【逆向】Windows服务逆向分析调试

前言

本文主要对Windows服务进行简要介绍，并对服务程序分析方法进行记录。

名词解释

服务进程：　　　　　　　//通过服务方式运行的可执行程序
服务控制程序：　　　　　//所有用于启动服务（StartService()）的程序，Windows中可以使用“services.msc”命令启动
服务控制管理器：　　　　//SCM（Service Control Manager），Windows中其实就是services.exe或者svchost.exe进程

服务Main函数：        //注册服务控制处理函数、设置服务运行状态、执行其它操作。
服务控制处理函数：     //SCM通过该回调函数设置服务运行状态。

启动流程

1、"服务控制程序" 调用StartService()启动服务，然后由SCM(services.exe)创建对应的 "服务进程"。
2、"服务进程" 在Main函数中调用StartServiceCtrlDispatcher()关联服务主线程，将 "服务Main函数" 地址提交给SCM。
3、SCM调用 "服务Main函数"。
4、"服务Main函数" 调用RegisterServiceCtrlHandler()注册 "服务控制处理函数"，然后调用SetServiceStatus()设置服务运行状态。

示例代码

#include <windows.h>
#include <tchar.h>
#include <stdio.h>

#define SVCNAME L"SvcTest"

VOID InstallService(LPCTSTR szSvcName, LPCTSTR szPath);
VOID UninstallService(LPCTSTR szSvcName);
VOID WINAPI SvcMain(DWORD argc, LPCTSTR *argv);
VOID WINAPI SvcCtrlHandler( DWORD dwCtrl );

SERVICE_STATUS_HANDLE g_hServiceStatusHandle = NULL;
SERVICE_STATUS g_ServiceStatus = {SERVICE_WIN32_OWN_PROCESS, 0, 0xFF, 0, 0, 0, 0};

//Main
void _tmain(int argc, TCHAR *argv[])
{ 
    TCHAR szPath[MAX_PATH] = {0,};
    SERVICE_TABLE_ENTRY DispatchTable[] = 
    { 
        { SVCNAME, (LPSERVICE_MAIN_FUNCTION)SvcMain }, 
        { NULL, NULL } 
    }; 

    //作为服务进程启动
    if( argc == 1 )
    {
        //关联服务主线程，将"服务Main函数"地址提交给SCM
        if (!StartServiceCtrlDispatcher( DispatchTable )) 
        { 
            _tprintf(L"StartServiceCtrlDispatcher() failed!!! [%d]\n", 
                GetLastError()); 
        }
    }
    //作为服务安装卸载程序启动
    else if( argc == 2 )
    {
        if( !GetModuleFileName(NULL, szPath, MAX_PATH) )
        {
            _tprintf(L"GetModuleFileName() failed! [%d]\n", 
                GetLastError());
            return;
        }

        if( _tcsicmp(argv[1], L"install") == 0 )
        {
            //安装服务
            InstallService(SVCNAME, szPath);
            return;
        }
        else if( _tcsicmp(argv[1], L"uninstall") == 0 )
        {
            //卸载服务
            UninstallService(SVCNAME);
            return;
        }
        else
        {
            _tprintf(L"Wrong parameters!!!\n");
        }
    }

    _tprintf(L"\nUSAGE : %s <install | uninstall>\n", argv[0]);
}

//创建服务
VOID InstallService(LPCTSTR szSvcName, LPCTSTR szPath)
{
    SC_HANDLE schSCManager = NULL;
    SC_HANDLE schService = NULL;
    DWORD dwError = 0;

    schSCManager = OpenSCManager( 
        NULL,                    // local computer
        NULL,                    // ServicesActive database 
        SC_MANAGER_ALL_ACCESS);  // full access rights 
    if( NULL == schSCManager ) 
    {
        _tprintf(L"InstallService() : OpenSCManager failed (%d)\n", GetLastError());
        return;
    }

    schService = CreateService( 
        schSCManager,              // SCM database 
        szSvcName,                 // name of service 
        szSvcName,                 // service name to display 
        SERVICE_ALL_ACCESS,        // desired access 
        SERVICE_WIN32_OWN_PROCESS, // service type 
        SERVICE_DEMAND_START,      // start type 
        SERVICE_ERROR_NORMAL,      // error control type 
        szPath,                    // path to service's binary 
        NULL,                      // no load ordering group 
        NULL,                      // no tag identifier 
        NULL,                      // no dependencies 
        NULL,                      // LocalSystem account 
        NULL);                     // no password 
    if( NULL == schService ) 
    {
        dwError = GetLastError();
        _tprintf(L"InstallService() : CreateService failed (%d)\n", dwError); 
        if( ERROR_SERVICE_EXISTS == dwError )
            _tprintf(L"  -> The specified service already exists.\n");
        goto _EXIT;
    }

    _tprintf(L"InstallService() : Service installed successfully\n"); 

_EXIT:
    if( schService )    CloseServiceHandle(schService); 
    if( schSCManager)   CloseServiceHandle(schSCManager);
}

//卸载服务
VOID UninstallService(LPCTSTR szSvcName)
{
    SC_HANDLE schSCManager = NULL;
    SC_HANDLE schService = NULL;
    SERVICE_STATUS ss = {0,};
    DWORD dwError = 0;

    schSCManager = OpenSCManager( 
        NULL,                    // local computer
        NULL,                    // ServicesActive database 
        SC_MANAGER_ALL_ACCESS);  // full access rights 
    if( NULL == schSCManager ) 
    {
        _tprintf(L"UninstallService() : OpenSCManager failed (%d)\n", GetLastError());
        return;
    }

    schService = OpenService( 
        schSCManager,       // SCM database 
        szSvcName,          // name of service 
        SERVICE_INTERROGATE |
        DELETE);            // need delete access 
    if( NULL == schService )
    { 
        dwError = GetLastError();
        if( dwError != ERROR_SERVICE_DOES_NOT_EXIST )
            _tprintf(L"UninstallService() : OpenSCManager failed (%d)\n", dwError);

        goto _EXIT;
    }
        
    ControlService(schService, SERVICE_CONTROL_INTERROGATE, &ss);
    if( ss.dwCurrentState != SERVICE_STOPPED )
    {
        _tprintf(L"  -> Service is running! Stop the service!!!\n");
        goto _EXIT;
    }

    if( !DeleteService(schService) ) 
        _tprintf(L"UninstallService() : DeleteService failed (%d)\n", GetLastError()); 
    else
        _tprintf(L"Service uninstalled successfully\n"); 

_EXIT:
    if( schService )    CloseServiceHandle(schService); 
    if( schSCManager )  CloseServiceHandle(schSCManager);
}

//服务Main（设置服务控制处理函数，修改服务运行状态）
VOID WINAPI SvcMain(DWORD argc, LPCTSTR *argv)
{
    // Service Control Handler
    g_hServiceStatusHandle = RegisterServiceCtrlHandler( 
        SVCNAME, 
        SvcCtrlHandler);
    if( !g_hServiceStatusHandle )
    { 
        OutputDebugString(L"RegisterServiceCtrlHandler() failed!!!"); 
        return; 
    } 

    // Service Status -> SERVICE_RUNNING
    g_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
    SetServiceStatus(g_hServiceStatusHandle, &g_ServiceStatus);

    // Print debug string
    while( TRUE )
    {
        OutputDebugString(L"[SvcTest] service is running...");
        Sleep(3 * 1000);        // 3 sec
    }
}

//服务控制处理函数
VOID WINAPI SvcCtrlHandler(DWORD dwCtrl)
{
   switch(dwCtrl) 
   {  
        //根据SCM传递过来的参数修改服务运行状态
        case SERVICE_CONTROL_STOP:
            g_ServiceStatus.dwCurrentState = SERVICE_STOP_PENDING;
            SetServiceStatus(g_hServiceStatusHandle, &g_ServiceStatus);
            
            g_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
            SetServiceStatus(g_hServiceStatusHandle, &g_ServiceStatus);

            OutputDebugString(L"[SvcTest] service is stopped...");
        break;
 
      default: 
         break;
   }
}

服务调试

1、直接设置EIP到服务Main函数

2、修改服务进程入口点代码为死循环，附加后改回原代码，继续往下调试