0

If you want to stop a process from being terminated, one way is to hook into TerminateProcess (or NtTerminateProcess). If the process is terminating itself (because you closed its window, for example), the handle supplied to those functions is NULL, so you can find out what executable is being terminated using GetCurrentProcess() & GetModuleFileNameEx(). As GetCurrentProcess() returns a pseudo-handle, you can access it with no problems.

If one process is terminating another, though, the handle supplied is not NULL. It represents the process being terminated. The problem is, you can't get information about that process. You can simply return a code saying "access denied" instead of calling the original [Nt]TerminateProcess(), but that blanket stops all processes from terminating others - which is a bad idea.

The handle must represent something valid otherwise TerminateProcess wouldn't be able to do anything useful with it - but I can't even call GetProcessId() on it, I get ERROR_INVALID_HANDLE (or ERROR_ACCESS_DENIED). I've tried various methods I've collected from the help and from online, including gaining the debug privilege (success) and DuplicateHandle() (same error) and ZwQueryInformationProcess() to get the ID (STATUS_ACCESS_DENIED). I can't even enumerate processes because they return IDs, and I can't get the ID, and OpenProcess() always returns a fresh handle, so I can't compare handles.

I can only assume the handle has PROCESS_TERMINATE right and nothing else. I know that Vista and higher have protected processes due to Digital Rights Management, but I'm using ProcessExplorer as my guinea pig so it's definitely not a media application!

Does anyone know how else I might be able to get any kind of information about the process being terminated from this handle?

4

1 回答 1

1

它只是一个普通的进程句柄。问题是,你的钩子函数在哪个进程中执行?如果是调用进程,句柄可以直接用于GetProcessId或NtQueryInformationProcess。如果没有,您需要调用 DuplicateHandle 将句柄复制到您的进程中。

如果您收到拒绝访问错误,可能是因为进程句柄只有 PROCESS_TERMINATE 访问权限。在这种情况下,请使用 DuplicateHandle 以 PROCESS_QUERY_(LIMITED_)INFORMATION 访问权限“重新打开”进程。

于 2010-11-07T11:45:24.067 回答