windows-Process-Exit process

To terminate the running of a process
1. The entry point function of the main thread is returned (preferably using this method).
2. A thread in the process calls the ExitProcess function (this method should be avoided).
3. Threads in another process call the TerminateProcess function (this method should be avoided).
4. All threads in the process terminate their operations themselves (this situation has almost never occurred).




The entry point function of the main thread returns

The application should always be designed so that its process terminates only when the entry point function of the main thread returns. This is the only way to ensure that all thread resources are properly purged. To return the main thread's entry point function, you can ensure that the following actions are implemented:


Any C + + objects created by the thread will be able to be properly undone using their destructors.
The operating system will be able to properly release the memory used by the thread's stack.
The system sets the exit code of the process (maintained in the kernel object of the process) to the return value of the entry point function.
The system decrements the return value of the process kernel object by 1.


ExitProcess function

When the entry point function of the main thread (WinMain, wWinMain, Main, or wmain) returns, it returns to the C + + run-time startup code, which correctly clears all C run-time resources used by the process. When the C run-time resource is freed, the C run-time startup code explicitly calls ExitProcess and passes the value returned by the entry point function to it. This explains why it is possible to terminate the entire process by simply returning the entry point function of the main thread. Note that any other threads running in the process are terminated together with the process.


Call exitprocess or ExitThread to cause a process or thread to terminate running in a function
C,c++ resources that may cause runtime libraries are not released, and the main thread does not have to be released

#include <windows.h> #include <stdio.h>class csomeobj{public:csomeobj (int index) {m_index = index;printf (" Constructor\r\n ");} ~csomeobj () {printf ("destructor%d \ r \ n", M_index);} Public:int M_index;}; Csomeobj G_globalobj (+), int _tmain (int argc, _tchar* argv[]) {csomeobj localobj (+);//this shouldn ' t be Hereexitprocess (0); return 0;}

terminateprocess function

BOOL terminateprocess (HANDLE hprocess,uint fuexitcode);
Can terminate another process or its own process in any thread
You should use TerminateProcess only if you cannot force a process to exit by using another method. The process that terminates the run has absolutely no notification that it will terminate the run because the application cannot be properly purged and cannot avoid being undone (except through normal security mechanisms).
This is a bit like your computer crashes the blue screen is running the program data is not being saved correctly
Note that the TerminateProcess function is a function that runs asynchronously, and you don't know what time it ends.

#include <windows.h> #include <stdio.h>typedef DWORD (__stdcall *ntterminateprocess) (HANDLE, UINT); Ntterminateprocess fntterminateprocess = NULL; BOOL Exitproc (HANDLE hproc) {hinstance hmodule = LoadLibrary (_t ("Ntdll.dll"));//Load Ntdll.dllif (hmodule! = 0) { Fntterminateprocess = (ntterminateprocess) GetProcAddress (hmodule, "ntterminateprocess"); Load external DLL function handle htoken = OpenProcess (Process_all_access, FALSE, (DWORD) hproc); Get maximum permissions for the process if (htoken! = 0) {if (Fntterminateprocess (htoken, 1) = = 0)//Close Program {printf ("End proc:%d\n", (int) hproc); return TR UE;} Else{return FALSE;}} return FALSE;}} int _tmain (int argc, _tchar* argv[]) {startupinfo si; Process_information Pi; ZeroMemory (&si, sizeof (SI)); si.cb = sizeof (SI); ZeroMemory (&pi, sizeof (PI)); TCHAR szpath[] = TEXT ("WORDPAD README.txt"); TCHAR lpcommandline[] = _t ("C:\\windows\\notepad.exe");//Start the child process. if (! CreateProcess (NULL,//No module name (use command line) lpcommandline,//Command linenull,//PRocess handle not Inheritablenull,//Thread handle not Inheritablefalse,//Set handle inheritance to FALSE0,//No creation flagsnull,//Use of Parent ' s environment blocknull,//Use of parent ' s Starting directory &si,//Pointer to Startupinfo structure&pi)//Pointer to Process_informa tion structure) {printf ("CreateProcess failed (%d) \ n", GetLastError ()); return 0;} ExitProcess (0);//exitthread (0); Exitproc (pi.hprocess);//closehandle (pi.hprocess);//closehandle (pi.hthread); return 0;}

The situation that occurs when the process terminates is basically not happening
When the process terminates running, the following actions start running:


1) All remaining threads in the process are terminated.
2) All user objects and GDI objects specified by the process are freed and all kernel objects are closed (if no other process has opened their handles, the kernel objects will be revoked.) However, if other processes open their handles, the kernel object will not be undone.
3) The exit code for the process will change from still_active to the code passed to ExitProcess or terminateprocess.
4) The status of the process kernel object becomes the status of the notification received (for a detailed description of the delivery notification, see chapter 9th). Other threads in the system can hang until the process terminates.
5) The usage count of the process kernel object is decremented by 1.

BOOL getexitcodeprocess (HANDLE hprocess,pdword pdwexitcode);

#include <Windows.h> #include <tchar.h> #include <strsafe.h>int _tmain (int argc, _tchar* argv[]) { TCHAR lpcommandline[] = TEXT ("NOTEPAD"); Startupinfo si; ZeroMemory (&si, sizeof (SI)); si.cb = sizeof (SI); Process_information Pi; ZeroMemory (&pi, sizeof (PI)); Security_attributes ps;ps.binherithandle = false;ps.nlength = sizeof (PS);p s.lpsecuritydescriptor = NULL;if (! CreateProcess (NULL,LPCOMMANDLINE,&AMP;PS,NULL,FALSE,NULL,NULL,NULL,&AMP;SI,&AMP;PI)) {printf ("CreateProcess Failed (%d) \ n ", GetLastError ()); return 0;} Else{dword Dwexitcode = Null;//close The thread handle as soon as//it are no longer needed!//suspend our execution until//t He has terminated. WaitForSingleObject (pi.hprocess, INFINITE);//the child process Terminated;//get its exit Code.if (! GetExitCodeProcess (Pi.hprocess,&dwexitcode)) {_tprintf (_t ("getexitcodeprocess false"));p rintf ("ExitCode Failed (%d) \ n ", GetLastError ());} else{printf ("ExitCode is%s", Dwexitcode);} Close the process handle as soon As//it is no longer needed. CloseHandle (Pi.hthread); CloseHandle (pi.hprocess);} return 0;}

The function looks at the kernel object of the process (identified by the hprocess parameter) and takes out the members of the kernel object's data structure to identify the exit code for the process. The value of the exit code is returned in the DWORD that the Pdwexitcode parameter points to.

Enumerating system processes

EnumProcess.cpp: Defines the entry point of the console application. #include "stdafx.h" #include <windows.h> #include <tchar.h> #include <strsafe.h> #include < Psapi.h>void Printprocessnameandid (DWORD processID) {TCHAR Szprocessname[max_path] = _t ("<unknown>");//Process ID Open Process Handle hprocess = OpenProcess (process_query_information | Process_vm_read,false, ProcessID); if (NULL! = hprocess) {hmodule Hmod;dword cbneeded;if (EnumProcessModules (hProcess, & Amp;hmod, sizeof (HMOD), &cbneeded)) {GetModuleBaseName (hprocess, Hmod, szprocessname,sizeof (szprocessname)/ sizeof (TCHAR));}} _tprintf (_t ("(PID:%-4u) \t%20s\n"), ProcessID, szProcessName); CloseHandle (hprocess);} int _tmain (int argc, _tchar* argv[]) {DWORD aprocesses[1024], cbneeded, cprocesses;unsigned int i;//Enumerate the idif of the process (!  EnumProcesses (aprocesses, sizeof (aprocesses), &cbneeded)) return 0;cprocesses = cbneeded/sizeof (DWORD); for (i = 0; i < cprocesses; i++) if (aprocesses[i]! = 0) Printprocessnameandid (aprocesses[i]); _tsystem (_t ("PAUSE")); return 0;} 

windows-Process-Exit process