{"id":38373,"date":"2004-07-22T07:00:00","date_gmt":"2004-07-22T07:00:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2004\/07\/22\/why-cant-you-trap-terminateprocess\/"},"modified":"2004-07-22T07:00:00","modified_gmt":"2004-07-22T07:00:00","slug":"why-cant-you-trap-terminateprocess","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20040722-00\/?p=38373","title":{"rendered":"Why can&#039;t you trap TerminateProcess?"},"content":{"rendered":"<p>If a user fires up Task Manager and clicks &#8220;End Task&#8221; on your program, Windows first tries to shut down your program nicely, by sending WM_CLOSE messages to GUI programs and CTRL_CLOSE_EVENT events to console programs. But you don&#8217;t get a chance to intercept TerminateProcess. Why not?\n <a href=\"http:\/\/msdn.microsoft.com\/library\/en-us\/dllproc\/base\/terminateprocess.asp\"> TerminateProcess<\/a> is the low-level process killing function. It bypasses DLL_PROCESS_DETACH and anything else in the process. Once you kill with TerminateProcess, no more user-mode code will run  in that process.  It&#8217;s gone. <a href=\"http:\/\/www.bartleby.com\/66\/76\/15776.html\"> Do not pass go. Do not collect $200<\/a>.\n If you could intercept TerminateProcess, then you would be escalating <a href=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2004\/02\/16\/73780.aspx\"> the arms race between programs and users<\/a>. Suppose you could intercept it.  Well, then if you wanted to make your program unkillable, you would just hang in your TerminateProcess handler!\n And then people would ask for &#8220;a way to kill a process that is refusing to be killed with TerminateProcess,&#8221; and we&#8217;d be back to where we started.<\/p>\n<p> Tomorrow: <a href=\"http:\/\/blogs.msdn.com\/oldnewthing\/archive\/2004\/07\/23\/192531.aspx\"> About those processes that don&#8217;t go away even though you&#8217;ve killed them<\/a>. They&#8217;re really dead, but they won&#8217;t go away. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>If a user fires up Task Manager and clicks &#8220;End Task&#8221; on your program, Windows first tries to shut down your program nicely, by sending WM_CLOSE messages to GUI programs and CTRL_CLOSE_EVENT events to console programs. But you don&#8217;t get a chance to intercept TerminateProcess. Why not? TerminateProcess is the low-level process killing function. It [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-38373","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>If a user fires up Task Manager and clicks &#8220;End Task&#8221; on your program, Windows first tries to shut down your program nicely, by sending WM_CLOSE messages to GUI programs and CTRL_CLOSE_EVENT events to console programs. But you don&#8217;t get a chance to intercept TerminateProcess. Why not? TerminateProcess is the low-level process killing function. It [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/38373","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=38373"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/38373\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=38373"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=38373"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=38373"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}