Geoff Chappell, Software Analyst
SVCHOST was not Microsoft’s first design for hosting service DLLs in a shared process. Right from Windows NT 3.51, SERVICES.EXE was not only the Services Control Manager but was also the host process for a baker’s dozen of service DLLs. Two more were added in Windows NT 4.0. Then the fun begins for historians, for despite the development of SVCHOST for Windows 2000, service DLLs continued to be written for running in the SERVICES process. Use of the Services Control Manager as a service host didn’t stop until Windows Vista.
There is no configurability for the sort of service DLL that is hosted by SERVICES. The names of the supported services and of their corresponding DLLs are hard-coded in the SERVICES executable. In the early versions, the calling point for starting the service is necessarily named ServiceEntry, and is essentially a ServiceMain with two extra arguments. Windows 2000 and higher allow that the name need not be ServiceEntry, but there is still no configurability: the function name joins the other names in being hard-coded, with ServiceEntry persisting as a default.
| Service | Service DLL | Entry Point | Supported SERVICES Versions |
|---|---|---|---|
| ALERTER | alrsvc.dll | SvcEntry_Alerter | 3.51 to 5.0 |
| AppMgmt | appmgmts.dll | SvcEntry_AppMgmt | 5.0 |
| BROWSER | browser.dll | SvcEntry_Browser | 3.51 to 5.0 |
| CiSvc | query.dll | SvcEntry_CiSvc | 5.0 |
| DHCP | dhcpcsvc.dll | SvcEntry_DHCP | 3.51 to 5.0 |
| dmserver | dmserver.dll | SvcEntry_dmserver | 5.0 |
| DnsCache | dnsrslvr.dll | SvcEntry_DnsCache | 5.0 |
| EVENTLOG | eventlog.dll | SvcEntry_Eventlog | 3.51 to 5.2 |
| LanmanServer | srvsvc.dll | SvcEntry_Server | 4.0 to 5.0 |
| LanmanWorkstation | wkssvc.dll | SvcEntry_Workstation | 3.51 to 5.0 |
| LMHOSTS | lmhsvc.dll | SvcEntry_LmHosts | 3.51 to 5.0 |
| MESSENGER | msgsvc.dll | SvcEntry_Messenger | 3.51 to 5.0 |
| NBT | nbtsvc.dll | 3.51 to 4.0 | |
| NtLmSsp | ntlmssps.dll | 3.51 to 4.0 | |
| NWCWorkstation | nwwks.dll | SvcEntry_NWCS | 3.51 to 5.0 |
| NwSapAgent | nwsap.dll | 3.51 to 4.0 | |
| PlugPlay | umpnpmgr.dll | SvcEntry_PlugPlay | 4.0 to 5.2 |
| ProtectedStorage | cryptsvc.dll | SvcEntry_ProtectedStorage | 5.0 |
| seclogon | seclogon.dll | SvcEntry_Seclogon | 5.0 |
| TCPIP | tcpipsvc.dll | 3.51 to 4.0 | |
| Telnet | telnet.dll | 3.51 to 4.0 | |
| TrkSvr | trksvr.dll | SvcEntry_TrkSvr | 5.0 |
| TrkWks | trkwks.dll | SvcEntry_TrkWks | 5.0 |
| W32Time | w32time.dll | SvcEntry_W32Time | 5.0 |
| Wmi | wmicore.dll | SvcEntry_WMI | 5.0 |
As of Windows Vista, all these services are adapted for hosting by SVCHOST, or are discontinued or otherwise re-implemented. However, SERVICES version 6.0 (from Windows Vista) does still have much of the code for hosting service DLLs. It’s just that its table of services to host is empty. Indeed, it seems most plausible that all the code remains in the source files, and is missed in the executable only because the compiler and linker determine that it is unreachable or unreferenced.