為了方便使用rundll32.exe進(jìn)行安裝，還提供了RundllInstallA()和RundllUninstallA()分別調(diào)用InstallService()及UninstallService()。因?yàn)閞undll32.exe使用的函數(shù)原型是： void CALLBACK FunctionName( HWND hwnd, // handle to owner window HINSTANCE hinst, // instance handle for the DLL LPTSTR lpCmdLine, // string the DLL will parse int nCmdShow // show state ); 對應(yīng)的命令行是rundll32 DllName,FunctionName [Arguments]
//main service process function void __stdcall ServiceMain( int argc, wchar_t* argv[] ); //report service stat to the service control manager int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ); //service control handler, call back by service control manager void __stdcall ServiceHandler( DWORD dwCommand ); //RealService just create a process int RealService(char *cmd, int bInteract);
//Install this dll as a Service host by svchost.exe, service name is given by caller int InstallService(char *name); //unInstall a Service, be CARE FOR call this to delete a service int UninstallService(char *name); //Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow); //unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);
//output the debug infor into log file(or stderr if a console program call me) & DbgPrint void OutputString( char *lpFmt, ... );
6. 代碼使用 C:/>tlist -s 0 System Process 8 System 240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi 504 svchost.exe Svcs: RpcSs 1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv
C:/>rundll32 svchostdll.dll,RundllInstall abcd SvcHostDLL: DllMain called DLL_PROCESS_ATTACH you specify service name not in Svchost/netsvcs, must be one of following: - EventSystem - Ias - Iprip - Irmon - Netman - Nwsapagent - Rasauto - Rasman - Remoteaccess - SENS - Sharedaccess - Tapisrv - Ntmssvc - wzcsvc
C:/>rundll32 svchostdll.dll,RundllInstall IPRIP SvcHostDLL: DllMain called DLL_PROCESS_ATTACH CreateService(IPRIP) SUCCESS. Config it Config service IPRIP ok.
C:/>sc start iprip "cmd /k whoami" 1 NT AUTHORITY/SYSTEM
SvcHostDLL: ServiceMain(3, IPRIP) called SvcHostDLL: RealService called 'cmd /k whoami' Interact SvcHostDLL: CreateProcess(cmd /k whoami) to 640
C:/>tlist -s 0 System Process 8 System 240 services.exe Svcs: Browser,Dhcp,dmserver,Dnscache,Eventlog,lanmanserver,lanmanworkstation, LmHosts,PlugPlay,ProtectedStorage,TrkWks,Wmi 504 svchost.exe Svcs: RpcSs 640 cmd.exe Title: C:/WINNT/System32/cmd.exe 1360 svchost.exe Svcs: EventSystem,Netman,RasMan,SENS,TapiSrv,IPRIP
C:/>net stop iprip The IPRIP service was stopped successfully.
8. 代碼 // SvcHostDLL.cpp : Demo for a service dll used by svchost.exe to host it. // // for detail comment see articles. // by bingle_at_email.com.cn // www.BingleSite.net // /* save following as a .def file to export function, only ServiceMain is needed. other used to install & uninstall service. or use /EXPORT: link option to export them.
//main service process function void __stdcall ServiceMain( int argc, wchar_t* argv[] ); //report service stat to the service control manager int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ); //service control handler, call back by service control manager void __stdcall ServiceHandler( DWORD dwCommand ); //RealService just create a process int RealService(char *cmd, int bInteract);
//Install this dll as a Service host by svchost.exe, service name is given by caller int InstallService(char *name); //unInstall a Service, be CARE FOR call this to delete a service int UninstallService(char *name); //Install this dll as a Service host by svchost.exe, used by RUNDLL32.EXE to call void CALLBACK RundllInstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow); //unInstall a Service used by RUNDLL32.EXE to call, be CARE FOR call this to delete a service void CALLBACK RundllUninstallA(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow);
//output the debug infor into log file(or stderr if a console program call me) & DbgPrint void OutputString( char *lpFmt, ... );
//dll module handle used to get dll path in InstallService HANDLE hDll = NULL; //Service HANDLE & STATUS used to get service state SERVICE_STATUS_HANDLE hSrv; DWORD dwCurrState;
case DLL_THREAD_ATTACH: OutputString("SvcHostDLL: DllMain called DLL_THREAD_ATTACH"); case DLL_THREAD_DETACH: OutputString("SvcHostDLL: DllMain called DLL_THREAD_DETACH"); case DLL_PROCESS_DETACH: TellSCM( SERVICE_STOP_PENDING, 0, 0 ); Sleep(1500); TellSCM( SERVICE_STOPPED, 0, 0 ); OutputString("SvcHostDLL: DllMain called DLL_PROCESS_DETACH"); #endif break; }
return TRUE; }
void __stdcall ServiceMain( int argc, wchar_t* argv[] ) { // DebugBreak(); char svcname[256]; strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it well wcstombs(svcname, argv[0], sizeof svcname); OutputString("SvcHostDLL: ServiceMain(%d, %s) called", argc, svcname);
do{ Sleep(10);//not quit until receive stop command, otherwise the service will stop }while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);
if(*ptr == 0) { OutputString("you specify service name not in Svchost//netsvcs, must be one of following:"); for(ptr = buff; *ptr; ptr = strchr(ptr, 0)+1) OutputString(" - %s", ptr); throw ""; }
//install service hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); if (hscm == NULL) throw "OpenSCManager()";
schService = CreateService( hscm, // SCManager database svcname, // name of service NULL, // service name to display SERVICE_ALL_ACCESS, // desired access SERVICE_WIN32_SHARE_PROCESS, // service type SERVICE_AUTO_START, // start type SERVICE_ERROR_NORMAL, // error control type bin, // service's binary NULL, // no load ordering group NULL, // no tag identifier NULL, // no dependencies NULL, // LocalSystem account NULL); // no password
/* used to install by rundll32.exe Platform SDK: Tools - Rundll32 The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax: */ void CALLBACK RundllInstallA( HWND hwnd, // handle to owner window HINSTANCE hinst, // instance handle for the DLL char *param, // string the DLL will parse int nCmdShow // show state ) { InstallService(param); }
int UninstallService(char *name) { int rc = 0; SC_HANDLE schService; SC_HANDLE hscm;
/* used to uninstall by rundll32.exe Platform SDK: Tools - Rundll32 The Run DLL utility (Rundll32.exe) included in Windows enables you to call functions exported from a 32-bit DLL. These functions must have the following syntax: */ void CALLBACK RundllUninstallA( HWND hwnd, // handle to owner window HINSTANCE hinst, // instance handle for the DLL char *param, // string the DLL will parse int nCmdShow // show state ) { UninstallService(param); }
