c# /Native:使用SCSI直通读取HDD串行

我已经编写了三种不同的方法，它们利用本地CreateFile和DeviceIoControl调用来检索硬盘序列号(而不是型号)。第一个用S.M.A.R.T.，第二个用Storage Query，第三个用SCSI PassThrough。我的大部分代码都是基于这个线程的内容(有一些修复和改进)。

下面是我使用diskid32实用程序得到的结果:

Trying to read the drive IDs using physical access with admin rights
Drive Model Number________________: [ST975XXXXX]
Drive Serial Number_______________: [            6WS2XXXX]
Trying to read the drive IDs using physical access with zero rights
Product Id = [ST975XXXXX]
Serial Number = [6WS2XXXX]
Trying to read the drive IDs using Smart
Drive Model Number________________: [ST975XXXXX]
Drive Serial Number_______________: [            6WS2XXXX]

现在，这里是使用我的方法的结果:

S.M.A.R.T. = 6WS2XXXX
Storage Query = 6WS2XXXX
SCSI PassThrough = ST975XXXXX

嗯…休斯顿，我们有麻烦了。通过前两种方法，我得到了正确的序列号。最后一个，我得到的型号是非常糟糕的。现在，这是我的代码:

--- METHOD ---
internal static String GetHardDiskSerialSCSIPassthrough(SafeFileHandle deviceHandle)
{
    IntPtr bufferPointer = IntPtr.Zero;
    String serial = String.Empty;
    UInt32 bytesReturned;
    SCSIPassthroughBuffered bspt = new SCSIPassthroughBuffered();
    bspt.SPT.Length = (UInt16)Marshal.SizeOf(bspt.SPT);
    bspt.SPT.CommandDescriptorBlockLength = 16;
    bspt.SPT.DataIn = 0x1;
    bspt.SPT.DataTransferLength = 64;
    bspt.SPT.DataBufferOffset = new IntPtr(Marshal.SizeOf(bspt) - 64);
    bspt.SPT.TimeOutValue = 60;
    bspt.SPT.CommandDescriptorBlock = new Byte[] { 0x12, 0x1, 0x80, 0x0, 64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 };
    Int32 bufferSize = Marshal.SizeOf(bspt);
    try
    {
        bufferPointer = Marshal.AllocHGlobal(bufferSize);
        Marshal.StructureToPtr(bspt, bufferPointer, true);
        if (DeviceIoControl(deviceHandle, 0x4D004, bufferPointer, (UInt32)bufferSize, bufferPointer, (UInt32)bufferSize, out bytesReturned, IntPtr.Zero) && (bytesReturned > 0))
        {
            SCSIPassthroughBuffered result = (SCSIPassthroughBuffered)Marshal.PtrToStructure(bufferPointer, typeof(SCSIPassthroughBuffered));
            serial = Encoding.ASCII.GetString(result.Buffer, 0, result.Buffer.Length).Replace("'0", String.Empty).Trim();
        }
    }
    finally
    {
        Marshal.FreeHGlobal(bufferPointer);
    }
    return serial;
}
--- STRUCTURES ---
[StructLayout(LayoutKind.Sequential)]
private struct SCSIPassthrough
{
    public UInt16 Length;
    public Byte SCSIStatus;
    public Byte PathID;
    public Byte TargetID;
    public Byte LogicalUnitNumber;
    public Byte CommandDescriptorBlockLength;
    public Byte SenseInfoLength;
    public Byte DataIn;
    public UInt32 DataTransferLength;
    public UInt32 TimeOutValue;
    public IntPtr DataBufferOffset;
    public UInt32 SenseInfoOffset;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 16)]
    public Byte[] CommandDescriptorBlock;
}
[StructLayout(LayoutKind.Sequential)]
private struct SCSIPassthroughBuffered
{
    public SCSIPassthrough SPT;
    public UInt32 Filler;
    [MarshalAs(UnmanagedType.ByValArray, SizeConst = 64)]
    public Byte[] Buffer;
}

我做错了什么?也许使用了错误的CDB?

serial = Encoding.ASCII.GetString(result.Buffer, 0, result.Buffer.Length)
                       .Replace("'0", String.Empty)
                       .Trim();

serial = Encoding.ASCII.GetString(result.Buffer, 0, result.Buffer.Length)
                       .Substring(IntPtr.Size)
                       .Replace("'0", String.Empty)
                       .Trim();