How to catch event when Task manager kill your C++ application

[Cer]

I have a trouble about Task manager. Please help me how to catch event when task manager kill your C++ application.

[G309216C]

Hi Cer,

You need to inject a code into a remote Process. To find that out.

[Cer]

#include <iostream>
#include <csignal>

using namespace std;

void signalHandler( int signum )
{
cout << "Interrupt signal (" << signum << ") received.\n";

// cleanup and close up stuff here
// terminate program

exit(signum);

}

int main ()
{
// register signal SIGINT and signal handler
signal(SIGINT, signalHandler);

while(1){
cout << "Going to sleep...." << endl;
sleep(1);
}

return 0;
}

This is a example when the console window is printing " Going to sleep " if you press "Ctrl + C" the process will go to signalHandler(). So i mean that when i end this process in the task manager, my app will go to signalHandler() before exit. Could you show me a solution

[modoran]

Just call the WaitForSingleObject function with a handle to the process.

A process cannot prevent itself from being terminated.

[G309216C]

True,

But there is a crude way to do this by hooking NtTerminateProcess() which will allow you to modify the function to prevent your process to be closed. But this is very Dangerous and Un needed. Unless you are developing a Security Application there, is no need for this. Maximum you can do is by using ACLS & DACLS.

Code to Disallow access via ACLS & DACLS:

BOOL DenyAccess()
{
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
	SECURITY_ATTRIBUTES sa;
	 TCHAR * szSD = TEXT("D:P")  ;
	  TEXT("(D;OICI;GA;;;BG)");     // Deny access to 
                                     // built-in guests
        TEXT("(D;OICI;GA;;;AN)") ;   // Deny access to 
                                     // anonymous logon
	sa.nLength = sizeof(SECURITY_ATTRIBUTES);
	sa.bInheritHandle = FALSE;

	if (!ConvertStringSecurityDescriptorToSecurityDescriptor(szSD, SDDL_REVISION_1, &(sa.lpSecurityDescriptor), NULL))
		return FALSE;

	if (!SetKernelObjectSecurity(hProcess, DACL_SECURITY_INFORMATION, sa.lpSecurityDescriptor))
		return FALSE;

	return TRUE;

}

This CAN be terminated by the Administrator.

Thanks

[Cer]

I only care when my process being terminated by the task manager to before to be closed i can do something for ex: release memory

[modoran]

Memory is automatically freed by windows operating system when the process is terminated, there is no need to do that yourself.

You can be notified when the process is terminated only using a second process running and waiting on a first process handle.

[Cer]

@modoran
Could you show me a code for that. I never program abut process

[Cer]

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <conio.h>
void _tmain( int argc, TCHAR *argv[] )
{
STARTUPINFO si;
PROCESS_INFORMATION pi;
STARTUPINFO sj;
PROCESS_INFORMATION pj;

ZeroMemory( &si, sizeof(si) );
si.cb = sizeof(si);
ZeroMemory( &pi, sizeof(pi) );

ZeroMemory( &sj, sizeof(sj) );
sj.cb = sizeof(sj);
ZeroMemory( &pj, sizeof(pj) );

// Start the child process p1.exe. Make sure p1.exe is in the
// same folder as current application. Otherwise write the full path in first argument.
if(!CreateProcess(L".\\p1.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &sj, &pj))
{
printf( "Hello CreateProcess failed (%d)\n", GetLastError() );
getch();
return;
}

// Start child process p2.exe. Make sure p2.exe is in the
// same folder as current application. Otherwise write the full path in first argument.
if(!CreateProcess(L".\\p2.exe", NULL, NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi))
{
printf( "CreateProcess2 failed (%d)\n", GetLastError() );
getch();
return;
}

// Wait until child processes exit.
WaitForSingleObject( pi.hProcess, INFINITE );
WaitForSingleObject( pj.hProcess, INFINITE );

// Close process and thread handles.
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
CloseHandle( pj.hProcess );
CloseHandle( pj.hThread );
printf( "Close p1 & p2" );
getch();
}

this my code using second process. But I mean, when process 1 running after time task manager end it, so how to it know being ended by itself.
Only use win32 API
not use .net framework

[modoran]

Check WaitForSingleObject() return value, if it is WAIT_OBJECT_0 then first process is terminated.

[Cer]

you mean using second process to WaitForSingleObject(pocess1)?
i mean only using one process, not using second process.

[modoran]

No, there is no way to know when YOUR PROCESS is being terminated if task manager uses TerminateProcess() API (this is done in case of "force kill option").

In C there is atexit() function which is called when the program is about to terminate (gracefully).
http://www.cplusplus.com/reference/cstdlib/atexit/

[Cer]

@all
i also think there is no way to do this. If you find out a solution, please show me. Thanks for your help,:D.