Add a winark service demo

Anti-Rootkit.sln

@@ -17,6 +17,10 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PdbParser", "PdbParser\PdbP
 EndProject
 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Utils", "Utils\Utils.vcxproj", "{4276EF07-4FDE-43AE-9C72-4CF73E669741}"
 EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WinArkSvc", "WinArkSvc\WinArkSvc.vcxproj", "{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}"
+EndProject
+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "alarm", "alarm\alarm.vcxproj", "{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|ARM = Debug|ARM
@@ -140,6 +144,30 @@ Global
 		{4276EF07-4FDE-43AE-9C72-4CF73E669741}.Release|x64.Build.0 = Release|x64
 		{4276EF07-4FDE-43AE-9C72-4CF73E669741}.Release|x86.ActiveCfg = Release|Win32
 		{4276EF07-4FDE-43AE-9C72-4CF73E669741}.Release|x86.Build.0 = Release|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|ARM.ActiveCfg = Debug|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|ARM64.ActiveCfg = Debug|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|x64.ActiveCfg = Debug|x64
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|x64.Build.0 = Debug|x64
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|x86.ActiveCfg = Debug|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Debug|x86.Build.0 = Debug|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|ARM.ActiveCfg = Release|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|ARM64.ActiveCfg = Release|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|x64.ActiveCfg = Release|x64
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|x64.Build.0 = Release|x64
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|x86.ActiveCfg = Release|Win32
+		{E2954D26-F8EA-4865-B31A-5AF74DAEC92D}.Release|x86.Build.0 = Release|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|ARM.ActiveCfg = Debug|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|ARM64.ActiveCfg = Debug|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|x64.ActiveCfg = Debug|x64
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|x64.Build.0 = Debug|x64
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|x86.ActiveCfg = Debug|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Debug|x86.Build.0 = Debug|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|ARM.ActiveCfg = Release|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|ARM64.ActiveCfg = Release|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|x64.ActiveCfg = Release|x64
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|x64.Build.0 = Release|x64
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|x86.ActiveCfg = Release|Win32
+		{23435BC0-4F45-4D8D-917D-90C86B5F0DA0}.Release|x86.Build.0 = Release|Win32
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE

WinArkSvc/ServiceCommon.h

@@ -0,0 +1,11 @@
+#pragma once
+
+enum class MessageType {
+	SetAlarm,
+	CancelAlarm
+};
+
+struct AlarmMessage {
+	MessageType Type;
+	FILETIME Time;
+};

WinArkSvc/WinArkSvc.cpp

@@ -0,0 +1,229 @@
+// WinArkSvc.cpp : This file contains the 'main' function. Program execution begins and ends there.
+//
+#include "pch.h"
+#include "ServiceCommon.h"
+
+#pragma comment(lib,"wtsapi32")
+
+void WINAPI ServiceMain(DWORD dwNumServicesArgs, LPTSTR* args);
+DWORD WINAPI ServiceHandler(DWORD dwControl, DWORD dwEventType, LPVOID lpEventData, LPVOID lpContext);
+void SetStatus(DWORD status);
+void HandleMessage(const AlarmMessage& msg);
+void NTAPI OnTimerExpired(
+	_Inout_     PTP_CALLBACK_INSTANCE Instance,
+	_Inout_opt_ PVOID                 Context,
+	_Inout_     PTP_TIMER             Timer);
+
+SERVICE_STATUS_HANDLE g_hService;
+SERVICE_STATUS g_Status;
+HANDLE g_hStopEvent;
+HANDLE g_hMainsolt;
+PTP_TIMER g_Timer;
+
+int main(){
+	// Note that the service name is typed as LPTSTR, meaning it should not be part of readonly
+	// memory, and that¡¯s why the name is first set to a variable on the stack(which is
+	// always read / write), before passing it to the structure.
+	WCHAR name[] = L"winark";
+
+	const SERVICE_TABLE_ENTRY table[] = {
+		{name,ServiceMain},
+		{nullptr,nullptr}
+	};
+
+	if (!::StartServiceCtrlDispatcher(table))
+		return 1;
+
+	return 0;
+}
+
+void WINAPI ServiceMain(DWORD dwNumServicesArgs, LPTSTR* args) {
+	g_Status.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
+	g_Status.dwWaitHint = 500;
+
+	bool error = true;
+	do {	// non-loop for easy breaking
+		g_hService = ::RegisterServiceCtrlHandlerEx(L"WinArkSvc",
+			ServiceHandler, nullptr);
+		if (!g_hService)
+			break;
+
+		g_hStopEvent = ::CreateEvent(nullptr, FALSE, FALSE, nullptr);
+		if (!g_hStopEvent)
+			break;
+
+		SetStatus(SERVICE_START_PENDING);
+
+		// create a mailslotand configure
+		// its security descriptor to allow full control to the user running the service, 
+		// with all other users having write/read access only
+		
+		// create the Everyone SID
+		// 
+		BYTE worldSid[SECURITY_MAX_SID_SIZE];
+		DWORD len = sizeof(worldSid);
+		auto pWorldSid = (PSID)worldSid;
+
+		if (!::CreateWellKnownSid(WinWorldSid, nullptr, pWorldSid, &len))
+			break;
+
+		//
+		// get SID of the user running this process
+		//
+		HANDLE hToken;
+		if (!::OpenProcessToken(::GetCurrentProcess(), TOKEN_QUERY, &hToken))
+			break;
+
+		BYTE userBuffer[SECURITY_MAX_SID_SIZE + sizeof(TOKEN_USER) + sizeof(SID_AND_ATTRIBUTES)];
+		auto user = (TOKEN_USER*)userBuffer;
+		BOOL ok = ::GetTokenInformation(hToken, TokenUser, userBuffer, sizeof(userBuffer), &len);
+		::CloseHandle(hToken);
+		if (!ok)
+			break;
+		auto ownerSid = user->User.Sid;
+
+		//
+		// allocate and initialize a new security descriptor
+		//
+		PSECURITY_DESCRIPTOR sd = ::HeapAlloc(::GetProcessHeap(), 0, SECURITY_DESCRIPTOR_MIN_LENGTH);
+		if (!sd)
+			break;
+		if (!::InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION)) {
+			break;
+		}
+
+		//
+		// build ACEs
+		//
+		EXPLICIT_ACCESS ea[2] = { 0 };
+		ea[0].grfAccessPermissions = FILE_ALL_ACCESS;
+		ea[0].grfAccessMode = SET_ACCESS;
+		ea[0].grfInheritance = NO_INHERITANCE;
+		ea[0].Trustee.TrusteeForm = TRUSTEE_IS_SID;
+		ea[0].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
+		ea[0].Trustee.ptstrName = (PWSTR)ownerSid;
+
+		ea[1].grfAccessPermissions =
+			FILE_GENERIC_WRITE | FILE_GENERIC_READ;
+		ea[1].grfAccessMode = SET_ACCESS;
+		ea[1].grfInheritance = NO_INHERITANCE;
+		ea[1].Trustee.TrusteeForm = TRUSTEE_IS_SID;
+		ea[1].Trustee.TrusteeType = TRUSTEE_IS_WELL_KNOWN_GROUP;
+		ea[1].Trustee.ptstrName = (PWSTR)pWorldSid;
+
+		//
+		// create DACL from ACEs
+		//
+		PACL dacl;
+		if (ERROR_SUCCESS != ::SetEntriesInAcl(_countof(ea), ea,
+			nullptr, &dacl))
+			break;
+
+		//
+		// apply owner and DACL
+		//
+		if (!::SetSecurityDescriptorOwner(sd, ownerSid, FALSE))
+			break;
+
+		if (!::SetSecurityDescriptorDacl(sd, TRUE, dacl, FALSE))
+			break;
+
+		//
+		// create mailsolt
+		//
+		SECURITY_ATTRIBUTES sa = { sizeof(sa) };
+		sa.lpSecurityDescriptor = sd;
+		g_hMainsolt = ::CreateMailslot(L"\\\\.\\mailslot\\winark", 1024,
+			MAILSLOT_WAIT_FOREVER, &sa);
+		if (g_hMainsolt == INVALID_HANDLE_VALUE)
+			break;
+
+		// 
+		// cleanup
+		//
+		::HeapFree(::GetProcessHeap(), 0, sd);
+		::LocalFree(dacl);
+		error = false;
+	} while (false);
+
+	if (error) {
+		// The most common error reporting
+		// mechanism used by services is writing to the Windows event log.
+		SetStatus(SERVICE_STOPPED);
+		return;
+	}
+	
+	SetStatus(SERVICE_RUNNING);
+
+	DWORD msgSize, count;
+	AlarmMessage msg;
+
+	while (::WaitForSingleObject(g_hStopEvent, 1000) == WAIT_TIMEOUT) {
+		do
+		{
+			if (!::GetMailslotInfo(g_hMainsolt, nullptr, &msgSize, &count, nullptr))
+				break;
+			if (msgSize == MAILSLOT_NO_MESSAGE)
+				break;
+
+			DWORD bytes;
+			if (msgSize == sizeof(msg) && 
+				::ReadFile(g_hMainsolt, &msg, sizeof(msg), &bytes, nullptr)) {
+				HandleMessage(msg);
+			}
+			count--;
+		} while (count>0);
+	}
+	SetStatus(SERVICE_STOPPED);
+
+	::CloseHandle(g_hStopEvent);
+	::CloseHandle(g_hMainsolt);
+}
+
+void SetStatus(DWORD status) {
+	g_Status.dwCurrentState = status;
+	g_Status.dwControlsAccepted = status == SERVICE_RUNNING ? SERVICE_ACCEPT_STOP : 0;
+	::SetServiceStatus(g_hService, &g_Status);
+}
+
+void HandleMessage(const AlarmMessage& msg) {
+	switch (msg.Type)
+	{	
+		case MessageType::SetAlarm:
+			if (g_Timer == nullptr)
+				g_Timer = ::CreateThreadpoolTimer(OnTimerExpired, nullptr, nullptr);
+			::SetThreadpoolTimer(g_Timer, (PFILETIME)&msg.Time, 0, 1000);
+			break;
+
+		case MessageType::CancelAlarm:
+			if (g_Timer) {
+				::CloseThreadpoolTimer(g_Timer);
+				g_Timer = nullptr;
+			}
+			break;
+		default:
+			break;
+	}
+}
+
+_Use_decl_annotations_
+void NTAPI OnTimerExpired(PTP_CALLBACK_INSTANCE, PVOID, PTP_TIMER) {
+	WCHAR title[] = L"!!! ALARM !!!";
+	WCHAR msg[] = L"It's time to wake up!";
+	DWORD response;
+
+	::WTSSendMessage(nullptr, ::WTSGetActiveConsoleSessionId(),
+		title, sizeof(title), msg, sizeof(msg),
+		MB_OK | MB_ICONEXCLAMATION, 0, &response, FALSE);
+}
+
+DWORD WINAPI ServiceHandler(DWORD dwControl, DWORD dwEventType, LPVOID lpEventData, LPVOID lpContext) {
+	switch (dwControl)
+	{
+		case SERVICE_CONTROL_STOP:
+			SetStatus(SERVICE_STOP_PENDING);
+			::SetEvent(g_hStopEvent);
+			break;
+	}
+	return 0;
+}

WinArkSvc/WinArkSvc.vcxproj

@@ -0,0 +1,151 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{e2954d26-f8ea-4865-b31a-5af74daec92d}</ProjectGuid>
+    <RootNamespace>WinArkSvc</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="WinArkSvc.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="pch.h" />
+    <ClInclude Include="ServiceCommon.h" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

WinArkSvc/WinArkSvc.vcxproj.filters

@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="WinArkSvc.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="pch.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="ServiceCommon.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+</Project>

WinArkSvc/pch.h

@@ -0,0 +1,7 @@
+#pragma once
+
+#include <Windows.h>
+#include <WtsApi32.h>
+#include <AclAPI.h>
+#include <sddl.h>
+#include <stdio.h>

alarm/alarm.cpp

@@ -0,0 +1,79 @@
+// alarm.cpp : This file contains the 'main' function. Program execution begins and ends there.
+//
+
+#include <Windows.h>
+#include <stdio.h>
+#include <string>
+#include "..\WinArkSvc\ServiceCommon.h"
+
+int Error(const char* msg) {
+    printf("%s (%u)\n", msg, ::GetLastError());
+    return 1;
+}
+
+int main(int argc,const char* argv[]){
+    if (argc < 2) {
+        printf("Usage: alarm <set hh::mm::ss | cancel>\n");
+        return 0;
+    }
+
+    HANDLE hFile = ::CreateFile(L"\\\\.\\mailslot\\winark", GENERIC_WRITE|GENERIC_READ, 0, nullptr, OPEN_EXISTING,
+        0, nullptr);
+    if (hFile == INVALID_HANDLE_VALUE)
+        return Error("Failed to open mailslot");
+
+    DWORD bytes;
+
+    if (_stricmp(argv[1], "set") == 0 && argc > 2) {
+        AlarmMessage msg;
+        msg.Type = MessageType::SetAlarm;
+        std::string time(argv[2]);
+        if (time.size() != 8) {
+            ::CloseHandle(hFile);
+            printf("Time format is illegal.\n");
+            return 1;
+        }
+        //
+        // get local time (for obtaining the date)
+        //
+        SYSTEMTIME st;
+        ::GetLocalTime(&st);
+
+        //
+        // change the time based on user input
+        //
+        st.wHour = atoi(time.substr(0, 2).c_str());
+        st.wMinute = atoi(time.substr(3, 2).c_str());
+        st.wSecond = atoi(time.substr(6, 2).c_str());
+        ::SystemTimeToFileTime(&st, &msg.Time);
+
+        //
+        // convert to UTC time
+        //
+        ::LocalFileTimeToFileTime(&msg.Time, &msg.Time);
+
+        //
+        // write to the mailsolt
+        //
+        if (!::WriteFile(hFile, &msg, sizeof(msg), &bytes, nullptr)) {
+            ::CloseHandle(hFile);
+            return Error("failed in WriteFile");
+        }
+    }
+    else if (_stricmp(argv[1], "cancel") == 0) {
+        AlarmMessage msg;
+        msg.Type = MessageType::CancelAlarm;
+        if (!::WriteFile(hFile, &msg, sizeof(msg), &bytes, nullptr)) {
+            ::CloseHandle(hFile);
+            return Error("failed in WriteFile");
+        }
+    }
+    else {
+        printf("Error in command line arguments.\n");
+    }
+    ::CloseHandle(hFile);
+
+    return 0;
+}
+
+

alarm/alarm.vcxproj

@@ -0,0 +1,147 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{23435bc0-4f45-4d8d-917d-90c86b5f0da0}</ProjectGuid>
+    <RootNamespace>alarm</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <WarningLevel>Level3</WarningLevel>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="alarm.cpp" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

alarm/alarm.vcxproj.filters

@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
+    </Filter>
+    <Filter Include="Resource Files">
+      <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
+      <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="alarm.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+</Project>