Hi guys I am programming a little program for becoming more productive. It should disconnect the user from the Internet or shut your computer down after a preset number of m
This functionality is, deliberately, unsupported and actively made intractable:
Why can't you trap TerminateProcess?
If a user fires up Task Manager and clicks the End Task button on the Applications tab, Windows first tries to shut down your program nicely, by sending
WM_CLOSE
messages to GUI programs andCTRL_CLOSE_EVENT
events to console programs. But you don't get a chance to interceptTerminateProcess
. Why not?
TerminateProcess
is the low-level process-killing function. It bypassesDLL_PROCESS_DETACH
and anything else in the process. When you kill withTerminateProcess
, no more user-mode code will run in that process. It's gone. Do not pass go. Do not collect $200.If you could intercept
TerminateProcess
, you would be escalating the arms race between programs and users. Suppose you could intercept it. Well, then if you wanted to make your program unkillable, you would just hand in yourTerminateProcess
handler! And then people would ask for "a way to kill a process that is refusing to be killed withTerminateProcess
," and we'd be back to where we started.
In practice, programs attempting to evade detection and task kill try to rename themselves to near isoforms of the Windows system processes. Don't do this. It guarantees your program will be submitted as malware and will kill your credibility dead.