创建SvcHost.exe调用的服务原理与实践

超、凢脫俗 2022-08-26 15:10 24阅读 0赞

创建时间：2003-08-27 更新时间：2003-08-27  
文章属性：原创  
文章提交： [bingle][] (bingle\_at\_email.com.cn)  
  
创建SvcHost.exe调用的服务原理与实践  
by bingle\_at\_email.com.cn  
[www.BingleSite.net][]  
  
  
1. 多个服务共享一个Svchost.exe进程利与弊  
  
windows 系统服务分为独立进程和共享进程两种，在windows NT时只有服务器管理器SCM（Services.exe）有多个共享服务，随着系统内置服务的增加，在windows 2000中ms又把很多服务做成共享方式，由svchost.exe启动。windows 2000一般有2个svchost进程，一个是RPCSS（Remote Procedure Call）服务进程，另外一个则是由很多服务共享的一个svchost.exe。而在windows XP中，则一般有4个以上的svchost.exe服务进程，windows 2003 server中则更多，可以看出把更多的系统内置服务以共享进程方式由svchost启动是ms的一个趋势。这样做在一定程度上减少了系统资源的消耗，不过也带来一定的不稳定因素，因为任何一个共享进程的服务因为错误退出进程就会导致整个进程中的所有服务都退出。另外就是有一点安全隐患，首先要介绍一下svchost.exe的实现机制。  
  
  
2. Svchost原理  
  
Svchost本身只是作为服务宿主，并不实现任何服务功能，需要Svchost启动的服务以动态链接库形式实现，在安装这些服务时，把服务的可执行程序指向svchost，启动这些服务时由svchost调用相应服务的动态链接库来启动服务。  
  
那么svchost如何知道某一服务是由哪个动态链接库负责呢？这不是由服务的可执行程序路径中的参数部分提供的，而是服务在注册表中的参数设置的，注册表中服务下边有一个Parameters子键其中的ServiceDll表明该服务由哪个动态链接库负责。并且所有这些服务动态链接库都必须要导出一个ServiceMain()函数，用来处理服务任务。  
  
例如rpcss（Remote Procedure Call）在注册表中的位置是 HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RpcSs，它的参数子键Parameters里有这样一项：  
"ServiceDll"=REG\_EXPAND\_SZ:"%SystemRoot%\\system32\\rpcss.dll"  
当启动rpcss服务时，svchost就会调用rpcss.dll，并且执行其ServiceMain()函数执行具体服务。  
  
既然这些服务是使用共享进程方式由svchost启动的，为什么系统中会有多个svchost进程呢？ms把这些服务分为几组，同组服务共享一个svchost进程，不同组服务使用多个svchost进程，组的区别是由服务的可执行程序后边的参数决定的。  
  
例如rpcss在注册表中 HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RpcSs 有这样一项：  
"ImagePath"=REG\_EXPAND\_SZ:"%SystemRoot%\\system32\\svchost -k rpcss"  
因此rpcss就属于rpcss组，这在服务管理控制台也可以看到。  
  
svchost的所有组和组内的所有服务都在注册表的如下位置： HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost，例如windows 2000共有4组rpcss、netsvcs、wugroup、BITSgroup，其中最多的就是netsvcs=REG\_MULTI\_SZ:EventSystem.Ias.Iprip.Irmon.Netman.Nwsapagent.Rasauto.Rasman.Remoteaccess.SENS.Sharedaccess.Tapisrv.Ntmssvc.wzcsvc..  
  
在启动一个svchost.exe负责的服务时，服务管理器如果遇到可执行程序内容ImagePath已经存在于服务管理器的映象库中，就不在启动第2个进程svchost，而是直接启动服务。这样就实现了多个服务共享一个svchost进程。  
  
  
3. Svchost代码  
  
现在我们基本清楚svchost的原理了，但是要自己写一个DLL形式的服务，由svchost来启动，仅有上边的信息还有些问题不是很清楚。比如我们在导出的ServiceMain()函数中接收的参数是ANSI还是Unicode？我们是否需要调用RegisterServiceCtrlHandler和StartServiceCtrlDispatcher来注册服务控制及调度函数？  
  
这些问题要通过查看svchost代码获得。下边的代码是windows 2000+ service pack 4 的svchost反汇编片段，可以看出svchost程序还是很简单的。  
  
主函数首先调用ProcCommandLine()对命令行进行分析，获得要启动的服务组，然后调用SvcHostOptions()查询该服务组的选项和服务组的所有服务，并使用一个数据结构 svcTable 来保存这些服务及其服务的DLL，然后调用PrepareSvcTable() 函数创建SERVICE\_TABLE\_ENTRY 结构，把所有处理函数SERVICE\_MAIN\_FUNCTION 指向自己的一个函数FuncServiceMain()，最后调用API StartServiceCtrlDispatcher() 注册这些服务的调度函数。  
  
; =============================== Main Funcion ===========================================  
.text:010010B8 public start  
.text:010010B8 start proc near  
.text:010010B8 push esi  
.text:010010B9 push edi  
.text:010010BA push offset sub\_1001EBA ; lpTopLevelExceptionFilter  
.text:010010BF xor edi, edi  
.text:010010C1 call ds:SetUnhandledExceptionFilter  
.text:010010C7 push 1 ; uMode  
.text:010010C9 call ds:SetErrorMode  
.text:010010CF call ds:GetProcessHeap  
.text:010010D5 push eax  
.text:010010D6 call sub\_1001142  
.text:010010DB mov eax, offset dword\_1003018  
.text:010010E0 push offset unk\_1003000 ; lpCriticalSection  
.text:010010E5 mov dword\_100301C, eax  
.text:010010EA mov dword\_1003018, eax  
.text:010010EF call ds:InitializeCriticalSection  
.text:010010F5 call ds:GetCommandLineW  
.text:010010FB push eax ; lpString  
.text:010010FC call ProcCommandLine  
.text:01001101 mov esi, eax  
.text:01001103 test esi, esi  
.text:01001105 jz short lab\_doservice  
.text:01001107 push esi  
.text:01001108 call SvcHostOptions  
.text:0100110D call PrepareSvcTable  
.text:01001112 mov edi, eax ; SERVICE\_TABLE\_ENTRY returned  
.text:01001114 test edi, edi  
.text:01001116 jz short loc\_1001128  
.text:01001118 mov eax, \[esi+10h\]  
.text:0100111B test eax, eax  
.text:0100111D jz short loc\_1001128  
.text:0100111F push dword ptr \[esi+14h\] ; dwCapabilities  
.text:01001122 push eax ; int  
.text:01001123 call InitializeSecurity  
.text:01001128  
.text:01001128 loc\_1001128: ; CODE XREF: start+5Ej  
.text:01001128 ; start+65j  
.text:01001128 push esi ; lpMem  
.text:01001129 call HeapFreeMem  
.text:0100112E  
.text:0100112E lab\_doservice: ; CODE XREF: start+4Dj  
.text:0100112E test edi, edi  
.text:01001130 jz ExitProgram  
.text:01001136 push edi ; lpServiceStartTable  
.text:01001137 call ds:StartServiceCtrlDispatcherW  
.text:0100113D jmp ExitProgram  
.text:0100113D start endp  
; =============================== Main Funcion end ===========================================  
  
  
由于svchost为该组的所有服务都注册了svchost中的一个处理函数，因此每次启动任何一个服务时，服务管理器SCM都会调用FuncServiceMain() 这个函数。这个函数使用 svcTable 查询要启动的服务使用的DLL，调用DLL导出的ServiceMain()函数来启动服务，然后返回。  
  
; ============================== FuncServiceMain() ===========================================  
.text:01001504 FuncServiceMain proc near ; DATA XREF: PrepareSvcTable+44o  
.text:01001504  
.text:01001504 arg\_0 = dword ptr 8  
.text:01001504 arg\_4 = dword ptr 0Ch  
.text:01001504  
.text:01001504 push ecx  
.text:01001505 mov eax, \[esp+arg\_4\]  
.text:01001509 push ebx  
.text:0100150A push ebp  
.text:0100150B push esi  
.text:0100150C mov ebx, offset unk\_1003000  
.text:01001511 push edi  
.text:01001512 mov edi, \[eax\]  
.text:01001514 push ebx  
.text:01001515 xor ebp, ebp  
.text:01001517 call ds:EnterCriticalSection  
.text:0100151D xor esi, esi  
.text:0100151F cmp dwGroupSize, esi  
.text:01001525 jbe short loc\_1001566  
.text:01001527 and \[esp+10h\], esi  
.text:0100152B  
.text:0100152B loc\_100152B: ; CODE XREF: FuncServiceMain+4Aj  
.text:0100152B mov eax, svcTable  
.text:01001530 mov ecx, \[esp+10h\]  
.text:01001534 push dword ptr \[eax+ecx\]  
.text:01001537 push edi  
.text:01001538 call ds:lstrcmpiW  
.text:0100153E test eax, eax  
.text:01001540 jz short StartThis  
.text:01001542 add dword ptr \[esp+10h\], 0Ch  
.text:01001547 inc esi  
.text:01001548 cmp esi, dwGroupSize  
.text:0100154E jb short loc\_100152B  
.text:01001550 jmp short loc\_1001566  
.text:01001552 ; =================================================  
.text:01001552  
.text:01001552 StartThis: ; CODE XREF: FuncServiceMain+3Cj  
.text:01001552 mov ecx, svcTable  
.text:01001558 lea eax, \[esi+esi\*2\]  
.text:0100155B lea eax, \[ecx+eax\*4\]  
.text:0100155E push eax  
.text:0100155F call GetDLLServiceMain  
.text:01001564 mov ebp, eax ; dll ServiceMain Function address  
.text:01001566  
.text:01001566 loc\_1001566: ; CODE XREF: FuncServiceMain+21j  
.text:01001566 ; FuncServiceMain+4Cj  
.text:01001566 push ebx  
.text:01001567 call ds:LeaveCriticalSection  
.text:0100156D test ebp, ebp  
.text:0100156F jz short loc\_100157B  
.text:01001571 push \[esp+10h+arg\_4\]  
.text:01001575 push \[esp+14h+arg\_0\]  
.text:01001579 call ebp  
.text:0100157B  
.text:0100157B loc\_100157B: ; CODE XREF: FuncServiceMain+6Bj  
.text:0100157B pop edi  
.text:0100157C pop esi  
.text:0100157D pop ebp  
.text:0100157E pop ebx  
.text:0100157F pop ecx  
.text:01001580 retn 8  
.text:01001580 FuncServiceMain endp ; sp = -8  
; ============================== FuncServiceMain() end ========================================  
  
  
由于svchost已经调用了StartServiceCtrlDispatcher来服务调度函数，因此我们在实现DLL实现时就不用了，这主要是因为一个进程只能调用一次StartServiceCtrlDispatcher API。但是需要用 RegisterServiceCtrlHandler 来注册响应控制请求的函数。最后我们的DLL接收的都是unicode字符串。  
  
由于这种服务启动后由svchost加载，不增加新的进程，只是svchost的一个DLL，而且一般进行审计时都不会去HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost 检查服务组是否变化，就算去检查，也不一定能发现异常，因此如果添加一个这样的DLL后门，伪装的好，是比较隐蔽的。  
  
  
4. 安装服务与设置  
要通过svchost调用来启动的服务，就一定要在HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost下有该服务名，这可以通过如下方式来实现：  
1） 添加一个新的服务组，在组里添加服务名  
2） 在现有组里添加服务名  
3） 直接使用现有服务组里的一个服务名，但本机没有安装的服务  
4） 修改现有服务组里的现有服务，把它的ServiceDll指向自己  
  
其中前两种可以被正常服务使用，如使用第1种方式，启动其服务要创建新的svchost进程；第2种方式如果该组服务已经运行，安装后不能立刻启动服务，因为svchost启动后已经把该组信息保存在内存里，并调用API StartServiceCtrlDispatcher() 为该组所有服务注册了调度处理函数，新增加的服务不能再注册调度处理函数，需要重起计算机或者该组的svchost进程。而后两种可能被后门使用，尤其是最后一种，没有添加服务，只是改了注册表里一项设置，从服务管理控制台又看不出来，如果作为后门还是很隐蔽的。比如EventSystem服务，缺省是指向es.dll，如果把ServiceDll改为EventSystem.dll就很难发现。  
  
因此服务的安装除了调用CreateService()创建服务之外，还需要设置服务的ServiceDll，如果使用前2种还要设置svchost的注册表选项，在卸载时也最好删除增加的部分。  
  
具体代码参见后边的附例（使用的是方法3）。  
  
注： ImagePath 和ServiceDll 是ExpandString不是普通字符串。因此如果使用.reg文件安装时要注意。  
  
  
5. DLL服务实现  
DLL程序的编写比较简单，只要实现一个ServiceMain()函数和一个服务控制程序，在ServiceMain()函数里用RegisterServiceCtrlHandler()注册服务控制程序，并设置服务的运行状态就可以了。  
  
另外，因为此种服务的安装除了正常的CreateService()之外，还要进行其他设置，因此最好实现安装和卸载函数。  
  
为了方便安装，实现的代码提供了InstallService()函数进行安装，这个函数可以接收服务名作为参数（如果不提供参数，就使用缺省的iprip），如果要安装的服务不在svchost的netsvcs组里安装就会失败；如果要安装的服务已经存在，安装也会失败；安装成功后程序会配置服务的ServiceDll为当前Dll。提供的UninstallService()函数，可以删除任何函数而没有进行任何检查。  
  
为了方便使用rundll32.exe进行安装，还提供了RundllInstallA()和RundllUninstallA()分别调用InstallService()及UninstallService()。因为rundll32.exe使用的函数原型是：  
void CALLBACK FunctionName(  
HWND hwnd, // handle to owner window  
HINSTANCE hinst, // instance handle for the DLL  
LPTSTR lpCmdLine, // string the DLL will parse  
int nCmdShow // show state  
);  
对应的命令行是rundll32 DllName,FunctionName \[Arguments\]  
  
DLL服务本身只是创建一个进程，该程序命令行就是启动服务时提供的第一个参数，如果未指定就使用缺省的svchostdll.exe。启动服务时如果提供第二个参数，创建的进程就是和桌面交互的。  
  
具体代码参见后边的附例8，源代码和DLL文件请到 [http://www.binglesite.net][http_www.binglesite.net]下载。  
  
//main service process function  
void \_\_stdcall ServiceMain( int argc, wchar\_t\* argv\[\] );  
//report service stat to the service control manager  
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );  
//service control handler, call back by service control manager  
void \_\_stdcall ServiceHandler( DWORD dwCommand );  
//RealService just create a process  
int RealService(char \*cmd, int bInteract);  
  
//Install this dll as a Service host by svchost.exe, service name is given by caller  
int InstallService(char \*name);  
//unInstall a Service, be CARE FOR call this to delete a service  
int UninstallService(char \*name);  
//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call  
void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char \*param, int nCmdShow);  
//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service  
void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char \*param, int nCmdShow);  
  
//output the debug infor into log file(or stderr if a console program call me) & DbgPrint  
void OutputString( char \*lpFmt, ... );  
  
  
6. 代码使用  
C:\\>tlist -s  
0 System Process  
8 System  
240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi  
504 svchost.exe Svcs: RpcSs  
1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv  
  
C:\\>rundll32 svchostdll.dll,RundllInstall abcd  
SvcHostDLL: DllMain called DLL\_PROCESS\_ATTACH  
you specify service name not in Svchost\\netsvcs, must be one of following:  
\- EventSystem  
\- Ias  
\- Iprip  
\- Irmon  
\- Netman  
\- Nwsapagent  
\- Rasauto  
\- Rasman  
\- Remoteaccess  
\- SENS  
\- Sharedaccess  
\- Tapisrv  
\- Ntmssvc  
\- wzcsvc  
  
C:\\>rundll32 svchostdll.dll,RundllInstall IPRIP  
SvcHostDLL: DllMain called DLL\_PROCESS\_ATTACH  
CreateService(IPRIP) SUCCESS. Config it  
Config service IPRIP ok.  
  
C:\\>sc start iprip "cmd /k whoami" 1  
NT AUTHORITY\\SYSTEM  
  
SvcHostDLL: ServiceMain(3, IPRIP) called  
SvcHostDLL: RealService called 'cmd /k whoami' Interact  
SvcHostDLL: CreateProcess(cmd /k whoami) to 640  
  
C:\\>tlist -s  
0 System Process  
8 System  
240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi  
504 svchost.exe Svcs: RpcSs  
640 cmd.exe Title: C:\\WINNT\\System32\\cmd.exe  
1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIP  
  
C:\\>net stop iprip  
The IPRIP service was stopped successfully.  
  
C:\\>rundll32 svchostdll.dll,RundllUninstall iprip  
DeleteService(IPRIP) SUCCESS.  
  
  
7. 参考  
  
Platform SDK: Tools - Rundll32  
1） Inside Win32 Services, Part 2 by: Mark Russinovich, at: [ http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3][http_www.winnetmag.com_Articles_Index.cfm_ArticleID_8943_pg_3]  
2） Platform SDK: Tools - Rundll32, at: [ http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp][http_msdn.microsoft.com_library_en-us_tools_tools_rundll32.asp]  
  
2003/8  
  
  
8. 代码  
// SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to host it.  
//  
// for detail comment see articles.  
// by bingle\_at\_email.com.cn  
// [www.BingleSite.net][]  
//  
/\* save following as a .def file to export function, only ServiceMain is needed.  
other used to install & uninstall service.  
or use /EXPORT: link option to export them.  
  
EXPORTS  
ServiceMain  
InstallService  
UninstallService  
RundllUninstallA  
RundllInstallA  
\*/  
/\*  
To compile & link:  
cl /MD /GX /LD svchostdll.cpp /link advapi32.lib /DLL /base:0x71000000 /export:ServiceMain /EXPORT:RundllUninstallA /EXPORT:RundllInstallA /EXPORT:InstallService /EXPORT:UninstallService  
\*/  
  
//  
// Articles:  
// 1. HOWTO Create a service dll used by svchost.exe by bingle, at: [ http://www.BingleSite.net/article/svchost-dll-service.html][http_www.BingleSite.net_article_svchost-dll-service.html]  
// 2. Inside Win32 Services, Part 2 by: Mark Russinovich, at: [ http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3][http_www.winnetmag.com_Articles_Index.cfm_ArticleID_8943_pg_3]  
// 3. Platform SDK: Tools - Rundll32, at: [ http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp][http_msdn.microsoft.com_library_en-us_tools_tools_rundll32.asp]  
  
\#include <stdio.h>  
\#include <time.h>  
\#include <assert.h>  
\#include <windows.h>  
  
\#define DEFAULT\_SERVICE "IPRIP"  
\#define MY\_EXECUTE\_NAME "SvcHostDLL.exe"  
  
//main service process function  
void \_\_stdcall ServiceMain( int argc, wchar\_t\* argv\[\] );  
//report service stat to the service control manager  
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress );  
//service control handler, call back by service control manager  
void \_\_stdcall ServiceHandler( DWORD dwCommand );  
//RealService just create a process  
int RealService(char \*cmd, int bInteract);  
  
//Install this dll as a Service host by svchost.exe, service name is given by caller  
int InstallService(char \*name);  
//unInstall a Service, be CARE FOR call this to delete a service  
int UninstallService(char \*name);  
//Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call  
void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char \*param, int nCmdShow);  
//unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service  
void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char \*param, int nCmdShow);  
  
//output the debug infor into log file(or stderr if a console program call me) & DbgPrint  
void OutputString( char \*lpFmt, ... );  
  
  
//dll module handle used to get dll path in InstallService  
HANDLE hDll = NULL;  
//Service HANDLE & STATUS used to get service state  
SERVICE\_STATUS\_HANDLE hSrv;  
DWORD dwCurrState;  
  
  
BOOL APIENTRY DllMain( HANDLE hModule,  
DWORD ul\_reason\_for\_call,  
LPVOID lpReserved  
)  
\{  
switch (ul\_reason\_for\_call)  
\{  
case DLL\_PROCESS\_ATTACH:  
hDll = hModule;  
\#ifdef \_DEBUG  
AllocConsole();  
OutputString("SvcHostDLL: DllMain called DLL\_PROCESS\_ATTACH");  
break;  
  
case DLL\_THREAD\_ATTACH:  
OutputString("SvcHostDLL: DllMain called DLL\_THREAD\_ATTACH");  
case DLL\_THREAD\_DETACH:  
OutputString("SvcHostDLL: DllMain called DLL\_THREAD\_DETACH");  
case DLL\_PROCESS\_DETACH:  
TellSCM( SERVICE\_STOP\_PENDING, 0, 0 );  
Sleep(1500);  
TellSCM( SERVICE\_STOPPED, 0, 0 );  
OutputString("SvcHostDLL: DllMain called DLL\_PROCESS\_DETACH");  
\#endif  
break;  
\}  
  
return TRUE;  
\}  
  
  
void \_\_stdcall ServiceMain( int argc, wchar\_t\* argv\[\] )  
\{  
// DebugBreak();  
char svcname\[256\];  
strncpy(svcname, (char\*)argv\[0\], sizeof svcname); //it's should be unicode, but if it's ansi we do it well  
wcstombs(svcname, argv\[0\], sizeof svcname);  
OutputString("SvcHostDLL: ServiceMain(%d, %s) called", argc, svcname);  
  
hSrv = RegisterServiceCtrlHandler( svcname, (LPHANDLER\_FUNCTION)ServiceHandler );  
if( hSrv == NULL )  
\{  
OutputString("SvcHostDLL: RegisterServiceCtrlHandler %S failed", argv\[0\]);  
return;  
\}else FreeConsole();  
  
TellSCM( SERVICE\_START\_PENDING, 0, 1 );  
TellSCM( SERVICE\_RUNNING, 0, 0 );  
  
// call Real Service function noew  
if(argc > 1)  
strncpy(svcname, (char\*)argv\[1\], sizeof svcname),  
wcstombs(svcname, argv\[1\], sizeof svcname);  
RealService(argc > 1 ? svcname : MY\_EXECUTE\_NAME, argc > 2 ? 1 : 0);  
  
do\{  
Sleep(10);//not quit until receive stop command, otherwise the service will stop  
\}while(dwCurrState != SERVICE\_STOP\_PENDING && dwCurrState != SERVICE\_STOPPED);  
  
OutputString("SvcHostDLL: ServiceMain done");  
return;  
\}  
  
int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress )  
\{  
SERVICE\_STATUS srvStatus;  
srvStatus.dwServiceType = SERVICE\_WIN32\_OWN\_PROCESS;  
srvStatus.dwCurrentState = dwCurrState = dwState;  
srvStatus.dwControlsAccepted = SERVICE\_ACCEPT\_STOP | SERVICE\_ACCEPT\_PAUSE\_CONTINUE | SERVICE\_ACCEPT\_SHUTDOWN;  
srvStatus.dwWin32ExitCode = dwExitCode;  
srvStatus.dwServiceSpecificExitCode = 0;  
srvStatus.dwCheckPoint = dwProgress;  
srvStatus.dwWaitHint = 3000;  
return SetServiceStatus( hSrv, &srvStatus );  
\}  
  
void \_\_stdcall ServiceHandler( DWORD dwCommand )  
\{  
// not really necessary because the service stops quickly  
switch( dwCommand )  
\{  
case SERVICE\_CONTROL\_STOP:  
TellSCM( SERVICE\_STOP\_PENDING, 0, 1 );  
OutputString("SvcHostDLL: ServiceHandler called SERVICE\_CONTROL\_STOP");  
Sleep(10);  
TellSCM( SERVICE\_STOPPED, 0, 0 );  
break;  
case SERVICE\_CONTROL\_PAUSE:  
TellSCM( SERVICE\_PAUSE\_PENDING, 0, 1 );  
OutputString("SvcHostDLL: ServiceHandler called SERVICE\_CONTROL\_PAUSE");  
TellSCM( SERVICE\_PAUSED, 0, 0 );  
break;  
case SERVICE\_CONTROL\_CONTINUE:  
TellSCM( SERVICE\_CONTINUE\_PENDING, 0, 1 );  
OutputString("SvcHostDLL: ServiceHandler called SERVICE\_CONTROL\_CONTINUE");  
TellSCM( SERVICE\_RUNNING, 0, 0 );  
break;  
case SERVICE\_CONTROL\_INTERROGATE:  
OutputString("SvcHostDLL: ServiceHandler called SERVICE\_CONTROL\_INTERROGATE");  
TellSCM( dwCurrState, 0, 0 );  
break;  
case SERVICE\_CONTROL\_SHUTDOWN:  
OutputString("SvcHostDLL: ServiceHandler called SERVICE\_CONTROL\_SHUTDOWN");  
TellSCM( SERVICE\_STOPPED, 0, 0 );  
break;  
\}  
\}  
  
  
//RealService just create a process  
int RealService(char \*cmd, int bInteract)  
\{  
OutputString("SvcHostDLL: RealService called '%s' %s", cmd, bInteract ? "Interact" : "");  
STARTUPINFO si = \{0\};  
PROCESS\_INFORMATION pi;  
si.cb = sizeof si;  
if(bInteract) si.lpDesktop = "WinSta0\\\\Default";  
if(!CreateProcess(NULL, cmd, NULL, NULL, false, 0, NULL, NULL, &si, &pi))  
OutputString("SvcHostDLL: CreateProcess(%s) error:%d", cmd, GetLastError());  
else OutputString("SvcHostDLL: CreateProcess(%s) to %d", cmd, pi.dwProcessId);  
  
return 0;  
\}  
  
  
int InstallService(char \*name)  
\{  
// Open a handle to the SC Manager database.  
int rc = 0;  
HKEY hkRoot = HKEY\_LOCAL\_MACHINE, hkParam = 0;  
SC\_HANDLE hscm = NULL, schService = NULL;  
  
try\{  
char buff\[500\];  
char \*svcname = DEFAULT\_SERVICE;  
if(name && name\[0\]) svcname = name;  
  
//query svchost setting  
char \*ptr, \*pSvchost = "SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Svchost";  
rc = RegOpenKeyEx(hkRoot, pSvchost, 0, KEY\_QUERY\_VALUE, &hkRoot);  
if(ERROR\_SUCCESS != rc)  
\{  
OutputString("RegOpenKeyEx(%s) KEY\_QUERY\_VALUE error %d.", pSvchost, rc);  
throw "";  
\}  
  
DWORD type, size = sizeof buff;  
rc = RegQueryValueEx(hkRoot, "netsvcs", 0, &type, (unsigned char\*)buff, &size);  
RegCloseKey(hkRoot);  
SetLastError(rc);  
if(ERROR\_SUCCESS != rc)  
throw "RegQueryValueEx(Svchost\\\\netsvcs)";  
  
for(ptr = buff; \*ptr; ptr = strchr(ptr, 0)+1)  
if(stricmp(ptr, svcname) == 0) break;  
  
if(\*ptr == 0)  
\{  
OutputString("you specify service name not in Svchost\\\\netsvcs, must be one of following:");  
for(ptr = buff; \*ptr; ptr = strchr(ptr, 0)+1)  
OutputString(" - %s", ptr);  
throw "";  
\}  
  
//install service  
hscm = OpenSCManager(NULL, NULL, SC\_MANAGER\_ALL\_ACCESS);  
if (hscm == NULL)  
throw "OpenSCManager()";  
  
char \*bin = "%SystemRoot%\\\\System32\\\\svchost.exe -k netsvcs";  
  
schService = CreateService(  
hscm, // SCManager database  
svcname, // name of service  
NULL, // service name to display  
SERVICE\_ALL\_ACCESS, // desired access  
SERVICE\_WIN32\_SHARE\_PROCESS, // service type  
SERVICE\_AUTO\_START, // start type  
SERVICE\_ERROR\_NORMAL, // error control type  
bin, // service's binary  
NULL, // no load ordering group  
NULL, // no tag identifier  
NULL, // no dependencies  
NULL, // LocalSystem account  
NULL); // no password  
  
if (schService == NULL)  
\{  
OutputString("CreateService(%s) error %d", svcname, rc = GetLastError());  
throw "";  
\}  
OutputString("CreateService(%s) SUCCESS. Config it", svcname);  
  
CloseServiceHandle(schService);  
CloseServiceHandle(hscm);  
  
//config service  
hkRoot = HKEY\_LOCAL\_MACHINE;  
strncpy(buff, "SYSTEM\\\\CurrentControlSet\\\\Services\\\\", sizeof buff);  
strncat(buff, svcname, 100);  
rc = RegOpenKeyEx(hkRoot, buff, 0, KEY\_ALL\_ACCESS, &hkRoot);  
if(ERROR\_SUCCESS != rc)  
\{  
OutputString("RegOpenKeyEx(%s) KEY\_SET\_VALUE error %d.", svcname, rc);  
throw "";  
\}  
  
rc = RegCreateKey(hkRoot, "Parameters", &hkParam);  
SetLastError(rc);  
if(ERROR\_SUCCESS != rc)  
throw "RegCreateKey(Parameters)";  
  
if(!GetModuleFileName(HMODULE(hDll), buff, sizeof buff))  
throw "GetModuleFileName() get dll path";  
  
rc = RegSetValueEx(hkParam, "ServiceDll", 0, REG\_EXPAND\_SZ, (unsigned char\*)buff, strlen(buff)+1);  
SetLastError(rc);  
if(ERROR\_SUCCESS != rc)  
throw "RegSetValueEx(ServiceDll)";  
  
OutputString("Config service %s ok.", svcname);  
\}catch(char \*str)  
\{  
if(str && str\[0\])  
\{  
rc = GetLastError();  
OutputString("%s error %d", str, rc);  
\}  
\}  
  
RegCloseKey(hkRoot);  
RegCloseKey(hkParam);  
CloseServiceHandle(schService);  
CloseServiceHandle(hscm);  
  
return rc;  
\}  
  
/\*  
used to install by rundll32.exe  
Platform SDK: Tools - Rundll32  
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:  
\*/  
void CALLBACK RundllInstallA(  
HWND hwnd, // handle to owner window  
HINSTANCE hinst, // instance handle for the DLL  
char \*param, // string the DLL will parse  
int nCmdShow // show state  
)  
\{  
InstallService(param);  
\}  
  
  
int UninstallService(char \*name)  
\{  
int rc = 0;  
SC\_HANDLE schService;  
SC\_HANDLE hscm;  
  
\_\_try\{  
hscm = OpenSCManager(NULL, NULL, SC\_MANAGER\_ALL\_ACCESS);  
if (hscm == NULL)  
\{  
OutputString("OpenSCManager() error %d", rc = GetLastError() );  
return rc;  
\}  
  
char \*svcname = DEFAULT\_SERVICE;  
if(name && name\[0\]) svcname = name;  
  
schService = OpenService(hscm, svcname, DELETE);  
if (schService == NULL)  
\{  
OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );  
return rc;  
\}  
  
if (!DeleteService(schService) )  
\{  
OutputString("OpenService(%s) error %d", svcname, rc = GetLastError() );  
return rc;  
\}  
  
OutputString("DeleteService(%s) SUCCESS.", svcname);  
\}\_\_except(1)  
\{  
OutputString("Exception Catched 0x%X", GetExceptionCode());  
\}  
  
CloseServiceHandle(schService);  
CloseServiceHandle(hscm);  
return rc;  
\}  
  
/\*  
used to uninstall by rundll32.exe  
Platform SDK: Tools - Rundll32  
The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax:  
\*/  
void CALLBACK RundllUninstallA(  
HWND hwnd, // handle to owner window  
HINSTANCE hinst, // instance handle for the DLL  
char \*param, // string the DLL will parse  
int nCmdShow // show state  
)  
\{  
UninstallService(param);  
\}  
  
//output the debug infor into log file & DbgPrint  
void OutputString( char \*lpFmt, ... )  
\{  
char buff\[1024\];  
va\_list arglist;  
va\_start( arglist, lpFmt );  
\_vsnprintf( buff, sizeof buff, lpFmt, arglist );  
va\_end( arglist );  
  
DWORD len;  
HANDLE herr = GetStdHandle(STD\_OUTPUT\_HANDLE);  
if(herr != INVALID\_HANDLE\_VALUE)  
\{  
WriteFile(herr, buff, strlen(buff), &len, NULL);  
WriteFile(herr, "\\r\\n", 2, &len, NULL);  
\}else  
\{  
FILE \*fp = fopen("SvcHost.DLL.log", "a");  
if(fp)  
\{  
char date\[20\], time\[20\];  
fprintf(fp, "%s %s - %s\\n", \_strdate(date), \_strtime(time), buff);  
if(!stderr) fclose(fp);  
\}  
\}  
  
OutputDebugString(buff);  
\}

[bingle]: https://www.xfocus.net/bbs/index.php?lang=cn&act=Profile&do=03&MID=1249
[www.BingleSite.net]: http://www.BingleSite.net
[http_www.binglesite.net]: http://www.binglesite.net
[http_www.winnetmag.com_Articles_Index.cfm_ArticleID_8943_pg_3]: http://www.winnetmag.com/Articles/Index.cfm?ArticleID=8943&pg=3
[http_msdn.microsoft.com_library_en-us_tools_tools_rundll32.asp]: http://msdn.microsoft.com/library/en-us/tools/tools/rundll32.asp
[http_www.BingleSite.net_article_svchost-dll-service.html]: http://www.BingleSite.net/article/svchost-dll-service.html