Windows® Internals, Sixth Edition, Part 1 полностью

The Scheduled Tasks service, which also leverages UBPM, provides similar functionality through an internal UBPM Singleton Class, which calls into Ubpm.dll. It allows its internal RegisterTask API to also register for trigger consumption, and it does similar processing of its input data, with the difference being that it uses the UBPM Start EXE action. Next, to actually perform the registration, both open a handle to UBPM, check if the consumer is already registered (changes to existing consumers are not allowed), and finally register the provider through the UbpmRegisterTriggerConsumer API.

Trigger consumer registration is done by UbpmTriggerProviderRegister, which validates the request, adds the provider’s GUID into the list of providers, and toggles it to enable the ETW trace to now receive events about this provider as well.

EXPERIMENT: Viewing Which Services React to Which Triggers

Certain Windows services are already preconfigured to consume the appropriate triggers to prevent them from staying resident even when they’re not needed, such as the Windows Time Service, the Tablet Input Service, and the Computer Browser service. The sc command lets you query information about a service’s triggers with the qtriggerinfo option.

Open a command prompt.

Type the following to see the triggers for the Windows Time Service:sc qtriggerinfo w32time [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: w32time START SERVICE DOMAIN JOINED STATUS : 1ce20aba-9851-4421-9430-1ddeb766e809 [DOMAIN JOINED] STOP SERVICE DOMAIN JOINED STATUS : ddaf516e-58c2-4866-9574-c3b615d42ea1 [NOT DOMAIN JOINED]

Now look at the Tablet Input Service:sc qtriggerinfo tabletinputservice [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: tabletinputservice START SERVICE DEVICE INTERFACE ARRIVAL : 4d1e55b2-f16f-11cf-88cb-001111000030 [INTERFACE CLASS GUID] DATA : HID_DEVICE_UP:000D_U:0001 DATA : HID_DEVICE_UP:000D_U:0002 DATA : HID_DEVICE_UP:000D_U:0003 DATA : HID_DEVICE_UP:000D_U:0004

Finally, here is the Computer Browser Service:sc qtriggerinfo browser [SC] QueryServiceConfig2 SUCCESS SERVICE_NAME: browser START SERVICE FIREWALL PORT EVENT : b7569e07-8421-4ee0-ad10-86915afdad09 [PORT OPEN] DATA : 139;TCP;System; DATA : 137;UDP;System; DATA : 138;UDP;System; STOP SERVICE FIREWALL PORT EVENT : a144ed38-8e12-4de4-9d96-e64740b1a524 [PORT CLOSE] DATA : 139;TCP;System; DATA : 137;UDP;System; DATA : 138;UDP;System;

In these three cases, note how the Windows Time Service is waiting for domain join/exit in order to decide whether or not it should run, while the Tablet Input Service is waiting for a device with the HID Class ID matching Tablet Device. Finally, the Computer Browser Service will run only if the firewall policy allows access on ports 137, 138, and 139, which are SMB network ports that the browser needs.

Task Host

TaskHost receives commands from UBPM living in the SCM. At initialization time, it opens the local RPC interface that was created by UBPM during its initialization and loops forever, waiting for commands to come through the channel. Four commands are currently supported, which are sent over the TaskHostSendResponseReceiveCommand RPC API:

Stopping the host

Starting a task

Stopping a task

Terminating a task

Additionally, hosted tasks are supplied with a TaskHostReportTaskStatus RPC API, which enables them to notify UBPM of their current execution state whenever they call UbpmReportTaskStatus.

All task-based commands are actually internally implemented by a generic COM Task library, and they essentially result in the creation and destruction of COM components.

Service Control Programs