我无法使用TerminateProcess杀死子进程

Question

I have a problem to kill a child process using TerminateProcess . I call to this function and the process still there (in the Task Manager). This piece of code is called many times launching the same program.exe many times and these process are there in the task manager which i think is not good. Actually is created two process all the time: the program.exe and conhost.exe.

I will really appreciate any help.

Here is the code:

STARTUPINFO childProcStartupInfo;
memset( &childProcStartupInfo, 0, sizeof(childProcStartupInfo));
childProcStartupInfo.cb = sizeof(childProcStartupInfo);
childProcStartupInfo.hStdInput = hFromParent;   // stdin
childProcStartupInfo.hStdOutput = hToParent;    //  stdout
childProcStartupInfo.hStdError = hToParentDup;  // stderr
childProcStartupInfo.dwFlags = STARTF_USESTDHANDLES | STARTF_USESHOWWINDOW;
childProcStartupInfo.wShowWindow = SW_HIDE;


PROCESS_INFORMATION childProcInfo;  /* for CreateProcess call */



bOk = CreateProcess(
    NULL,           // filename
    pCmdLine,   // full command line for child
    NULL,           // process security descriptor */
    NULL,           // thread security descriptor */
    TRUE,           // inherit handles? Also use if STARTF_USESTDHANDLES */
    0,              // creation flags */
    NULL,           // inherited environment address */
    NULL,           // startup dir; NULL = start in current */
    &childProcStartupInfo,          // pointer to startup info (input) */
    &childProcInfo);            // pointer to process info (output) */

CloseHandle( hFromParent );
CloseHandle( hToParent );
CloseHandle( hToParentDup );

CloseHandle( childProcInfo.hThread);
CloseHandle( childProcInfo.hProcess);

TerminateProcess( childProcInfo.hProcess ,0);  //this is not working, the process 

Answer 1

There are two possible reasons that I know of:

• you can't kill a process running under a different security context than the one of the process which calls TerminateProcess ( see here )
• the process is doing something in kernel mode (eg some unfinished I/O operations by driver, etc) - I believe this was introduced with Vista, but I might be wrong