sc 创建svchost服务_关闭svchost服务就断网_svchost是什么(3)

这个函数使用 svcTable 查询要启动的服务使用的DLL，调用DLL导出的ServiceMain()函数来启动服务，然后返回。; ============================== FuncServiceMain() ===========================================.text:01001504 FuncServiceMain proc near ; DATA XREF: PrepareSvcTable+44o.text:01001504.text:01001504 arg_0 = dword ptr8.text:01001504 arg_4 = dword ptr0Ch.text:01001504.text:01001504 pushecx.text:01001505 mov eax, [esp+arg_4].text:01001509 pushebx.text:0100150A pushebp.text:0100150B pushesi.text:0100150C mov ebx, offset unk_1003000.text:01001511 pushedi.text:01001512 mov edi, [eax].text:01001514 pushebx.text:01001515 xor ebp, ebp.text:01001517 callds:EnterCriticalSection.text:0100151D xor esi, esi.text:0100151F cmp dwGroupSize, esi.text:01001525 jbe short loc_1001566.text:01001527 and [esp+10h], esi.text:0100152B.text:0100152B loc_100152B:; CODE XREF: FuncServiceMain+4Aj.text:0100152B mov eax, svcTable.text:01001530 mov ecx, [esp+10h].text:01001534 pushdword ptr [eax+ecx].text:01001537 pushedi.text:01001538 callds:lstrcmpiW.text:0100153E testeax, eax.text:01001540 jzshort StartThis.text:01001542 add dword ptr [esp+10h], 0Ch.text:01001547 inc esi.text:01001548 cmp esi, dwGroupSize.text:0100154E jbshort loc_100152B.text:01001550 jmp short loc_1001566.text:01001552 ; =================================================.text:01001552.text:01001552 StartThis:; CODE XREF: FuncServiceMain+3Cj.text:01001552 mov ecx, svcTable.text:01001558 lea eax, [esi+esi*2].text:0100155B lea eax, [ecx+eax*4].text:0100155E pusheax.text:0100155F callGetDLLServiceMain.text:01001564 mov ebp, eax; dll ServiceMain Function address.text:01001566.text:01001566 loc_1001566:; CODE XREF: FuncServiceMain+21j.text:01001566 ; FuncServiceMain+4Cj.text:01001566 pushebx.text:01001567 callds:LeaveCriticalSection.text:0100156D testebp, ebp.text:0100156F jzshort loc_100157B.text:01001571 push[esp+10h+arg_4].text:01001575 push[esp+14h+arg_0].text:01001579 callebp.text:0100157B.text:0100157B loc_100157B:; CODE XREF: FuncServiceMain+6Bj.text:0100157B pop edi.text:0100157C pop esi.text:0100157D pop ebp.text:0100157E pop ebx.text:0100157F pop ecx.text:01001580 retn8.text:01001580 FuncServiceMain endp ; sp = -8; ============================== FuncServiceMain() end ========================================由于svchost已经调用了StartServiceCtrlDispatcher来服务调度函数，因此我们在实现DLL实现时就不用了，这主要是因为一个进程只能调用一次StartServiceCtrlDispatcher API。

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-45729-3.html