热门关键词:搜龙体育  
当前位置:首页 > 企业新闻
搜龙体育:建立SvcHost.exe挪用的服务原理与实践(转贴34)
2021-11-07 [59329]
本文摘要:1. 多个服务共享一个Svchost.exe历程利与弊windows 系统服务分为独立历程和共享历程两种,在windows NT时只有服务器治理器SCM(Services.exe)有多个共享服务,随着系统内置服务的增加,在windows 2000年ms又把许多服务做成共享方式,由svchost.exe启动。

搜龙体育

1. 多个服务共享一个Svchost.exe历程利与弊windows 系统服务分为独立历程和共享历程两种,在windows NT时只有服务器治理器SCM(Services.exe)有多个共享服务,随着系统内置服务的增加,在windows 2000年ms又把许多服务做成共享方式,由svchost.exe启动。windows 2000一般有2个svchost历程,一个是RPCSS(Remote Procedure Call)服务历程,另外一个则是由许多服务共享的一个svchost.exe。

而在windows XP中,则一般有4个以上的svchost.exe服务历程,windows 2003 server中则更多,可以看出把更多的系统内置服务以共享历程方式由svchost启动是ms的一个趋势。这样做在一定水平上淘汰了系统资源的消耗,不外也带来一定的不稳定因素,因为任何一个共享历程的服务因为错误退出历程就会导致整个历程中的所有服务都退出。

另外就是有一点宁静隐患,首先要先容一下 svchost.exe的实现机制。2. Svchost原理Svchost自己只是作为服务宿主,并不实现任何服务功效,需要Svchost启动的服务以动态链接库形式实现,在安装这些服务时,把服务的可执行法式指向svchost,启动这些服务时由svchost挪用相应服务的动态链接库来启动服务。那么svchost如何知道某一服务是由哪个动态链接库卖力呢?这不是由服务的可执行法式路径中的参数部门提供的,而是服务在注册表中的参数设置的,注册表中服务下边有一个Parameters子键其中的ServiceDll讲明该服务由哪个动态链接库卖力。

搜龙体育

而且所有这些服务动态链接库都必须要导出一个 ServiceMain()函数,用来处置惩罚服务任务。例如rpcss(Remote Procedure Call)在注册表中的位置是 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs,它的参数子键Parameters里有这样一项:“ServiceDll”=REG_EXPAND_SZ:”%SystemRoot%\system32\rpcss.dll”当启动rpcss服务时,svchost就会挪用rpcss.dll,而且执行其ServiceMain()函数执行详细服务。既然这些服务是使用共享历程方式由svchost启动的,为什么系统中会有多个svchost历程呢?ms把这些服务分为几组,同组服务共享一个svchost历程,差别组服务使用多个svchost历程,组的区别是由服务的可执行法式后边的参数决议的。例如rpcss在注册表中 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RpcSs 有这样一项:“ImagePath”=REG_EXPAND_SZ:”%SystemRoot%\system32\svchost -k rpcss”因此rpcss就属于rpcss组,这在服务治理控制台也可以看到。

svchost的所有组和组内的所有服务都在注册表的如下位置: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost,例如windows 2000共有4组rpcss、netsvcs、wugroup、BITSgroup,其中最多的就是netsvcs=REG_MULTI_SZ: EventSystem.Ias.Iprip.Irmon.Netman.Nwsapagent.Rasauto.Rasman.Remoteaccess.SENS.Sharedaccess.Tapisrv.Ntmssvc.wzcsvc..在启动一个svchost.exe卖力的服务时,服务治理器如果遇到可执行法式内容ImagePath已经存在于服务治理器的映象库中,就不在启动第2个历程svchost,而是直接启动服务。这样就实现了多个服务共享一个svchost历程。3. Svchost代码现在我们基本清楚svchost的原理了,可是要自己写一个DLL形式的服务,由svchost来启动,仅有上边的信息另有些问题不是很清楚。

好比我们在导出的ServiceMain()函数中吸收的参数是ANSI还是Unicode?我们是否需要挪用 RegisterServiceCtrlHandler和StartServiceCtrlDispatcher来注册服务控制及调理函数?这些问题要通过检察svchost代码获得。下边的代码是windows 2000+ service pack 4 的svchost反汇编片段,可以看出svchost法式还是很简朴的。主函数首先挪用ProcCommandLine()对下令行举行分析,获得要启动的服务组,然后挪用SvcHostOptions()查询该服务组的选项和服务组的所有服务,并使用一个数据结构 svcTable 来生存这些服务及其服务的DLL,然后挪用PrepareSvcTable() 函数建立SERVICE_TABLE_ENTRY 结构,把所有处置惩罚函数SERVICE_MAIN_FUNCTION 指向自己的一个函数FuncServiceMain(),最后挪用API StartServiceCtrlDispatcher() 注册这些服务的调理函数。

搜龙体育

; =============================== Main Funcion ===========================================.text:010010B8 public start.text:010010B8 start proc near.text:010010B8 push esi.text:010010B9 push edi.text:010010BA push offset sub_1001EBA ; lpTopLevelExceptionFilter.text:010010BF xor edi, edi.text:010010C1 call ds:SetUnhandledExceptionFilter.text:010010C7 push 1 ; uMode.text:010010C9 call ds:SetErrorMode.text:010010CF call ds:GetProcessHeap.text:010010D5 push eax.text:010010D6 call sub_1001142.text:010010DB mov eax, offset dword_1003018.text:010010E0 push offset unk_1003000 ; lpCriticalSection.text:010010E5 mov dword_100301C, eax.text:010010EA mov dword_1003018, eax.text:010010EF call ds:InitializeCriticalSection.text:010010F5 call ds:GetCommandLineW.text:010010FB push eax ; lpString.text:010010FC call ProcCommandLine.text:01001101 mov esi, eax.text:01001103 test esi, esi.text:01001105 jz short lab_doservice.text:01001107 push esi.text:01001108 call SvcHostOptions.text:0100110D call PrepareSvcTable.text:01001112 mov edi, eax ; SERVICE_TABLE_ENTRY returned.text:01001114 test edi, edi.text:01001116 jz short loc_1001128.text:01001118 mov eax, [esi+10h].text:0100111B test eax, eax.text:0100111D jz short loc_1001128.text:0100111F push dword ptr [esi+14h] ; dwCapabilities.text:01001122 push eax ; int.text:01001123 call InitializeSecurity.text:01001128.text:01001128 loc_1001128: ; CODE XREF: start+5Ej.text:01001128 ; start+65j.text:01001128 push esi ; lpMem.text:01001129 call HeapFreeMem.text:0100112E.text:0100112E lab_doservice: ; CODE XREF: start+4Dj.text:0100112E test edi, edi.text:01001130 jz ExitProgram.text:01001136 push edi ; lpServiceStartTable.text:01001137 call ds:StartServiceCtrlDispatcherW.text:0100113D jmp ExitProgram.text:0100113D start endp; =============================== Main Funcion end ===========================================由于svchost为该组的所有服务都注册了svchost中的一个处置惩罚函数,因此每次启动任何一个服务时,服务治理器SCM都市挪用 FuncServiceMain() 这个函数。这个函数使用 svcTable 查询要启动的服务使用的DLL,挪用DLL导出的ServiceMain()函数来启动服务,然后返回。

; ============================== FuncServiceMain() ===========================================.text:01001504 FuncServiceMain proc near ; DATA XREF: PrepareSvcTable+44o.text:01001504.text:01001504 arg_0 = dword ptr 8.text:01001504 arg_4 = dword ptr 0Ch.text:01001504.text:01001504 push ecx.text:01001505 mov eax, [esp+arg_4].text:01001509 push ebx.text:0100150A push ebp.text:0100150B push esi.text:0100150C mov ebx, offset unk_1003000.text:01001511 push edi.text:01001512 mov edi, [eax].text:01001514 push ebx.text:01001515 xor ebp, ebp.text:01001517 call ds:EnterCriticalSection.text:0100151D xor esi, esi.text:0100151F cmp dwGroupSize, esi.text:01001525 jbe short loc_1001566.text:01001527 and [esp+10h], esi.text:0100152B.text:0100152B loc_100152B: ; CODE XREF: FuncServiceMain+4Aj.text:0100152B mov eax, svcTable.text:01001530 mov ecx, [esp+10h].text:01001534 push dword ptr [eax+ecx].text:01001537 push edi.text:01001538 call ds:lstrcmpiW.text:0100153E test eax, eax.text:01001540 jz short StartThis.text:01001542 add dword ptr [esp+10h], 0Ch.text:01001547 inc esi.text:01001548 cmp esi, dwGroupSize.text:0100154E jb short loc_100152B.text:01001550 jmp short loc_1001566.text:01001552 ; =================================================.text:01001552.text:01001552 StartThis: ; CODE XREF: FuncServiceMain+3Cj.text:01001552 mov ecx, svcTable.text:01001558 lea eax, [esi+esi*2].text:0100155B lea eax, [ecx+eax*4].text:0100155E push eax.text:0100155F call GetDLLServiceMain.text:01001564 mov ebp, eax ; dll ServiceMain Function address.text:01001566.text:01001566 loc_1001566: ; CODE XREF: FuncServiceMain+21j.text:01001566 ; FuncServiceMain+4Cj.text:01001566 push ebx.text:01001567 call ds:LeaveCriticalSection.text:0100156D test ebp, ebp.text:0100156F jz short loc_100157B.text:01001571 push [esp+10h+arg_4].text:01001575 push [esp+14h+arg_0].text:01001579 call ebp.text:0100157B.text:0100157B loc_100157B: ; CODE XREF: FuncServiceMain+6Bj.text:0100157B pop edi.text:0100157C pop esi.text:0100157D pop ebp.text:0100157E pop ebx.text:0100157F pop ecx.text:01001580 retn 8.text:01001580 FuncServiceMain endp ; sp = -8; ============================== FuncServiceMain() end ========================================由于svchost已经挪用了StartServiceCtrlDispatcher来服务调理函数,因此我们在实现DLL实现时就不用了,这主要是因为一个历程只能挪用一次StartServiceCtrlDispatcher API。可是需要用 RegisterServiceCtrlHandler 来注册响应控制请求的函数。最后我们的DLL吸收的都是unicode字符串。由于这种服务启动后由svchost加载,不增加新的历程,只是svchost的一个DLL,而且一般举行审计时都不会去 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost 检查服务组是否变化,就算去检查,也纷歧定能发现异常,因此如果添加一个这样的DLL后门,伪装的好,是比力隐蔽的。

4. 安装服务与设置要通过svchost挪用来启动的服务,就一定要在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost下有该服务名,这可以通过如下方式来实现:1) 添加一个新的服务组,在组里添加服务名2) 在现有组里添加服务名3) 直接使用现有服务组里的一个服务名,但本机没有安装的服务4) 修改现有服务组里的现有服务,把它的ServiceDll指向自己其中前两种可以被正常服务使用,如使用第1种方式,启动其服务要建立新的svchost历程;第2种方式如果该组服务已经运行,安装后不能连忙启动服务,因为svchost启动后已经把该组信息生存在内存里,并挪用API StartServiceCtrlDispatcher() 为该组所有服务注册了调理处置惩罚函数,新增加的服务不能再注册调理处置惩罚函数,需要重启盘算机或者该组的svchost历程。尔后两种可能被后门使用,尤其是最后一种,没有添加服务,只是改了注册内外一项设置,从服务治理控制台又看不出来,如果作为后门还是很隐蔽的。好比EventSystem服务,缺省是指向es.dll,如果把ServiceDll改为EventSystem.dll就很难发现。因此服务的安装除了挪用CreateService()建立服务之外,还需要设置服务的ServiceDll,如果使用前2种还要设置svchost的注册表选项,在卸载时也最好删除增加的部门。

搜龙体育

详细代码参见后边的附例(使用的是方法3)。注: ImagePath 和ServiceDll 是ExpandString不是普通字符串。因此如果使用.reg文件安装时要注意。5. DLL服务实现DLL法式的编写比力简朴,只要实现一个ServiceMain()函数和一个服务控制法式,在ServiceMain()函数里用RegisterServiceCtrlHandler()注册服务控制法式,并设置服务的运行状态就可以了。

另外,因为此种服务的安装除了正常的CreateService()之外,还要举行其他设置,因此最好实现安装和卸载函数。为了利便安装,实现的代码提供了InstallService()函数举行安装,这个函数可以吸收服务名作为参数(如果不提供参数,就使用缺省的 iprip),如果要安装的服务不在svchost的netsvcs组里安装就会失败;如果要安装的服务已经存在,安装也会失败;安装乐成后法式会设置服务的ServiceDll为当前Dll。提供的UninstallService()函数,可以删除任何函数而没有举行任何检查。

为了利便使用rundll32.exe举行安装,还提供了RundllInstallA()和RundllUninstallA()划分挪用InstallService()及UninstallService()。因为rundll32.exe使用的函数原型是:void CALLBACK FunctionName(HWND hwnd, // handle to owner windowHINSTANCE hinst, // instance handle for the DLLLPTSTR lpCmdLine, // string the DLL will parseint nCmdShow // show state);对应的下令行是rundll32 DllName,FunctionName [Arguments]DLL服务自己只是建立一个历程,该法式下令行就是启动服务时提供的第一个参数,如果未指定就使用缺省的svchostdll.exe。启动服务时如果提供第二个参数,建立的历程就是和桌面交互的。详细代码参见后边的附例8,源代码和DLL文件请到http://www.binglesite.net下载。

//main service process functionvoid __stdcall ServiceMain( int argc, wchar_t* argv[] );//report service stat to the service control managerint TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );//service control handler, call back by service control managervoid __stdcall ServiceHandler( DWORD dwCommand );//RealService just create a processint RealService(char *cmd, int bInteract);//Install this dll as a Service host by svchost.exe, service name is given by callerint InstallService(char *name);//unInstall a Service, be CARE FOR call this to delete a serviceint UninstallService(char *name);//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to callvoid CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a servicevoid CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//output the debug infor into log file(or stderr if a console program call me) & DbgPrintvoid OutputString( char *lpFmt, … );6. 代码使用C:\>tlist -s0 System Process8 System240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi504 svchost.exe Svcs: RpcSs1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrvC:\>rundll32 svchostdll.dll,RundllInstall abcdSvcHostDLL: DllMain called DLL_PROCESS_ATTACHyou specify service name not in Svchost\netsvcs, must be one of following:– EventSystem– Ias– Iprip– Irmon– Netman– Nwsapagent– Rasauto– Rasman– Remoteaccess– SENS– Sharedaccess– Tapisrv– Ntmssvc– wzcsvcC:\>rundll32 svchostdll.dll,RundllInstall IPRIPSvcHostDLL: DllMain called DLL_PROCESS_ATTACHCreateService(IPRIP) SUCCESS. Config itConfig service IPRIP ok.C:\>sc start iprip “cmd /k whoami” 1NT AUTHORITY\SYSTEMSvcHostDLL: ServiceMain(3, IPRIP) calledSvcHostDLL: RealService called ‘cmd /k whoami’ InteractSvcHostDLL: CreateProcess(cmd /k whoami) to 640C:\>tlist -s0 System Process8 System240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi504 svchost.exe Svcs: RpcSs640 cmd.exe Title: C:\WINNT\System32\cmd.exe1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIPC:\>net stop ipripThe IPRIP service was stopped successfully.C:\>rundll32 svchostdll.dll,RundllUninstall ipripDeleteService(IPRIP) SUCCESS.7. 参考Platform SDK: Tools – Rundll321) Inside Win32 Services, Part 2 by: Mark Russinovich, at: http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=32) Platform SDK: Tools – Rundll32, at: http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp2003/88. 代码// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to host it.//// for detail comment see articles.// by bingle_at_email.com.cn// www.BingleSite.net///* save following as a .def file to export function, only ServiceMain is needed.other used to install & uninstall service.or use /EXPORT: link option to export them.EXPORTSServiceMainInstallServiceUninstallServiceRundllUninstallARundllInstallA*//*To compile & link:cl /MD /GX /LD svchostdll.cpp /link advapi32.lib /DLL /base:0x71000000 /export:ServiceMain /EXPORT:RundllUninstallA /EXPORT:RundllInstallA /EXPORT:InstallService /EXPORT:UninstallService*///// Articles:// 1. HOWTO Create a service dll used by svchost.exe by bingle, at: http://www.BingleSite.net/article/svchost-dll-service.html// 2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3// 3. Platform SDK: Tools – Rundll32, at: http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp#include #include #include #include #define DEFAULT_SERVICE “IPRIP”#define MY_EXECUTE_NAME “SvcHostDLL.exe”//main service process functionvoid __stdcall ServiceMain( int argc, wchar_t* argv[] );//report service stat to the service control managerint TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );//service control handler, call back by service control managervoid __stdcall ServiceHandler( DWORD dwCommand );//RealService just create a processint RealService(char *cmd, int bInteract);//Install this dll as a Service host by svchost.exe, service name is given by callerint InstallService(char *name);//unInstall a Service, be CARE FOR call this to delete a serviceint UninstallService(char *name);//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to callvoid CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a servicevoid CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//output the debug infor into log file(or stderr if a console program call me) & DbgPrintvoid OutputString( char *lpFmt, … );//dll module handle used to get dll path in InstallServiceHANDLE hDll = NULL;//Service HANDLE & STATUS used to get service stateSERVICE_STATUS_HANDLE hSrv;DWORD dwCurrState;BOOL APIENTRY DllMain( HANDLE hModule,DWORD ul_reason_for_call,LPVOID lpReserved){switch (ul_reason_for_call){case DLL_PROCESS_ATTACH:hDll = hModule;#ifdef _DEBUGAllocConsole();OutputString(“SvcHostDLL: DllMain called DLL_PROCESS_ATTACH”);break;case DLL_THREAD_ATTACH:OutputString(“SvcHostDLL: DllMain called DLL_THREAD_ATTACH”);case DLL_THREAD_DETACH:OutputString(“SvcHostDLL: DllMain called DLL_THREAD_DETACH”);case DLL_PROCESS_DETACH:TellSCM( SERVICE_STOP_PENDING, 0, 0 );Sleep(1500);TellSCM( SERVICE_STOPPED, 0, 0 );OutputString(“SvcHostDLL: DllMain called DLL_PROCESS_DETACH”);#endifbreak;}return TRUE;}void __stdcall ServiceMain( int argc, wchar_t* argv[] ){// DebugBreak();char svcname[256];strncpy(svcname, (char*)argv[0], sizeof svcname); //it’s should be unicode, but if it’s ansi we do it wellwcstombs(svcname, argv[0], sizeof svcname);OutputString(“SvcHostDLL: ServiceMain(%d, %s) called”, argc, svcname);hSrv = RegisterServiceCtrlHandler( svcname, (LPHANDLER_FUNCTION)ServiceHandler );if( hSrv == NULL ){OutputString(“SvcHostDLL: RegisterServiceCtrlHandler %S failed”, argv[0]);return;}else FreeConsole();TellSCM( SERVICE_START_PENDING, 0, 1 );TellSCM( SERVICE_RUNNING, 0, 0 );// call Real Service function noewif(argc > 1)strncpy(svcname, (char*)argv[1], sizeof svcname),wcstombs(svcname, argv[1], sizeof svcname);RealService(argc > 1 ? svcname : MY_EXECUTE_NAME, argc > 2 ? 1 : 0);do{Sleep(10);//not quit until receive stop command, otherwise the service will stop}while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);OutputString(“SvcHostDLL: ServiceMain done”);return;}int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ){SERVICE_STATUS srvStatus;srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;srvStatus.dwCurrentState = dwCurrState = dwState;srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN;srvStatus.dwWin32ExitCode = dwExitCode;srvStatus.dwServiceSpecificExitCode = 0;srvStatus.dwCheckPoint = dwProgress;srvStatus.dwWaitHint = 3000;return SetServiceStatus( hSrv, &srvStatus );}void __stdcall ServiceHandler( DWORD dwCommand ){// not really necessary because the service stops quicklyswitch( dwCommand ){case SERVICE_CONTROL_STOP:TellSCM( SERVICE_STOP_PENDING, 0, 1 );OutputString(“SvcHostDLL: ServiceHandler called SERVICE_CONTROL_STOP”);Sleep(10);TellSCM( SERVICE_STOPPED, 0, 0 );break;case SERVICE_CONTROL_PAUSE:TellSCM( SERVICE_PAUSE_PENDING, 0, 1 );OutputString(“SvcHostDLL: ServiceHandler called SERVICE_CONTROL_PAUSE”);TellSCM( SERVICE_PAUSED, 0, 0 );break;case SERVICE_CONTROL_CONTINUE:TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 );OutputString(“SvcHostDLL: ServiceHandler called SERVICE_CONTROL_CONTINUE”);TellSCM( SERVICE_RUNNING, 0, 0 );break;case SERVICE_CONTROL_INTERROGATE:OutputString(“SvcHostDLL: ServiceHandler called SERVICE_CONTROL_INTERROGATE”);TellSCM( dwCurrState, 0, 0 );break;case SERVICE_CONTROL_SHUTDOWN:OutputString(“SvcHostDLL: ServiceHandler called SERVICE_CONTROL_SHUTDOWN”);TellSCM( SERVICE_STOPPED, 0, 0 );break;}}//RealService just create a processint RealService(char *cmd, int bInteract){OutputString(“SvcHostDLL: RealService called ‘%s’ %s”, cmd, bInteract ? “Interact” : “”);STARTUPINFO si = {0};PROCESS_INFORMATION pi;si.cb = sizeof si;if(bInteract) si.lpDesktop = “WinSta0\\Default”;if(!CreateProcess(NULL, cmd, NULL, NULL, false, 0, NULL, NULL, &si, &pi))OutputString(“SvcHostDLL: CreateProcess(%s) error:%d”, cmd, GetLastError());else OutputString(“SvcHostDLL: CreateProcess(%s) to %d”, cmd, pi.dwProcessId);return 0;}int InstallService(char *name){// Open a handle to the SC Manager database.int rc = 0;HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;SC_HANDLE hscm = NULL, schService = NULL;try{char buff[500];char *svcname = DEFAULT_SERVICE;if(name && name[0]) svcname = name;//query svchost settingchar *ptr, *pSvchost = “SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost”;rc = RegOpenKeyEx(hkRoot, pSvchost, 0, KEY_QUERY_VALUE, &hkRoot);if(ERROR_SUCCESS != rc){OutputString(“RegOpenKeyEx(%s) KEY_QUERY_VALUE error %d.”, pSvchost, rc);throw “”;}DWORD type, size = sizeof buff;rc = RegQueryValueEx(hkRoot, “netsvcs”, 0, &type, (unsigned char*)buff, &size);RegCloseKey(hkRoot);SetLastError(rc);if(ERROR_SUCCESS != rc)throw “RegQueryValueEx(Svchost\\netsvcs)”;for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)if(stricmp(ptr, svcname) == 0) break;if(*ptr == 0){OutputString(“you specify service name not in Svchost\\netsvcs, must be one of following:”);for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)OutputString(” – %s”, ptr);throw “”;}//install servicehscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);if (hscm == NULL)throw “OpenSCManager()”;char *bin = “%SystemRoot%\\System32\\svchost.exe -k netsvcs”;schService = CreateService(hscm, // SCManager databasesvcname, // name of serviceNULL, // service name to displaySERVICE_ALL_ACCESS, // desired accessSERVICE_WIN32_SHARE_PROCESS, // service typeSERVICE_AUTO_START, // start typeSERVICE_ERROR_NORMAL, // error control typebin, // service’s binaryNULL, // no load ordering groupNULL, // no tag identifierNULL, // no dependenciesNULL, // LocalSystem accountNULL); // no passwordif (schService == NULL){OutputString(“CreateService(%s) error %d”, svcname, rc = GetLastError());throw “”;}OutputString(“CreateService(%s) SUCCESS. Config it”, svcname);CloseServiceHandle(schService);CloseServiceHandle(hscm);//config servicehkRoot = HKEY_LOCAL_MACHINE;strncpy(buff, “SYSTEM\\CurrentControlSet\\Services\\”, sizeof buff);strncat(buff, svcname, 100);rc = RegOpenKeyEx(hkRoot, buff, 0, KEY_ALL_ACCESS, &hkRoot);if(ERROR_SUCCESS != rc){OutputString(“RegOpenKeyEx(%s) KEY_SET_VALUE error %d.”, svcname, rc);throw “”;}rc = RegCreateKey(hkRoot, “Parameters”, &hkParam);SetLastError(rc);if(ERROR_SUCCESS != rc)throw “RegCreateKey(Parameters)”;if(!GetModuleFileName(HMODULE(hDll), buff, sizeof buff))throw “GetModuleFileName() get dll path”;rc = RegSetValueEx(hkParam, “ServiceDll”, 0, REG_EXPAND_SZ, (unsigned char*)buff, strlen(buff)+1);SetLastError(rc);if(ERROR_SUCCESS != rc)throw “RegSetValueEx(ServiceDll)”;OutputString(“Config service %s ok.”, svcname);}catch(char *str){if(str && str[0]){rc = GetLastError();OutputString(“%s error %d”, str, rc);}}RegCloseKey(hkRoot);RegCloseKey(hkParam);CloseServiceHandle(schService);CloseServiceHandle(hscm);return rc;}/*used to install by rundll32.exePlatform SDK: Tools – Rundll32The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:*/void CALLBACK RundllInstallA(HWND hwnd, // handle to owner windowHINSTANCE hinst, // instance handle for the DLLchar *param, // string the DLL will parseint nCmdShow // show state){InstallService(param);}int UninstallService(char *name){int rc = 0;SC_HANDLE schService;SC_HANDLE hscm;__try{hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);if (hscm == NULL){OutputString(“OpenSCManager() error %d”, rc = GetLastError() );return rc;}char *svcname = DEFAULT_SERVICE;if(name && name[0]) svcname = name;schService = OpenService(hscm, svcname, Delete);if (schService == NULL){OutputString(“OpenService(%s) error %d”, svcname, rc = GetLastError() );return rc;}if (!DeleteService(schService) ){OutputString(“OpenService(%s) error %d”, svcname, rc = GetLastError() );return rc;}OutputString(“DeleteService(%s) SUCCESS.”, svcname);}__except(1){OutputString(“Exception Catched 0x%X”, GetExceptionCode());}CloseServiceHandle(schService);CloseServiceHandle(hscm);return rc;}/*used to uninstall by rundll32.exePlatform SDK: Tools – Rundll32The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:*/void CALLBACK RundllUninstallA(HWND hwnd, // handle to owner windowHINSTANCE hinst, // instance handle for the DLLchar *param, // string the DLL will parseint nCmdShow // show state){UninstallService(param);}//output the debug infor into log file & DbgPrintvoid OutputString( char *lpFmt, … ){char buff[1024];va_list arglist;va_start( arglist, lpFmt );_vsnprintf( buff, sizeof buff, lpFmt, arglist );va_end( arglist );DWORD len;HANDLE herr = GetStdHandle(STD_OUTPUT_HANDLE);if(herr != INVALID_HANDLE_VALUE){WriteFile(herr, buff, strlen(buff), &len, NULL);WriteFile(herr, “\r\n”, 2, &len, NULL);}else{FILE *fp = fopen(“SvcHost.DLL.log”, “a”);if(fp){char date[20], time[20];fprintf(fp, “%s %s – %s\n”, _strdate(date), _strtime(time), buff);if(!stderr) fclose(fp);}}OutputDebugString(buff);}。


本文关键词:搜龙体育

本文来源:搜龙体育-www.mhzhwztls.com