【原创】驱动卸载之ControlService函数

1. BOOL WINAPI ControlService(
2. _In_ SC_HANDLE hService,
3. _In_ DWORD dwControl,
4. _Out_ LPSERVICE_STATUS lpServiceStatus
5. );

函数作用：给指定的服务发送一个控制码

参数：

1. hService： OpenService 或CreateService function返回的服务句柄；

2. dwControl：要发送的控制码，控制码可以是下列系统定义的控制码；也可以是用户自定义的控制码，范围是128-255，需要有SERVICE_USER_DEFINED_CONTROL权限。

Control code	Meaning
SERVICE_CONTROL_CONTINUE 0x00000003	Notifies a paused service that it should resume. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. （恢复服务，需要SERVICE_PAUSE_CONTINUE权限）
SERVICE_CONTROL_INTERROGATE 0x00000004	Notifies a service that it should report its current status information to the service control manager. The hService handle must have the SERVICE_INTERROGATE access right. Note that this control is not generally useful as the SCM is aware of the current state of the service. （向SCM报告服务的当前状态信息，需要有SERVICE_INTERROGATE权限）
SERVICE_CONTROL_NETBINDADD 0x00000007	Notifies a network service that there is a new component for binding. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. However, this control code has been deprecated; use Plug and Play functionality instead. （网络绑定相关，已废弃）
SERVICE_CONTROL_NETBINDDISABLE 0x0000000A	Notifies a network service that one of its bindings has been disabled. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. However, this control code has been deprecated; use Plug and Play functionality instead. （网络绑定相关，已废弃）
SERVICE_CONTROL_NETBINDENABLE 0x00000009	Notifies a network service that a disabled binding has been enabled. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. However, this control code has been deprecated; use Plug and Play functionality instead. （网络绑定相关，已废弃）
SERVICE_CONTROL_NETBINDREMOVE 0x00000008	Notifies a network service that a component for binding has been removed. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. However, this control code has been deprecated; use Plug and Play functionality instead. （网络绑定相关，已废弃）
SERVICE_CONTROL_PARAMCHANGE 0x00000006	Notifies a service that its startup parameters have changed. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. （服务启动参数已经改变，需要有SERVICE_PAUSE_CONTINUE权限）
SERVICE_CONTROL_PAUSE 0x00000002	Notifies a service that it should pause. The hService handle must have the SERVICE_PAUSE_CONTINUE access right. （暂停服务，需要有SERVICE_PAUSE_CONTINUE权限）
SERVICE_CONTROL_STOP 0x00000001	Notifies a service that it should stop. The hService handle must have the SERVICE_STOP access right. After sending the stop request to a service, you should not send other controls to the service. （停止服务，需要有SERVICE_STOP权限）

3. lpServiceStatus：返回值，一个指向存储服务最新状态的结构体ServiceStatus，返回的服务信息来自SCM中最近的服务状态报告。

只有当ControlService返回以下的错误代码：NO_ERROR, ERROR_INVALID_SERVICE_CONTROL, ERROR_SERVICE_CANNOT_ACCEPT_CTRL, or ERROR_SERVICE_NOT_ACTIVE，

SCM才会填充结构体ServiceStatus。

 

返回值：

成功，返回非0；

失败，返回0，错误码使用GetLastError获得；

Return code	Description
ERROR_ACCESS_DENIED	The handle does not have the required access right.
ERROR_DEPENDENT_SERVICES_RUNNING	The service cannot be stopped because other running services are dependent on it.
ERROR_INVALID_HANDLE	The specified handle was not obtained using CreateService or OpenService, or the handle is no longer valid.
ERROR_INVALID_PARAMETER	The requested control code is undefined.
ERROR_INVALID_SERVICE_CONTROL	The requested control code is not valid, or it is unacceptable to the service.
ERROR_SERVICE_CANNOT_ACCEPT_CTRL	The requested control code cannot be sent to the service because the state of the service is SERVICE_STOPPED, SERVICE_START_PENDING, or SERVICE_STOP_PENDING.
ERROR_SERVICE_NOT_ACTIVE	The service has not been started.
ERROR_SERVICE_REQUEST_TIMEOUT	The process for the service was started, but it did not call StartServiceCtrlDispatcher, or the thread that called StartServiceCtrlDispatcher may be blocked in a control handler function.
ERROR_SHUTDOWN_IN_PROGRESS	The system is shutting down.

说明：

（1）ControlService函数要求服务控制管理器(SCM)向服务发送请求的控制代码。SCM发送的前提是服务已经指定要接收控制码，或服务处于控制码可以发送给它的一个状态。

（2）SCM是以串行的方式处理服务控制通知——它会等待服务完成一个服务控制通知的处理，才发送下一个通知。所以如果任何服务正忙于处理一个控制码，ControlService的一个调用将会暂停30s的时间（这是一个超时时间），如果超时时间一过但处理还没完成，那么函数将返回一个ERROR_SERVICE_REQUEST_TIMEOUT。

（3）其他：

To stop and start a service requires a security descriptor that allows you to do so. The default security descriptor allows the LocalSystem account, and members of the Administrators and Power Users groups to stop and start services. To change the security descriptor of a service, see Modifying the DACL for a Service.

The QueryServiceStatusEx function returns a SERVICE_STATUS_PROCESS structure whose dwCurrentState and dwControlsAccepted members indicate the current state and controls accepted by a running service. All running services accept the SERVICE_CONTROL_INTERROGATE control code by default. Drivers do not accept control codes other than SERVICE_CONTROL_STOP and SERVICE_CONTROL_INTERROGATE. Each service specifies the other control codes that it accepts when it calls the SetServiceStatus function to report its status. A service should always accept these codes when it is running, no matter what it is doing.

The following table shows the action of the SCM in each of the possible service states.

Service state	Stop	Other controls
STOPPED	(c)	(c)
STOP_PENDING	(b)	(b)
START_PENDING	(a)	(b)
RUNNING	(a)	(a)
CONTINUE_PENDING	(a)	(a)
PAUSE_PENDING	(a)	(a)
PAUSED	(a)	(a)

(a)

If the service accepts this control code, send the request to the service; otherwise, ControlService returns zero and GetLastError returns ERROR_INVALID_SERVICE_CONTROL.

(b)

The service is not in a state in which a control can be sent to it, so ControlService returns zero and GetLastError returns ERROR_SERVICE_CANNOT_ACCEPT_CTRL.

(c)

The service is not active, so ControlService returns zero and GetLastError returns ERROR_SERVICE_NOT_ACTIVE.

本文链接：http://www.cnblogs.com/cposture/p/4717546.html