Windows Internals Notes--terminating a process

1. The process can be terminated in one of the following four ways:

• The entry point function of the main thread is returned (strongly recommended)
• A thread in the process calls the ExitProcess function (avoid this way)
• A thread in another process calls the TerminateProcess function (avoid this way)
• All threads in a process are "naturally dead" (this situation almost never happens)

2. It should be ensured that the process of the application terminates only after the entry point function of the main thread is returned, in order to ensure that all resources of the main thread are properly cleaned up. The entry point function of the main thread is returned to ensure that the following operations are performed:

• Any C + + objects created by the thread will be destroyed correctly by the destructor of those objects.
• The operating system will correctly release the memory used by the thread stack.
• The system sets the exit code of the thread (maintained in the process kernel object) to the return value of the entry point function.
• The system decrements the usage count of the process kernel object.

The 3.ExitProcess function terminates the process, sets the exit code, does not return a value, and the subsequent code is never executed (the destructor of the object cannot be called).

4. When the main thread's entry point function (Winmain,main) returns, it returns to the startup code of the C/D + + runtime, which correctly cleans up all C run-time resources used by the process. After the C run-time resource is freed, the C run-time startup code displays the call to ExitProcess and passes the value returned by the entry point function to it. This explains why the entire process is terminated by simply returning from the entry point function of the main thread. Note that any other threads running in the process will terminate with the process.

5. From the operating system point of view, a process is correct only after all of its threads have been terminated. However, the strategy of the C/s + + runtime is that, regardless of whether there are other threads running in the process, as long as the main thread returns from its entry point function, the C + + library calls ExitProcess to terminate the process. However, if the entry point function calls the ExitThread instead of the exitprocess or the entry point function to return directly, the main thread of the application will stop executing, but the process will not terminate as long as there are other threads running in the process.

6. Any thread can call TerminateProcess to terminate another process or its own process. This is only used if the process cannot be forced to exit by another method. And the terminated process is not notified of its own termination, nor can it prevent itself from being forcibly terminated.

7. Once the process terminates, no matter how it is terminated, the system will ensure that no part of it is left. There is absolutely no way to know which process is running. The process will never leak anything after termination (memory will be freed, files will be shut down, and kernel object count will be decremented).

The 8.TerminateProcess function is asynchronous, and the system does not guarantee that the process has been forcibly terminated when the function returns.

9. If all the threads in a process are terminated (they all call exitthread or TerminateThread to terminate), the operating system considers that there is no reason to keep the process's address space, which terminates the process. The exit code for the process is set to the exit code of the last terminated thread.

10. When a process terminates, the system performs the following actions in turn:

• Terminate any threads left in the process
• Frees all user objects and GDI objects allocated by the process, shutting down all kernel objects (unless other processes are also turned on)
• The exit code of the process changes from still_active to the code passed to the ExitProcess or TerminateProcess function.
• The state of the process kernel object becomes a triggered state, which is why other threads in the system can suspend themselves until another process terminates.
• The usage count of the process kernel object is decremented by 1.

Windows Internals Notes--terminating a process