// 突破SESSION 0隔离创建用户进程
BOOL CreateUserProcess(char *lpszFileName)
{
BOOL bRet = TRUE;
DWORD dwSessionID = 0;
HANDLE hToken = NULL;
HANDLE hDuplicatedToken = NULL;
LPVOID lpEnvironment = NULL;
STARTUPINFO si = { 0 };
PROCESS_INFORMATION pi = { 0 };
si.cb = sizeof(si);
do
{
// 获得当前Session ID
dwSessionID = ::WTSGetActiveConsoleSessionId();
// 获得当前Session的用户令牌
if (FALSE == ::WTSQueryUserToken(dwSessionID, &hToken))
{
ShowMessage("WTSQueryUserToken", "ERROR");
bRet = FALSE;
break;
}
// 复制令牌
if (FALSE == ::DuplicateTokenEx(hToken, MAXIMUM_ALLOWED, NULL,
SecurityIdentification, TokenPrimary, &hDuplicatedToken))
{
ShowMessage("DuplicateTokenEx", "ERROR");
bRet = FALSE;
break;
}
// 创建用户Session环境
if (FALSE == ::CreateEnvironmentBlock(&lpEnvironment,
hDuplicatedToken, FALSE))
{
ShowMessage("CreateEnvironmentBlock", "ERROR");
bRet = FALSE;
break;
}
// 在复制的用户Session下执行应用程序，创建进程
if (FALSE == ::CreateProcessAsUser(hDuplicatedToken,
lpszFileName, NULL, NULL, NULL, FALSE,
NORMAL_PRIORITY_CLASS | CREATE_NEW_CONSOLE | CREATE_UNICODE_ENVIRONMENT,
lpEnvironment, NULL, &si, &pi))
{
ShowMessage("CreateProcessAsUser", "ERROR");
bRet = FALSE;
break;
}
} while (FALSE);
// 关闭句柄, 释放资源
if (lpEnvironment)
{
::DestroyEnvironmentBlock(lpEnvironment);
}
if (hDuplicatedToken)
{
::CloseHandle(hDuplicatedToken);
}
if (hToken)
{
::CloseHandle(hToken);
}
return bRet;
}
void ShowMessage(TCHAR *lpszMessage, TCHAR *lpszTitle)
{
// 获取当前的Session ID
DWORD dwSessionId = ::WTSGetActiveConsoleSessionId();
// 显示消息对话框
DWORD dwResponse = 0;
::WTSSendMessage(WTS_CURRENT_SERVER_HANDLE, dwSessionId,
lpszTitle, (1 + ::lstrlen(lpszTitle)),
lpszMessage, (1 + ::lstrlen(lpszMessage)),
0, 0, &dwResponse, FALSE);
}
#include <stdio.h>
#include <windows.h>
#include <iostream>
using namespace std;
wchar_t serviceName[20] = L"qwer1234";
wchar_t serviceDescribe[50] = L"this is a describe";
wstring getExeFullFilename()
{
static wchar_t buffer[1024];
GetModuleFileNameW(NULL, buffer, 1024);
return wstring(buffer);
}
SERVICE_STATUS serviceStatus = { 0 };
SERVICE_STATUS_HANDLE g_serviceStatusHandle = NULL;
//首先声明一个句柄，后面操作这个服务全靠这个句柄
#define SAFE_CALL(FuncCall, ErrorCode)
if (FuncCall == ErrorCode) {
cout << #FuncCall " error, code:" << GetLastError()
<< " ,line:" << __LINE__ << "
";
exit(-1);
}
void setServiceStatus(DWORD status)
{
SERVICE_STATUS serviceStatus;
serviceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
serviceStatus.dwWin32ExitCode = NO_ERROR;
serviceStatus.dwServiceSpecificExitCode = 0;
serviceStatus.dwWaitHint = 2000;
serviceStatus.dwCheckPoint = 0;
serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_PAUSE_CONTINUE |
SERVICE_ACCEPT_SHUTDOWN |
SERVICE_ACCEPT_STOP;
serviceStatus.dwCurrentState = status;
SAFE_CALL(SetServiceStatus(g_serviceStatusHandle, &serviceStatus), 0);
}
//名字自己定义，用来操作服务的状态，参数是服务的状态
void __stdcall ServiceHandler(DWORD ServiceStatusCode) {
switch (ServiceStatusCode) {
case SERVICE_CONTROL_CONTINUE:
/*
//第一种方式，我觉得可以
ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
ServiceStatus.dwWin32ExitCode = -1; 这个看情况吧，我觉得多余了。
SetServiceStatus(g_serviceStatusHandle, &ServiceStatus);*/
setServiceStatus(SERVICE_START_PENDING); //另一种方式，我觉得挺好
//下面不赘述，自我发挥一下
case SERVICE_CONTROL_INTERROGATE:
break;
case SERVICE_CONTROL_PAUSE:
setServiceStatus(SERVICE_PAUSED); break;
case SERVICE_CONTROL_SHUTDOWN:
setServiceStatus(SERVICE_STOPPED); break;
case SERVICE_CONTROL_STOP:
setServiceStatus(SERVICE_STOPPED); break;
default:
break;
}
}
void Init() {
//初始化所有的状态
//初始话服务为的状态
serviceStatus.dwServiceType = SERVICE_WIN32;
serviceStatus.dwCurrentState = SERVICE_START_PENDING;
serviceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_SHUTDOWN;//设置控制方式
serviceStatus.dwWin32ExitCode = 0; //设置推出代码
serviceStatus.dwServiceSpecificExitCode = 0;
serviceStatus.dwCheckPoint = 0;
}
void __stdcall ServiceMain(DWORD argc, LPWSTR* argv) {
// 注册服务控制器,为了控制服务的状态等 SCM第一个参数是服务的名字，第二个参数是回调函数
g_serviceStatusHandle = RegisterServiceCtrlHandler(serviceName, &ServiceHandler);
if (g_serviceStatusHandle == 0)
{
cout << "RegisterServiceCtrlHandlerW error, code:" << GetLastError()
<< " ,line:" << __LINE__ << "
";
exit(-1);
}
//先pending，再running，只是改变状态而已，其实初始话已经pending
//为了稳妥起见再pending一次
setServiceStatus(SERVICE_START_PENDING);//表示正在初始化
setServiceStatus(SERVICE_RUNNING);
}
/*==================分割线======================*/
/*
上面是服务的部分
下面是注册等等的部分
*/
void runService()
{
const SERVICE_TABLE_ENTRYW serviceTable[] = {
{ L"", ServiceMain },
{ NULL, NULL }
};
//注册服务入口函数
SAFE_CALL(StartServiceCtrlDispatcherW(&serviceTable[0]), 0);
}
void installService() {
//注册一个服务
//函数建立了一个到服务控制管理器的连接，并打开指定的数据库。
SC_HANDLE scHandle = OpenSCManagerW(NULL, NULL, SC_MANAGER_CREATE_SERVICE);
SAFE_CALL(scHandle, NULL);
//创建一个服务对象，并将其添加到指定的服务控制管理器数据库的函数
SC_HANDLE serviceHandle = CreateServiceW(
scHandle,
serviceName,//以NULL 结尾的服务名，用于创建登记数据库中的关键字
serviceName,//以NULL 结尾的服务名，用于用户界面标识服务
SERVICE_ALL_ACCESS,//指定服务返回类型
SERVICE_WIN32_OWN_PROCESS,//指定服务类型
SERVICE_AUTO_START,//指定何时启动服务
SERVICE_ERROR_NORMAL,//指定服务启动失败的严重程度
getExeFullFilename().c_str(),//指定服务程序二进制文件的路径
NULL,//指定顺序装入的服务组名
NULL,//忽略，NULL
L"", //指定启动该服务前必须先启动的服务或服务组
NULL,//以NULL 结尾的字符串，指定服务帐号。如是NULL,则表示使用LocalSystem帐号
L""//以NULL 结尾的字符串，指定对应的口令。为NULL表示无口令。但使用LocalSystem时填NULL
);
SAFE_CALL(serviceHandle, NULL);
CloseServiceHandle(scHandle);
CloseServiceHandle(serviceHandle);
}
void startService() {
SC_HANDLE scHandle = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);
SAFE_CALL(scHandle, NULL);
SC_HANDLE serviceHandle = OpenServiceW(scHandle, serviceName, SERVICE_ALL_ACCESS);
SAFE_CALL(serviceHandle, NULL);
SERVICE_STATUS serviceStatus;
SAFE_CALL(QueryServiceStatus(serviceHandle, &serviceStatus), 0);
if (serviceStatus.dwCurrentState == SERVICE_START && serviceStatus.dwCurrentState != SERVICE_START_PENDING) {
//为啥判断两个
return;
}
SAFE_CALL(StartServiceW(serviceHandle, 0, NULL), FALSE);
CloseServiceHandle(scHandle);
CloseServiceHandle(serviceHandle);
}
void uninstallService() {
SC_HANDLE scHandle = OpenSCManagerW(NULL, NULL, SC_MANAGER_ALL_ACCESS);
SAFE_CALL(scHandle, NULL);
SC_HANDLE serviceHandle = OpenServiceW(scHandle, serviceName, SERVICE_ALL_ACCESS);
SAFE_CALL(serviceHandle, NULL);
SERVICE_STATUS serviceStatus;
SAFE_CALL(QueryServiceStatus(serviceHandle, &serviceStatus), 0);
//查询状态，直到真正关闭
if (serviceStatus.dwCurrentState == SERVICE_RUNNING) {
SAFE_CALL(ControlService(serviceHandle, SERVICE_CONTROL_STOP, &serviceStatus), 0);
SAFE_CALL(serviceStatus.dwCurrentState, NO_ERROR);
do {
SAFE_CALL(QueryServiceStatus(serviceHandle, &serviceStatus), 0);
Sleep(0);
} while (serviceStatus.dwCurrentState != SERVICE_STOPPED);
}
SAFE_CALL(DeleteService(serviceHandle), FALSE);
CloseServiceHandle(scHandle);
CloseServiceHandle(serviceHandle);
}
int wmain(int argc, wchar_t* argv[])
{
if (argc == 1) {
runService();
}
else if (argc == 2) {
if (argv[1] == wstring(L"-install")) {
installService();
startService();
}
if (argv[1] == wstring(L"-uninstall")) {
uninstallService();
}
}
else {
std::cout << "usage: a.exe [-install/-uninstall]";
}
return 0;
}