MSDN - Windows Kernel Documentation

Overview

The Windows kernel provides a set of mechanisms for terminating a process. Termination can be initiated by the process itself, another process, or the operating system in response to critical failures.

Key concepts include:

• Graceful shutdown via ExitProcess
• Forced termination using TerminateProcess
• Kernel-mode cleanup via PsTerminateProcess
• Notification to registered callbacks (e.g., PsSetCreateProcessNotifyRoutineEx)

Termination Routines

ExitProcess (User‑mode)

#include <windows.h>

int main()
{
    // Perform cleanup tasks
    // ...

    // Exit with a status code
    ExitProcess(0);
    return 0; // Unreachable
}

TerminateProcess (User‑mode, forced)

#include <windows.h>
#include <stdio.h>

int main()
{
    DWORD pid = 1234; // Target PID
    HANDLE h = OpenProcess(PROCESS_TERMINATE, FALSE, pid);
    if (h == NULL) {
        printf("Unable to open process: %lu\n", GetLastError());
        return 1;
    }
    if (!TerminateProcess(h, 1)) {
        printf("TerminateProcess failed: %lu\n", GetLastError());
    } else {
        printf("Process terminated.\n");
    }
    CloseHandle(h);
    return 0;
}

PsTerminateProcess (Kernel‑mode)

NTSTATUS
PsTerminateProcess(
    _In_ PEPROCESS Process,
    _In_ NTSTATUS   ExitStatus
    );

This routine must be called from within kernel mode and requires proper security considerations.

Exit Codes

Windows uses a 32‑bit unsigned integer to represent process exit codes. Common conventions:

• 0 – Success
• 1 – Generic error
• 0xC0000005 – Access violation
• Custom application‑specific values can be defined as needed.

Example: Terminating a Child Process

The following snippet spawns a child process and then terminates it after a delay.

#include <windows.h>
#include <stdio.h>

int main()
{
    STARTUPINFO si = { sizeof(si) };
    PROCESS_INFORMATION pi;
    if (!CreateProcess(L"C:\\Windows\\System32\\notepad.exe",
                       NULL, NULL, NULL, FALSE,
                       0, NULL, NULL, &si, &pi)) {
        printf("CreateProcess failed: %lu\n", GetLastError());
        return 1;
    }

    Sleep(3000); // Let Notepad run for 3 seconds

    if (!TerminateProcess(pi.hProcess, 0)) {
        printf("TerminateProcess failed: %lu\n", GetLastError());
    } else {
        printf("Notepad terminated.\n");
    }

    CloseHandle(pi.hThread);
    CloseHandle(pi.hProcess);
    return 0;
}

Best Practices

1. Prefer graceful shutdown (ExitProcess) over forced termination.
2. Release all handles and free resources before exiting.
3. Use TerminateProcess only when a process cannot be stopped safely.
4. In kernel mode, validate the PEPROCESS pointer before calling PsTerminateProcess.
5. Log exit status for diagnostics.