svchostdll_system svchost_svchost dll casn(3)

.text:01001101 mov esi, eax

.text:01001103 test esi, esi

.text:01001105 jz short lab_doservice

.text:01001107 push esi

.text:01001108 call SvcHostOptions

.text:0100110D call PrepareSvcTable

.text:01001112 mov edi, eax ; SERVICE_TABLE_ENTRY returned

.text:01001114 test edi, edi

.text:01001116 jz short loc_1001128

.text:01001118 mov eax, [esi10h]

.text:0100111B test eax, eax

.text:0100111D jz short loc_1001128

.text:0100111F push dword ptr [esi14h] ; dwCapabilities

.text:01001122 push eax ; int

.text:01001123 call InitializeSecurity

.text:01001128

.text:01001128 loc_1001128: ; CODE XREF: start5Ej

.text:01001128 ; start65j

.text:01001128 push esi ; lpMem

.text:01001129 call HeapFreeMem

.text:0100112E

.text:0100112E lab_doservice: ; CODE XREF: start4Dj

.text:0100112E test edi, edi

.text:01001130 jz ExitProgram

.text:01001136 push edi ; lpServiceStartTable

.text:01001137 call ds:StartServiceCtrlDispatcherW

.text:0100113D jmp ExitProgram

.text:0100113D start endp

; =============================== Main Funcion end ===========================================

由于svchost为该组的所有服务都注册了svchost中的一个处理函数，因此每次启动任何一个服务时，服务管理器SCM都会调用FuncServiceMain() 这个函数。这个函数使用 svcTable 查询要启动的服务使用的DLL，调用DLL导出的ServiceMain()函数来启动服务，然后返回。

; ============================== FuncServiceMain() ===========================================

.text:01001504 FuncServiceMain proc near ; DATA XREF: PrepareSvcTable44o

.text:01001504

.text:01001504 arg_0 = dword ptr 8

.text:01001504 arg_4 = dword ptr 0Ch

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-45628-3.html