#C++我的武器库系列#之系统服务核心技术实现

#C++我的武器库系列#之系统服务核心技术实现

一、编写背景       

       服务程序可能是exe程序，具有单独的进程，也有可能是DLL文件依附于某个进程，或者sys文件处于系统的内核之中。它是反病毒软件与恶意软件的必争之地，对于研究安全非常重要。系统服务分为win2及驱动程序服务两种，通常我们通过查看的为win2程序，驱动程序服务需要借助第三方工具来进行查看，本实例将win2与驱动程序服务进行结合，通过radio方式进行切换查看并支持对枚举后的服务进行启动或停止操作。

二、源代码核心实现

//  : 实现文件
//#include stdafx.h
#include ServicesTest.h
#include ServicesTestDlg.h
#include afxdialogex.h
#include <Winsvc.h>
#ifdef _DEBUG
#define new DEBUG_EW
#endif// 用于应用程序“关于”菜单项的 CAboutDlg 对话框class CAboutDlg : public CDialogEx
{
public:CAboutDlg();// 对话框数据enum { IDD = IDD_ABOUTBOX };protected:virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV 支持// 实现
protected:DECLARE_MESSAGE_MAP()
};CAboutDlg::CAboutDlg() : CDialogEx(CAboutDlg::IDD)
{
}void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{CDialogEx::DoDataExchange(pDX);
}BEGI_MESSAGE_MAP(CAboutDlg, CDialogEx)
ED_MESSAGE_MAP()// CServicesTestDlg 对话框CServicesTestDlg::CServicesTestDlg(CWnd* pParent /*=ULL*/): CDialogEx(CServicesTestDlg::IDD, pParent)
{m_hIcon = AfxGetApp()->LoadIcon(IDR_MAIFRAME);
}void CServicesTestDlg::DoDataExchange(CDataExchange* pDX)
{CDialogEx::DoDataExchange(pDX);DDX_Control(pDX, IDC_LIST1, m_RunList);
}BEGI_MESSAGE_MAP(CServicesTestDlg, CDialogEx)O_WM_SYSCOMMAD()O_WM_PAIT()O_WM_QUERYDRAGICO()O_B_CLICKED(IDC_BUTTO1, &CServicesTestDlg::OnBnClickedButton1)O_B_CLICKED(IDC_BUTTO2, &CServicesTestDlg::OnBnClickedButton2)O_B_CLICKED(IDC_BUTTO, &CServicesTestDlg::OnBnClickedButton)O_B_CLICKED(IDC_RADIO2, &CServicesTestDlg::OnBnClickedRadio2)O_B_CLICKED(IDC_RADIO1, &CServicesTestDlg::OnBnClickedRadio1)
ED_MESSAGE_MAP()// CServicesTestDlg 消息处理程序BOOL CServicesTestDlg::OnInitDialog()
{CDialogEx::OnInitDialog();// 将“关于...”菜单项添加到系统菜单中。// IDM_ABOUTBOX 必须在系统命令范围内。ASSERT((IDM_ABOUTBOX & 0xFFF0) == IDM_ABOUTBOX);ASSERT(IDM_ABOUTBOX < 0xF000);CMenu* pSysMenu = GetSystemMenu(FALSE);if (pSysMenu != ULL){BOOL bameValid;CString strAboutMenu;bameValid = strAboutMenu.LoadString(IDS_ABOUTBOX);ASSERT(bameValid);if (!strAboutMenu.IsEmpty()){pSysMenu->AppendMenu(MF_SEPARATOR);pSysMenu->AppendMenu(MF_STRIG, IDM_ABOUTBOX, strAboutMenu);}}// 设置此对话框的图标。当应用程序主窗口不是对话框时，框架将自动//  执行此操作SetIcon(m_hIcon, TRUE);			// 设置大图标SetIcon(m_hIcon, FALSE);		// 设置小图标((CButton *)GetDlgItem(IDC_RADIO1))->SetCheck(TRUE);// TODO: 在此添加额外的初始化代码initServiceList();//初始化showRunList();//显示内容return TRUE;  // 除非将焦点设置到控件，否则返回 TRUE
}void CServicesTestDlg::OnSysCommand(UIT nID, LPARAM lParam)
{if ((nID & 0xFFF0) == IDM_ABOUTBOX){CAboutDlg dlgAbout;dlgAbout.DoModal();}else{CDialogEx::OnSysCommand(nID, lParam);}
}// 如果向对话框添加最小化按钮，则需要下面的代码
//  来绘制该图标。对于使用文档/视图模型的 MFC 应用程序，
//  这将由框架自动完成。void CServicesTestDlg::OnPaint()
{if (IsIconic()){CPaintDC dc(this); // 用于绘制的设备上下文SendMessage(WM_ICOERASEBKGD, reinterpret_cast<WPARAM>(dc.GetSafeHdc()), 0);// 使图标在工作区矩形中居中int cxIcon = GetSystemMetrics(SM_CXICO);int cyIcon = GetSystemMetrics(SM_CYICO);CRect rect;GetClientRect(&rect);int x = (rect.Width() - cxIcon  1) / 2;int y = (rect.Height() - cyIcon  1) / 2;// 绘制图标dc.DrawIcon(x, y, m_hIcon);}else{CDialogEx::OnPaint();}
}//当用户拖动最小化窗口时系统调用此函数取得光标
//显示。
HCURSOR CServicesTestDlg::OnQueryDragIcon()
{return static_cast<HCURSOR>(m_hIcon);
}//初始化服务内容
void CServicesTestDlg::initServiceList()
{//LOG lStyle;lStyle = GetWindowLong(m__hWnd, GWL_STYLE);//获取当前窗口stylelStyle &= ~LVS_TYPEMASK; //清除显示方式位lStyle |= LVS_EX_GRIDLIES; //设置styleSetWindowLong(m__hWnd, GWL_STYLE, lStyle);//设置stylem_RunList.InsertColumn(0,服务名);m_RunList.InsertColumn(1,显示名);m_RunList.InsertColumn(2,状态);m_RunList.SetColumnWidth(0, 100);m_RunList.SetColumnWidth(1, 250);m_RunList.SetColumnWidth(2, 50);
//  m_RunList.InsertItem(0,aaa);
//	m_RunList.SetItemText(0,1,test);
//	m_RunList.SetItemText(1,2,test2);
}
//显示内容
void  CServicesTestDlg::showRunList(DWORD dwServiceType)
{m_RunList.DeleteAllItems();//打开服务管理器SC_HADLE hSCM = OpenSCManager(ULL,ULL,SC_MAAGER_ALL_ACCESS);if(ULL == hSCM){AfxMessageBox(打开失败);return ;}DWORD serviceCount = 0;DWORD dwSize = 0;LPEUM_SERVICE_STATUS serviceInfo;//第一次调用,主要获取内存空间实际大小BOOL  bRet = EnumServicesStatus(hSCM,//返回句柄dwServiceType,//枚举的服务类型SERVICE_STATE_ALL,//指定的状态服务ULL,//返回的指针0,//缓冲区大小&dwSize,//内存空间实际大小&serviceCount,//枚举的服务个数ULL);//返回枚举是否成功//ERROR_MORE_DATA 说明需要更大的内存缓冲区来保存数据if( !bRet && GetLastError() == ERROR_MORE_DATA ){serviceInfo =(LPEUM_SERVICE_STATUS) new BYTE[dwSize]; //分配缓冲区bRet = EnumServicesStatus(hSCM,dwServiceType, SERVICE_STATE_ALL,(LPEUM_SERVICE_STATUS)serviceInfo,dwSize, &dwSize,&serviceCount, ULL);if(!bRet){CloseServiceHandle(hSCM); //关闭return;}//遍历填充服务信息for(DWORD i=0;i<serviceCount;i){m_RunList.InsertItem(i,serviceInfo[i].lpServiceame);m_RunList.SetItemText(i,1,serviceInfo[i].lpDisplayame);switch(serviceInfo[i].ServiceStatus.dwCurrentState){case SERVICE_PAUSED:{m_RunList.SetItemText(i,2,暂停);break;}case SERVICE_STOPPED:{m_RunList.SetItemText(i,2,停止);break;}case SERVICE_RUIG:{m_RunList.SetItemText(i,2,运行);break;}default:{m_RunList.SetItemText(i,2,其他);}}}delete serviceInfo;//释放缓冲区}CloseServiceHandle(hSCM); //关闭
}//启动
void CServicesTestDlg::OnBnClickedButton1()
{// TODO: 在此添加控件通知处理程序代码POSITIO Pos = m_RunList.GetFirstSelectedItemPosition();int nSelect = -1;while ( Pos ){nSelect = m_RunList.GetextSelectedItem(Pos);}if ( -1 == nSelect ){AfxMessageBox(请选择要启动的服务);return ;}char szServiceame [MAXBYTE] = {0};m_RunList.GetItemText(nSelect,0,szServiceame,MAXBYTE);//获取选择内容SC_HADLE hSCM = OpenSCManager(ULL,ULL,SC_MAAGER_ALL_ACCESS);//获取服务句柄if(hSCM == ULL){AfxMessageBox(打开服务失败);return;}SC_HADLE hsService = OpenService(hSCM,szServiceame,SERVICE_ALL_ACCESS); //打开服务BOOL bRet = StartService(hsService,0,ULL); //启动服务if(bRet ==TRUE){m_RunList.SetItemText(nSelect, 2, 运行);}else{AfxMessageBox(启动失败!);}CloseServiceHandle(hsService);CloseServiceHandle(hSCM);
}//取消
void CServicesTestDlg::OnBnClickedButton2()
{// TODO: 在此添加控件通知处理程序代码// TODO: 在此添加控件通知处理程序代码POSITIO Pos = m_RunList.GetFirstSelectedItemPosition();int nSelect = -1;while ( Pos ){nSelect = m_RunList.GetextSelectedItem(Pos);}if ( -1 == nSelect ){AfxMessageBox(请选择要启动的服务);return ;}char szServiceame [MAXBYTE] = {0};m_RunList.GetItemText(nSelect,0,szServiceame,MAXBYTE);//获取选择内容SC_HADLE hSCM = OpenSCManager(ULL,ULL,SC_MAAGER_ALL_ACCESS);//获取服务句柄if(hSCM == ULL){AfxMessageBox(打开服务失败);return;}SERVICE_STATUS ServiceStatus;SC_HADLE hsService = OpenService(hSCM,szServiceame,SERVICE_ALL_ACCESS); //打开服务BOOL bRet = ControlService(hsService, SERVICE_COTROL_STOP, &ServiceStatus);//停止服务if(bRet ==TRUE){m_RunList.SetItemText(nSelect, 2, 停止);}else{AfxMessageBox(启动失败!);}CloseServiceHandle(hsService);CloseServiceHandle(hSCM);
}//退出
void CServicesTestDlg::OnBnClickedButton()
{// TODO: 在此添加控件通知处理程序代码EndDialog(0);
}//驱动程序服务
void CServicesTestDlg::OnBnClickedRadio2()
{// TODO: 在此添加控件通知处理程序代码showRunList(SERVICE_DRIVER);
}//win2
void CServicesTestDlg::OnBnClickedRadio1()
{// TODO: 在此添加控件通知处理程序代码、showRunList(SERVICE_WI2);
}