Cannot Interact with service using SERVICE_USER_DEFINED_CONTROL [SOLVED]

vishalgpt

Firstly sorry for such a lengthy code. I found this sample in codeproject. But when i try to run this. cmd.exe is not invoking. CustomMessageSender is working ok. But LaunchAppIntoDifferentSession()fails in launching the cmd.exe. Have i missed something. I tried a lot but failed. FileName : ServiceTwo

#pragma comment (lib,"WtsApi32.lib")
#pragma comment (lib,"UserEnv.lib")

#include
#include
#include
#include
#include
#include

//CUSTOM MESSAGE FOR SERVICE TO LAUNCH AN APP INTO SESSION 1
#define SERVICE_CONTROL_CUSTOM_MESSAGE 0x095

//ADD CUSTOM METHOD TO LAUNCH
BOOL LaunchAppIntoDifferentSession(LPWSTR appName, LPPROCESS_INFORMATION pi);

SERVICE_STATUS m_ServiceStatus;
SERVICE_STATUS_HANDLE m_ServiceStatusHandle;

BOOL bRunning =TRUE;

VOID WINAPI ServiceControlHandler(DWORD Opcode);

using namespace std;

VOID WINAPI ServiceControlHandler(DWORD Opcode)
{
PROCESS_INFORMATION pi;
LPWSTR appName = L"cmd.exe";
switch(Opcode)
{
case SERVICE_CONTROL_CUSTOM_MESSAGE:
LaunchAppIntoDifferentSession(appName, &pi);
break;
case SERVICE_CONTROL_PAUSE:
m_ServiceStatus.dwCurrentState = SERVICE_PAUSED;
break;
case SERVICE_CONTROL_CONTINUE:
m_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
break;
case SERVICE_CONTROL_STOP:
m_ServiceStatus.dwWin32ExitCode = 0;
m_ServiceStatus.dwCurrentState = SERVICE_STOPPED;
m_ServiceStatus.dwCheckPoint = 0;
m_ServiceStatus.dwWaitHint = 0;

	SetServiceStatus(m\_ServiceStatusHandle, &m\_ServiceStatus);
	bRunning = FALSE;
	break;
case SERVICE\_CONTROL\_INTERROGATE:
	break;
return;

}

BOOL LaunchAppIntoDifferentSession(LPWSTR appName,LPPROCESS_INFORMATION pi)
{
//PROCESS_INFORMATION pi;
STARTUPINFO si;
BOOL bResult = FALSE;
DWORD dwSessionID = 0, winLogonPid = 0, winLogonSessionID = 0, dwCreationFlags;
HANDLE hUserTokenDup, hPToken, hProcess;

dwSessionID = WTSGetActiveConsoleSessionId();

PROCESSENTRY32 procEntry;

HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS\_SNAPPROCESS,0);
if (hSnap == INVALID\_HANDLE\_VALUE)return 1;

procEntry.dwSize = sizeof(PROCESSENTRY32);

if (!Process32First(hSnap, &procEntry)) return 1;

do 
{
	if (wcscmp(procEntry.szExeFile,L"winlogon.exe") == 0)
	{
		ProcessIdToSessionId(procEntry.th32ProcessID, &winLogonSessionID);
		if (winLogonSessionID == dwSessionID)
		{
			winLogonPid = procEntry.th32ProcessID;
		}
	}
} while (Proce

Lost User

vishalgpt wrote:

I found this sample in codeproject.

Then you should post your question in the forum at the end of the article where you found it. That author of the code is the best person to help you.

Unrequited desire is character building. OriginalGriff

vishalgpt

i asked it here because since long time the author had not replied to any questions in his article.

Regards, Vishal

Lost User

Your original message gives no clue as to why the code fails; collect some diagnostic information and maybe people will be able to make some suggestions. It may also help if you post a link to the article.

Unrequited desire is character building. OriginalGriff

vishalgpt

Subverting Vista UAC in Both 32 and 64 bit Architectures[^] Service is installed correctly. But when i call the below code in CustomMessageSender.

OpenService(hSCM, SERVICE_NAME,SERVICE_USER_DEFINED_CONTROL);
bSuccess = ControlService(hMyService,SERVICE_CONTROL_CUSTOM_MESSAGE, &status);

bSuccess return TRUE; But the cmd.exe is not executed as called in LaunchAppIntoDifferentSession()

Lost User

Things to consider:

ControlService(hMyService,SERVICE_CONTROL_CUSTOM_MESSAGE, &status);

I presume this line causes ServiceControlHandler() to be called, which in turn calls LaunchAppIntoDifferentSession() which does lots of things, some of which return a result indicating success or failure. Unfortunately these results are not passed back up the line so you have no idea what happened in this function. Add some breakpoints in the LaunchAppIntoDifferentSession() function in order to find out what is happening.

Unrequited desire is character building. OriginalGriff

vishalgpt

dwSessionID = WTSGetActiveConsoleSessionId();

procEntry.dwSize = sizeof(PROCESSENTRY32);

if (!Process32First(hSnap, &procEntry)) return 1;

do
{
if (wcscmp(procEntry.szExeFile,L"winlogon.exe") == 0)
{
ProcessIdToSessionId(procEntry.th32ProcessID, &winLogonSessionID);
if (winLogonSessionID == dwSessionID)
{
winLogonPid = procEntry.th32ProcessID;
}
}
} while (Process32Next(hSnap, &procEntry));

Here the problem, i guess. Firstly WTSGetActiveConsoleSessionID is always 0 (ZERO); Secondly winlogon.exe SessionID is always 1 then how winLogonSessionID will be equal to dwSessionID(WTSGetActiveConsoleSessionID). please guide :confused::confused: :sigh: :(

Regards, Vishal

vishalgpt

Richard MacCutchan wrote:

Add some breakpoints in the LaunchAppIntoDifferentSession() function in order to find out what is happening.

Thank you sir, Everything now works like a charm...... Love you sir, and love u codeproject.... :thumbsup::thumbsup::thumbsup::thumbsup::thumbsup::thumbsup: :rose::rose::rose::rose::rose::rose::rose: :) :) :) :) :) :) :cool:

Regards, Vishal

vishalgpt

Ooops! There was a small mistake in WTSGetActiveConsoleSessionID() which result in return of Session id to zero only. Problem solved. :-\ :)

Regards, Vishal