{"id":6548,"date":"2020-08-20T22:24:41","date_gmt":"2020-08-20T22:24:41","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=6548"},"modified":"2020-08-20T22:24:41","modified_gmt":"2020-08-20T22:24:41","slug":"sc-and-its-quirky-cmd-line-args","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2020\/08\/20\/sc-and-its-quirky-cmd-line-args\/","title":{"rendered":"SC and its quirky cmd line args"},"content":{"rendered":"\n<p>I wrote it long time ago and just discovered it in my drafts folder.<\/p>\n\n\n\n<p><em>Sc.exe<\/em> is a popular native OS program used to control services. We see\/use it pretty often but rarely look at its rich and less-known options. This post tries to map these options to APIs and control codes that are being used by <em>sc.exe<\/em> to communicate with the services. <\/p>\n\n\n\n<p>So, yes, it turns out that many of <em>sc.exe<\/em> options are just a convenient wrapper for standard Windows Service functions. If you ever programmed and built at least one service process the commands offered by the<em> sc.exe <\/em>will sound very familiar to you. We can create a service, we can start it, we can pause it, we can query its status and its many parameters, and we can stop it. We can finally remove it. And in-between we can send various control codes to it too. Pretty straightforward.<\/p>\n\n\n\n<p>Let&#8217;s walk through all options one by one:<\/p>\n\n\n\n<ul><li>query<ul><li>Queries the status for a service, or enumerates the status for types of services.<\/li><li>-> EnumQueryServicesStatus<\/li><\/ul><\/li><li>queryex<ul><li>Queries the extended status for a service, or enumerates the status for types of services.<\/li><li>-> EnumQueryServicesStatus<\/li><\/ul><\/li><li>start<ul><li>Starts a service.<\/li><li>-> StartServiceW<\/li><\/ul><\/li><li>pause<ul><li>Sends a PAUSE control request to a service.<\/li><li>-> SERVICE_CONTROL_PAUSE<\/li><\/ul><\/li><li>interrogate<ul><li>Sends an INTERROGATE control request to a service.<\/li><li>-> SERVICE_CONTROL_INTERROGATE<\/li><\/ul><\/li><li>continue<ul><li>Sends a CONTINUE control request to a service.<\/li><li>-> SERVICE_CONTROL_CONTINUE<\/li><\/ul><\/li><li>stop<ul><li>Sends a STOP request to a service.<\/li><li>-> SERVICE_CONTROL_STOP<\/li><\/ul><\/li><li>config<ul><li>Changes the configuration of a service (persistent).<\/li><li>-> ChangeServiceConfig2W<\/li><\/ul><\/li><li>description<ul><li>Changes the description of a service.<\/li><li>-> ChangeServiceConfig2W<\/li><\/ul><\/li><li>failure<ul><li>Changes the actions taken by a service upon failure.<\/li><li> -> ChangeServiceConfig2W <\/li><\/ul><\/li><li>failureflag<ul><li>Changes the failure actions flag of a service.<\/li><li>  -> ChangeServiceConfig2W  <\/li><\/ul><\/li><li>sidtype<ul><li>Changes the service SID type of a service.<\/li><li>   -> ChangeServiceConfig2W   <\/li><\/ul><\/li><li>privs<ul><li>Changes the required privileges of a service.<\/li><li>  -> ChangeServiceConfig2W  <\/li><\/ul><\/li><li>managedaccount<ul><li>Changes the service to mark the service account password as managed by LSA.<\/li><li>   -> ChangeServiceConfig2W   <\/li><\/ul><\/li><li>qc<ul><li>Queries the configuration information of a service.<\/li><li>-> QueryServiceConfig2W<\/li><\/ul><\/li><li>qdescription<ul><li>Queries the description of a service.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qfailure<ul><li>Queries the actions taken by a service upon failure.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qfailureflag<ul><li>Queries the failure actions flag of a service.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qsidtype<ul><li>Queries the service SID type of a service.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qprivs<ul><li>Queries the required privileges of a service.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qtriggerinfo<ul><li>Queries the trigger parameters of a service.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qpreferrednode<ul><li>Queries the preferred NUMA node of a service.<\/li><li>   -> ChangeServiceConfig2W   <\/li><\/ul><\/li><li>qmanagedaccount<ul><li>Queries whether a services uses an account with a password managed by LSA.<\/li><li> -> QueryServiceConfig2W <\/li><\/ul><\/li><li>qprotection<ul><li>Queries the process protection level of a service.<\/li><li>-> QueryServiceConfig2<\/li><\/ul><\/li><li>quserservice<ul><li>Queries for a local instance of a user service template.<\/li><li>-> QueryLocalUserServiceName<\/li><\/ul><\/li><li>delete<ul><li>Deletes a service (from the Registry).<\/li><li>-> DeleteService<\/li><\/ul><\/li><li>create<ul><li>Creates a service. (adds it to the Registry).<\/li><li>-> CreateServiceW<\/li><\/ul><\/li><li>control<ul><li>Sends a control to a service.<\/li><li>A wrapper for  <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/api\/winsvc\/nf-winsvc-controlservice\">ControlService<\/a>  <ul><li>paramchange<ul><li>SERVICE_CONTROL_PARAMCHANGE<\/li><\/ul><\/li><li>netbindadd<ul><li>SERVICE_CONTROL_NETBINDADD<\/li><\/ul><\/li><li>netbindremove<ul><li>SERVICE_CONTROL_NETBINDREMOVE<\/li><\/ul><\/li><li>netbindenable<ul><li>SERVICE_CONTROL_NETBINDENABLE<\/li><\/ul><\/li><li>netbinddisable<ul><li> SERVICE_CONTROL_NETBINDDISABLE <\/li><\/ul><\/li><li>&lt;any integer value><ul><li>any control code &#8211; either predefined, or service-specific<\/li><\/ul><\/li><\/ul><\/li><\/ul><\/li><li>sdshow<ul><li>Displays a service&#8217;s security descriptor.<\/li><li>-> QueryServiceObjectSecurity<\/li><\/ul><\/li><li>sdset<ul><li>Sets a service&#8217;s security descriptor.<\/li><li>-> SetServiceObjectSecurity<\/li><\/ul><\/li><li>showsid<ul><li>Displays the service SID string corresponding to an arbitrary name.<\/li><li>-> QueryServiceConfig2W<\/li><\/ul><\/li><li>triggerinfo<ul><li>Configures the trigger parameters of a service.<\/li><li>   -> ChangeServiceConfig2W   <\/li><\/ul><\/li><li>preferrednode<ul><li>Sets the preferred NUMA node of a service.<\/li><\/ul><\/li><li>GetDisplayName<ul><li>Gets the DisplayName for a service.<\/li><li>-> GetServiceDisplayNameW<\/li><\/ul><\/li><li>GetKeyName<ul><li>Gets the ServiceKeyName for a service.<\/li><li>-> GetServiceKeyNameW<\/li><\/ul><\/li><li>EnumDepend<ul><li>Enumerates Service Dependencies.<\/li><li>-> EnumDependentServicesW<\/li><\/ul><\/li><li>boot<ul><li>(ok | bad) Indicates whether the last boot should be saved as the last-known-good boot configuration<\/li><li>-> NdrClientCall4<\/li><\/ul><\/li><li>Lock<ul><li>Locks the Service Database<\/li><li>-> NdrClientCall4<\/li><\/ul><\/li><li>QueryLock<ul><li>Queries the LockStatus for the SCManager Database<\/li><li> -> NdrClientCall4 <\/li><\/ul><\/li><\/ul>\n\n\n\n<p>Now that we have this out of the way, I can reveal why I was attracted to looking at these config options in a first place. It is the <em>bufsize=<\/em> command line argument I have never used before.<\/p>\n\n\n\n<p>It lets you decide how large the buffer will be when a specific API or control code is being sent to the service. Make it too small, and you get an error. Make it too big, and it&#8217;s an error too. Interesting.<\/p>\n\n\n\n<p>For instance, if you run <em>sc query<\/em>, you will get a list of all services. If you run <em>sc query bufsize= 100<\/em> though, the command will fail.<\/p>\n\n\n\n<p>Plus, if there is a default hard-coded inside the <em>sc.exe<\/em>, then will I, by making the service parameters always outside of the default size, make <em>sc<\/em> fail to report unless I actually use the <em>bufsize=<\/em> command line argument that is allocating buffer large enough to hold all the data?<\/p>\n\n\n\n<p>Another interesting bit is that you can use <em>sc control<\/em> command to determine the status of the service instead of sc query or sc qc e.g:<\/p>\n\n\n\n<p>sc control SysmonDrv 4<\/p>\n\n\n\n<p>shows:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote\"><p>SERVICE_NAME: SysmonDrv<br>         TYPE               : 1  KERNEL_DRIVER<br>         STATE              : 4  RUNNING<br>                                 (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)<br>         WIN32_EXIT_CODE    : 0  (0x0)<br>         SERVICE_EXIT_CODE  : 0  (0x0)<br>         CHECKPOINT         : 0x0<br>         WAIT_HINT          : 0x0<\/p><\/blockquote>\n\n\n\n<p>This is because control code 4 is actually SERVICE_CONTROL_INTERROGATE.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I wrote it long time ago and just discovered it in my drafts folder. Sc.exe is a popular native OS program used to control services. We see\/use it pretty often but rarely look at its rich and less-known options. This &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2020\/08\/20\/sc-and-its-quirky-cmd-line-args\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,53],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6548"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=6548"}],"version-history":[{"count":6,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6548\/revisions"}],"predecessor-version":[{"id":7401,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/6548\/revisions\/7401"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=6548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=6548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=6548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}