如何得到NT服务可执行文件的所在路经？

[ttoomm]

谢谢！

[DentistryDoctor]

一般来说可以在注册表里取得，多数服务都有一个ImagePath的键值。

[danyueer]

调用序列：
OpenService
QueryServiceConfig

例子：
VOID GetSampleServiceConfig()
{
LPQUERY_SERVICE_CONFIG lpqscBuf;
LPSERVICE_DESCRIPTION lpqscBuf2;
DWORD dwBytesNeeded;

// Open a handle to the service.

schService = OpenService(
schSCManager, // SCManager database
"Sample_Srv", // name of service
SERVICE_QUERY_CONFIG); // need QUERY access
if (schService == NULL)
MyErrorExit("OpenService");

// Allocate a buffer for the configuration information.

lpqscBuf = (LPQUERY_SERVICE_CONFIG) LocalAlloc(
LPTR, 4096);
if (lpqscBuf == NULL)
MyErrorExit("LocalAlloc");

lpqscBuf2 = (LPSERVICE_DESCRIPTION) LocalAlloc(
LPTR, 4096);
if (lpqscBuf2 == NULL)
MyErrorExit("LocalAlloc");

// Get the configuration information.

if (! QueryServiceConfig(
schService,
lpqscBuf,
4096,
&dwBytesNeeded) )
{
MyErrorExit("QueryServiceConfig");
}

if (! QueryServiceConfig2(
schService,
SERVICE_CONFIG_DESCRIPTION,
lpqscBuf2,
4096,
&dwBytesNeeded) )
{
MyErrorExit("QueryServiceConfig2");
}

// Print the configuration information.

printf("\nSample_Srv configuration: \n");
printf(" Type: 0x%x\n", lpqscBuf->dwServiceType);
printf(" Start Type: 0x%x\n", lpqscBuf->dwStartType);
printf(" Error Control: 0x%x\n", lpqscBuf->dwErrorControl);
printf(" Binary path: %s\n", lpqscBuf->lpBinaryPathName); // <<====== 注意！这里就是你要的！

if (lpqscBuf->lpLoadOrderGroup != NULL)
printf(" Load order group: %s\n", lpqscBuf->lpLoadOrderGroup);
if (lpqscBuf->dwTagId != 0)
printf(" Tag ID: %d\n", lpqscBuf->dwTagId);
if (lpqscBuf->lpDependencies != NULL)
printf(" Dependencies: %s\n", lpqscBuf->lpDependencies);
if (lpqscBuf->lpServiceStartName != NULL)
printf(" Start Name: %s\n", lpqscBuf->lpServiceStartName);
if (lpqscBuf2->lpDescription != NULL)
printf(" Description: %s\n", lpqscBuf2->lpDescription);

LocalFree(lpqscBuf);
LocalFree(lpqscBuf2);
}

[lzzqqq]

先用
GetServiceKeyName();
得到注册表对应该服务的健值信息。
再取该键的
"GetServiceKeyName"
值.