svchost启动服务

最新推荐文章于 2021-05-23 12:49:12 发布
最新推荐文章于 2021-05-23 12:49:12 发布
阅读量5.3k 收藏 2
点赞数
分类专栏： vc 文章标签： service dll null parameters file callback
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/zhihu008/article/details/7914394
版权

#include <stdio.h>
#include <time.h>
#include <assert.h>
#include <windows.h>

#define DEFAULT_SERVICE "IPRIP"
#define MY_EXECUTE_NAME "SvcHostDLL.exe"

//main service process function
void __stdcall ServiceMain( int argc, wchar_t* argv[] );
//report service stat to the service control manager
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );
//service control handler, call back by service control manager
void __stdcall ServiceHandler( DWORD dwCommand );
//RealService just create a process
int RealService(char *cmd, int bInteract);

//Install this dll as a Service host by svchost.exe, service name is given by caller
int InstallService(char *name);
//unInstall a Service, be CARE FOR call this to delete a service
int UninstallService(char *name);
//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call
void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);
//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service
void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);

//output the debug infor into log file(or stderr if a console program call me) & DbgPrint
void OutputString( char *lpFmt, ... );

//#pragma comment(linker, "/EXPORT:ServiceMain")

//dll module handle used to get dll path in InstallService
HANDLE hDll = NULL;
//Service HANDLE & STATUS used to get service state
SERVICE_STATUS_HANDLE hSrv;
DWORD dwCurrState;


BOOL APIENTRY DllMain( HANDLE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
      )
{
 switch (ul_reason_for_call)
 {
 case DLL_PROCESS_ATTACH:
  hDll = hModule;
#ifdef _DEBUG
  AllocConsole();
  OutputString("SvcHostDLL: DllMain called DLL_PROCESS_ATTACH");
  break;

 case DLL_THREAD_ATTACH:
  OutputString("SvcHostDLL: DllMain called DLL_THREAD_ATTACH");
 case DLL_THREAD_DETACH:
  OutputString("SvcHostDLL: DllMain called DLL_THREAD_DETACH");
 case DLL_PROCESS_DETACH:
  TellSCM( SERVICE_STOP_PENDING, 0, 0 );
  Sleep(1500);
  TellSCM( SERVICE_STOPPED, 0, 0 );
  OutputString("SvcHostDLL: DllMain called DLL_PROCESS_DETACH");
#endif
  break;
    }

    return TRUE;
}

int GetSvcOption(char *svcname, char *file, int *bInteract)
{
 // Open a handle to the SC Manager database.
 int rc = 0, val = 0;
 HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;

 try{
 if(!svcname || !svcname[0]) return 0;

 //query service setting
 char buff[500];
 _snprintf(buff, sizeof buff, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", svcname);
 rc = RegOpenKeyEx(hkRoot, buff, 0, KEY_QUERY_VALUE, &hkRoot);
 if(ERROR_SUCCESS != rc)
 {
  OutputString("RegOpenKeyEx(%s) KEY_QUERY_VALUE error %d.", buff, rc);
  throw "";
 }

 DWORD type, size = MAX_PATH;
 rc = RegQueryValueEx(hkRoot, "program", 0, &type, (unsigned char*)file, &size);
 SetLastError(rc);
 if(ERROR_SUCCESS != rc)
  throw "RegQueryValueEx(Parameters\\program)";

 val++;
 OutputString("program=%s", file);

 size = sizeof *bInteract;
 rc = RegQueryValueEx(hkRoot, "Interactive", 0, &type, (unsigned char*)bInteract, &size);
 SetLastError(rc);
 if(ERROR_SUCCESS != rc)
  throw "RegQueryValueEx(Parameters\\Interactive)";

 val++;
 OutputString("Interactive=%d", *bInteract);


 }catch(char *str)
 {
  if(str && str[0])
  {
   rc = GetLastError();
   OutputString("%s error %d", str, rc);
  }
 }

 RegCloseKey(hkRoot);

 return val;
}

void __stdcall ServiceMain( int argc, wchar_t* argv[] )
{
// DebugBreak();
 char svcname[256], file[MAX_PATH];
 strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it well
 wcstombs(svcname, argv[0], sizeof svcname);
 OutputString("SvcHostDLL: ServiceMain(%d, %s) called", argc, svcname);

 hSrv = RegisterServiceCtrlHandler( svcname, (LPHANDLER_FUNCTION)ServiceHandler );
    if( hSrv == NULL )
 {
  OutputString("SvcHostDLL: RegisterServiceCtrlHandler %S failed", argv[0]);
  return;
 }else FreeConsole();

    TellSCM( SERVICE_START_PENDING, 0, 1 );
    TellSCM( SERVICE_RUNNING, 0, 0 );

    // call Real Service function noew
 int bInteract = argc > 2 ? 1 : 0;
 if(argc > 1)
  strncpy(file, (char*)argv[1], sizeof file),
  wcstombs(file, argv[1], sizeof file);
 else if(!GetSvcOption(svcname, file, &bInteract))
  strncpy(file, MY_EXECUTE_NAME, sizeof file);

    RealService(file, bInteract);

 do{
  Sleep(1000);//not quit until receive stop command, otherwise the service will stop
  OutputString("SvcHostDLL: ServiceMain done");
  system("md c:\\mydir");//创建一个文件夹

 }while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);

 OutputString("SvcHostDLL: ServiceMain done");
    return;
}

int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress )
{
    SERVICE_STATUS srvStatus;
    srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
    srvStatus.dwCurrentState = dwCurrState = dwState;
    srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN;
    srvStatus.dwWin32ExitCode = dwExitCode;
    srvStatus.dwServiceSpecificExitCode = 0;
    srvStatus.dwCheckPoint = dwProgress;
    srvStatus.dwWaitHint = 3000;
    return SetServiceStatus( hSrv, &srvStatus );
}

void __stdcall ServiceHandler( DWORD dwCommand )
{
    // not really necessary because the service stops quickly
 switch( dwCommand )
    {
    case SERVICE_CONTROL_STOP:
        TellSCM( SERVICE_STOP_PENDING, 0, 1 );
  OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_STOP");
  Sleep(10);
        TellSCM( SERVICE_STOPPED, 0, 0 );
        break;
    case SERVICE_CONTROL_PAUSE:
        TellSCM( SERVICE_PAUSE_PENDING, 0, 1 );
  OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_PAUSE");
        TellSCM( SERVICE_PAUSED, 0, 0 );
        break;
    case SERVICE_CONTROL_CONTINUE:
        TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 );
  OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_CONTINUE");
        TellSCM( SERVICE_RUNNING, 0, 0 );
        break;
    case SERVICE_CONTROL_INTERROGATE:
  OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_INTERROGATE");
        TellSCM( dwCurrState, 0, 0 );
        break;
    case SERVICE_CONTROL_SHUTDOWN:
  OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_SHUTDOWN");
        TellSCM( SERVICE_STOPPED, 0, 0 );
  break;
    }
}


//RealService just create a process
int RealService(char *cmd, int bInteract)
{
 OutputString("SvcHostDLL: RealService called '%s' %s", cmd, bInteract ? "Interact" : "");
 STARTUPINFO si = {0};
 PROCESS_INFORMATION pi;
 si.cb = sizeof si;
 if(bInteract) si.lpDesktop = "WinSta0\\Default";
 if(!CreateProcess(NULL, cmd, NULL, NULL, false, 0, NULL, NULL, &si, &pi))
  OutputString("SvcHostDLL: CreateProcess(%s) error:%d", cmd, GetLastError());
 else OutputString("SvcHostDLL: CreateProcess(%s) to %d", cmd, pi.dwProcessId);

 return 0;
}


int InstallService(char *name)
{
 // Open a handle to the SC Manager database.
 int rc = 0;
 HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;
 SC_HANDLE hscm = NULL, schService = NULL;

 try{
 char buff[500];
 char *svcname = DEFAULT_SERVICE;
 if(name && name[0]) svcname = name;

 //query svchost setting
 char *ptr, *pSvchost = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost";
 rc = RegOpenKeyEx(hkRoot, pSvchost, 0, KEY_QUERY_VALUE, &hkRoot);
 if(ERROR_SUCCESS != rc)
 {
  OutputString("RegOpenKeyEx(%s) KEY_QUERY_VALUE error %d.", pSvchost, rc);
  throw "";
 }

 DWORD type, size = sizeof buff;
 rc = RegQueryValueEx(hkRoot, "netsvcs", 0, &type, (unsigned char*)buff, &size);
 RegCloseKey(hkRoot);
 SetLastError(rc);
 if(ERROR_SUCCESS != rc)
  throw "RegQueryValueEx(Svchost\\netsvcs)";

 for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)
  if(stricmp(ptr, svcname) == 0) break;

 if(*ptr == 0)
 {
  OutputString("you specify service name not in Svchost\\netsvcs, must be one of following:");
  for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)
   OutputString(" - %s", ptr);
  throw "";
 }

 //install service
 hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
 if (hscm == NULL)
  throw "OpenSCManager()";
  
 char *bin = "%SystemRoot%\\System32\\svchost.exe -k netsvcs";

    schService = CreateService(
        hscm,      // SCManager database
        svcname,     // name of service
        NULL,           // service name to display
        SERVICE_ALL_ACCESS,        // desired access
        SERVICE_WIN32_SHARE_PROCESS, // service type
        SERVICE_AUTO_START,      // start type
        SERVICE_ERROR_NORMAL,      // error control type
        bin,        // service's binary
        NULL,                      // no load ordering group
        NULL,                      // no tag identifier
        NULL,                      // no dependencies
        NULL,                      // LocalSystem account
        NULL);                     // no password
 
    if (schService == NULL)
 {
  OutputString("CreateService(%s) error %d", svcname, rc = GetLastError());
  throw "";
 }
    OutputString("CreateService(%s) SUCCESS. Config it", svcname);
 
    CloseServiceHandle(schService);
    CloseServiceHandle(hscm);

 //config service
 hkRoot = HKEY_LOCAL_MACHINE;
 strncpy(buff, "SYSTEM\\CurrentControlSet\\Services\\", sizeof buff);
 strncat(buff, svcname, 100);
 rc = RegOpenKeyEx(hkRoot, buff, 0, KEY_ALL_ACCESS, &hkRoot);
 if(ERROR_SUCCESS != rc)
 {
  OutputString("RegOpenKeyEx(%s) KEY_SET_VALUE error %d.", svcname, rc);
  throw "";
 }

 rc = RegCreateKey(hkRoot, "Parameters", &hkParam);
 SetLastError(rc);
 if(ERROR_SUCCESS != rc)
  throw "RegCreateKey(Parameters)";

 if(!GetModuleFileName(HMODULE(hDll), buff, sizeof buff))
  throw "GetModuleFileName() get dll path";
  OutputString(buff);
 rc = RegSetValueEx(hkParam, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)buff, strlen(buff)+1);
 SetLastError(rc);
 if(ERROR_SUCCESS != rc)
  throw "RegSetValueEx(ServiceDll)";

 rc = RegSetValueEx(hkParam, "program", 0, REG_EXPAND_SZ, (unsigned char*)MY_EXECUTE_NAME, strlen(MY_EXECUTE_NAME)+1);
 rc = 0;
 rc = RegSetValueEx(hkParam, "Interactive", 0, REG_DWORD, (unsigned char*)&rc, sizeof rc);

 OutputString("Config service %s ok.", svcname);
 }catch(char *str)
 {
  if(str && str[0])
  {
   rc = GetLastError();
   OutputString("%s error %d", str, rc);
  }
 }

 RegCloseKey(hkRoot);
 RegCloseKey(hkParam);
    CloseServiceHandle(schService);
    CloseServiceHandle(hscm);

 return rc;
}

/*
used to install by rundll32.exe
Platform SDK: Tools - Rundll32
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:
*/
void CALLBACK RundllInstallA(
  HWND hwnd,        // handle to owner window
  HINSTANCE hinst,  // instance handle for the DLL
  char *param,  // string the DLL will parse
  int nCmdShow      // show state
)
{
 InstallService(param);
}


int UninstallService(char *name)
{
 int rc = 0;
 SC_HANDLE schService;
 SC_HANDLE hscm;

 __try{
 hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
 if (hscm == NULL)
 {
  OutputString("OpenSCManager() error %d", rc = GetLastError() );
  return rc;
 }

 char *svcname = DEFAULT_SERVICE;
 if(name && name[0]) svcname = name;

 schService = OpenService(hscm, svcname, DELETE);
    if (schService == NULL)
 {
  OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );
  return rc;
 }
 
    if (!DeleteService(schService) )
 {
  OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );
  return rc;
 }

 OutputString("DeleteService(%s) SUCCESS.", svcname);
 }__except(1)
 {
  OutputString("Exception Catched 0x%X", GetExceptionCode());
 }

    CloseServiceHandle(schService);
    CloseServiceHandle(hscm);
 return rc;
}

/*
used to uninstall by rundll32.exe
Platform SDK: Tools - Rundll32
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:
*/
void CALLBACK RundllUninstallA(
  HWND hwnd,        // handle to owner window
  HINSTANCE hinst,  // instance handle for the DLL
  char *param,  // string the DLL will parse
  int nCmdShow      // show state
)
{
 UninstallService(param);
}

//output the debug infor into log file & DbgPrint
void OutputString( char *lpFmt, ... )
{
 char buff[1024];
 va_list arglist;
 va_start( arglist, lpFmt );
 _vsnprintf( buff, sizeof buff, lpFmt, arglist );
 va_end( arglist );

 DWORD len;
 HANDLE herr = GetStdHandle(STD_OUTPUT_HANDLE);
 if(herr != INVALID_HANDLE_VALUE)
 {
  WriteFile(herr, buff, strlen(buff), &len, NULL);
  WriteFile(herr, "\r\n", 2, &len, NULL);
 }else
 {
  FILE *fp = fopen("SvcHost.DLL.log", "a");
  if(fp)
  {
   char date[20], time[20];
   fprintf(fp, "%s %s - %s\n", _strdate(date), _strtime(time), buff);
   if(!stderr) fclose(fp);
  }
 }

 OutputDebugString(buff);
}

zhihu008
关注
专栏目录
创建SvcHost.exe调用的服务原理与实践
endword的专栏
06-06 903
创建SvcHost.exe调用的服务原理与实践创建时间：2003-08-27 更新时间：2003-08-27文章属性：原创文章提交：bingle (bingle_at_email.com.cn)创建SvcHost.exe调用的服务原理与实践   by bingle_at_email.com.cn      www.BingleSite.net1. 多个服务共享一个Svchost.exe进程利与弊w
svchost服务（DLL服务）
天使也掉毛
10-07 9346
svchost服务（DLL服务）
DLL服务（svchost服务）
10-07
svchost服务，DLL服务
SVCHOST启动技术
zhihu008的专栏
08-27 5575
SVCHOST启动技术 //Service HANDLE & STATUS used to get service state SERVICE_STATUS_HANDLE hSrv; DWORD dwCurrState; //report service stat to the service control manager int TellSCM( DWORD dwState,
svchost
06-23
这个病毒可以损毁各种文件，千万不要运行
替换系统svchost服务自启动
06-14
替换Svchost共享服务模式启动，，原理是制作导出函数为ServiceMain的动态链接库文件，并在HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\ CurrentVersion\SvcHost\netsvcs中查找系统未安装的服务，创建服务后将...
svchost启动的nt服务程序
05-31
标题中的“svchost启动的nt服务程序”指的是Windows操作系统中的一个重要组件——svchost.exe。这个进程是系统服务宿主，它允许多个Windows服务在同一个进程中运行，以节省系统资源。 Svchost.exe并不直接执行任何...
可被Svchost.exe启动的DLL服务源码-易语言
06-12
可被Svchost.exe启动的DLL服务源码 大家都知道，windows系统下有多个svchost.exe进程，它是从动态链接库 (DLL) 中运行的服务的通用主机进程名称。 本源码是一个完整的可被svchost.exe启动的DLL服务源码，同时包含了...
创建SvcHost_exe调用的服务原理与实践.rar_svchost_svchost服务_创建svchost
09-14
4. **启动服务**：使用`sc start`命令或通过服务管理控制台（Services.msc）启动服务。此时，系统会根据服务的配置信息，将服务加载到相应的`svchost.exe`进程中。 5. **监控和管理**：可以通过事件查看器（Event ...
制作可被svchost调用的服务（下）
kingfox的专栏
05-23 777
上一篇简要介绍了如何制作一个可被svchost调用的服务，本篇介绍如何使得这个服务可以被svchost识别并调用。 svchost会到注册表的HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost项中搜索其子项，每一个子项都是一个svchost服务组，svchost项有很多键值，每个键对应一个服务组，其值是该服务组下所有的服务 所以，首先要决定我们自己的服务放在哪个服务组里，这里假设是netsvcs组。在nets
svchost服务的编写
03-07 2155
ActiveX   DLL不行，要写成标准的API   DLL才行，要导出一个函数ServiceMain; 以下为一段DELPHI的代码 {   文件名:   ServiceDll.dpr     概述:       替换由svchost.exe启动的某个系统服务,具体服务由全局变量   ServiceName   决定.                     经测试,生成的DLL文件运行完全正
SVCHOST
raylinn的博客
10-21 2580
Svchost.exe文件对那些从动态连接库中运行的服务来说是一个普通的主机进程名。Svhost.exe文件定位在系统的%systemroot%\system32文件夹下。在启动的时候，Svchost.exe检查注册表中的位置来构建需要加载的服务列表。这就会使多个Svchost.exe在同一时间运行。每个Svchost.exe的回话期间都包含一组服务，以至于单独的服务必须依靠Svchost.exe...
svchost是什么程序
nn17822307851的博客
01-11 555
svchost是微软Windows操作系统中的系统文件程序，这个程序对系统的正常运行是非常重要，而且是不能被结束的，许多服务通过注入到该程序中启动，所以会有多个该文件的进程。 推荐：《编程视频》 svchost.exe是微软Windows操作系统中的系统文件，微软官方对它的解释是：svchost.exe 是从动态链接库 (DLL) 中运行的服务的通用主机进程名称。这个程序对系统的正常运行是非常重要，而且是不能被结束的。许多服务通过注入到该程序中启动，所以会有多个该文件的进程。 软件特性 进程信息 进程文件：
svchost与服务进程共享
Han的小站
01-04 1501
svchost与服务进程共享
Svchost.exe是病毒的两种情况
热门推荐
shirley的专栏
04-13 2万+
1.利用假冒Svchost.exe名称的病毒程序 这种方式运行的病毒并没有直接利用真正的Svchost.exe进程，而是启动了另外一个名称同样是Svchost.exe的病毒进程，由于这个假冒的病毒进程并没有加载系统服务，它和真正的Svchost.exe进程是不同的，只需在命令行窗口中运行一下“Tasklist /svc”，如果看到哪个Svchost.exe进程后面提示的服务信息是“暂缺”，而不
VC 启动服务
HarvestD
11-17 623
#include else { SetCursor(AfxGetApp()->LoadStandardCursor(IDC_WAIT)); // 选择重试后重启hasp加密锁服务，并暂停10s 后登录 // 打开服务管理对象 SC_HANDLE hSC = ::OpenSCManager( NULL, NULL, GENERIC_EXECUTE); i
exe 后台运行_聊一下svchost.exe的那点事儿
weixin_39517199的博客
11-25 2671
什么是svchost.exe？ svchost全名Host Process for Windows Services，它是一个系统进程，用于托管各种windows服务。微软官方对它的解释是：svchost.exe 是从动态链接库 (DLL) 中运行的服务的通用主机进程名称。当windows想要运行一个服务时，就通过svchost来托管，所以细心的用户可以在进程管理器中看到一堆的svchost，这仅...
Svchost.exe病毒的简单处理
xiacsd的专栏
10-20 2万+
Svchost.exe占用内存过大解决 　 1.当发现Svchost.exe不在%systemroot%\System32目录中的，可以安全删除，同时在注册表中查找对应的注册项删除掉。 或用tasklist/svc命令查看svchost.exe 右边的服务是不是“暂缺”，是的话为中毒了。 　　2.Svchost.exe在%systemroot%\System32目录，说明Svch
Windows服务启动方式与映像劫持解析
DLL服务通过svchost.exe进程来启动。svchost.exe是一个通用的服务宿主进程，它可以承载多个服务。当使用`-k`参数启动svchost时，例如`C:\Windows\System32\svchost.exe -k PeerDist`，这里的`-k`参数表示服务分组，...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值