How to kill all recursive children of process windows

问题

I have a question but no solution.

My program run and create some processes,but processes go on creating another processes. I don't know how to get all children to kill all.

I used CreateToolhelp32Snapshot function to get all children whose parent is my program(mainthread) ... and go on getting all children from each children of mainthread.

hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );

If I use this solution,performance is very low because I had PID of all processes in the first time,so I couldn't need to call CreateToolhelp32Snapshot again

Which best solution can I do to get all recursive children of process windows ?

回答1:

First, take a look at the Win32 Job API. One functionality is the ability to automatically terminate all process belonging to the same Job. See the TerminateJobObject API.

EDIT: Mr Chen just blogged about that precise subject. Destroying all child processes (and grandchildren) when the parent exits

Then, your question. You could build a std::map of all the currently running process, the key being the PID, and the values being a std::vector of child processes. You can then recursion on the map to terminate a process and all his children.

// KillChildren.cpp
// Usage: pass a PID a argument

#include <Windows.h>
#include <TlHelp32.h>
#include <vector>
#include <map>

typedef std::vector<DWORD> VEC_CHILDS;
typedef VEC_CHILDS::iterator IT_CHILDS;
typedef std::map<DWORD, VEC_CHILDS> MAP_PIDS;
typedef MAP_PIDS::iterator IT_PIDS;

void KillProcess( DWORD dwPID ) {

    HANDLE hProcess = OpenProcess( PROCESS_TERMINATE | SYNCHRONIZE, FALSE, dwPID );
    if ( hProcess == NULL ) {
        printf( "Cant't OpenProcess for PID %u, Reason %u\n", dwPID, GetLastError() );
        return;
    }
    BOOL bWin32Success = TerminateProcess( hProcess, 0 );
    if ( bWin32Success == 0 ) {
        printf( "Cant't TerminateProcess for PID %u, Reason %u\n",
                dwPID, GetLastError() );
    } else {
        DWORD dwRetVal = WaitForSingleObject( hProcess, 2000 );
        if ( dwRetVal != WAIT_OBJECT_0 ) {
            printf( "Failed to Wait for Process Termination for PID %u,"
                    "RetVal %u Reason %u\n", dwPID, dwRetVal, GetLastError() );
        } else {
            printf( "Process %u Terminated\n", dwPID );
        }
    }
    CloseHandle( hProcess );

}

void KillChilds( DWORD dwParentPID, MAP_PIDS & mPids ) {
    IT_PIDS it = mPids.find( dwParentPID );
    if ( it == mPids.end() ) return;
    VEC_CHILDS & vChilds = it->second;
    for ( IT_CHILDS itChild = vChilds.begin(); itChild != vChilds.end(); ++itChild ) {
        KillChilds( *itChild, mPids );
    }
    KillProcess( dwParentPID );
}

// usage: PID as first arg
int main( int argc, char* argv[] ) {

    if ( argc <= 1 ) return -1;
    DWORD dwPID = atoi( argv[ 1 ] );

    HANDLE hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
    if ( hProcessSnap == INVALID_HANDLE_VALUE ) return -1;

    // build PID list with children
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof( PROCESSENTRY32 );
    if( !Process32First( hProcessSnap, &pe32 ) ) {
        CloseHandle( hProcessSnap );
        return -1;
    }
    MAP_PIDS mPids;
    do {
        // Add as a Parent, with no child, yet, if not already done
        IT_PIDS it = mPids.find( pe32.th32ProcessID );
        if ( it == mPids.end() ) mPids[ pe32.th32ProcessID ] = VEC_CHILDS();
        // Process the Parent
        it = mPids.find( pe32.th32ParentProcessID );
        if ( it == mPids.end() ) {
            // unknown parent, add it with one child
            VEC_CHILDS vChilds;
            vChilds.push_back( pe32.th32ProcessID );
            mPids[ pe32.th32ParentProcessID ] = vChilds;
        } else {
            // Parent already here, add one more child
            it->second.push_back( pe32.th32ProcessID );
        }
    } while ( Process32Next( hProcessSnap, &pe32 ) );
    CloseHandle( hProcessSnap );

    KillChilds( dwPID, mPids );
    return 0;

}

If you want to test the above program, here is a small Process Tree generator

// CreateChildren.cpp
// beware, messing may be 'fork bombing'

#include <Windows.h>

int main( int argc, char* argv[] ) {

    srand( GetTickCount() );
    // always childs if args
    if ( argc == 0 ) {
        int iRandom = rand();
        if ( iRandom % 3 ) Sleep( INFINITE );
    }

    char szFullExeName[ MAX_PATH ];
    DWORD dwCopied = GetModuleFileName( NULL, szFullExeName, sizeof( szFullExeName ) );
    if ( dwCopied == 0 ) return -1;

    STARTUPINFO si;
    memset( &si, 0, sizeof( si ) );
    si.cb = sizeof( si );
    PROCESS_INFORMATION pi;
    int ChildCount = rand() % 3;
    while ( ChildCount-- ) {
        BOOL bWin32Success = CreateProcess( szFullExeName, NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi );
        if ( bWin32Success ) {
            CloseHandle( pi.hThread );
            CloseHandle( pi.hProcess );
        }
    }

    Sleep( INFINITE );
    return 0;

}

来源：https://stackoverflow.com/questions/20469327/how-to-kill-all-recursive-children-of-process-windows