can a windows service be spawned from something other than services.exe?

in the _EPROCESS structure, the Inherited From Unique Process field for servic开发者_运维问答es like alg.exe,svchost.exe,spoolsv.exe always points to services.exe. So, here are my questions.

1) Can a service be spawned from non-services.exe process

2) Can services.exe spawn a non service process?

Services.exe is the service control manager, so it is likely that it starts all services, but this is probably not guaranteed. It is also probably not guaranteed the services.exe doesn't spawn other processes. In fact it seems likely that it might.

Perhaps if you said why you want to know, we might be able to help with the wider problem.