创建SvcHost.exe调用的服务原理与实践(2)

8. 代码

// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to host it.
//
// for detail comment see articles.
//　by bingle_at_email.com.cn
//　 www.BingleSite.net
//
/* save following as a .def file to export function, only ServiceMain is needed.
other used to install & uninstall service.
or use /EXPORT: link option to export them.
EXPORTS
　ServiceMain
　InstallService
　UninstallService
　RundllUninstallA
　RundllInstallA
*/
/*
To compile & link:
cl /MD /GX /LD svchostdll.cpp /link
advapi32.lib /DLL /base:0x71000000 /export:ServiceMain
/EXPORT:RundllUninstallA /EXPORT:RundllInstallA
/EXPORT:InstallService /EXPORT:UninstallService
*/
//
// Articles:
// 1. HOWTO Create a service dll used by svchost.exe by bingle, at: http://www.BingleSite.net/article/svchost-dll-service.html
// 2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3
// 3. Platform SDK: Tools - Rundll32, at: http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp
#include <stdio.h>
#include <time.h>
#include <assert.h>
#include <windows.h>
#define DEFAULT_SERVICE "IPRIP"
#define MY_EXECUTE_NAME "SvcHostDLL.exe"
//main service process function void __stdcall ServiceMain( int argc, wchar_t* argv[] );
//report service stat to the service control manager int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );
//service control handler, call back by service control manager void __stdcall ServiceHandler( DWORD dwCommand );
//RealService just create a process int RealService(char *cmd, int bInteract);
//Install this dll as a Service host by svchost.exe, service name is given by caller int InstallService(char *name);
//unInstall a Service, be CARE FOR call this to delete a service int UninstallService(char *name);
//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);
//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);
//output the debug infor into log file(or stderr if a console program call me) & DbgPrint void OutputString( char *lpFmt, ... );
//dll module handle used to get dll path in InstallService HANDLE hDll = NULL;
//Service HANDLE & STATUS used to get service state SERVICE_STATUS_HANDLE hSrv;
DWORD dwCurrState;
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
　 )
{
　switch (ul_reason_for_call)
　{
　case DLL_PROCESS_ATTACH:
hDll = hModule;
#ifdef _DEBUG
AllocConsole();
OutputString("SvcHostDLL: DllMain called DLL_PROCESS_ATTACH");
break;
　case DLL_THREAD_ATTACH:
OutputString("SvcHostDLL: DllMain called DLL_THREAD_ATTACH");
　case DLL_THREAD_DETACH:
OutputString("SvcHostDLL: DllMain called DLL_THREAD_DETACH");
　case DLL_PROCESS_DETACH:
TellSCM( SERVICE_STOP_PENDING, 0, 0 );
Sleep(1500);
TellSCM( SERVICE_STOPPED, 0, 0 );
OutputString("SvcHostDLL: DllMain called DLL_PROCESS_DETACH");
#endif
break;
　}
　return TRUE;
}
void __stdcall ServiceMain( int argc, wchar_t* argv[] )
{
//　DebugBreak();
　char svcname[256];
　strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it well
　wcstombs(svcname, argv[0], sizeof svcname);
　OutputString("SvcHostDLL: ServiceMain(%d, %s) called", argc, svcname);
　hSrv = RegisterServiceCtrlHandler( svcname, (LPHANDLER_FUNCTION)ServiceHandler );
　if( hSrv == NULL )
　{
OutputString("SvcHostDLL: RegisterServiceCtrlHandler %S failed", argv[0]);
return;
　}else FreeConsole();
　TellSCM( SERVICE_START_PENDING, 0, 1 );
　TellSCM( SERVICE_RUNNING, 0, 0 );
　// call Real Service function noew
　if(argc > 1)
strncpy(svcname, (char*)argv[1], sizeof svcname),
wcstombs(svcname, argv[1], sizeof svcname);
　RealService(argc > 1 ? svcname : MY_EXECUTE_NAME, argc > 2 ? 1 : 0);
　do{
Sleep(10);//not quit until receive stop command, otherwise the service will stop
　}while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);
　OutputString("SvcHostDLL: ServiceMain done");
　return;
}
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress )
{
　SERVICE_STATUS srvStatus;
　srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
　srvStatus.dwCurrentState = dwCurrState = dwState;
　srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN;
　srvStatus.dwWin32ExitCode = dwExitCode;
　srvStatus.dwServiceSpecificExitCode = 0;
　srvStatus.dwCheckPoint = dwProgress;
　srvStatus.dwWaitHint = 3000;
　return SetServiceStatus( hSrv, &srvStatus );
}
void __stdcall ServiceHandler( DWORD dwCommand )
{
　// not really necessary because the service stops quickly
　switch( dwCommand )
　{
　case SERVICE_CONTROL_STOP:
TellSCM( SERVICE_STOP_PENDING, 0, 1 );
OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_STOP");
Sleep(10);
TellSCM( SERVICE_STOPPED, 0, 0 );
break;
　case SERVICE_CONTROL_PAUSE:
TellSCM( SERVICE_PAUSE_PENDING, 0, 1 );
OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_PAUSE");
TellSCM( SERVICE_PAUSED, 0, 0 );
break;
　case SERVICE_CONTROL_CONTINUE:
TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 );
OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_CONTINUE");
TellSCM( SERVICE_RUNNING, 0, 0 );
break;
　case SERVICE_CONTROL_INTERROGATE:
OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_INTERROGATE");
TellSCM( dwCurrState, 0, 0 );
break;
　case SERVICE_CONTROL_SHUTDOWN:
OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_SHUTDOWN");
TellSCM( SERVICE_STOPPED, 0, 0 );
break;
　}
}
//RealService just create a process
int RealService(char *cmd, int bInteract)
{
　OutputString("SvcHostDLL: RealService called '%s' %s", cmd, bInteract ? "Interact" : "");
　STARTUPINFO si = {0};
　PROCESS_INFORMATION pi;
　si.cb = sizeof si;
　if(bInteract) si.lpDesktop = "WinSta0\\Default";
　if(!CreateProcess(NULL, cmd, NULL, NULL, false, 0, NULL, NULL, &si, &pi))
OutputString("SvcHostDLL: CreateProcess(%s) error:%d", cmd, GetLastError());
　else OutputString("SvcHostDLL: CreateProcess(%s) to %d", cmd, pi.dwProcessId);
　return 0;
}
int InstallService(char *name)
{
　// Open a handle to the SC Manager database.
　int rc = 0;
　HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;
　SC_HANDLE hscm = NULL, schService = NULL;
　try{
　char buff[500];
　char *svcname = DEFAULT_SERVICE;
　if(name && name[0]) svcname = name;
　//query svchost setting
　char *ptr, *pSvchost = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost";
　rc = RegOpenKeyEx(hkRoot, pSvchost, 0, KEY_QUERY_VALUE, &hkRoot);
　if(ERROR_SUCCESS != rc)
　{
OutputString("RegOpenKeyEx(%s) KEY_QUERY_VALUE error %d.", pSvchost, rc);
throw "";
　}
　DWORD type, size = sizeof buff;
　rc = RegQueryValueEx(hkRoot, "netsvcs", 0, &type, (unsigned char*)buff, &size);
　RegCloseKey(hkRoot);
　SetLastError(rc);
　if(ERROR_SUCCESS != rc)
throw "RegQueryValueEx(Svchost\\netsvcs)";
　for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)
if(stricmp(ptr, svcname) == 0) break;
　if(*ptr == 0)
　{
OutputString("you specify service name not in Svchost\\netsvcs, must be one of following:");
for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)
　OutputString(" - %s", ptr);
throw "";
　}
　//install service
　hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
　if (hscm == NULL)
throw "OpenSCManager()";
　char *bin = "%SystemRoot%\\System32\\svchost.exe -k netsvcs";
　schService = CreateService(
hscm,// SCManager database
svcname,　// name of service
NULL,　// service name to display
SERVICE_ALL_ACCESS,// desired access
SERVICE_WIN32_SHARE_PROCESS, // service type
SERVICE_AUTO_START,　 // start type
SERVICE_ERROR_NORMAL,　 // error control type
bin,// service's binary
NULL,　 // no load ordering group
NULL,　 // no tag identifier
NULL,　 // no dependencies
NULL,　 // LocalSystem account
NULL);　 // no password
　if (schService == NULL)
　{
OutputString("CreateService(%s) error %d", svcname, rc = GetLastError());
throw "";
　}
　OutputString("CreateService(%s) SUCCESS. Config it", svcname);
　CloseServiceHandle(schService);
　CloseServiceHandle(hscm);
　//config service
　hkRoot = HKEY_LOCAL_MACHINE;
　strncpy(buff, "SYSTEM\\CurrentControlSet\\Services\\", sizeof buff);
　strncat(buff, svcname, 100);
　rc = RegOpenKeyEx(hkRoot, buff, 0, KEY_ALL_ACCESS, &hkRoot);
　if(ERROR_SUCCESS != rc)
　{
OutputString("RegOpenKeyEx(%s) KEY_SET_VALUE error %d.", svcname, rc);
throw "";
　}
　rc = RegCreateKey(hkRoot, "Parameters", &hkParam);
　SetLastError(rc);
　if(ERROR_SUCCESS != rc)
throw "RegCreateKey(Parameters)";
　if(!GetModuleFileName(HMODULE(hDll), buff, sizeof buff))
throw "GetModuleFileName() get dll path";
　rc = RegSetValueEx(hkParam, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)buff, strlen(buff)+1);
　SetLastError(rc);
　if(ERROR_SUCCESS != rc)
throw "RegSetValueEx(ServiceDll)";
　OutputString("Config service %s ok.", svcname);
　}catch(char *str)
　{
if(str && str[0])
{
　rc = GetLastError();
　OutputString("%s error %d", str, rc);
}
　}
　RegCloseKey(hkRoot);
　RegCloseKey(hkParam);
　CloseServiceHandle(schService);
　CloseServiceHandle(hscm);
　return rc;
}
/*
used to install by rundll32.exe
Platform SDK: Tools - Rundll32
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:
*/
void CALLBACK RundllInstallA(
HWND hwnd,// handle to owner window
HINSTANCE hinst, // instance handle for the DLL
char *param,// string the DLL will parse
int nCmdShow　 // show state
)
{
　InstallService(param);
}
int UninstallService(char *name)
{
　int rc = 0;
　SC_HANDLE schService;
　SC_HANDLE hscm;
　__try{
　hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
　if (hscm == NULL)
　{
OutputString("OpenSCManager() error %d", rc = GetLastError() );
return rc;
　}
　char *svcname = DEFAULT_SERVICE;
　if(name && name[0]) svcname = name;
　schService = OpenService(hscm, svcname, DELETE);
　if (schService == NULL)
　{
OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );
return rc;
　}
　if (!DeleteService(schService) )
　{
OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );
return rc;
　}
　OutputString("DeleteService(%s) SUCCESS.", svcname);
　}__except(1)
　{
OutputString("Exception Catched 0x%X", GetExceptionCode());
　}
　CloseServiceHandle(schService);
　CloseServiceHandle(hscm);
　return rc;
}
/*
used to uninstall by rundll32.exe
Platform SDK: Tools - Rundll32
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:
*/
void CALLBACK RundllUninstallA(
HWND hwnd,// handle to owner window
HINSTANCE hinst, // instance handle for the DLL
char *param,// string the DLL will parse
int nCmdShow　 // show state
)
{
　UninstallService(param);
}
//output the debug infor into log file & DbgPrint
void OutputString( char *lpFmt, ... )
{
　char buff[1024];
　va_list　arglist;
　va_start( arglist, lpFmt );
　_vsnprintf( buff, sizeof buff, lpFmt, arglist );
　va_end( arglist );
　DWORD len;
　HANDLE herr = GetStdHandle(STD_OUTPUT_HANDLE);
　if(herr != INVALID_HANDLE_VALUE)
　{
WriteFile(herr, buff, strlen(buff), &len, NULL);
WriteFile(herr, "\r\n", 2, &len, NULL);
　}else
　{
FILE *fp = fopen("SvcHost.DLL.log", "a");
if(fp)
{
　char date[20], time[20];
　fprintf(fp, "%s %s - %s\n", _strdate(date), _strtime(time), buff);
　if(!stderr) fclose(fp);
}
　}
　OutputDebugString(buff);
}