Handling a process termination.

[Software_Developer]

Ok, try TerminateProcess(). Check out these links. How to kill a process given a name[^] How To Terminate an Application "Cleanly" in Win32 http://support.microsoft.com/default.aspx?scid=KB;en-us;q178893[^] http://social.msdn.microsoft.com/Forums/en-US/vssmartdevicesnative/thread/a3b5a913-e7f9-454e-9913-658219c5124b[^]

[progDes]

Well, the questions was not "How terminate process?", but "How to execute some code when process terminated normal or abnormal?" :).

[Michel Godfroid]

The OP Doesn't want to terminate a process, he wants to INTERCEPT process termination in order to do cleanup. Please stop confusing the issue.

[Software_Developer]

How to execute some code when process terminated normal or abnormal? Answer: WinAPI (Win32) specific only. If you close the window from Taskmanager's "End Task", then you get the WM_CLOSE notification. The WM_CLOSE message is sent as a signal that a window or an application should terminate. BUT If you click on "End Process" from task manager, then there's no way to handle it, in .NET or Win32. You better hope that the end user clicks on Taskmanager's "End Task" and not on "End Process" . LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) { switch(message) { case WM_CLOSE: // !!!!!!!!!!! Insert code here. // this only works if you close the window from Taskmanager's "End Task" MessageBox(NULL, "closed the window from Taskmanager!", "abnormal exit" , MB_OK); break; default: return DefWindowProc(hWnd, message, wParam, lParam); }

modified on Friday, April 30, 2010 11:01 AM

[progDes]

Hey, I know how to execute some code when application closing in normal case. I'm not novice, and know how Windows messages system is working. The question is more advanced. What if for example, something go wrong, application freezing - and user terminates it using task manager, terminates it dirty? I need to do some code here. Probably this is impossible, but look at the answer Michael Godfroid gave me above. This seems to be what I look for. So I'm going to investigate this.

[enhzflep]

Tried it. Doesn't seem to work. I made a console app added a line to pause execution then terminated it from the task manager. I didn't get the message. :(

[progDes]

Did you tried this in debugger? I guess with debugging it will not work. Try to make infinite loop instead. I mean try following: In main() make infinite loop. In signal handler need to do something to identify we here, probably type to console (but this might not work). Run application without debugging. It's important, cause things like this might behave different when debugger attached. I didnt tried it myself yet, going to check this on monday.

[progDes]

Btw, here is from doc. Note SIGINT is not supported for any Win32 application. When a CTRL+C interrupt occurs, Win32 operating systems generate a new thread to specifically handle that interrupt. This can cause a single-thread application such as one in UNIX to become multithreaded, resulting in unexpected behavior. So terminating from Ctrl+C will not work. Try to kill process from task manager.

[Software_Developer]

For console: CTRL_CLOSE_EVENT or the Console process termination message. If you close the console from Taskmanager's "End Task", then you get the CTRL_CLOSE_EVENT notification. The CTRL_CLOSE_EVENT message is sent as a signal that a console application should terminate. BUT If you click on "End Process" from task manager, then there's no way to handle it, in .NET or Win32. The code below displays the message "Signal to quit was received" once you click on "End Task" from task manager.

modified on Friday, April 30, 2010 12:01 PM

[enhzflep]

I used this code in release mode and killed it from the task manager, while running it from the command line so as to catch the text. - It never came. Not quite sure what SIGINT has to do with the price of chewing-gum in Czechoslovakia? ;P We're not trying to interrupt the process, we're just terminating it.

#include <conio.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <tchar.h>

void SignalHandler(int signal)
{
printf("Application aborting...\n");
}

int main()
{
typedef void (*SignalHandlerPointer)(int);
SignalHandlerPointer previousHandler;

previousHandler = signal(SIGABRT, SignalHandler);
getch();
abort();

}

However, now that I can't find the page that I lifted the above code from I can't help but get the feeling that this particular approach is an exercise that won't succeed. I reckon that the signal is only thrown when the _application_ calls abort(), and not when windows calls abort(theApp). I wonder if you'd have to hook TerminateProcess or something similar. I've a feeling that such a solution will require a fairly hard-core answer. Good-luck:thumbsup:

[David Crow]

When Task Manager uses TerminateProcess() to end a process, there is no notification. Also, there are no notifications generated for WH_CBT hook procedures.

"One man's wage rise is another man's price increase." - Harold Wilson

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

"Man who follows car will be exhausted." - Confucius

[Michel Godfroid]

Can't really be done folks. Task manager sends a WM_CLOSE or CTRL_CLOSE_EVENT first, but only if you terminate from the applications tab. You'll be able to intercept that one with the SetConsoleCtrlHandler function. Otherwise task manager will fire a TerminateProcess, which cannot be intercepted ever. Read it from the master himself here.[^]

[Lost User]

Hi, The task manager uses two methods of terminating a process depending on which tab has been selected. The tab labled 'Applications' will send a WM_CLOSE message to the window when 'End Task' has been selected which can easily be intercepted and handled. The task manager tab labled 'Processes' utilizes TerminateProcess[^] which cannot be intercepted/blocked by the target process. Some useful documentation from Microsoft Windows Internals Fourth Edition[^]: Processes, Threads, and Jobs[^] Best Wishes, -David Delaune

[kawayi]

Hook SSDT ,but I think it is pretty difficlt

[_Superman_]

You could try and hook the TerminateProcess API. But API hooking is not at all possible/recommended these days.

«_Superman_» I love work. It gives me something to do between weekends.
Microsoft MVP (Visual C++)