控制台下修改系统驱动状态的代码

控制台下修改系统驱动状态的代码

最近在sinister大哥的指点下，学习一些驱动方面的东西。在调一个程序很头痛...于是写了这个东西，可以安装，卸载，启动和停止驱动，也可以查询当前系统加载驱动的状况。
没什么高深的东西，只是调用Advapi32.lib中API来实现的...代码有点乱...
VC 6.0 sp5 + win2k pro
---------
多谢sinister大哥的指点..

#include <stdio.h>
#include <windows.h>
#include <Winsvc.h>

LPENUM_SERVICE_STATUS EnumServices(SC_HANDLE, LPDWORD);
BOOL InstallService(SC_HANDLE hSCManager, LPCTSTR ServiceName, LPCTSTR ServiceExe);
BOOL RemoveService(SC_HANDLE hSCManager, LPCTSTR ServiceName);
BOOL StartService(SC_HANDLE hSCManager, LPCTSTR ServiceName);
BOOL StopService(SC_HANDLE hSCManager, LPCTSTR ServiceName);
BOOL IsAdmin(void);
void err_show(char*);
void Usage(char*);

int main(int argc, char* argv[])
{
SC_HANDLE hSCManager = NULL;
int nRet = 0;

nRet = IsAdmin();
if(!nRet)
{
printf("Must administrator privilege!/n");
}

//
// 打开服务控制管理器
//
hSCManager = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
if(hSCManager == NULL)
{
fprintf(stderr, "OpenSCManager() failed. --err: %d/n", GetLastError());
return -1;
}

//
// 调用EnumServices列举系统中的服务
//
LPENUM_SERVICE_STATUS lpServices = NULL;
DWORD dwServicesReturned = 0;
lpServices = EnumServices(hSCManager, &dwServicesReturned);
if(lpServices == 0)
{
free(lpServices);
CloseServiceHandle(hSCManager);
return -1;
}

//
// 显示服务信息
//

if(argc == 2)
{
//
// 显示帮助信息
//
if(!stricmp(argv[1], "-h") || !stricmp(argv[1], "-help"))
{
Usage(argv[0]);
return 0;
}

for(DWORD i = 0; i < dwServicesReturned; i++, lpServices++)
{
if(!stricmp(lpServices->lpServiceName, argv[1]))
break;
}

if(i == dwServicesReturned)
{
printf("Service not found!/n");
free(lpServices);
CloseServiceHandle(hSCManager);
return -1;
}

printf("[%s]/n", lpServices->lpDisplayName);
printf("/tService Name: %s/n", lpServices->lpServiceName);
printf("/tService Type: ");
switch(lpServices->ServiceStatus.dwServiceType)
{
case SERVICE_FILE_SYSTEM_DRIVER: printf("File System Driver/n");
break;
case SERVICE_KERNEL_DRIVER: printf("Device Driver/n");
break;
default: printf("User-Mode Service/n");
break;
}

printf("/tState: ");
switch(lpServices->ServiceStatus.dwCurrentState)
{
case SERVICE_PAUSED: printf("PAUSED/n");
break;
case SERVICE_RUNNING: printf("RUNNING/n");
break;
case SERVICE_STOPPED: printf("STOPPED/n");
break;
default: printf("PENDING/n");
break;
}

free(lpServices);
CloseServiceHandle(hSCManager);
return 0;
}
if(argc == 1)
{
for(DWORD i = 0; i < dwServicesReturned; i++, lpServices++)
printf("%s [%s]/n", lpServices->lpServiceName,
lpServices->lpDisplayName);
printf("/n/t/tTotal %d Service(s)./n/n", dwServicesReturned);

free(lpServices);
CloseServiceHandle(hSCManager);
return 0;
}

// ------------------------
// 分析命令行参数
// ------------------------

//
// 安装服务
//
if(!stricmp(argv[1], "-install"))
{
if(argc != 4)
{
Usage(argv[0]);
return 0;
}
nRet = InstallService(hSCManager, argv[2], argv[3]);
if(!nRet)
{
printf("Install service failed./n");
return -1;
}
}

//
// 卸载服务
//
if(!stricmp(argv[1], "-remove"))
{
if(argc != 3)
{
Usage(argv[0]);
return 0;
}
nRet = RemoveService(hSCManager, argv[2]);
if(!nRet)
{
printf("Remove service failed./n");
return -1;
}
}

//
// 启动服务
//
if(!stricmp(argv[1], "-start"))
{
if(argc != 3)
{
Usage(argv[0]);
return 0;
}
nRet = StartService(hSCManager, argv[2]);
if(!nRet)
{
printf("Start service failed./n");
return -1;
}
}

//
// 停止服务
//
if(!stricmp(argv[1], "-stop"))
{
if(argc != 3)
{
Usage(argv[0]);
return 0;
}
nRet = StopService(hSCManager, argv[2]);
if(!nRet)
{
printf("Stop service failed./n");
return -1;
}
}
// -----------------------------------------------------

CloseServiceHandle(hSCManager);
return 0;
}

//
// EnumServices
// 列举系统的驱动
// ----------------------
// 参数：
// [IN] SC_HANDLE hSCManager 服务管理器句柄
// [OUT] LPDWORD lpdwServices 系统中安装的驱动的数量
// 返回值：
// 成功返回ENUM_SERVICE_STATUS结构的指针,否则返回NULL
//
LPENUM_SERVICE_STATUS EnumServices(SC_HANDLE hSCManager, LPDWORD lpdwServices)
{
DWORD cbBytesNeeded = 0;
DWORD cbBufSize = 0;
DWORD dwServicesReturned = 0;

int nRet = 0;

//
// 首次调用EnumServicesStatus确定缓冲区的大小,由cbBytesNeeded返回
//
nRet = EnumServicesStatus(
hSCManager,
SERVICE_DRIVER,
SERVICE_STATE_ALL,
NULL,
0,
&cbBytesNeeded,
lpdwServices,
0);

LPENUM_SERVICE_STATUS lpServices = (LPENUM_SERVICE_STATUS) malloc(cbBytesNeeded);

cbBufSize = cbBytesNeeded;

nRet = EnumServicesStatus(
hSCManager,
SERVICE_DRIVER,
SERVICE_STATE_ALL,
lpServices,
cbBufSize,
&cbBytesNeeded,
lpdwServices,
0);
if(nRet == 0)
{
err_show("EnumServicesStatus()");
return NULL;
}

return lpServices;
}

//
// InstallService
// 安装服务
// 参数：
// [IN] SC_HANDLE hSCManager 服务管理器句柄
// [IN] LPCTSTR ServiceName 服务名称
// [IN] LPCTSTR ServiceExe 可执行文件(需全路径)
// 输出：
// 成功：返回TRUE，否则返回FALSE
//
BOOL InstallService(SC_HANDLE hSCManager, LPCTSTR ServiceName, LPCTSTR ServiceExe)
{
SC_HANDLE schService;

//
// so #$%@! ...:)
//
printf("Install %s... ", ServiceExe);
schService = CreateService( hSCManager, // SCManager database
ServiceName, // name of service
ServiceName, // name to display
SERVICE_ALL_ACCESS, // desired access
SERVICE_KERNEL_DRIVER, // service type
SERVICE_DEMAND_START, // start type
SERVICE_ERROR_NORMAL, // error control type
ServiceExe, // service's binary
NULL, // no load ordering group
NULL, // no tag identifier
NULL, // no dependencies
NULL, // LocalSystem account
NULL // no password
);
if (schService == NULL)
{
if(GetLastError() == ERROR_SERVICE_EXISTS)
{
printf("Service has already installed!/n");
}
err_show("CreateService()");
return FALSE;
}
printf("Ok!/n");

CloseServiceHandle(schService);
return TRUE;
}

//
// StartService
// 启动服务
// ----------------
// 参数：
// [IN] SC_HANDLE hSCManager 服务管理器句柄
// [IN] LPCTSTR ServiceName 驱动名称
// 返回值：
// 成功返回TRUE，否则返回FALSE
//
BOOL StartService(SC_HANDLE hSCManager, LPCTSTR ServiceName)
{
SC_HANDLE schService = NULL;
int nRet = 0;

schService = OpenService(hSCManager, ServiceName, SERVICE_ALL_ACCESS);
if(schService == NULL)
{
if(GetLastError() == ERROR_SERVICE_DOES_NOT_EXIST)
{
printf("Service is not exist!/n");
return FALSE;
}
err_show("OpenService()");
return FALSE;
}

nRet = StartService(schService, 0, NULL);
if(!nRet)
{
if(GetLastError() == ERROR_SERVICE_ALREADY_RUNNING)
{
printf("Service is already running!/n");
return nRet;
}
err_show("StartService()");
}

CloseServiceHandle(schService);
return nRet;
}

//
// StopService
// 停止驱动
// ---------------
// 参数：
// [IN] SC_HANDLE hSCManager 服务管理器句柄
// [IN] LPCTSTR ServiceName 服务名称
// 返回值：
// 成功返回TRUE，否则返回FALSE
//
BOOL StopService(SC_HANDLE hSCManager, LPCTSTR ServiceName)
{
SC_HANDLE schService = NULL;
SERVICE_STATUS ServiceStatus;
int nRet = 0;

schService = OpenService(hSCManager, ServiceName, SERVICE_ALL_ACCESS);
if(schService == NULL)
return FALSE;

nRet = ControlService(schService, SERVICE_CONTROL_STOP, &ServiceStatus);
if(!nRet)
{
switch(GetLastError())
{
case ERROR_SERVICE_NOT_ACTIVE:
printf("Service has stopped!/n");
return nRet;

case ERROR_INVALID_SERVICE_CONTROL:
printf("The requested control code is not valid!/n");
return nRet;
}
err_show("ControlService()");
}

CloseServiceHandle(schService);
return nRet;
}

//
// RemoveService
// 卸载服务
// ------------
// 参数：
// [IN] SC_HANDLE hSCManager 服务管理器句柄
// [IN] LPCTSTR ServiceName 服务名称
// 返回值：
// 成功返回TRUE，否则返回FALSE
//
BOOL RemoveService(SC_HANDLE hSCManager, LPCTSTR ServiceName)
{
SC_HANDLE schService;
int nRet = 0;

schService = OpenService(hSCManager, ServiceName, SERVICE_ALL_ACCESS);
if(schService == NULL)
return FALSE;

nRet = DeleteService(schService);
if(!nRet)
{
err_show("DeleteService()");
}

CloseServiceHandle(schService);

return nRet;
}

//
// IsAdmin
// 判断当前用户是否有Administrator的权限
// -----------------------------------------
// 参数：
// N/A
// 返回值：
// 若具有权限返回TRUE，否则返回FALSE
//
BOOL IsAdmin(void)
{
HANDLE hAccessToken;
BYTE *InfoBuffer;
PTOKEN_GROUPS ptgGroups;
DWORD dwInfoBufferSize;
PSID psidAdministrators;
SID_IDENTIFIER_AUTHORITY siaNtAuthority = SECURITY_NT_AUTHORITY;
UINT i;
BOOL bRet = FALSE;

if(!OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY,&hAccessToken))
goto cleanup;

InfoBuffer = new BYTE[1024];
if(!InfoBuffer)
goto cleanup;

bRet = GetTokenInformation(hAccessToken,
TokenGroups,
InfoBuffer,
1024,
&dwInfoBufferSize);

CloseHandle(hAccessToken);

if(!bRet)
goto cleanup;

if( !AllocateAndInitializeSid(&siaNtAuthority,
2,
SECURITY_BUILTIN_DOMAIN_RID,
DOMAIN_ALIAS_RID_ADMINS,
0,0,0,0,0,0,
&psidAdministrators) )
goto cleanup;

bRet = FALSE;

ptgGroups = (PTOKEN_GROUPS)InfoBuffer;

for(i = 0; i < ptgGroups->GroupCount; i++)
{
if(EqualSid(psidAdministrators,ptgGroups->Groups[i].Sid))
{
bRet = TRUE;
break;
}
}

FreeSid(psidAdministrators);

cleanup:

if(InfoBuffer)
delete InfoBuffer;

return bRet;
}

void err_show(char* msg)
{
fprintf(stderr, "%s failed. --err: %d/n", msg, GetLastError());
}

void Usage(char* msg)
{
printf("+------------------------------+/n");
printf("| Services tool v0.1 |/n");
printf("| Write By CDrea |/n");
printf("| 2004-11-1 |/n");
printf("| thx to sinister |/n");
printf("|

http://www.safechina.net/ |/n");
printf("+------------------------------+/n");
printf("USAGE:/n");
printf(" %s [[-install srv exe] | [-remove srv] | [-start srv] | [-stop srv]] [srv]/n/n", msg);
printf(" %s Show all service/n", msg);
printf(" %s srv Show status of srv_name/n", msg);
printf(" -install srv exe Install a service, and must full path of exe/n");
printf(" -remove srv Remove a service/n");
printf(" -start srv Start a service/n");
printf(" -stop srv Stop a service/n");
printf("eg./n");
printf(" %s -install fw c://fw.sys", msg);
}