Reverse engineering windows service

Question

I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own program.

Now as far as I can see I have a few possible approaches:

1. I try to reverse engineer the control panel, and discover the calls sent. But this panel consists of a lot of bloatware.
2. I try to reverse engineer the service, and discover the input needed. But this service also handles other (unknown) functions.
3. I try to catch the communication between the panel and the service.

Now 3 would be the easiest approach, but I have no idea if this is technically possible. Then I tried option 2, but i can only statically analyze the exe, Since dynamic analysis causes it to crash prematurely. Option 1 seems to be the most logical one, and this was the first I tried, but I can't really find an interesting starting point.

Is there anyone who can point me in the right direction. I have some reverse engineering experience from crackme's and applications, but this is my first attempt at reversing a driver.

Answer 1

If you goal is ultimately to control the service, it make more sense to reverse it versus reversing control panel. Who knows, you might find functionality you were not aware of. The key part of reversing windows service is to realize that it runs within the context of the Service Control Manager, and simply running the executable will not work. There are several major components of any windows service, that you need to be aware of. I have already given an answer to How does services.exe trigger the start of a service? question. It describes inner workings of a windows service.

It is very much possible to reverse a Windows service both dynamically and statically as long as you understand underlining concepts. If you run your service in context of command prompt, it will fail. Every Windows service by design has to call to Service Control Manager, if that call fails it means the service is not executed within the SCM. It is expected to fail being executed outside of the SCM. If services expects input, you will have to figure out what it needs. Firstly, you will need to locate Service Worker Thread. Thereafter, locating part of the way it communicates to control panel should be easy.