How will you kill a process WITHOUT using any API ?

closed account (3hMz8vqX)
Hi all,
i have a small question!
How will you kill a process WITHOUT using any API ?

Is there a way???
That doesn't work for another process.
Without any API your program doesn't (and, in some environments, cannot) know about other processes.
closed account (Dy7SLyTq)
Without any API your program doesn't (and, in some environments, cannot) know about other processes

how does that work? because couldnt Aravind333 write exactly the same code that the api used? i know that it is unlikely, and i would suggest an api, but just asking for clarification
The API eventually invokes kernel-level calls that a user-level program wouldn't be able to run. See a book on OS design for more information.
He could write exactly the same code the API used, but it would just be using more APIs. Eventually you would get to APIs you can't even use without the OS' help because the OS has your program in a slightly sandboxed environment.

So no, he couldn't. If he did, it wouldn't work.
To close\terminate a program you can either use kernel level calls such as ZwTeminateProcess or you can go all rogue and mov a value into eax then call KiFastSystemCall or X86SwitchTo64BitMode that way you invoke a direct contact directly into borders of Ring2.

Or you can try to process injection, then call a exit() from that process memory therefore terminating the process as a whole. This can be effective but if the process blocks process injection, you can load a DLL via registry, in which can it would bypass the proactives of the process.
try this

ExitProcess();

Topic archived. No new replies allowed.