Geoff Chappell, Software Analyst
This structure is available to service DLLs that use SERVICES as a host process. It is instantiated in SERVICES.EXE and is passed to service DLLs when SERVICES calls their ServiceEntry function.
typedef struct _SVCS_GLOBAL_DATA { PSID NullSid; // S-1-0-0 PSID WorldSid; // S-1-1-0 PSID LocalSid; // S-1-2-0 PSID NetworkSid; // S-1-5-2 PSID LocalSystemSid; // S-1-5-18 #if _WIN32_WINNT >= _WIN32_WINNT_WINXP PSID LocalServiceSid; // S-1-5-19 PSID NetworkServiceSid; // S-1-5-20 #endif PSID BuiltinDomainSid; // S-1-5-32 PSID AuthenticatedUserSid; // S-1-5-11 PSID AliasAdminsSid; // S-1-5-32-544 PSID AliasUsersSid; // S-1-5-32-545 PSID AliasGuestsSid; // S-1-5-32-546 PSID AliasPowerUsersSid; // S-1-5-32-547 PSID AliasAccountOpsSid; // S-1-5-32-548 PSID AliasSystemOpsSid; // S-1-5-32-549 PSID AliasPrintOpsSid; // S-1-5-32-550 PSID AliasBackupOpsSid; // S-1-5-32-551 LPSTART_RPC_SERVER StartRpcServer; LPSTOP_RPC_SERVER StopRpcServer; #if _WIN32_WINNT <= _WIN32_WINNT_WIN2K LPNET_BIOS_OPEN NetBiosOpen; LPNET_BIOS_CLOSE NetBiosClose; LPNET_BIOS_RESET NetBiosReset; #endif LPCWSTR Group; // L"ntsvcs" #if _WIN32_WINNT >= _WIN32_WINNT_WIN2K BOOL IsSetupInProgress; #else LPADD_WORK_ITEM AddWorkItem; LPREMOVE_WORK_ITEM RemoveWorkItem; #endif } SVCS_GLOBAL_DATA;
Though the name SVCS_GLOBAL_DATA is known from Microsoft’s published symbol files, all other names are inventions, including the following type definitions for function pointers:
typedef long (WINAPI *LPSTART_RPC_SERVER) (RPC_WSTR, RPC_IF_HANDLE); typedef long (WINAPI *LPSTOP_RPC_SERVER) (RPC_IF_HANDLE); typedef VOID (WINAPI *LPNET_BIOS_OPEN) (VOID); typedef VOID (WINAPI *LPNET_BIOS_CLOSE) (VOID); typedef DWORD (WINAPI *LPNET_BIOS_RESET (DWORD); typedef PVOID (WINAPI *LPADD_WORK_ITEM) (HANDLE, LPWORK_ITEM_CALLBACK, PVOID, DWORD, DWORD, PVOID); typedef BOOL (WINAPI *LPREMOVE_WORK_ITEM (PVOID);
in which
typedef VOID (WINAPI *LPWORK_ITEM_CALLBACK) (PVOID, DWORD);
Many of the members, from the start of the structure, are addresses of well-known SIDs. Though preparing these things is straightforward, it is a chore which is much better done once, i.e., by SERVICES, for use by all. Note that SIDs for the LOCAL SERVICE and NETWORK SERVICE accounts are provided only in version 5.1 and higher.
Several members are addresses of functions which do things that may be wanted by more than one service DLL and are either convenient to have coded for common use or actually do need to be.
The SVCS_GLOBAL_DATA structure is prepared by SERVICES version 3.51 and higher. It is passed to service DLLs in versions before 6.0, and presumably would be in version 6.0 also: it is still prepared but there are no service DLLs to pass it to.
Use of SERVICES as a host for service DLLs is not a general feature. Names for the services and their corresponding DLLs must be hard-coded in the SERVICES executable. If you like, the feature is technologically internal to Microsoft. Contrast with the generality of running service DLLs in a SVCHOST process, which also is private to Microsoft, but only by being undocumented. This article exists for historical reference.