CHAPTER 14 - DEBUGGING WINDOWS SERVICES Service Basics Creating Windows Services – The API User Accounts Debugging Windows Services – Debugging the Core Code Debugging the Basic Service

Service Basics SCM (Service Control Manager) Maintains a database of installed services. RPC Server. Can be remotely accessed. Transmits control requests to running services. Starting Services at System Startup (or on user-demand). Maintains Status Info for running services.

Service Basics The Following Programs use the functions provided by the SCM – Service Program Executable code for a service. Service Configuration Program Install / Delete services. Modify configurations / Security Settings. Service Control Program Starts , Controls services by requesting the SCM.

Creating Windows Services – The API Writing Service Program’s Main() Can use main() or WinMain(). First call the StartServiceCtrlDispatcher. Pass a SERVICE_TABLE_ENTRY structure. This structure indicates the name and main entry point for you service. StartServiceCtrlDispatcher talks to SCM to start your service. SCM starts Control Dispatcher thread.

Creating Windows Services – The API Writing the ServiceMain() Control Dispatcher thread calls into your ServiceMain(). This entry point must register a handle SERVICE_STATUS_HANDLE with RegisterServiceCtrlHandlerEx(). It must then call SetServiceStatus() to communicate to the SCM, its status (starting, stopping, pausing).

Creating Windows Services – The API So what ??

Creating Windows Services – The API Your Service Program’s main() must call the StartServiceCtrlDispatcher within 30 seconds of starting. Your ServiceMain() must call SetServiceStatus within 82 seconds of starting. Else the SCM will terminate your service.

Creating Windows Service – User Account Every Service has an associated account. (Default = LocalService account). When a Service starts, the SCM logs on to the account. The System produces an access tokens and attaches it to the service process. The system compares the service’s access token to a securable object’s Security Descriptor before granting access.

Creating Windows Service – User Account Alternative for User Accounts – LocalService Anonymous Network Access (no password required) SE_AUDIT_NAME SE_CHANGE_NOTIFY_NAME SE_UNDOCK_NAME NetworkService Credentials Supplied to Remote Servers

Creating Windows Service – User Account Alternative for User Accounts – LocalSystem Account SE_ASSIGNPRIMARYTOKEN_NAME, SE_AUDIT_NAME SE_BACKUP_NAME, SE_CHANGE_NOTIFY_NAME SE_CREATE_PAGEFILE_NAME, SE_CREATE_PERMANENT_NAME SE_DEBUG_NAME, SE_INC_BASE_PRIORITY_NAME SE_INCREASE_QUOTA_NAME, SE_LOAD_DRIVER_NAME SE_CREATE_TOKEN_NAME, SE_LOCK_MEMORY_NAME SE_PROF_SINGLE_PROCESS_NAME, SE_RESTORE_NAME SE_SECURITY_NAME, SE_SHUTDOWN_NAME SE_SYSTEM_ENVIRONMENT_NAME, SE_TCB_NAME SE_SYSTEMTIME_NAME, SE_SYSTEM_PROFILE_NAME, SE_TAKE_OWNERSHIP_NAME , SE_UNDOCK_NAME

Debugging – The Core Code Ensure that – Service core code is on the same machine. Client code is also on the same machine. Log in using your developer account. Hence you do not have to worry about nasty security or network issues while debugging your logic. These pleasures are reserved for later !

Debugging – The Service Step 1 – Allow Service to interact with Desktop

Debugging – The Service Step 2 – Set your Service Identity Set you service to start under an administrator privilege to avoid security problems.

Debugging – The Service Step 3 – Attach to your Service

Debugging – The Service Step 3 – Attach to your Service

Debugging – The Service Alternative Method – (Attach to your Service) Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\YOUR SERVICE Value: Full path of the Debugger (REG_SZ)

Debugging – The Service Yet Another Method – (Attach to your Service) DebugBreakProcess() – Generates breakpoint exception in specified process. Invokes the debugger for just-in-time debugging.

Debugging – The Service A Reminder……… Your Service Program’s main() must call the StartServiceCtrlDispatcher within 30 seconds of starting. Your ServiceMain() must call SetServiceStatus within 82 seconds of starting. Else the SCM will terminate your service

Debugging – The Service Solutions – Use DebugView. Change SCM timeout limit typedef struct _SERVICE_STATUS { DWORD dwServiceType; DWORD dwCurrentState; DWORD dwControlsAccepted; DWORD dwWin32ExitCode; DWORD dwServiceSpecificExitCode; DWORD dwCheckPoint; SET TO ZERO DWORD dwWaitHint; INCREMENT } SERVICE_STATUS, *LPSERVICE_STATUS;