Function ServiceMain

RedEdrPplService/RedEdrPplService.cpp:66–130

Real service main()

// Real service main()
VOID WINAPI ServiceMain(DWORD argc, LPTSTR* argv)
{
    DWORD retval = 0;
    LOG_W(LOG_INFO, L"Service Start");

    // Register our service control handler with the SCM
    g_StatusHandle = RegisterServiceCtrlHandler(SERVICE_NAME, ServiceCtrlHandler);
    if (g_StatusHandle == NULL)
    {
        retval = GetLastError();
        LOG_W(LOG_ERROR, L"ServiceMain: RegisterServiceCtrlHandler Error: %d", retval);
        return;
    }

    // Set the service status to START_PENDING
    g_ServiceStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
    g_ServiceStatus.dwCurrentState = SERVICE_START_PENDING;
    g_ServiceStatus.dwControlsAccepted = 0;
    g_ServiceStatus.dwWin32ExitCode = 0;
    g_ServiceStatus.dwServiceSpecificExitCode = 0;
    g_ServiceStatus.dwCheckPoint = 0;
    g_ServiceStatus.dwWaitHint = 3000;  // Wait hint of 3 seconds
    
    if (!SetServiceStatus(g_StatusHandle, &g_ServiceStatus)) {
        LOG_W(LOG_ERROR, L"ServiceMain: Failed to set service status");
        return;
    }

    // Initialize object cache
	g_ProcessResolver.PopulateAllProcesses();

    // Start Control thread which will listen on a pipe for commands
    StartControl();

    // Set the service status to RUNNING after initialization is complete
    g_ServiceStatus.dwCurrentState = SERVICE_RUNNING;
    g_ServiceStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP;
    g_ServiceStatus.dwCheckPoint = 0;
    g_ServiceStatus.dwWaitHint = 0;
    
    if (!SetServiceStatus(g_StatusHandle, &g_ServiceStatus)) {
        LOG_W(LOG_ERROR, L"ServiceMain: Failed to set running status");
        ShutdownService();
        return;
    }

    LOG_W(LOG_INFO, L"Service is now running");

    // Service main loop
    while (g_ServiceStatus.dwCurrentState == SERVICE_RUNNING && !g_ServiceStopping) {
        // Start collecting - this may block
        StartEtwtiReader();
        
        // If we get here, ETW reader has stopped, check if we should continue
        if (!g_ServiceStopping) {
            LOG_W(LOG_INFO, L"ServiceMain: ETWTI reader stopped, waiting before restart...");
            Sleep(5000); // Wait before retry to avoid rapid restart loop
        }