How can my VC++ app detect if its running as a service via SRVANY.exe

[pschiff]

How can my VC++ app tell if its running as a service from SRVANY.exe tks
Peter

[Loada]

Could you look for your app in the services key in the registry and check it's image-path value (that will indicate if its running via srvany.exe)? I admit, it's a bit klonky though, probably not what your after?

[Mick]

Can you explain what you are trying to do? If you are using srvany.exe to install your application as a service then don't. It is not the proper way to create a service. Use the service API's to create a service such as ServiceMain(...) which you can find on msdn.microsoft.com and also if you search the win32 api forum here on cg you'll find sample code in some of the threads.

If you are concerned that someone puts your application running under srvany.exe.

Then as indicated you could parse the registry entries. Or use EnumServicesStatusEx(...) which has a SERVICE_STATUS_PROCESS which contains the pid of the service your enumerating, if this pid matches your program pid as you enumerate (assuming your check when your program starts) then you are a service.

[antichrist]

C# example:


[DllImport("advapi32.dll", CharSet=System.Runtime.InteropServices.CharSet.Unicode, SetLastError=true)]
private extern static IntPtr OpenSCManager(string machineName, string databaseName, int access);

[DllImport("advapi32.dll",SetLastError=true, CharSet=CharSet.Auto)]
private static extern bool EnumServicesStatusEx(IntPtr hSCManager,
int InfoLevel, int dwServiceType,
int dwServiceState, IntPtr lpServices, UInt32 cbBufSize,
out uint pcbBytesNeeded, out uint lpServicesReturned,
ref uint lpResumeHandle, string pszGroupName);

[DllImport("advapi32.dll")]
private static extern bool CloseServiceHandle(IntPtr hSCObject);

[DllImport("kernel32.dll", CharSet=CharSet.Auto)]
private static extern int GetCurrentProcessId();

[StructLayout(LayoutKind.Sequential, Pack=1)]
public struct ENUM_SERVICE_STATUS_PROCESS
{
public static readonly int SizeOf = Marshal.SizeOf(typeof(ENUM_SERVICE_STATUS_PROCESS));

[MarshalAs(System.Runtime.InteropServices.UnmanagedType.LPWStr)]
public string pServiceName;

[MarshalAs(System.Runtime.InteropServices.UnmanagedType.LPWStr)]
public string pDisplayName;

public SERVICE_STATUS_PROCESS ServiceStatus;
}

[StructLayout(LayoutKind.Sequential, Pack=1)]
public struct SERVICE_STATUS_PROCESS
{
public static readonly int SizeOf = Marshal.SizeOf(typeof(SERVICE_STATUS_PROCESS));

public int dwServiceType;
public int dwCurrentState;
public int dwControlsAccepted;
public int dwWin32ExitCode;
public int dwServiceSpecificExitCode;
public int dwCheckPoint;
public int dwWaitHint;
public int dwProcessId;
public int dwServiceFlags;
}

// http://www.hoytsoft.org/sourceFile.aspx?zip=files/HoytSoft.ServiceProcess_src(Rev3).zip&source=Service%20Base/ServicesAPI.cs
private const int SERVICE_NO_CHANGE = -1;
private const int STANDARD_RIGHTS_REQUIRED = 0xF0000;
private const int SC_ENUM_PROCESS_INFO = 0;

private enum ServiceType { SERVICE_KERNEL_DRIVER = 0x1, SERVICE_FILE_SYSTEM_DRIVER = 0x2, SERVICE_WIN32_OWN_PROCESS = 0x10, SERVICE_WIN32_SHARE_PROCESS = 0x20, SERVICE_INTERACTIVE_PROCESS = 0x100, SERVICETYPE_NO_CHANGE = SERVICE_NO_CHANGE, SERVICE_WIN32 = (SERVICE_WIN32_OWN_PROCESS | SERVICE_WIN32_SHARE_PROCESS) }
private enum ServiceStartType { SERVICE_BOOT_START = 0x0, SERVICE_SYSTEM_START = 0x1, SERVICE_AUTO_START = 0x2, SERVICE_DEMAND_START = 0x3, SERVICE_DISABLED = 0x4, SERVICESTARTTYPE_NO_CHANGE = SERVICE_NO_CHANGE }
private enum ServiceErrorControl { SERVICE_ERROR_IGNORE = 0x0, SERVICE_ERROR_NORMAL = 0x1, SERVICE_ERROR_SEVERE = 0x2, SERVICE_ERROR_CRITICAL = 0x3, msidbServiceInstallErrorControlVital = 0x8000, SERVICEERRORCONTROL_NO_CHANGE = SERVICE_NO_CHANGE }
private enum ServiceStateRequest { SERVICE_ACTIVE = 0x1, SERVICE_INACTIVE = 0x2, SERVICE_STATE_ALL = (SERVICE_ACTIVE | SERVICE_INACTIVE) }
private enum ServiceControlType { SERVICE_CONTROL_STOP = 0x1, SERVICE_CONTROL_PAUSE = 0x2, SERVICE_CONTROL_CONTINUE = 0x3, SERVICE_CONTROL_INTERROGATE = 0x4, SERVICE_CONTROL_SHUTDOWN = 0x5, SERVICE_CONTROL_PARAMCHANGE = 0x6, SERVICE_CONTROL_NETBINDADD = 0x7, SERVICE_CONTROL_NETBINDREMOVE = 0x8, SERVICE_CONTROL_NETBINDENABLE = 0x9, SERVICE_CONTROL_NETBINDDISABLE = 0xA, SERVICE_CONTROL_DEVICEEVENT = 0xB, SERVICE_CONTROL_HARDWAREPROFILECHANGE = 0xC, SERVICE_CONTROL_POWEREVENT = 0xD, SERVICE_CONTROL_SESSIONCHANGE = 0xE, }
private enum ServiceState { SERVICE_STOPPED = 0x1, SERVICE_START_PENDING = 0x2, SERVICE_STOP_PENDING = 0x3, SERVICE_RUNNING = 0x4, SERVICE_CONTINUE_PENDING = 0x5, SERVICE_PAUSE_PENDING = 0x6, SERVICE_PAUSED = 0x7 }
private enum ServiceControlAccepted { SERVICE_ACCEPT_STOP = 0x1, SERVICE_ACCEPT_PAUSE_CONTINUE = 0x2, SERVICE_ACCEPT_SHUTDOWN = 0x4, SERVICE_ACCEPT_PARAMCHANGE = 0x8, SERVICE_ACCEPT_NETBINDCHANGE = 0x10, SERVICE_ACCEPT_HARDWAREPROFILECHANGE = 0x20, SERVICE_ACCEPT_POWEREVENT = 0x40, SERVICE_ACCEPT_SESSIONCHANGE = 0x80 }
private enum ServiceControlManagerType { SC_MANAGER_CONNECT = 0x1, SC_MANAGER_CREATE_SERVICE = 0x2, SC_MANAGER_ENUMERATE_SERVICE = 0x4, SC_MANAGER_LOCK = 0x8, SC_MANAGER_QUERY_LOCK_STATUS = 0x10, SC_MANAGER_MODIFY_BOOT_CONFIG = 0x20, SC_MANAGER_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SC_MANAGER_CONNECT | SC_MANAGER_CREATE_SERVICE | SC_MANAGER_ENUMERATE_SERVICE | SC_MANAGER_LOCK | SC_MANAGER_QUERY_LOCK_STATUS | SC_MANAGER_MODIFY_BOOT_CONFIG }
private enum ACCESS_TYPE { SERVICE_QUERY_CONFIG = 0x1, SERVICE_CHANGE_CONFIG = 0x2, SERVICE_QUERY_STATUS = 0x4, SERVICE_ENUMERATE_DEPENDENTS = 0x8, SERVICE_START = 0x10, SERVICE_STOP = 0x20, SERVICE_PAUSE_CONTINUE = 0x40, SERVICE_INTERROGATE = 0x80, SERVICE_USER_DEFINED_CONTROL = 0x100, SERVICE_ALL_ACCESS = STANDARD_RIGHTS_REQUIRED | SERVICE_QUERY_CONFIG | SERVICE_CHANGE_CONFIG | SERVICE_QUERY_STATUS | SERVICE_ENUMERATE_DEPENDENTS | SERVICE_START | SERVICE_STOP | SERVICE_PAUSE_CONTINUE | SERVICE_INTERROGATE | SERVICE_USER_DEFINED_CONTROL }

public static bool IsCurrentProcessAService()
{
return IsProcessAService(GetCurrentProcessId());
}

//public static bool IsProcessAService(int processId)
public static bool IsProcessAService(int processId)
{
IntPtr handle = IntPtr.Zero;
IntPtr buf = IntPtr.Zero;
try
{
handle = OpenSCManager(null, null, (int)ServiceControlManagerType.SC_MANAGER_ALL_ACCESS);
if(handle != IntPtr.Zero)
{
uint iBytesNeeded = 0;
uint iServicesReturned = 0;
uint iResumeHandle = 0;

ENUM_SERVICE_STATUS_PROCESS infoLevel = new ENUM_SERVICE_STATUS_PROCESS();
if(!EnumServicesStatusEx(handle, SC_ENUM_PROCESS_INFO, (int)ServiceType.SERVICE_WIN32, (int)ServiceStateRequest.SERVICE_STATE_ALL, IntPtr.Zero, 0, out iBytesNeeded, out iServicesReturned, ref iResumeHandle, null))
{
buf = Marshal.AllocHGlobal((int)iBytesNeeded);
if(!EnumServicesStatusEx(handle, SC_ENUM_PROCESS_INFO, (int)ServiceType.SERVICE_WIN32, (int)ServiceStateRequest.SERVICE_STATE_ALL, buf, iBytesNeeded, out iBytesNeeded, out iServicesReturned, ref iResumeHandle, null))
throw new Win32Exception(Marshal.GetLastWin32Error());

ENUM_SERVICE_STATUS_PROCESS serviceStatus;
int iPtr = buf.ToInt32();
for(int i = 0; i < (int)iServicesReturned; i++)
{
serviceStatus = (ENUM_SERVICE_STATUS_PROCESS)Marshal.PtrToStructure(new IntPtr(iPtr), typeof(ENUM_SERVICE_STATUS_PROCESS));

//System.Console.WriteLine("{0} - {1}", serviceStatus.pServiceName, serviceStatus.ServiceStatus.dwProcessId);

if(serviceStatus.ServiceStatus.dwProcessId == processId)
return true;

iPtr += ENUM_SERVICE_STATUS_PROCESS.SizeOf;
}
}
}

return false;
}
finally
{
if(handle != IntPtr.Zero)
CloseServiceHandle(handle);

if(buf != IntPtr.Zero)
Marshal.FreeHGlobal(buf);
}
}

[Krishnaa]

You can use CreateToolhelp32Snapshot & Process32First, Process32Next to find out the parent process ID (DWORD th32ParentProcessID; of PROCESSENTRY32 structure), you can check if that is srvany.exe(compare/substring search szExeFile of all process with possible "srvany.exe").