How Do Task Managers Kill Apps

How do Task Managers kill apps?

You can send the signal using:

Process.sendSignal(pid, Process.SIGNAL_KILL);

To completely kill the process, it's recommended to call:

ActivityManager.killBackgroundProcesses(PackageName)

before sending the signal.

How does task manager kill my program?

Yes, both of these are correct. You should respond to WM_CLOSE to close gracefully. This could come from anywhere, not just task manager (shutdown for instance).

MFC normally handles WM_CLOSE. If your app is not responding then your main thread must be sat doing something else, or more likely from your description is crashing somewhere in the WM_CLOSE handler.

Can you debug your app to find where the exception is being raised?

What is the difference between closing an application and ending the process from Task Manager?

When you click the "X" button in the title bar of an application's window, that sends the window a WM_CLOSE message. This is a "graceful" shutdown—the application processes the message, handles any necessary cleanup tasks, and can even refuse to shut down if it so desires (by returning zero in response to the message). WM_CLOSE is simply a request that the window or application terminate; the window is not destroyed until the application itself calls the DestroyWindow function.

When you press the "End Task" button in Task Manager, Windows will first try to send the application (if it is a GUI application) a WM_CLOSE message. In other words, it first asks nicely and gives the app a chance to terminate itself cleanly.^*

If you fail to close in response to that initial WM_CLOSE message, the Task Manager will follow up by calling the TerminateProcess function. This function is a little bit different because it forcefully terminates the application's process and all of its threads without asking for permission from the app. This is a very harsh method of closing something, and should be used as a last resort—such as when an application is hung and is no longer responding to messages.

TerminateProcess is a very low-level function that essentially rips the user-mode part of a process from memory, forcing it to terminate unconditionally. Calling TerminateProcess bypasses such niceties as close notifications and DLL_PROCESS_DETACH. Your application does not have the ability to refuse to close, and there is no way to catch/trap/hook calls to TerminateProcess. All user-mode code in the process simply stops running for good. This is a very unclean shut down procedure, somewhat akin to jerking the computer's power plug out of the wall.

_{^* Note that this only true if you use the "Applications" tab of Task Manager to kill the application. If you use the "Processes" tab, this step is skipped and the TerminateProcess function is called immediately. This distinction is reflected in the caption on the respective buttons. For the "Applications" tab, the button is lableled "End Task"; for the "Processes" tab, the button is labeled "End Process".}

How do we prevent closing the application from the Task Manager?

Anti-Virus software that is signed and have special contact with Microsoft are allowed to be part of ELAM/Protected processes.

You can try to do the same by writing a kernel driver and deny everyone the right to open a handle with terminate rights on your process. This is however a bit ugly and should be avoided if possible.

The sane solution is to write your "important" application as a Windows service, this will prevent normal users from stopping it.

It will not stop administrator users but that is OK because untrusted users should not be administrators.

Can I handle the killing of my windows process through the Task Manager?

There are two ways to kill application in Task Manager.

• Killing through Applications tab would roughly be equivalent of SIGTERM. Application may intercept it and do more processing, since it's basically sending a "close window" message. Message to catch is WM_CLOSE.
• Killing through Processes tab would roughly be equivalent of SIGKILL. There is nothing you can do to intercept that, short of monitoring user's actions in Task Manager's listbox and End Process button, or having a watchdog process that will see when the first one is killed.

Alternatively, design the application in a way that does not require cleanup, or in a way that it will perform cleanup at startup.

---

Related Topics