How to find out what process issued a windows service start?

[DavidXanatos]

Originally Posted by WhoCares

hook the RPC server in services.exe?

Sounds tricky, could you please point me in the direction of a guide or how-to for that task.

[Rasmus]

Originally Posted by DavidXanatos

Sounds tricky, could you please point me in the direction of a guide or how-to for that task.

https://docs.microsoft.com/en-us/windows/win32/rpc/how-rpc-works

A quick example though it is in java-

https://github.com/km-works/portal-rpc-server-hook

You'd need to do the same for services.exe

[WhoCares]

here is a tutorial with demo source code, but in Chinese
https://bbs.pediy.com/thread-251158.htm

Originally Posted by DavidXanatos

Sounds tricky, could you please point me in the direction of a guide or how-to for that task.

[agoo]

Originally Posted by WhoCares

here is a tutorial with demo source code, but in Chinese
https://bbs.pediy.com/thread-251158.htm

Any english version of the tutorial?

[SinaDiR]

Originally Posted by agoo

Any english version of the tutorial?

Yes, try Google Chrome or use Google Translate !