Thread: Failed to host service in Svchost.exe

Hi,

I developed a service to be hosted by Svchost.exe. This task seemed pretty simple and is all done. The real problem comes out when I try to run it in a particular instance of svchost.exe (let’s say netsvcs) it does not work as expected, it creates a completely new instance of Svchost.exe instead of using a previously created one. The reason of developing this service this way was because of performance considerations specially cost in memory so it loses any sense if it runs in a new instance of Svchost.exe.
Would anyone tell me how to make my service (library) run in a particular instance of Svchost.exe without creating a new one?

Cheers

Have you created the necessary registry keys?

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SvcHost
REG_MULTI_SZ "ServiceGroupName" = "MyService"

In HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\SvcHost\ServiceGroupName
Optional values:
REG_DWORD CoInitializeSecurityParam = [0/1]
REG_DWORD SystemCritical = [0/1]
REG_DWORD DefaultRpcStackSize = [stack size in kb]
REG_DWORD AuthenticationCapabilities = [capabilities mask]
REG_DWORD ImpersonationLevel = [impersonation level]
REG_DWORD AuthenticationLevel = [authentication level]

SystemCritical causes the system to shutdown if the svchost group terminates.

If CoInitializeSecurityParam is set to 1, COM and COM security are initialized.

AuthenticationCapabilities, ImpersonationLevel, and AuthenticationLevel are only meaningful if
CoInitializeSecurityParam is set to 1. They are passed to CoInitializeSecurity().

DefaultRpcStackSize is provided in kilobytes. If it is omitted, the default image stack size
is taken from the process main image.

In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servic es\ServiceName\Parameters
REG_EXPAND_SZ "MyServiceDll" = "PathToMyServiceDll"

Yes, I had already done all that but problem persisted. Anyway I do not want to rcreate a new group for Svchost, I want to use an existing one. I guess the problem here has something to do with security issues, it sounds resaonable to me.
I suppose than Windows has some way to verify whether a new component is trusted or not (Windows Logo Program or alike) and if not it launches it in a new instance of Svchost in order to protect the rest of services that are runing under the existing instance of svchot. So the question that arises right now is how to make my Dll trusted by Windows? Do I have to get some kind of certificate? Do I have to sign it? Could I use a nasty trick to fool Windows? I have no idea.