OrcLib: DriverMgmt: add DisableStart

DFIR-ORC · Feb 10, 2021 · c12489c · c12489c
1 parent 08e5c26
commit c12489c
Show file tree

Hide file tree

Showing 2 changed files with 76 additions and 0 deletions.
diff --git a/src/OrcLib/DriverMgmt.cpp b/src/OrcLib/DriverMgmt.cpp
@@ -355,6 +355,11 @@ HRESULT Driver::Stop()
     return S_OK;
 }
 
+HRESULT Orc::Driver::DisableStart()
+{
+    return DriverMgmt::SetStartupMode(m_manager->m_SchSCManager, m_strServiceName.c_str(), DriverStartupMode::Disabled);
+}
+
 Orc::Result<DriverStatus> Orc::Driver::GetStatus()
 {
     HRESULT hr = E_FAIL;
@@ -840,3 +845,62 @@ HRESULT Orc::DriverMgmt::GetDriverBinaryPathName(
     wcscpy_s(szDriverFileName, BufferLength, pServiceConfig->lpBinaryPathName);
     return S_OK;
 }
+
+HRESULT
+Orc::DriverMgmt::SetStartupMode(__in SC_HANDLE SchSCManager, __in LPCTSTR DriverName, __in DriverStartupMode mode)
+{
+    HRESULT hr = E_FAIL;
+    SC_HANDLE schService;
+
+    //
+    // Open the handle to the existing service.
+    schService = OpenService(SchSCManager, DriverName, SERVICE_ALL_ACCESS);
+    if (schService == NULL)
+    {
+        hr = HRESULT_FROM_WIN32(GetLastError());
+        Log::Error(L"OpenService failed for '{}' [{}]", DriverName, SystemError(hr));
+        return hr;
+    }
+
+    BOOST_SCOPE_EXIT(&schService)
+    {
+        if (schService)
+        {
+            CloseServiceHandle(schService);
+            schService = NULL;
+        }
+    }
+    BOOST_SCOPE_EXIT_END;
+
+    DWORD dwServiceStart = 0;
+
+    switch (mode)
+    {
+        case DriverStartupMode::Auto:
+            dwServiceStart = SERVICE_AUTO_START;
+            break;
+        case DriverStartupMode::Boot:
+            dwServiceStart = SERVICE_BOOT_START;
+            break;
+        case DriverStartupMode::Demand:
+            dwServiceStart = SERVICE_DEMAND_START;
+            break;
+        case DriverStartupMode::Disabled:
+            dwServiceStart = SERVICE_DISABLED;
+            break;
+        case DriverStartupMode::System:
+            dwServiceStart = SERVICE_SYSTEM_START;
+            break;
+        default:
+            throw Exception(Severity::Fatal, L"Invalid driver startup mode: {}", mode);
+    }
+
+    if (!ChangeServiceConfigW(
+            schService, SERVICE_NO_CHANGE, dwServiceStart, SERVICE_NO_CHANGE, NULL, NULL, NULL, NULL, NULL, NULL, NULL))
+    {
+        hr = HRESULT_FROM_WIN32(GetLastError());
+        Log::Error(L"ChangeServiceConfig failed for '{}' [{}]", DriverName, SystemError(hr));
+        return hr;
+    }
+    return S_OK;
+}
diff --git a/src/OrcLib/DriverMgmt.h b/src/OrcLib/DriverMgmt.h
@@ -29,6 +29,15 @@ enum class DriverStatus
     PendingContinue
 };
 
+enum class DriverStartupMode
+{
+    Auto,
+    Boot,
+    Demand,
+    Disabled,
+    System
+};
+
 class DriverMgmt;
 
 class DriverTermination;
@@ -51,6 +60,7 @@ class ORCLIB_API Driver : public std::enable_shared_from_this<Driver>
 
     HRESULT Start();
     HRESULT Stop();
+    HRESULT DisableStart();
 
     Result<DriverStatus> GetStatus();
 
@@ -98,6 +108,8 @@ class ORCLIB_API DriverMgmt : public std::enable_shared_from_this<DriverMgmt>
         const WCHAR* DriverName,
         WCHAR* szDriverFileName,
         ULONG BufferLength);
+    static HRESULT SetStartupMode(SC_HANDLE SchSCManager, __in LPCTSTR DriverName, __in DriverStartupMode mode);
+
 
     SC_HANDLE m_SchSCManager = NULL;
     SC_HANDLE m_SchService = NULL;