search

winsiderss / systeminformer

A free, powerful, multi-purpose tool that helps you monitor system resources, debug software and detect malware. Brought to you by Winsider Seminars & Solutions, Inc. @ http://www.windows-internals.com
https://systeminformer.sourceforge.io
MIT License
10.82k stars 1.38k forks source link

wierd auto-change ImagePath when chnage Start type of drivers #1371

Closed amymor closed 2 years ago

amymor commented 2 years ago

Brief description of your issue

i noticed sometime when i change Start type of drivers, the PH automatically changes ImagePath, it seems add \Systemroot\ to the beginning of address, for example System32\drivers\vdrvroot.sys changed to \Systemroot\System32\drivers\vdrvroot.sys and also if i change it further i noticed it changed to \Systemroot\Systemroot\System32\drivers\vdrvroot.sys. a week ago i disabled some Bluetooth drivers, so i checked them and noticed that \Systemroot\ added to their ImagePath too.

Steps to reproduce (optional)

changing Start type to something like System start.

Expected behavior (optional)

No response

Actual behavior (optional)

No response

Environment (optional)

Process Hacker 3.0.4953
Windows 10 20h2
dmex commented 2 years ago

PH automatically changes ImagePath

PH doesn't do anything with the filename. It just copies whatever from the textbox and passes it directly to ChangeServiceConfig:

image

You can check the sources here: https://github.com/winsiderss/systeminformer/blob/dee9746f44b24888d68e438934d231c2e850fd45/SystemInformer/srvprp.c#L499-L525

it seems add \Systemroot\ to the beginning of address

The ChangeServiceConfig function is adding \systemroot\ to the filename and it does this when the service start type was changed to BootStart.

ChangeServiceConfig is built into Windows and mandatory for changing service configuration and we can't prevent the function from modifying file paths. You could modify the registry directly but you would have to immediately reboot since service information is cached by services.exe

i noticed it changed to \Systemroot\Systemroot\

I wasn't able to reproduce this issue. ChangeServiceConfig appends \Systemroot\ but then doesn't append it a second time.

dmex commented 2 years ago

You can also reproduce the same behavior using Windows commands. For example:

1) Open elevated command prompt 2) Execute sc config SERVICENAME start=boot

The sc command is included with Windows and also uses ChangeServiceConfig, so it also changes the path to include \systemroot\

I found this post from 18 years ago discussing the same issue with a response from Microsoft: https://microsoft.public.win32.programmer.kernel.narkive.com/zkVmV2Fz/problem-using-changeserviceconfig-to-set-a-driver-to-boot-start#post6