Solved

RegisterServiceProcess function

Posted on 2002-04-17
7
1,805 Views
Last Modified: 2008-02-01
Hi,

I have a program which uses the RegisterServiceProcess function to hide from the process list in Win9x.

The way I use it is like this:

I declare the function above the implementation line:

function RegisterServiceProcess(dwProcessID, dwType: DWord): DWord;stdcall; external 'KERNEL32.DLL' name 'RegisterServiceProcess';

implementation
....


Then I call it like this in the form-create event:

RegisterServiceProcess(GetCurrentProcessId(),1);

This works fine on Win9x and the program is infact hidden.

However, when I try to run the program on WinNT, I get an error saying that the procedure can not be found in Kernel32.dll which is pretty easy to understand because it is not available in NT/2k/XP

To prevent seeing this message I decided to detect which operating system the program is run on, and if it is Windows 9x, then dynamically load kernel32.dll and call the function.  Something like this:

procedure TfrmBase.FormCreate(Sender: TObject);
var
extprocRegisterServiceProcess : function (dwProcessID, dwType: DWord): DWord;
begin
//here I check which windows is running, if it is Win9x I run the following code:    
hndKernel:=LoadLibrary('KERNEL32.DLL');
    @extprocRegisterServiceProcess := getProcAddress(hndKernel,'RegisterServiceProcess');
    extprocRegisterServiceProcess(GetCurrentProcessId(), 1);
FreeLibrary(hndKernel);
end;

This just WONT work when run on Win9x!  If it is done in the formcreate event I'll either get an access violation or a strange error saying that project1.exe has caused an error in <unknown> at address <unknown> or something.  Then the program crashes.

If, however, I place the code in the onclick event of a button, either nothing happens or I get an access violation.  Atleast the function call fails because the program does not get hidden from the process list.


So in other words,  I need to be able to dynamically call the function RegisterServiceProcess from kernel32.dll to hide my program from the processlist in Win9x.  I can not do it by declaring the function like this:
function RegisterServiceProcess(dwProcessID, dwType: DWord): DWord;stdcall; external 'KERNEL32.DLL' name 'RegisterServiceProcess';

because then I'll get a nasty error when I run the program on WinNT/2k/XP

How can I do this?
0
Comment
Question by:hagur
  • 4
  • 3
7 Comments
 
LVL 17

Expert Comment

by:inthe
ID: 6949737
hi
from paq:


declare it as a type example:


type
  TRegisterServiceProcess = function (dwProcessID, dwType: DWord): DWord;

var
    Nt2k : Boolean;
    h  : THandle;
    RegisterServiceProcess: TRegisterServiceProcess;

//implementation

//form create

var
 os: TOSVersionInfo;
begin
  os.dwOSVersionInfoSize := sizeof(os);
  GetVersionEx(os);
  if os.dwPlatformId = VER_PLATFORM_WIN32_NT
 then nt2k := true
  else
   begin
    Nt2k := false;
    h := LoadLibrary('kernel32.dll');
   if h <> 0 then @RegisterServiceProcess := GetProcAddress(h, 'RegisterServiceProcess');
  end
end


//also formclose

if h <> 0 then FreeLibrary(h);
0
 
LVL 3

Author Comment

by:hagur
ID: 6951034
Thank you for this Inthe, I'm going to test this as soon as I can.
0
 
LVL 3

Author Comment

by:hagur
ID: 6952063
HI Inthe, I tried your solution.  I declared it as a type and then I put it into the formcreate event like this:

procedure TForm1.FormCreate(Sender: TObject);
var
  os: TOSVersionInfo;
begin
  os.dwOSVersionInfoSize := sizeof(os);
  GetVersionEx(os);
  if os.dwPlatformId = VER_PLATFORM_WIN32_NT then
    nt2k := true
  else
    begin
      Nt2k := false;
      h := LoadLibrary('kernel32.dll');
      if h <> 0 then begin
        @RegisterServiceProcess := GetProcAddress(h, 'RegisterServiceProcess');
      end;
    end;
end;

Then I ran the program on Win9x and nothing happened.  Then I noticed that the function RegisterServiceProcess is never called.

Then I added this line:
RegisterServiceProcess(GetCurrentProcessID(),1);
below the line:
@RegisterServiceProcess := GetProcAddress(h, 'RegisterServiceProcess');

Now when I run the program I get an access violation and the program does not hide from the process list.

What am I doing wrong?
0
Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

 
LVL 17

Accepted Solution

by:
inthe earned 150 total points
ID: 6952660
hi,
yep sorry me too i never etsted it before so tried another approach.
ive tested the following on win2k and win98 it seems to work better:


  public
    { Public declarations }
  end;
 type
  MyRegisterServiceProcess = function(dwProcessID, dwType: DWord) : DWord; stdcall;

const
  SimpleService = 1;
  UnRegisterSimpleService = 0;

 var
  Form1: TForm1;
   h  : THandle;
   RegisterServiceProcess: MyRegisterServiceProcess;

implementation

{$R *.dfm}

procedure HideProgram(ProgramID : DWORD; ShowHide : Boolean);
begin
  if @RegisterServiceProcess = nil then
    Raise(Exception.Create('This is not win9*'));
  if ShowHide then
    RegisterServiceProcess(ProgramID,SimpleService)
  else
    RegisterServiceProcess(ProgramID, UnRegisterSimpleService);
end;


procedure TForm1.FormCreate(Sender: TObject);
begin
@RegisterServiceProcess := nil;
if Win32Platform <> VER_PLATFORM_WIN32_NT then
  begin
    h := GetModuleHandle('Kernel32');
    if h = 0 then Exit;
    RegisterServiceProcess := GetProcAddress(h,'RegisterServiceProcess');
    HideProgram(GetCurrentProcessId,True);
  end
end;

procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
if h <> 0 then FreeLibrary(h);
end;

Hope this is working better for you  :)

Regards Barry
0
 
LVL 3

Author Comment

by:hagur
ID: 6953369
Thanks again, this looks alot better :-)

I'm gonna see if this works.
0
 
LVL 3

Author Comment

by:hagur
ID: 6955902
Hi again,

I just managed to test your code and I can safely say that it works flawlessly!  Thank you very much for your effort.

I decided to increase the points a bit, because it was very important for me to get a solution, and now I have it.
0
 
LVL 17

Expert Comment

by:inthe
ID: 6956623
ok thankyou :)
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Objective: - This article will help user in how to convert their numeric value become words. How to use 1. You can copy this code in your Unit as function 2. than you can perform your function by type this code The Code   (CODE) The Im…
Have you ever had your Delphi form/application just hanging while waiting for data to load? This is the article to read if you want to learn some things about adding threads for data loading in the background. First, I'll setup a general applica…
In a recent question (https://www.experts-exchange.com/questions/28997919/Pagination-in-Adobe-Acrobat.html) here at Experts Exchange, a member asked how to add page numbers to a PDF file using Adobe Acrobat XI Pro. This short video Micro Tutorial sh…
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

823 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question