是否有可能在不松开调用堆栈的情况下终止Windows XP上的C ++应用程序？

Question

My understanding is that when you kill a C++ application through Task Manager in Windows XP, the application is still "cleanly" destructed - ie the call stack will unwind and all the relevant object destructors will be invoked. Not sure if my understanding is wrong here.

Is it possible to kill such an application immediately, without unwinding the stack?

For example, the application may employ RAII patterns which will destroy or release resources when an object is destructed. If the traditional "kill process" through Task Manager is graceful, providing a way to kill the application immediately would allow me to test ungraceful shutdown (eg a power outage).

Edit:

Just to clarify, I was after an existing utility or program that would allow me to do this. I should be able to use the solution on programs that I don't have the source code for, meaning that a programmatic solution is not really acceptable.

Edit:

Just to provide more context, sometimes I have to work with 3rd party services which are very intrusive (eg nagging me to reboot every hour). Since I know that I don't need to reboot, I want to kill the process/service so it doesn't nag me anymore. Unfortunately some of the 3rd party developers were "smart" enough to prevent me from doing this, and when I kill the process through Task Manager, the system will reboot immediately (I'm guessing that are using RAII to achieve this).

Answer 1

I believe task manager tries a "nice" shutdown by sending a WM_CLOSE message, then if the application doesn't respond it's killed.

This call should kill the process immediately with no warning:

TerminateProcess

eg:

TerminateProcess(GetCurrentProcess(), 1);

Update:

You may find this article interesting:

Quitting time: exiting a C++ program

Update 2:

I should be able to use the solution on programs that I don't have the source code for

Hmm, well this is undesirable behavior 99.9% of the time.

SysInternals has a utility called pskill :

http://technet.microsoft.com/en-us/sysinternals/bb896683.aspx

but I'm not sure how "nice" it is.

You might need to roll your own, but it should be pretty easy:

DWORD pid = <get pid from command line>;

TerminateProcess(OpenProcess(PROCESS_TERMINATE, FALSE, pid));

Answer 2

The standard Windows way to do this, without relying on 3rd-party tools, is to use taskkill /f :

taskkill /f <process-id>
taskkill /f /im <process-executable-name> 

/f means "force" here, and ensures that process is terminated unconditionally and immediately, with no query or warning.

Answer 3

Unless I'm terribly mistaken (and I just did a little testing to confirm), Task Manager tries to close programs in different ways depending on which tab you're using. If going through the Applications tab and pressing End Task, it will try to close the program cleanly by first sending a WM_CLOSE. But if going through the Processes tab and pressing End Process, it seems to use something along the lines of TerminateProcess, which means no stack unwinding and such.

So first, if you aren't using End Process on the Processes tab, try that.

If that's what you already tried and their software still manages to reboot the system somehow, then there is something more complicated going on. Other people may be on the right track about there being additional processes.

Answer 4

I believe the C standard library method exit(0); will do exactly that, abort the program without calling any destructors, deallocators, etc.

Try that, and let me know if it meets your needs?

Answer 5

It looks like abort() will give you an abnormal exit.

ANSI 4.10.4.1 The behavior of the abort function with regard to open and temporary files The abort function does not close files that are open or temporary. It does not flush stream buffers [source]

and

Abort current process Aborts the process with an abnormal program termination. The function generates the SIGABRT signal, which by default causes the program to terminate >returning an unsuccessful termination error code to the host environment. The program is terminated without executing destructors for objects of automatic or static storage duration, and without calling any atexit function. The function never returns to its caller. [source]

Answer 6

I would try PSKill as suggested by Tim above . I would guess that this will fail as well. If the 3rd party services are really serious about avoiding death, then the service definition may be set to "reboot on crash". The other common approach is to have another service that watchdogs the primary one. The primary service usually sets a global event or employs some other notification mechanism that the watchdog service watches. If the primary service doesn't notify the watchdog, then the watchdog restarts the computer.

Answer 7

The aptly named Kill Tool , available from Microsoft Download. Is part of the Windbg suite also.

The Kill tool, kill.exe, terminates one or more processes and all of their threads. This tool works only on processes running on the local computer.

kill /f <process>

For example, kill /f lsass (just kidding, do not kill LSA!). If you want to roll your own, TerminateProcess is the way to go.

Answer 8

The C function abort() in the standard library will instantly kill your application with no cleanup.

C++ defines a standard global function terminate(). Calling it will also instantly exit your application.

Technically terminate()'s behavior could be overridden by the set_terminate function. It calls abort by default.

Answer 9

There are utilities around that can forbid reboot.

HideToolz does that for example -- there is a checkbox buried somewhere that will make it ask you when something initiates reboot. It is detected by many antiviruses as rootkit (which it is, but this one is supposedly tame), so it might be probematic to run on systems you don't have full control over (when antivirus mandated by domain policy, etc)