Why Cant Start A service.

[ZuBi]

Zitat:

Zitat von Olli

The perhaps most interesting thing (which you did wrong as well) is, that you MUST NOT use StartServiceCtrlDispatcher(). Actually this function does nothing more than passing the dispatcher function address to the SCM. The SCM calls it and the service EXE is no more than a "quasi-DLL" of the SCM from this point.

So this was your first mistake. You don't need to call this function because it is only needed if your service was located in an EXE file!

... to be continued ...

wow nice, where did u read that ? (i didnt know this), thats make me to next qustion then, how can i know if the program is running a service, and not called by rundll( if i got true with (StartServiceCtrlDispatcher) means its running as a servie)), is it possible without making a function for connect to scm and chk the status ?

[Olli]

Zitat:

Zitat von ZuBi

wow nice, where did u read that ? (i didnt know this), thats make me to next qustion then, how can i know if the program is running a service, and not called by rundll( if i got true with (StartServiceCtrlDispatcher) means its running as a servie)), is it possible without making a function for connect to scm and chk the status ?

Hi,

my sample code is almost finished, but works not perfectly yet. That's why I do not publish it right now. You will have to wait some days. Sorry for that.

How can you distinguish? Well, easy. You have two choices:
- Get the module handle of the EXE and check the name for svchost.exe vs. rundll32.exe
- Check under which account you run. SYSTEM is most likely the result when running under svchost.exe

Note: The latter method is somewhat unsafe compared to the first one.

Where did I read it? Well in the cache of this Chinese website (although I don't understand a single word Chinese ;) ) and on the other websites you linked above. The principle is relatively easy - implementation not quite.

Please stay tuned for the sample source.

[ZuBi]

[quote="Olli"]

Zitat:

Zitat von ZuBi

wow nice, where did u read that ? (i didnt know this), thats make me to next qustion then, how can i know if the program is running a service, and not called by rundll( if i got true with (StartServiceCtrlDispatcher) means its running as a servie)), is it possible without making a function for connect to scm and chk the status ?

Hi,

my sample code is almost finished, but works not perfectly yet. That's why I do not publish it right now. You will have to wait some days. Sorry for that.

How can you distinguish? Well, easy. You have two choices:
- Get the module handle of the EXE and check the name for svchost.exe vs. rundll32.exe
- Check under which account you run. SYSTEM is most likely the result when running under svchost.exe

Note: The latter method is somewhat unsafe compared to the first one.

Where did I read it? Well in the cache of this Chinese website (although I don't understand a single word Chinese ;) ) and on the other websites you linked above. The principle is relatively easy - implementation not quite.

i back
those methods are unreible for me - i cant used them them but anyway.

i tut while ServiceMain has been called it stop the maim thread means no code at the main thead should be procced, the problem come when its not like that i tryd many ways to know what called has been send by services or not. do u know some more about the servicemain ? i tut the svchost calling directly to the procedure like when u call in rundll c.dll,install no other code then the procedure will start( the main thread ) so well some info may do u know ?

[Olli]

Zitat:

Zitat von ZuBi

i back
those methods are unreible for me - i cant used them them but anyway.

i tut while ServiceMain has been called it stop the maim thread means no code at the main thead should be procced, the problem come when its not like that i tryd many ways to know what called has been send by services or not. do u know some more about the servicemain ? i tut the svchost calling directly to the procedure like when u call in rundll c.dll,install no other code then the procedure will start( the main thread ) so well some info may do u know ?

Sorry, I don't understand.

My solution will not be available before friday, though.

[ZuBi]

Zitat:

Zitat von Olli

Zitat:

Zitat von ZuBi

i back
those methods are unreible for me - i cant used them them but anyway.

i tut while ServiceMain has been called it stop the maim thread means no code at the main thead should be procced, the problem come when its not like that i tryd many ways to know what called has been send by services or not. do u know some more about the servicemain ? i tut the svchost calling directly to the procedure like when u call in rundll c.dll,install no other code then the procedure will start( the main thread ) so well some info may do u know ?

Sorry, I don't understand.

My solution will not be available before friday, though.

its not that, those things are old problems :>

i will say it in other way: is it possible to halt the main thread when servicemain is called

[Olli]

Zitat:

Zitat von ZuBi

i will say it in other way: is it possible to halt the main thread when servicemain is called

What do you mean by main thread? Only the SCM holds the threads which are then running the Service-DLL.

[NicoDE]

Zitat:

Zitat von Olli

How can you distinguish? Well, easy. You have two choices:
- Get the module handle of the EXE and check the name for svchost.exe vs. rundll32.exe
- Check under which account you run. SYSTEM is most likely the result when running under svchost.exe

You should use this code to check for the 'System Process Context':

Delphi-Quellcode:

function IsSystemProcessContext: Boolean;
(** )
type
  TLUID = LARGE_INTEGER;
  TTokenStatistics = packed record
    TokenId           : TLUID;
    AuthenticationId  : TLUID;
    ExpirationTime    : LARGE_INTEGER;
    TokenType         : TTokenType;
    ImpersonationLevel: TSecurityImpersonationLevel;
    DynamicCharged    : DWORD;
    DynamicAvailable  : DWORD;
    GroupCount        : DWORD;
    PrivilegeCount    : DWORD;
    ModifiedId        : TLUID;
  end;
const
  SYSTEM_LUID: LARGE_INTEGER = (LowPart: $03E7; HighPart: $0);
(**)
var
  TokenHandle: THandle;
  TokenInformation: TTokenStatistics;
  ReturnLength: DWORD;
begin
  Result := False;
  if OpenProcessToken(GetCurrentProcess, TOKEN_QUERY, TokenHandle) then
    try
      Result := GetTokenInformation(TokenHandle, TokenStatistics,
        Addr(TokenInformation), SizeOf(TTokenStatistics), ReturnLength) and
        (TokenInformation.AuthenticationId.LowPart = SYSTEM_LUID.LowPart) and
        (TokenInformation.AuthenticationId.HighPart = SYSTEM_LUID.HighPart);
    finally
      CloseHandle(TokenHandle);
    end;
end;