I'm trying to understand the inner workings of StartServiceCtrlDispatcher. Specifically, I'm trying to figure out how it determines if its being called from the SCM. So I write a simple service in C# and called it as a console app. I started it from WinDbg and set a breakpoint at ADVAPI32!StartServiceCtrlDispatcherWStub. I then stepped into a few calls until I got the following stack trace:0:000> kPChild-SP          RetAddr           Call Site00000000`0037e578 00007ffa`101a52be RPCRT4!RpcStringBindingComposeW+0xff00000000`0037e580 00007ffa`101abedf sechost!ScClientBindToServer+0x7600000000`0037e690 00007ffa`101a8751 sechost!ScOpenServiceChannelHandle+0x1f00000000`0037e6d0 00007ffa`009796f0 sechost!StartServiceCtrlDispatcherW+0x3c00000000`0037e710 00007ffa`0097c0af System_ServiceProcess_ni+0x296f000000000`0037e7e0 00007ff9`a0730104 System_ServiceProcess_ni+0x2c0af00000000`0037e880 00007ff9`ffe84113 0x00007ff9`a073010400000000`0037e8d0 00007ff9`ffe83fde clr!CallDescrWorkerInternal+0x8300000000`0037e910 00007ff9`ffe889a3 clr!CallDescrWorkerWithHandler+0x4a00000000`0037e950 00007ff9`fff591aa clr!MethodDescCallSite::CallTargetWorker+0x25100000000`0037eb00 00007ff9`fff5999a clr!RunMain+0x1e700000000`0037ece0 00007ff9`fff59893 clr!Assembly::ExecuteMainMethod+0xb600000000`0037efd0 00007ff9`fff59372 clr!SystemDomain::ExecuteMainMethod+0x50600000000`0037f5e0 00007ff9`fff592c6 clr!ExecuteEXE+0x3f00000000`0037f650 00007ff9`fff59d84 clr!_CorExeMainInternal+0xae00000000`0037f6e0 00007ffa`011e7ced clr!CorExeMain+0x1400000000`0037f720 00007ffa`0128ea5b mscoreei!CorExeMain+0xe000000000`0037f770 00007ffa`107115cd MSCOREE!CorExeMain_Exported+0xcb00000000`0037f7a0 00007ffa`10a343d1 KERNEL32!BaseThreadInitThunk+0xd00000000`0037f7d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d0:000> !clrstackOS Thread Id: 0x2ae4 (0)        Child SP               IP Call Site000000000037e738 00007ffa100795b3 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)000000000037e738 00007ffa009796f0 [InlinedCallFrame: 000000000037e738] System.ServiceProcess.NativeMethods.StartServiceCtrlDispatcher(IntPtr)000000000037e710 00007ffa009796f0 DomainBoundILStubClass.IL_STUB_PInvoke(IntPtr)000000000037e7e0 00007ffa0097c0af System.ServiceProcess.ServiceBase.Run(System.ServiceProcess.ServiceBase[])000000000037e880 00007ff9a0730104 ConsoleAndSCMPatternDemo.Program.Main(System.String[]) [c:\Users\Justin\Documents\Visual Studio 2013\Projects\ConsoleAndSCMPatternDemo\ConsoleAndSCMPatternDemo\Program.cs @ 21]000000000037ebb0 00007ff9ffe84113 [GCFrame: 000000000037ebb0] I have two questions:What is this sechost.dll that seems to have AdvApi32 functionality.Where can I find documentation about the following API calls:ScClientBindToServerScOpenServiceChannelHandleGoogle doesn't give good info on either.
Getting info for undocumented APIs called by StartServiceCtrlDispatcher
windows;windbg;callstack