创建Service程序并监控有界面的进程实现

直接上代码，比较简单，容易看懂。

需要注意的是：启动的监控程序默认桌面是WinLogon，如果登陆成功后，被启动的程序，需要设置活动桌面。（通过OpenInputDesktop和GetUserObjectInformation当前的活动桌面，然后通过SetThreadDesktop设置线程桌面）

// RemoteControlService.cpp : Defines the entry point for the console application.

//

#include "stdafx.h"

#include "RemoteControlService.h"

#include <Winsvc.h>

#include "CommonClas.h"

#ifdef _DEBUG

#define new DEBUG_NEW

#endif

TCHAR szServiceName[] = _T("Win8 Server");

DWORD dwThreadID;

HANDLE hEvent = INVALID_HANDLE_VALUE;

SERVICE_STATUS status;

SERVICE_STATUS_HANDLE hServiceStatus;

void Init();

BOOL IsServiceInstalled();

BOOL InstallService();

BOOL UninstallService();

BOOL ServiceCtrlStart();

BOOL ServiceCtrlStop();

void WINAPI ServiceMain();

void WINAPI ServiceStrl(DWORD dwOpcode);

BOOL RunRemoteControl();

// The one and only application object

CWinApp theApp;

using namespace std;

int _tmain(int argc, TCHAR* argv[], TCHAR* envp[])

{

int nRetCode = 0;

// initialize MFC and print and error on failure

if (!AfxWinInit(::GetModuleHandle(NULL), NULL, ::GetCommandLine(), 0))

{

// TODO: change error code to suit your needs

_tprintf(_T("Fatal Error: MFC initialization failed\n"));

nRetCode = 1;

}

else

{

// TODO: code your application's behavior here.

}

Init();

dwThreadID = ::GetCurrentThreadId();

SERVICE_TABLE_ENTRY st[] =

{

{ szServiceName, (LPSERVICE_MAIN_FUNCTION)ServiceMain },

{ NULL, NULL }

};

TCHAR *lpCmdLine = argv[1];

if ( argc == 2 )

{

BOOL bRet;

if (wcsicmp(lpCmdLine, L"/install") == 0)

{

bRet = InstallService();

if ( bRet == TRUE )

{

printf( "Install service %s success", szServiceName );

}

else

{

printf( "Install service %s failed", szServiceName );

}

}

else if (wcsicmp(lpCmdLine, L"/uninstall") == 0)

{

bRet = UninstallService();

if ( bRet == TRUE )

{

printf( "Uninstall service %s success", szServiceName );

}

else

{

printf( "Uninstall service %s failed", szServiceName );

}

// 杀掉进程

CToolFunction::bProcessExist(_T("Win8_Server.exe"), TRUE);

}

else if (wcsicmp(lpCmdLine, L"/start") == 0)

{

bRet = ServiceCtrlStart();

if ( bRet == TRUE )

{

printf( "Start service %s success", szServiceName );

}

else

{

printf( "Start service %s failed", szServiceName );

}

}

else if (wcsicmp(lpCmdLine, L"/stop") == 0)

{

bRet = ServiceCtrlStop();

if ( bRet == TRUE )

{

printf( "Stop service %s success", szServiceName );

}

else

{

printf( "Stop service %s failed", szServiceName );

}

}

else

{

if (!::StartServiceCtrlDispatcher(st))

{

//LogEvent(_T("Register Service Main Function Error!"));

}

}

}

else

{

if (!::StartServiceCtrlDispatcher(st))

{

//LogEvent(_T("Register Service Main Function Error!"));

}

}

return nRetCode;

}

// 功能描述：初始化相关结构

void Init()

{

hServiceStatus = NULL;

status.dwServiceType = SERVICE_WIN32_OWN_PROCESS;

status.dwCurrentState = SERVICE_STOPPED;

status.dwControlsAccepted = SERVICE_ACCEPT_STOP;

status.dwWin32ExitCode = 0;

status.dwServiceSpecificExitCode = 0;

status.dwCheckPoint = 0;

status.dwWaitHint = 0;

}

// 功能描述：启动第三方程序

BOOL RunRemoteControl()

{

HANDLE hToken;

HDESK hdesk;

HWINSTA hwinsta;

PROCESS_INFORMATION pi;

STARTUPINFO si;

//HANDLE hExp = GetProcessHandle(L"EXPLORER.EXE");

HANDLE hExp = CToolFunction::GetProcessHandle(L"Winlogon.exe");

while (hExp == NULL)

{

hExp = CToolFunction::GetProcessHandle(L"Winlogon.exe");

Sleep(100);

}

OpenProcessToken(hExp, TOKEN_ALL_ACCESS, &hToken);

if(hToken == NULL)

{

return FALSE;

}

HWND hDesk = GetDesktopWindow();

// BOOL bOk = ImpersonateLoggedOnUser(hToken);

// GenericLog(Info,"ImpersonateLoggedOnUser %s",bOk?"Ok":"Failed");

//GenericLog(Info,"Desktop HWND %s",(hDesk == GetDesktopWindow())?"Equal":"Not Equal");

// obtain a handle to the interactive windowstation

hwinsta = OpenWindowStation( _T("winsta0"), FALSE, READ_CONTROL|WRITE_DAC );

if (hwinsta == NULL)

{

return FALSE;

}

HWINSTA hwinstaold = GetProcessWindowStation();

if (!SetProcessWindowStation(hwinsta))

{

return FALSE;

}

// obtain a handle to the "default" desktop

hdesk = OpenDesktop(

_T("Winlogon"),

0,

FALSE,

READ_CONTROL | WRITE_DAC |

DESKTOP_WRITEOBJECTS | DESKTOP_READOBJECTS

);

if (hdesk == NULL)

{

return FALSE;

}

// close the handles to the interactive windowstation and desktop

CloseWindowStation(hwinsta);

CloseDesktop(hdesk);

ZeroMemory(&si, sizeof(STARTUPINFO));

si.cb = sizeof(STARTUPINFO);

si.lpDesktop = _T("winsta0\\Winlogon");

TCHAR szParameter[10] = {0};

if(CreateProcessAsUser(hToken, CToolFunction::oGetCurPath()+_T("\\Win8_Server.exe"), szParameter, NULL, NULL, FALSE, CREATE_NO_WINDOW, NULL, NULL, &si, &pi))

{

CloseHandle(pi.hProcess);

CloseHandle(pi.hThread);

}

SetProcessWindowStation(hwinstaold);

return TRUE;

}

// 功能描述：服务主线程函数，既用户选择开启服务时调用的函数

void WINAPI ServiceMain()

{

// Register the control request handler

status.dwCurrentState = SERVICE_START_PENDING;

status.dwControlsAccepted = SERVICE_ACCEPT_STOP;

//注册服务控制

hServiceStatus = RegisterServiceCtrlHandler(szServiceName, ServiceStrl);

if (hServiceStatus == NULL)

{

return;

}

SetServiceStatus(hServiceStatus, &status);

//如下代码可以为启动服务前的准备工作

hEvent = ::CreateEvent( NULL, TRUE, FALSE, NULL );

if ( hEvent == NULL )

{

status.dwCurrentState = SERVICE_STOPPED;

SetServiceStatus(hServiceStatus, &status);

return;

}

//更改服务状态为启动

status.dwWin32ExitCode = S_OK;

status.dwCheckPoint = 0;

status.dwWaitHint = 0;

status.dwCurrentState = SERVICE_RUNNING;

SetServiceStatus(hServiceStatus, &status);

//等待用户选择停止服务，

//当然你也可以把你的服务代码用线程来执行，

//此时这里只需等待线程结束既可。

// 启动第三方程序

RunRemoteControl();

while ( WaitForSingleObject( hEvent, 3000 ) != WAIT_OBJECT_0 )

{

if (!CToolFunction::bProcessExist(_T("Win8_Server.exe")))

{

// 启动第三方程序

RunRemoteControl();

}

}

//

//停止服务

status.dwCurrentState = SERVICE_STOPPED;

SetServiceStatus(hServiceStatus, &status);

}

// 功能描述：服务控制函数

void WINAPI ServiceStrl(DWORD dwOpcode)

{

switch (dwOpcode)

{

case SERVICE_CONTROL_STOP:

status.dwCurrentState = SERVICE_STOP_PENDING;

SetServiceStatus(hServiceStatus, &status);

//告诉服务线程停止工作

::SetEvent( hEvent );

break;

case SERVICE_CONTROL_PAUSE:

break;

case SERVICE_CONTROL_CONTINUE:

break;

case SERVICE_CONTROL_INTERROGATE:

break;

case SERVICE_CONTROL_SHUTDOWN:

break;

default:

;

}

}

// 功能描述：判断服务是否已安装

BOOL IsServiceInstalled()

{

BOOL bResult = FALSE;

//打开服务控制管理器

SC_HANDLE hSCM = ::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);

if (hSCM != NULL)

{

//打开服务

SC_HANDLE hService = ::OpenService(hSCM, szServiceName, SERVICE_QUERY_CONFIG);

if (hService != NULL)

{

bResult = TRUE;

::CloseServiceHandle(hService);

}

::CloseServiceHandle(hSCM);

}

return bResult;

}

// 功能描述：安装服务

BOOL InstallService()

{

if (IsServiceInstalled())

return TRUE;

//打开服务控制管理器

SC_HANDLE hSCM = ::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);

if (hSCM == NULL)

{

return FALSE;

}

// Get the executable file path

TCHAR szFilePath[MAX_PATH];

::GetModuleFileName(NULL, szFilePath, MAX_PATH);

//创建服务

SC_HANDLE hService = ::CreateService(

hSCM,

szServiceName,

szServiceName,

SERVICE_ALL_ACCESS,

SERVICE_WIN32_OWN_PROCESS|SERVICE_INTERACTIVE_PROCESS,

SERVICE_AUTO_START, //如果为SERVICE_DEMAND_START则表示此服务需手工启动

SERVICE_ERROR_NORMAL,

szFilePath,

NULL,

NULL,

_T("RPCSS\0"),

NULL,

NULL);

if (hService == NULL)

{

::CloseServiceHandle(hSCM);

return FALSE;

}

::CloseServiceHandle(hService);

::CloseServiceHandle(hSCM);

return TRUE;

}

// 功能描述：删除服务

BOOL UninstallService()

{

if (!IsServiceInstalled())

return TRUE;

SC_HANDLE hSCM = ::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);

if (hSCM == NULL)

{

return FALSE;

}

SC_HANDLE hService = ::OpenService(hSCM, szServiceName, SERVICE_STOP | DELETE);

if (hService == NULL)

{

::CloseServiceHandle(hSCM);

return FALSE;

}

SERVICE_STATUS status;

::ControlService(hService, SERVICE_CONTROL_STOP, &status);

// 删除服务

BOOL bDelete = ::DeleteService(hService);

::CloseServiceHandle(hService);

::CloseServiceHandle(hSCM);

if (bDelete)

return TRUE;

//LogEvent(_T("Service could not be deleted"));

return FALSE;

}

// 功能描述：开启服务

BOOL ServiceCtrlStart()

{

BOOL bRet;

SC_HANDLE hSCM;

SC_HANDLE hService;

hSCM=OpenSCManager(NULL,NULL,SC_MANAGER_CONNECT);

if (hSCM!=NULL)

{

hService=OpenService( hSCM, szServiceName, SERVICE_START);

if (hService!=NULL)

{

//开始Service

bRet = StartService(hService,0,NULL);

CloseServiceHandle(hService);

}

else

{

bRet = FALSE;

}

CloseServiceHandle(hSCM);

}

else

{

bRet = FALSE;

}

return bRet;

}

// 功能描述：停止服务

BOOL ServiceCtrlStop()

{

BOOL bRet;

SC_HANDLE hSCM;

SC_HANDLE hService;

SERVICE_STATUS ServiceStatus;

hSCM=OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );

if (hSCM!=NULL)

{

hService=OpenService( hSCM, szServiceName, SERVICE_STOP|SERVICE_QUERY_STATUS );

if (hService!=NULL)

{

QueryServiceStatus( hService, &ServiceStatus );

if (ServiceStatus.dwCurrentState == SERVICE_RUNNING)

{

bRet = ControlService( hService, SERVICE_CONTROL_STOP, &ServiceStatus );

}

else

{

bRet = FALSE;

}

CloseServiceHandle( hService );

}

else

{

bRet = FALSE;

}

CloseServiceHandle( hSCM );

}

else

{

bRet = FALSE;

}

return bRet;

}