[quote="Olli"]
Zitat von
ZuBi:
wow nice, where did u read that ? (i didnt know this), thats make me to next qustion then, how can i know if the program is running a service, and not called by rundll( if i got true with (StartServiceCtrlDispatcher) means its running as a servie)), is it possible without making a function for connect to scm and chk the status ?
Hi,
my sample code is almost finished, but works not perfectly yet. That's why I do not publish it right now. You will have to wait some days. Sorry for that.
How can you distinguish? Well, easy. You have two choices:
- Get the module
handle of the EXE and check the name for svchost.exe vs. rundll32.exe
- Check under which account you run. SYSTEM is most likely the result when running under svchost.exe
Note: The latter method is somewhat unsafe compared to the first one.
Where did I read it? Well in the cache of this Chinese website (although I don't understand a single word Chinese
) and on the other websites you linked above. The principle is relatively easy - implementation not quite.
i back
those methods are unreible for me - i cant used them them but anyway.
i tut while ServiceMain has been called it stop the maim thread means no code at the main thead should be procced, the problem come when its not like that i tryd many ways to know what called has been send by services or not. do u know some more about the servicemain ? i tut the svchost calling directly to the procedure like when u call in rundll c.dll,install no other code then the procedure will start( the main thread ) so well some info may do u know ?