Re: How can I tell if I'm running as a service

From: Old Fart (oldfart_at_newsgroups.nospam)
Date: 08/11/04 

Date: Wed, 11 Aug 2004 08:32:32 -0700

I'm not entirely comfortable with this approach. In particular, my reading
of the meaning of SECURITY_SERVICE_RID is that the account is authorized to
run services, not necessarily that the process is running as a service.
Also, the code is so ugly that I'd feel compelled to completely rewrite it.

One approach that occurred to me would be to check to see if the parent
process was services.exe. My main discomfort here is relying on the
particular name "services.exe". Any suggestions on a better way to
determine if a particular process is the service manager?

Then, I also noticed that I could trace the lineage of service processes all
the way back to process 0. On the other hand, I could not do that for my
user mode processes. So, another possibility would be to try to trace back
to process 0. If I could not get to process 0, then I'm not a service. If
I can, then I might be a service and I'll call StartServiceCtrlDispatcher
and see whether or not it fails.

Any comments on the relative merits of these three approaches (including the
process token approach)? Any better ideas?

"William DePalo [MVP VC++]" <willd.no.spam@mvps.org> wrote in message
news:e%23tVRh0fEHA.3988@tk2msftngp13.phx.gbl...
> "Old Fart" <oldfart@newsgroups.nospam> wrote in message
> news:ulg1rOzfEHA.396@TK2MSFTNGP12.phx.gbl...
> > Can someone suggest a fast way to tell whether or not my application is
> > being started as a service? (Please do not suggest using command line
> > parameters.)
>
> You may want to take a look at the heuristic demonstrated here:
>
> http://win32.mvps.org/security/is_svc.html
>
> Regards,
> Will
>
>

Relevant Pages

  • Re: [PATCH][GIT PULL] tracing/wakeup: move access to wakeup_cpu into spinlock
    ... I believe this is the fix for the oops that Maneesh saw. ... he did sounds like it would trigger the race. ... just reading the trace in a while loop. ...
    (Linux-Kernel)
  • Re: Incoming Call Tracing
    ... logic would suggest that they could back trace. ... made on your account certainly for past 3months. ... Yeah ithink they can do it......but ... How about getting caller display? ...
    (uk.telecom)
  • Re: Computer crash
    ... The software and associated registry keys are gone, so yeah, all trace of PP ... access which accounts, so if Party and Empire share that info, they could ... Somehow I doubt they would turn you down for an Empire account on ...
    (rec.gambling.poker)
  • Re: OT Help with posting
    ... Giganews is exactly the same (they themsleves ... could trace you but would only do so if you were spamming) you'd have ... individual net has in their terms and conditions that you ... They need a real address to post your account name and password to but as ...
    (alt.support.diabetes)
  • Re: OT PayPal
    ... At the moment we are trying to trace and resolve the provenience of this matter, so please get involved in helping us trace these bruteforcing attempts. ... Use the link below to access our mainframe database and confirm the information we have on file for your account. ... PayPal is committed in assisting law enforcement with any inquires related to attempts to misappropriate personal information with the intent to commit fraud or theft. ... Or better still copy the source code of the email then post it here as these scammers can be pesky so and so's and disguise the links destination, but you should be able too see how in the source code of the email. ...
    (uk.sport.football.clubs.celtic)