;
 #pragma pack ()

 unsigned char* buffer = (unsigned char*)malloc (512*numberofsectors);
 DIOC_REGISTERS reg ;
 BOOL  fResult ;
 DWORD cb ;

 // Creating handle to vwin32.vxd (win 9x)
 hDevice = CreateFile ( "\\\\.\\vwin32",
         0,
         0,
         NULL,
         0,
         FILE_FLAG_DELETE_ON_CLOSE,
         NULL );

 if ( hDevice == INVALID_HANDLE_VALUE )
 {

    // win 2k code
    DWORD bytesread;
   
    // Creating a handle to drive a: using CreateFile () function ..
    char _devicename[] = "\\\\.\\A:";
    _devicename[4] += drive;
    hDevice = CreateFile(_devicename,
        // GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
        GENERIC_WRITE | GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE,
        NULL, OPEN_EXISTING, 0, NULL);

    if (hDevice == INVALID_HANDLE_VALUE)
        return NULL;

    SetFilePointer (hDevice, (startinglogicalsector*512), NULL, FILE_BEGIN);
    if (!ReadFile (hDevice, buffer, 512*numberofsectors, &bytesread, NULL) )
        return NULL;   
 }
 else
 {
     // code for win 95/98
     ControlBlock.StartingSector = (DWORD)startinglogicalsector;
     ControlBlock.NumberOfSectors = (DWORD)numberofsectors ;
     ControlBlock.pBuffer =  (DWORD)buffer ;

    //-----------------------------------------------------------
    // SI contains read/write mode flags
    // SI=0h for read and SI=1h for write
    // CX must be equal to ffffh for
    // int 21h's 7305h extention
    // DS:BX -> base addr of the
    // control block structure
    // DL must contain the drive number
    // (01h=A:, 02h=B: etc)
    //-----------------------------------------------------------

     reg.reg_ESI = 0x00 ;
     reg.reg_ECX = -1 ;
     reg.reg_EBX = (DWORD)(&ControlBlock);
     reg.reg_EDX = drive+1;
     reg.reg_EAX = 0x7305 ;

     //  6 == VWIN32_DIOC_DOS_DRIVEINFO
     fResult = DeviceIoControl ( hDevice,
         6,
         &(reg),
         sizeof (reg),
          &(reg),
         sizeof (reg),
         &cb,
         0);

     if (!fResult || (reg.reg_Flags & 0x0001)) return NULL;        
 }

 // CloseHandle(hDevice);
 return buffer;
}


int _tmain(int argc, _TCHAR* argv[])
{
    const int mbr_drive = 'C' - 'A';
    const int mbr_sector_start = 0;
    const int mbr_sectors = 1;
    if(argc==1)
    {
        printf("\nmbr v002");
        printf("\nmbr /dump > mbr.hex");
        printf("\nmbr /fix < mbr.hex");
        printf("\n");
    }

    unsigned char * pmbr=NULL;
    pmbr=ReadSector(mbr_drive,mbr_sector_start,mbr_sectors);
    if(pmbr==NULL)
    {
        printf("Read error\n");
        return -1;
    }

    if(argc==1)
    {
        printf("Read ok\n");       
        for(int i=0;i<16;i++)
        {
            printf("%02x ",pmbr[i]);
        }
        printf("\n");   
    }

    const int MBR_BYTES = 446;
    if(argc==2)
    {
        if(0==memcmp(argv[1],"/dump",5))
        {
            for(int i=0; i<MBR_BYTES; i++)
            {
                if (i%16==0) printf("\n");
                printf("%02x ",pmbr[i]);
            }
        }
        else if(0==memcmp(argv[1],"/fix",4))
        {
            unsigned char mbr_new[512];
            int count = 0;        // 446 hex byte expected
            const int BUF_SIZE=2048;
            char hexbuf[BUF_SIZE];
            printf("\n/fix");
            while(count<MBR_BYTES)
            {
                memset(hexbuf,0,BUF_SIZE);
                gets(hexbuf);               
                char * phex=hexbuf;
                // printf("\n[%s]",hexbuf);

                printf("\n");
                for(int i=0;i<16;i++)
                {
                    unsigned int value;
                    int item=sscanf(phex,"%02x",&value);
                    if(item!=1)
                        break;
                    phex=phex+3;
                    printf("%02x ",value);
                    mbr_new[count]=value;
                    count++;
                    if(count >= MBR_BYTES)
                        break;
                }
            }

            int diff = 0;
            for(int i=0; i<MBR_BYTES; i++)
            {
                if(mbr_new[i]!=pmbr[i]) diff++;
            }

            if(diff!=0)
            {
                for(int i=0;i<MBR_BYTES; i++) pmbr[i]=mbr_new[i];
                printf("\nneed write new mbr 446 bytes record into harddisk\n");
                WriteSector(mbr_drive,mbr_sector_start,mbr_sectors,pmbr);
            }
        }
    }

    printf("\n");
    if(hDevice!=NULL)
        CloseHandle(hDevice);
    if(pmbr)
        free(pmbr);
    return 0;
}

enable user environment debug logging

enable user environment debug logging 

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Entry: UserEnvDebugLevel

Type: REG_DWORD 

NONE 0x00000000
NORMAL 0x00000001
VERBOSE 0x00000002
LOGFILE 0x00010000
DEBUGGER 0x00020000

The default value is NORMAL|LOGFILE (0x00010001).

Note To disable logging, select NONE (0x00000000).

You can combine these values. For example, you can combine VERBOSE 0x00000002 and LOGFILE 0x00010000 to get 0x00010002. Therefore, if UserEnvDebugLevel is given a value of 0x00010002, LOGFILE and VERBOSE are both turned on. Combining these values is the same as using an OR statement.

0x00010000 OR 0x00000002 = 0x00010002

Note If you set UserEnvDebugLevel to 0x00030002, the most verbose details are logged in the Userenv.log file.

%Systemroot%\Debug\UserMode\Userenv.log file. If the Userenv.log file is larger than 300 KB, the file is renamed Userenv.bak, and a new Userenv.log file is created.

you can set the read-only attribute on the Userenv.bak file, and the Userenv.log file will grow indefinitely.

啟用 Wiadebug.log 檔案的記錄

啟用 Wiadebug.log 檔案的記錄

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\StillImage\Debug\Module_name\DebugFlags

WIA 服務中，適當的二進位模組會是 Wiaservc.dll。

DebugFlags中的值會控制的記錄級別。下列清單說明這三個設定:

• 0x00000001: 顯示錯誤
• 0x00000002: 顯示警告 
• 0x00000004: 顯示追蹤

DebugFlags的值是bit旗標值

重新啟動 
 net stop stisvc

 net start stisvc

windows xp , stop wbem logging, and change WMI repository to ramdisk

windows xp , stop wbem logging, and change WMI repository to ramdisk

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\CIMOM
Key: Repository Directory
value: R:\xxx\Repository
where R: drive is your ramdisk drive, and xxx is your existing folder in ramdrive.


Key: Logging
value:  1  --> 0

您也可以為 WMI 設定錯誤記錄檔：

• 所有的記錄檔的目的資料夾是設定此登錄子機碼：
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\LoggingDirectory
• 最大檔案大小是設定下列登錄子機碼：
  
  HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\Log File Max Size

下列登錄子機碼會決定如何 Windows 驅動程式模型 (WDM) 提供者將會記錄錯誤：

HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM\Logging

值：
0： 關閉記錄
1:   錯誤記錄
2： 詳細資訊記錄

windows XP assign Recent folder to ramdisk, or other drive

windows XP  assign Recent folder to ramdisk, or other drive

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
key: Recent
string: R:\Recent

purpose: decrease ssd, or system drive read/write activity