17 Mar
Posted by: Christian Wimmer in: JEDI Windows API Headers
The people from Microsoft decided that the user has to be in full control over the computer. So there is no assured way to make a program user resistant. She can always use TerminateProcess to forcibly kill the process.
Because nobody reads the remarks section of TerminateProcess, I cite it here.
The TerminateProcess function is used to unconditionally cause a process to exit. The state of global data maintained by dynamic-link libraries (DLLs) may be compromised if TerminateProcess is used rather than ExitProcess.
TerminateProcess initiates termination and returns immediately. This stops execution of all threads within the process and requests cancellation of all pending I/O. The terminated process cannot exit until all pending I/O has been completed or canceled.
And remind this little sentence.
A process cannot prevent itself from being terminated.
However there are some reasons not to make your application undestroyable.
Tell me how you liked this blog entry by adding a comment.
2 Responses
parmaster
15|Apr|2008 1You could actually inject a thread into process system wide hooking the TerminateProcess API. When a program on the system tries to call the API it can be intercepted and canceled if it matches your unstoppable file.
Oliver
20|Apr|2008 2Right, but this requires at least to have the rights to inject into any process and it doesn’t matter. How about me just calling something like ExitProcess() via CreateRemoteThread()? Or how about me injecting faulty code, that will make the process fault and end with an exception? How about the half a dozen other functions that are able to cause the same thing?
The situation is similar to that of rootkits. Rootkits can only use known methods to hide and defenders can only use known vectors to find rootkits. Not in all cases those sets of know-how match, so that one may be ahead of the other, but the problem remains ultimately unsolvable.
// Oliver
Leave a reply