Handling a process termination.

[enhzflep]

Tried it. Doesn't seem to work. I made a console app added a line to pause execution then terminated it from the task manager. I didn't get the message. :(

[progDes]

Did you tried this in debugger? I guess with debugging it will not work. Try to make infinite loop instead. I mean try following: In main() make infinite loop. In signal handler need to do something to identify we here, probably type to console (but this might not work). Run application without debugging. It's important, cause things like this might behave different when debugger attached. I didnt tried it myself yet, going to check this on monday.

[progDes]

Btw, here is from doc. Note SIGINT is not supported for any Win32 application. When a CTRL+C interrupt occurs, Win32 operating systems generate a new thread to specifically handle that interrupt. This can cause a single-thread application such as one in UNIX to become multithreaded, resulting in unexpected behavior. So terminating from Ctrl+C will not work. Try to kill process from task manager.

[Software_Developer]

For console: CTRL_CLOSE_EVENT or the Console process termination message. If you close the console from Taskmanager's "End Task", then you get the CTRL_CLOSE_EVENT notification. The CTRL_CLOSE_EVENT message is sent as a signal that a console application should terminate. BUT If you click on "End Process" from task manager, then there's no way to handle it, in .NET or Win32. The code below displays the message "Signal to quit was received" once you click on "End Task" from task manager.

modified on Friday, April 30, 2010 12:01 PM

[enhzflep]

I used this code in release mode and killed it from the task manager, while running it from the command line so as to catch the text. - It never came. Not quite sure what SIGINT has to do with the price of chewing-gum in Czechoslovakia? ;P We're not trying to interrupt the process, we're just terminating it.

#include <conio.h>
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <tchar.h>

void SignalHandler(int signal)
{
printf("Application aborting...\n");
}

int main()
{
typedef void (*SignalHandlerPointer)(int);
SignalHandlerPointer previousHandler;

previousHandler = signal(SIGABRT, SignalHandler);
getch();
abort();

}

However, now that I can't find the page that I lifted the above code from I can't help but get the feeling that this particular approach is an exercise that won't succeed. I reckon that the signal is only thrown when the _application_ calls abort(), and not when windows calls abort(theApp). I wonder if you'd have to hook TerminateProcess or something similar. I've a feeling that such a solution will require a fairly hard-core answer. Good-luck:thumbsup:

[David Crow]

When Task Manager uses TerminateProcess() to end a process, there is no notification. Also, there are no notifications generated for WH_CBT hook procedures.

"One man's wage rise is another man's price increase." - Harold Wilson

"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons

"Man who follows car will be exhausted." - Confucius

[Michel Godfroid]

Can't really be done folks. Task manager sends a WM_CLOSE or CTRL_CLOSE_EVENT first, but only if you terminate from the applications tab. You'll be able to intercept that one with the SetConsoleCtrlHandler function. Otherwise task manager will fire a TerminateProcess, which cannot be intercepted ever. Read it from the master himself here.[^]

[Lost User]

Hi, The task manager uses two methods of terminating a process depending on which tab has been selected. The tab labled 'Applications' will send a WM_CLOSE message to the window when 'End Task' has been selected which can easily be intercepted and handled. The task manager tab labled 'Processes' utilizes TerminateProcess[^] which cannot be intercepted/blocked by the target process. Some useful documentation from Microsoft Windows Internals Fourth Edition[^]: Processes, Threads, and Jobs[^] Best Wishes, -David Delaune

[kawayi]

Hook SSDT ,but I think it is pretty difficlt

[_Superman_]

You could try and hook the TerminateProcess API. But API hooking is not at all possible/recommended these days.

«_Superman_» I love work. It gives me something to do between weekends.
Microsoft MVP (Visual C++)