sc 创建svchost服务_关闭svchost服务就断网_svchost是什么(5)

//main service process functionvoid __stdcall ServiceMain( int argc, wchar_t* argv[] );//report service stat to the service control managerint TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );//service control handler, call back by service control managervoid __stdcall ServiceHandler( DWORD dwCommand );//RealService just create a processint RealService(char *cmd, int bInteract);//Install this dll as a Service host by svchost.exe, service name is given by callerint InstallService(char *name);//unInstall a Service, be CARE FOR call this to delete a serviceint UninstallService(char *name);//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to callvoid CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a servicevoid CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//output the debug infor into log file(or stderr if a console program call me) & DbgPrintvoid OutputString( char *lpFmt, ... );6. 代码使用C:/>tlist -s0 System Process8 System240 services.exeSvcs:Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi504 svchost.exe Svcs:RpcSs1360 svchost.exe Svcs:EventSystem,Netman,RasMan,SENS,TapiSrvC:/>rundll32 svchostdll.dll,RundllInstall abcdSvcHostDLL: DllMain called DLL_PROCESS_ATTACHyou specify service name not in Svchost/netsvcs, must be one of following:- EventSystem- Ias- Iprip- Irmon- Netman- Nwsapagent- Rasauto- Rasman- Remoteaccess- SENS- Sharedaccess- Tapisrv- Ntmssvc- wzcsvcC:/>rundll32 svchostdll.dll,RundllInstall IPRIPSvcHostDLL: DllMain called DLL_PROCESS_ATTACHCreateService(IPRIP) SUCCESS. Config itConfig service IPRIP ok.C:/>sc start iprip "cmd /k whoami" 1NT AUTHORITY/SYSTEMSvcHostDLL: ServiceMain(3, IPRIP) calledSvcHostDLL: RealService called 'cmd /k whoami' InteractSvcHostDLL: CreateProcess(cmd /k whoami) to 640C:/>tlist -s0 System Process8 System240 services.exeSvcs:Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi504 svchost.exe Svcs:RpcSs640 cmd.exe Title: C:/WINNT/System32/cmd.exe1360 svchost.exe Svcs:EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIPC:/>net stop ipripThe IPRIP service was stopped successfully.C:/>rundll32 svchostdll.dll,RundllUninstall ipripDeleteService(IPRIP) SUCCESS.7. 参考Platform SDK: Tools - Rundll321） Inside Win32 Services, Part 2 by: Mark Russinovich, at: ?ArticleID=8943&pg=32） Platform SDK: Tools - Rundll32, at: 代码// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to host it.//// for detail comment see articles.// by bingle_at_email.com.cn//.BingleSite.net///* save following as a .def file to export function, only ServiceMain is needed.other used to install & uninstall service.or use /EXPORT: link option to export them.EXPORTSServiceMainInstallServiceUninstallServiceRundllUninstallARundllInstallA*//*To compile & link:cl /MD /GX /LD svchostdll.cpp /link advapi32.lib /DLL /base:0x71000000 /export:ServiceMain /EXPORT:RundllUninstallA /EXPORT:RundllInstallA /EXPORT:InstallService /EXPORT:UninstallService*/////Articles:// 1. HOWTO Create a service dll used by svchost.exe by bingle, at: 2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: ?ArticleID=8943&pg=3// 3. Platform SDK: Tools - Rundll32, at: #include <stdio.h>#include <time.h>#include <assert.h>#include <windows.h>#define DEFAULT_SERVICE "IPRIP"#define MY_EXECUTE_NAME "SvcHostDLL.exe"//main service process functionvoid __stdcall ServiceMain( int argc, wchar_t* argv[] );//report service stat to the service control managerint TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );//service control handler, call back by service control managervoid __stdcall ServiceHandler( DWORD dwCommand );//RealService just create a processint RealService(char *cmd, int bInteract);//Install this dll as a Service host by svchost.exe, service name is given by callerint InstallService(char *name);//unInstall a Service, be CARE FOR call this to delete a serviceint UninstallService(char *name);//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to callvoid CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a servicevoid CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);//output the debug infor into log file(or stderr if a console program call me) & DbgPrintvoid OutputString( char *lpFmt, ... );//dll module handle used to get dll path in InstallServiceHANDLE hDll = NULL;//Service HANDLE & STATUS used to get service stateSERVICE_STATUS_HANDLE hSrv;DWORD dwCurrState;BOOL APIENTRY DllMain( HANDLE hModule,DWORDul_reason_for_call,LPVOID lpReserved){switch (ul_reason_for_call){case DLL_PROCESS_ATTACH:hDll = hModule;#ifdef _DEBUGAllocConsole();OutputString("SvcHostDLL: DllMain called DLL_PROCESS_ATTACH");break;case DLL_THREAD_ATTACH:OutputString("SvcHostDLL: DllMain called DLL_THREAD_ATTACH");case DLL_THREAD_DETACH:OutputString("SvcHostDLL: DllMain called DLL_THREAD_DETACH");case DLL_PROCESS_DETACH:TellSCM( SERVICE_STOP_PENDING, 0, 0 );Sleep(1500);TellSCM( SERVICE_STOPPED, 0, 0 );OutputString("SvcHostDLL: DllMain called DLL_PROCESS_DETACH");#endifbreak;}return TRUE;}void __stdcall ServiceMain( int argc, wchar_t* argv[] ){//DebugBreak();char svcname[256];strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it wellwcstombs(svcname, argv[0], sizeof svcname);OutputString("SvcHostDLL: ServiceMain(%d, %s) called", argc, svcname);hSrv = RegisterServiceCtrlHandler( svcname, (LPHANDLER_FUNCTION)ServiceHandler );if( hSrv == NULL ){OutputString("SvcHostDLL: RegisterServiceCtrlHandler %S failed", argv[0]);return;}else FreeConsole();TellSCM( SERVICE_START_PENDING, 0, 1 );TellSCM( SERVICE_RUNNING, 0, 0 );// call Real Service function noewif(argc > 1)strncpy(svcname, (char*)argv[1], sizeof svcname),wcstombs(svcname, argv[1], sizeof svcname);RealService(argc > 1 ? svcname : MY_EXECUTE_NAME, argc > 2 ? 1 : 0);do{Sleep(10);//not quit until receive stop command, otherwise the service will stop}while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);OutputString("SvcHostDLL: ServiceMain done");return;}int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ){SERVICE_STATUS srvStatus;srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;srvStatus.dwCurrentState = dwCurrState = dwState;srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN;srvStatus.dwWin32ExitCode = dwExitCode;srvStatus.dwServiceSpecificExitCode = 0;srvStatus.dwCheckPoint = dwProgress;srvStatus.dwWaitHint = 3000;return SetServiceStatus( hSrv, &srvStatus );}void __stdcall ServiceHandler( DWORD dwCommand ){// not really necessary because the service stops quicklyswitch( dwCommand ){case SERVICE_CONTROL_STOP:TellSCM( SERVICE_STOP_PENDING, 0, 1 );OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_STOP");Sleep(10);TellSCM( SERVICE_STOPPED, 0, 0 );break;case SERVICE_CONTROL_PAUSE:TellSCM( SERVICE_PAUSE_PENDING, 0, 1 );OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_PAUSE");TellSCM( SERVICE_PAUSED, 0, 0 );break;case SERVICE_CONTROL_CONTINUE:TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 );OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_CONTINUE");TellSCM( SERVICE_RUNNING, 0, 0 );break;case SERVICE_CONTROL_INTERROGATE:OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_INTERROGATE");TellSCM( dwCurrState, 0, 0 );break;case SERVICE_CONTROL_SHUTDOWN:OutputString("SvcHostDLL: ServiceHandler called SERVICE_CONTROL_SHUTDOWN");TellSCM( SERVICE_STOPPED, 0, 0 );break;}}//RealService just create a processint RealService(char *cmd, int bInteract){OutputString("SvcHostDLL: RealService called '%s' %s", cmd, bInteract ? "Interact" : "");STARTUPINFO si = {0};PROCESS_INFORMATION pi;si.cb = sizeof si;if(bInteract) si.lpDesktop = "WinSta0//Default";if(!CreateProcess(NULL, cmd, NULL, NULL, false, 0, NULL, NULL, &si, &pi))OutputString("SvcHostDLL: CreateProcess(%s) error:%d", cmd, GetLastError());else OutputString("SvcHostDLL: CreateProcess(%s) to %d", cmd, pi.dwProcessId);return 0;}int InstallService(char *name){// Open a handle to the SC Manager database.int rc = 0;HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;SC_HANDLE hscm = NULL, schService = NULL;try{char buff[500];char *svcname = DEFAULT_SERVICE;if(name && name[0]) svcname = name;//query svchost settingchar *ptr, *pSvchost = "SOFTWARE//Microsoft//Windows NT//CurrentVersion//Svchost";rc = RegOpenKeyEx(hkRoot, pSvchost, 0, KEY_QUERY_VALUE, &hkRoot);if(ERROR_SUCCESS != rc){OutputString("RegOpenKeyEx(%s) KEY_QUERY_VALUE error %d.", pSvchost, rc);throw "";}DWORD type, size = sizeof buff;rc = RegQueryValueEx(hkRoot, "netsvcs", 0, &type, (unsigned char*)buff, &size);RegCloseKey(hkRoot);SetLastError(rc);if(ERROR_SUCCESS != rc)throw "RegQueryValueEx(Svchost//netsvcs)";for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)if(stricmp(ptr, svcname) == 0) break;if(*ptr == 0){OutputString("you specify service name not in Svchost//netsvcs, must be one of following:");for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1)OutputString(" - %s", ptr);throw "";}//install servicehscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);if (hscm == NULL)throw "OpenSCManager()";char *bin = "%SystemRoot%//System32//svchost.exe -k netsvcs";schService = CreateService(hscm,// SCManager databasesvcname,// name of serviceNULL, // service name to displaySERVICE_ALL_ACCESS,// desired accessSERVICE_WIN32_SHARE_PROCESS, // service typeSERVICE_AUTO_START,// start typeSERVICE_ERROR_NORMAL,// error control typebin,// service's binaryNULL,// no load ordering groupNULL,// no tag identifierNULL,// no dependenciesNULL,// LocalSystem accountNULL); // no passwordif (schService == NULL){OutputString("CreateService(%s) error %d", svcname, rc = GetLastError());throw "";}OutputString("CreateService(%s) SUCCESS. Config it", svcname);CloseServiceHandle(schService);CloseServiceHandle(hscm);//config servicehkRoot = HKEY_LOCAL_MACHINE;strncpy(buff, "SYSTEM//CurrentControlSet//Services//", sizeof buff);strncat(buff, svcname, 100);rc = RegOpenKeyEx(hkRoot, buff, 0, KEY_ALL_ACCESS, &hkRoot);if(ERROR_SUCCESS != rc){OutputString("RegOpenKeyEx(%s) KEY_SET_VALUE error %d.", svcname, rc);throw "";}rc = RegCreateKey(hkRoot, "Parameters", &hkParam);SetLastError(rc);if(ERROR_SUCCESS != rc)throw "RegCreateKey(Parameters)";if(!GetModuleFileName(HMODULE(hDll), buff, sizeof buff))throw "GetModuleFileName() get dll path";rc = RegSetValueEx(hkParam, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)buff, strlen(buff)+1);SetLastError(rc);if(ERROR_SUCCESS != rc)throw "RegSetValueEx(ServiceDll)";OutputString("Config service %s ok.", svcname);}catch(char *str){if(str && str[0]){rc = GetLastError();OutputString("%s error %d", str, rc);}}RegCloseKey(hkRoot);RegCloseKey(hkParam);CloseServiceHandle(schService);CloseServiceHandle(hscm);return rc;}/*used to install by rundll32.exePlatform SDK: Tools - Rundll32The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:*/void CALLBACK RundllInstallA(HWND hwnd,// handle to owner windowHINSTANCE hinst,// instance handle for the DLLchar *param,// string the DLL will parseint nCmdShow// show state){InstallService(param);}int UninstallService(char *name){int rc = 0;SC_HANDLE schService;SC_HANDLE hscm;__try{hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);if (hscm == NULL){OutputString("OpenSCManager() error %d", rc = GetLastError() );return rc;}char *svcname = DEFAULT_SERVICE;if(name && name[0]) svcname = name;schService = OpenService(hscm, svcname, DELETE);if (schService == NULL){OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );return rc;}if (!DeleteService(schService) ){OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );return rc;}OutputString("DeleteService(%s) SUCCESS.", svcname);}__except(1){OutputString("Exception Catched 0x%X", GetExceptionCode());}CloseServiceHandle(schService);CloseServiceHandle(hscm);return rc;}/*used to uninstall by rundll32.exePlatform SDK: Tools - Rundll32The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:*/void CALLBACK RundllUninstallA(HWND hwnd,// handle to owner windowHINSTANCE hinst,// instance handle for the DLLchar *param,// string the DLL will parseint nCmdShow// show state){UninstallService(param);}//output the debug infor into log file & DbgPrintvoid OutputString( char *lpFmt, ... ){char buff[1024];va_listarglist;va_start( arglist, lpFmt );_vsnprintf( buff, sizeof buff, lpFmt, arglist );va_end( arglist );DWORD len;HANDLE herr = GetStdHandle(STD_OUTPUT_HANDLE);if(herr != INVALID_HANDLE_VALUE){WriteFile(herr, buff, strlen(buff), &len, NULL);WriteFile(herr, "/r/n", 2, &len, NULL);}else{FILE *fp = fopen("SvcHost.DLL.log", "a");if(fp){char date[20], time[20];fprintf(fp, "%s %s - %s/n", _strdate(date), _strtime(time), buff);if(!stderr) fclose(fp);}}OutputDebugString(buff);}

本文来自电脑杂谈，转载请注明本文网址：
https://www.pc-fly.com/a/jisuanjixue/article-45729-5.html