Another method for backing-disk identification by using INT13 drive number (as seen from NTLDR).
- Save drive number pair in registry
key = "whatever\BackingDisk", value = drive number of sector-mapped disk, type REG_DWORD, data = drive number of backing disk.
example. value "80" data 0x90
- In GRUB4DOS map backing disk as drive number specified in registry
map (hd0,0)/aaaa.img (0x80)
map (hd0) (0x90)
- When driver read drive map slot, it see drive number 0x80.
Driver read registry value "80". It get data 0x90 which is drive number of backing disk.
Driver enumerate all disk on system and send IOCTL_DISK_GET_DRIVE_GEOMETRY_EX to each of them.
If the returned diskdetectioninfo->DetectionType==DetectInt13 and diskdetectioninfo->DriveSelect == drive number of backing disk, we have found the backing disk.
Edited by fightingcat, 07 January 2017 - 11:55 AM.