Services: Fall back to registry for protected configuration changes

SystemInformer/actions.c

@@ -463,8 +463,6 @@ BOOLEAN PhUiConnectToPhSvcEx(
                 {
                     ULONG attempts = 10;
 
-                    started = TRUE;
-
                     // Try to connect several times because the server may take
                     // a while to initialize.
                     do
@@ -478,11 +476,21 @@ BOOLEAN PhUiConnectToPhSvcEx(
 
                     } while (--attempts != 0);
 
-                    // Increment the reference count even if we failed.
-                    // We don't want to prompt the user again.
-
-                    PhSvcCurrentMode = Mode;
-                    _InterlockedIncrement(&PhSvcReferenceCount);
+                    if (NT_SUCCESS(status))
+                    {
+                        started = TRUE;
+                        PhSvcCurrentMode = Mode;
+                        _InterlockedIncrement(&PhSvcReferenceCount);
+                    }
+                    else
+                    {
+                        PhShowStatus(
+                            WindowHandle,
+                            L"Unable to connect to the service helper.",
+                            status,
+                            0
+                            );
+                    }
                 }
             }
         }

SystemInformer/include/phsettings.h

@@ -264,6 +264,7 @@ EXT ULONG PhCsProcessMonitorCacheLimit;
 #define SETTING_ENABLE_SERVICE_NON_POLL_NOTIFY                      L"EnableServiceNonPollNotify"
 #define SETTING_ENABLE_SERVICE_STAGE2                               L"EnableServiceStage2"
 #define SETTING_ENABLE_SERVICE_PROGRESS_DIALOG                      L"EnableServiceProgressDialog"
+#define SETTING_ENABLE_SERVICE_REGISTRY_FALLBACK                    L"EnableServiceRegistryFallback"
 #define SETTING_ENABLE_SHELL_EXECUTE_SKIP_IFEO_DEBUGGER             L"EnableShellExecuteSkipIfeoDebugger"
 #define SETTING_ENABLE_STAGE2                                       L"EnableStage2"
 #define SETTING_ENABLE_STREAMER_MODE                                L"EnableStreamerMode"

SystemInformer/include/phsvcapi.h

@@ -13,8 +13,13 @@
 #ifndef PH_PHSVCAPI_H
 #define PH_PHSVCAPI_H
 
+#ifdef DEBUG
+#define PHSVC_PORT_NAME (L"\\BaseNamedObjects\\SiSvcApiPortDebug")
+#define PHSVC_WOW64_PORT_NAME (L"\\BaseNamedObjects\\SiSvcWow64ApiPortDebug")
+#else
 #define PHSVC_PORT_NAME (L"\\BaseNamedObjects\\SiSvcApiPort")
 #define PHSVC_WOW64_PORT_NAME (L"\\BaseNamedObjects\\SiSvcWow64ApiPort")
+#endif
 
 typedef enum _PHSVC_API_NUMBER
 {
@@ -167,10 +172,14 @@ typedef union _PHSVC_API_CHANGESERVICECONFIG
         PH_RELATIVE_STRINGREF Password;
         PH_RELATIVE_STRINGREF DisplayName;
         BOOLEAN TagIdSpecified;
+        BOOLEAN DelayedStartSpecified;
+        BOOLEAN DelayedStart;
+        BOOLEAN RegistryFallbackAllowed;
     } i;
     struct
     {
         ULONG TagId;
+        BOOLEAN RegistryFallbackUsed;
     } o;
 } PHSVC_API_CHANGESERVICECONFIG, *PPHSVC_API_CHANGESERVICECONFIG;
 

SystemInformer/include/phsvccl.h

@@ -96,6 +96,25 @@ NTSTATUS PhSvcCallChangeServiceConfig(
     _In_opt_ PCWSTR DisplayName
     );
 
+PHAPPAPI
+NTSTATUS PhSvcCallChangeServiceConfigEx(
+    _In_ PCWSTR ServiceName,
+    _In_ ULONG ServiceType,
+    _In_ ULONG StartType,
+    _In_ ULONG ErrorControl,
+    _In_opt_ PCWSTR BinaryPathName,
+    _In_opt_ PCWSTR LoadOrderGroup,
+    _Out_opt_ PULONG TagId,
+    _In_opt_ PCWSTR Dependencies,
+    _In_opt_ PCWSTR ServiceStartName,
+    _In_opt_ PCWSTR Password,
+    _In_opt_ PCWSTR DisplayName,
+    _In_ BOOLEAN DelayedStartSpecified,
+    _In_ BOOLEAN DelayedStart,
+    _In_ BOOLEAN RegistryFallbackAllowed,
+    _Out_ PBOOLEAN RegistryFallbackUsed
+    );
+
 PHAPPAPI
 NTSTATUS PhSvcCallChangeServiceConfig2(
     _In_ PCWSTR ServiceName,

SystemInformer/main.c

@@ -98,6 +98,7 @@ INT WINAPI wWinMain(
     PhInitializeCallbacks();
 
     if (PhEnableKsiSupport &&
+        !PhStartupParameters.PhSvc &&
         !PhStartupParameters.ShowOptions)
     {
         PhInitializeKsi();

SystemInformer/phsvc/clapi.c

@@ -542,7 +542,7 @@ NTSTATUS PhSvcCallCreateService(
     return status;
 }
 
-NTSTATUS PhSvcCallChangeServiceConfig(
+NTSTATUS PhSvcCallChangeServiceConfigEx(
     _In_ PCWSTR ServiceName,
     _In_ ULONG ServiceType,
     _In_ ULONG StartType,
@@ -553,7 +553,11 @@ NTSTATUS PhSvcCallChangeServiceConfig(
     _In_opt_ PCWSTR Dependencies,
     _In_opt_ PCWSTR ServiceStartName,
     _In_opt_ PCWSTR Password,
-    _In_opt_ PCWSTR DisplayName
+    _In_opt_ PCWSTR DisplayName,
+    _In_ BOOLEAN DelayedStartSpecified,
+    _In_ BOOLEAN DelayedStart,
+    _In_ BOOLEAN RegistryFallbackAllowed,
+    _Out_ PBOOLEAN RegistryFallbackUsed
     )
 {
     NTSTATUS status;
@@ -578,6 +582,10 @@ NTSTATUS PhSvcCallChangeServiceConfig(
     m.p.u.ChangeServiceConfig.i.StartType = StartType;
     m.p.u.ChangeServiceConfig.i.ErrorControl = ErrorControl;
     m.p.u.ChangeServiceConfig.i.TagIdSpecified = TagId != NULL;
+    m.p.u.ChangeServiceConfig.i.DelayedStartSpecified = DelayedStartSpecified;
+    m.p.u.ChangeServiceConfig.i.DelayedStart = DelayedStart;
+    m.p.u.ChangeServiceConfig.i.RegistryFallbackAllowed = RegistryFallbackAllowed;
+    *RegistryFallbackUsed = FALSE;
 
     status = STATUS_NO_MEMORY;
 
@@ -626,6 +634,8 @@ NTSTATUS PhSvcCallChangeServiceConfig(
 
     if (NT_SUCCESS(status))
     {
+        *RegistryFallbackUsed = m.p.u.ChangeServiceConfig.o.RegistryFallbackUsed;
+
         if (TagId)
             *TagId = m.p.u.ChangeServiceConfig.o.TagId;
     }
@@ -648,6 +658,41 @@ NTSTATUS PhSvcCallChangeServiceConfig(
     return status;
 }
 
+NTSTATUS PhSvcCallChangeServiceConfig(
+    _In_ PCWSTR ServiceName,
+    _In_ ULONG ServiceType,
+    _In_ ULONG StartType,
+    _In_ ULONG ErrorControl,
+    _In_opt_ PCWSTR BinaryPathName,
+    _In_opt_ PCWSTR LoadOrderGroup,
+    _Out_opt_ PULONG TagId,
+    _In_opt_ PCWSTR Dependencies,
+    _In_opt_ PCWSTR ServiceStartName,
+    _In_opt_ PCWSTR Password,
+    _In_opt_ PCWSTR DisplayName
+    )
+{
+    BOOLEAN registryFallbackUsed;
+
+    return PhSvcCallChangeServiceConfigEx(
+        ServiceName,
+        ServiceType,
+        StartType,
+        ErrorControl,
+        BinaryPathName,
+        LoadOrderGroup,
+        TagId,
+        Dependencies,
+        ServiceStartName,
+        Password,
+        DisplayName,
+        FALSE,
+        FALSE,
+        FALSE,
+        &registryFallbackUsed
+        );
+}
+
 PVOID PhSvcpPackRoot(
     _Inout_ PPH_BYTES_BUILDER BytesBuilder,
     _In_ PVOID Buffer,

SystemInformer/phsvc/svcapi.c

@@ -797,6 +797,8 @@ NTSTATUS PhSvcApiChangeServiceConfig(
     PPH_STRING displayName = NULL;
     ULONG tagId = 0;
     SC_HANDLE serviceHandle;
+    BOOLEAN serviceConfigChanged = FALSE;
+    BOOLEAN registryFallbackUsed = FALSE;
 
     if (!NT_SUCCESS(status = PhSvcCaptureString(&Payload->u.ChangeServiceConfig.i.ServiceName, FALSE, &serviceName)))
         goto CleanupExit;
@@ -833,13 +835,48 @@ NTSTATUS PhSvcApiChangeServiceConfig(
 
         if (NT_SUCCESS(status))
         {
+            serviceConfigChanged = TRUE;
             Payload->u.ChangeServiceConfig.o.TagId = tagId;
+
+            if (Payload->u.ChangeServiceConfig.i.DelayedStartSpecified)
+            {
+                status = PhSetServiceDelayedAutoStart(
+                    serviceHandle,
+                    Payload->u.ChangeServiceConfig.i.DelayedStart
+                    );
+            }
         }
 
         PhCloseServiceHandle(serviceHandle);
     }
 
+    if (
+        status == STATUS_ACCESS_DENIED &&
+        (!password || serviceConfigChanged) &&
+        Payload->u.ChangeServiceConfig.i.RegistryFallbackAllowed
+        )
+    {
+        status = PhChangeServiceConfigRegistry(
+            &serviceName->sr,
+            serviceConfigChanged ? SERVICE_NO_CHANGE : Payload->u.ChangeServiceConfig.i.ServiceType,
+            serviceConfigChanged ? SERVICE_NO_CHANGE : Payload->u.ChangeServiceConfig.i.StartType,
+            serviceConfigChanged ? SERVICE_NO_CHANGE : Payload->u.ChangeServiceConfig.i.ErrorControl,
+            serviceConfigChanged ? NULL : PhGetString(binaryPathName),
+            serviceConfigChanged ? NULL : PhGetString(loadOrderGroup),
+            serviceConfigChanged ? NULL : PhGetString(serviceStartName),
+            serviceConfigChanged ? NULL : PhGetString(displayName),
+            Payload->u.ChangeServiceConfig.i.DelayedStartSpecified,
+            Payload->u.ChangeServiceConfig.i.DelayedStart
+            );
+
+        if (NT_SUCCESS(status))
+            registryFallbackUsed = TRUE;
+    }
+
 CleanupExit:
+    if (NT_SUCCESS(status))
+        Payload->u.ChangeServiceConfig.o.RegistryFallbackUsed = registryFallbackUsed;
+
     PhClearReference(&displayName);
 
     if (password)

SystemInformer/phsvc/svcapiport.c

@@ -262,7 +262,25 @@ VOID PhSvcHandleConnectionRequest(
         clientId.UniqueProcess = (HANDLE)message64->h.ClientId.UniqueProcess;
         clientId.UniqueThread = (HANDLE)message64->h.ClientId.UniqueThread;
 
-#if defined(PH_BUILD_API)
+#if defined(DEBUG)
+        PPH_STRING referenceFileName;
+        PPH_STRING remoteFileName;
+
+        referenceFileName = NULL;
+        PhGetProcessImageFileNameByProcessId(NtCurrentProcessId(), &referenceFileName);
+        PH_AUTO(referenceFileName);
+
+        remoteFileName = NULL;
+        PhGetProcessImageFileNameByProcessId(clientId.UniqueProcess, &remoteFileName);
+        PH_AUTO(remoteFileName);
+
+        if (PhIsNullOrEmptyString(referenceFileName) || PhIsNullOrEmptyString(remoteFileName) || !PhEqualString(referenceFileName, remoteFileName, FALSE))
+        {
+            NtAcceptConnectPort(&portHandle, NULL, PortMessage, FALSE, NULL, NULL);
+            return;
+        }
+#endif // DEBUG
+#if defined(PH_BUILD_API) && !defined(DEBUG)
         PPH_STRING remoteFileName;
 
         remoteFileName = NULL;
@@ -274,7 +292,7 @@ VOID PhSvcHandleConnectionRequest(
             NtAcceptConnectPort(&portHandle, NULL, PortMessage, FALSE, NULL, NULL);
             return;
         }
-#endif // PH_BUILD_API
+#endif // PH_BUILD_API && !DEBUG
     }
     else
     {
@@ -302,7 +320,7 @@ VOID PhSvcHandleConnectionRequest(
             return;
         }
 #endif // DEBUG
-#if defined(PH_BUILD_API)
+#if defined(PH_BUILD_API) && !defined(DEBUG)
         remoteFileName = NULL;
         clientId = message->h.ClientId;
         PhGetProcessImageFileNameByProcessId(clientId.UniqueProcess, &remoteFileName);
@@ -313,7 +331,7 @@ VOID PhSvcHandleConnectionRequest(
             NtAcceptConnectPort(&portHandle, NULL, PortMessage, FALSE, NULL, NULL);
             return;
         }
-#endif // PH_BUILD_API
+#endif // PH_BUILD_API && !DEBUG
     }
 
     client = PhSvcCreateClient(&clientId);

SystemInformer/settings.c

@@ -63,6 +63,7 @@ VOID PhAddDefaultSettings(
     PhpAddIntegerSetting(SETTING_ENABLE_SERVICE_NON_POLL_NOTIFY, L"1");
     PhpAddIntegerSetting(SETTING_ENABLE_SERVICE_STAGE2, L"0");
     PhpAddIntegerSetting(SETTING_ENABLE_SERVICE_PROGRESS_DIALOG, L"1");
+    PhpAddIntegerSetting(SETTING_ENABLE_SERVICE_REGISTRY_FALLBACK, L"0");
     PhpAddIntegerSetting(SETTING_ENABLE_SHELL_EXECUTE_SKIP_IFEO_DEBUGGER, L"1");
     PhpAddIntegerSetting(SETTING_ENABLE_STAGE2, L"1");
     PhpAddIntegerSetting(SETTING_ENABLE_STREAMER_MODE, L"0");