[Xearinox]

Hello.
If I hook ZwTerminateProcess, is possible kill my process without this function?
I have in the mind, if I kill all threads of the process, process is useless, but how this internally work ? Is safe assumed hooking ZwTerminateProcess is 'bulletproof' ? Thanks.

[EP_X0FF]

Hello,

Hooking one function is not enough. See this for examples http://www.kernelmode.info/forum/viewto ... =15&t=1485

[TETYYSs]

Hello.
If I hook ZwTerminateProcess, is possible kill my process without this function?
I have in the mind, if I kill all threads of the process, process is useless, but how this internally work ? Is safe assumed hooking ZwTerminateProcess is 'bulletproof' ? Thanks.

http://wj32.org/wp/2009/05/10/12-ways-t ... a-process/

[Xearinox]

Re: ZwTerminateProcess - catch all killing attempts?

Post by TETYYSs » Fri Dec 13, 2013 10:26 am

Xearinox wrote:Hello.
If I hook ZwTerminateProcess, is possible kill my process without this function?
I have in the mind, if I kill all threads of the process, process is useless, but how this internally work ? Is safe assumed hooking ZwTerminateProcess is 'bulletproof' ? Thanks.


http://wj32.org/wp/2009/05/10/12-ways-t ... a-process/

This I know ;) , maybe my question is bad formated.

Simply: Killing all threads call Nt/ZwTerminateProcess or not ?

[rinn]

Hello.

Simply: Killing all threads call Nt/ZwTerminateProcess or not ?

NtTerminateProcess terminates all running threads of the given process in a cycle. If there are no other working threads process is deleted. If you need complete details see WRK. If you only intercept NtTerminateProcess there will be other ways to end it work.

Best Regards,
-rin

[Vrtule]

Simply: Killing all threads call Nt/ZwTerminateProcess or not ?

If you are asking whether the NtTerminateProcess is called when all threads of a given process are terminated (i.e. by NtTerminateThread), I think the repsponse is NO. In such situation, the system would not use handle to identify the (empty) process, it would prefer pointer to the process object instead (since it already knows it).

[Xearinox]

Thank you all.