Zitat von
ZuBi:
wow nice, where did u read that ? (i didnt know this), thats make me to next qustion then, how can i know if the program is running a service, and not called by rundll( if i got true with (StartServiceCtrlDispatcher) means its running as a servie)), is it possible without making a function for connect to scm and chk the status ?
Hi,
my sample code is almost finished, but works not perfectly yet. That's why I do not publish it right now. You will have to wait some days. Sorry for that.
How can you distinguish? Well, easy. You have two choices:
- Get the module
handle of the EXE and check the name for svchost.exe vs. rundll32.exe
- Check under which account you run. SYSTEM is most likely the result when running under svchost.exe
Note: The latter method is somewhat unsafe compared to the first one.
Where did I read it? Well in the cache of this Chinese website (although I don't understand a single word Chinese
) and on the other websites you linked above. The principle is relatively easy - implementation not quite.
Please stay tuned for the sample source.