svchostdll_system svchost_svchost dll casn(7)

int InstallService(char *name);

//unInstall a Service, be CARE FOR call this to delete a service

int UninstallService(char *name);

//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call

void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);

//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service

void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);

//output the debug infor into log file(or stderr if

a console program call me) & DbgPrint

void OutputString( char *lpFmt, ... );

6. 代码使用

C:/>tlist -s

0 System Process

8 System

240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi

504 svchost.exe Svcs: RpcSs

1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv

C:/>rundll32 svchostdll.dll,RundllInstall abcd

SvcHostDLL: DllMain called DLL_PROCESS_ATTACH

you specify service name not in Svchost/netsvcs, must be one of following:

- EventSystem

- Ias

- Iprip

- Irmon

- Netman

- Nwsapagent

- Rasauto

- Rasman

- Remoteaccess

- SENS

- Sharedaccess

- Tapisrv

- Ntmssvc

- wzcsvc

C:/>rundll32 svchostdll.dll,RundllInstall IPRIP

SvcHostDLL: DllMain called DLL_PROCESS_ATTACH

CreateService(IPRIP) SUCCESS. Config it

Config service IPRIP ok.

C:/>sc start iprip "cmd /k whoami" 1

NT AUTHORITY/SYSTEM

SvcHostDLL: ServiceMain(3, IPRIP) called

SvcHostDLL: RealService called ''cmd /k whoami'' Interact

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-45628-7.html