Hello, FS gurus
I know this issue had been talked about numerous times but still, I suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
-
Terminating the child process in Create Process Notification CB in
kernel mode filter driver by using ZwTerminateProcess().
-
Denying access to image files by blocking IRP_MJ_CREATE when the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode apps
spawning new processes really do complain about their children being killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so well
documented) way to kill a starting process? Maybe the best way to achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
For Vista SP1 and beyond, register a create process notify routine with PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus from the callback for a creation notification.
-----Original Message-----
From: Dmitry G
Sent: Thursday, June 18, 2009 09:34
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Terminating a starting process
Hello, FS gurus
I know this issue had been talked about numerous times but still, I suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
1. Terminating the child process in Create Process Notification CB in
kernel mode filter driver by using ZwTerminateProcess().
2. Denying access to image files by blocking IRP_MJ_CREATE when the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode apps
spawning new processes really do complain about their children being killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so well
documented) way to kill a starting process? Maybe the best way to achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Thanks for a quick reply!
- As for Vista SP1 and beyond I have tried this method and sometimes it’s
even dirtier than ZwTerminateProcess() since the user-mode app throws a
message-box with “Access Denied”
- And what about XP?
Thanks!
“Skywing” wrote in message news:xxxxx@ntfsd…
For Vista SP1 and beyond, register a create process notify routine with
PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus from
the callback for a creation notification.
- S
-----Original Message-----
From: Dmitry G
Sent: Thursday, June 18, 2009 09:34
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Terminating a starting process
Hello, FS gurus
I know this issue had been talked about numerous times but still, I suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
1. Terminating the child process in Create Process Notification CB in
kernel mode filter driver by using ZwTerminateProcess().
2. Denying access to image files by blocking IRP_MJ_CREATE when the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode apps
spawning new processes really do complain about their children being killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so well
documented) way to kill a starting process? Maybe the best way to achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
You’re probably not going to find a way to make apps happy if you terminate their child processes and they’re written to require that their child processes actually work. That’s just the way it is. This is one of those things that should be used sparingly, because most apps don’t appreciate whatever they were working with being ripped out from under them.
-----Original Message-----
From: Dmitry G
Sent: Thursday, June 18, 2009 10:04
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Terminating a starting process
Thanks for a quick reply!
1. As for Vista SP1 and beyond I have tried this method and sometimes it’s
even dirtier than ZwTerminateProcess() since the user-mode app throws a
message-box with “Access Denied”
2. And what about XP?
Thanks!
“Skywing” wrote in message news:xxxxx@ntfsd…
For Vista SP1 and beyond, register a create process notify routine with
PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus from
the callback for a creation notification.
- S
-----Original Message-----
From: Dmitry G
Sent: Thursday, June 18, 2009 09:34
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Terminating a starting process
Hello, FS gurus
I know this issue had been talked about numerous times but still, I suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
1. Terminating the child process in Create Process Notification CB in
kernel mode filter driver by using ZwTerminateProcess().
2. Denying access to image files by blocking IRP_MJ_CREATE when the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode apps
spawning new processes really do complain about their children being killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so well
documented) way to kill a starting process? Maybe the best way to achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
The second one is a better way because you are NOT killing a process. Rather
you are preventing it from getting started.
Regards,
Ayush Gupta
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-370352-
xxxxx@lists.osr.com] On Behalf Of Dmitry G
Sent: Thursday, June 18, 2009 10:57 PM
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Terminating a starting process
Hello, FS gurus
I know this issue had been talked about numerous times but still, I
suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
-
Terminating the child process in Create Process Notification CB
in
kernel mode filter driver by using ZwTerminateProcess().
-
Denying access to image files by blocking IRP_MJ_CREATE when
the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode
apps
spawning new processes really do complain about their children being
killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so
well
documented) way to kill a starting process? Maybe the best way to
achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
I would say that throwing “Access denied” is MUCH BETTER than silently
getting terminated. IIRC, there if you call ZwTerminateProcess the address
space does not get cleaned up properly or something like that.
Regards,
Ayush Gupta
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-370358-
xxxxx@lists.osr.com] On Behalf Of Dmitry G
Sent: Thursday, June 18, 2009 11:33 PM
To: Windows File Systems Devs Interest List
Subject: Re:[ntfsd] Terminating a starting process
Thanks for a quick reply!
- As for Vista SP1 and beyond I have tried this method and sometimes
it’s
even dirtier than ZwTerminateProcess() since the user-mode app throws a
message-box with “Access Denied”
- And what about XP?
Thanks!
“Skywing” wrote in message
> news:xxxxx@ntfsd…
> For Vista SP1 and beyond, register a create process notify routine with
> PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus
> from
> the callback for a creation notification.
>
> - S
>
> -----Original Message-----
> From: Dmitry G
> Sent: Thursday, June 18, 2009 09:34
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Terminating a starting process
>
>
> Hello, FS gurus
>
> I know this issue had been talked about numerous times but still, I
> suppose,
> the exhaustive answer had never been given.
>
> How can a starting process be terminated?
>
> I tried these:
>
> 1. Terminating the child process in Create Process Notification CB
> in
> kernel mode filter driver by using ZwTerminateProcess().
>
> 2. Denying access to image files by blocking IRP_MJ_CREATE when
> the
> access requested included
>
> EXECUTE permission.
>
> These worked for me (with some exceptions though). Sometimes user-mode
> apps
> spawning new processes really do complain about their children being
> killed
> (hey, who can blame them?) showing angry message boxes. My question is:
>
> What is the cleanest and the most recommended/documented (or not so
> well
> documented) way to kill a starting process? Maybe the best way to
> achieve
> this goal is from a user-mode app/service? Am I missing anything?
>
> Regards,
>
> Dmitry.
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
The address space will certainly be properly cleaned up. But there’s again an increased chance that the app won’t handle the rug being pulled out from under it very well.
-----Original Message-----
From: Ayush Gupta
Sent: Thursday, June 18, 2009 11:27
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Terminating a starting process
I would say that throwing “Access denied” is MUCH BETTER than silently
getting terminated. IIRC, there if you call ZwTerminateProcess the address
space does not get cleaned up properly or something like that.
Regards,
Ayush Gupta
> -----Original Message-----
> From: xxxxx@lists.osr.com [mailto:bounce-370358-
> xxxxx@lists.osr.com] On Behalf Of Dmitry G
> Sent: Thursday, June 18, 2009 11:33 PM
> To: Windows File Systems Devs Interest List
> Subject: Re:[ntfsd] Terminating a starting process
>
> Thanks for a quick reply!
> 1. As for Vista SP1 and beyond I have tried this method and sometimes
> it’s
> even dirtier than ZwTerminateProcess() since the user-mode app throws a
> message-box with “Access Denied”
> 2. And what about XP?
>
> Thanks!
>
>
> “Skywing” wrote in message
> news:xxxxx@ntfsd…
> For Vista SP1 and beyond, register a create process notify routine with
> PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus
> from
> the callback for a creation notification.
>
> - S
>
> -----Original Message-----
> From: Dmitry G
> Sent: Thursday, June 18, 2009 09:34
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Terminating a starting process
>
>
> Hello, FS gurus
>
> I know this issue had been talked about numerous times but still, I
> suppose,
> the exhaustive answer had never been given.
>
> How can a starting process be terminated?
>
> I tried these:
>
> 1. Terminating the child process in Create Process Notification CB
> in
> kernel mode filter driver by using ZwTerminateProcess().
>
> 2. Denying access to image files by blocking IRP_MJ_CREATE when
> the
> access requested included
>
> EXECUTE permission.
>
> These worked for me (with some exceptions though). Sometimes user-mode
> apps
> spawning new processes really do complain about their children being
> killed
> (hey, who can blame them?) showing angry message boxes. My question is:
>
> What is the cleanest and the most recommended/documented (or not so
> well
> documented) way to kill a starting process? Maybe the best way to
> achieve
> this goal is from a user-mode app/service? Am I missing anything?
>
> Regards,
>
> Dmitry.
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer
Hmmm… Right… But the poor process won’t get a chance to do anything.
Regards,
Ayush Gupta
-----Original Message-----
From: xxxxx@lists.osr.com [mailto:bounce-370370-
xxxxx@lists.osr.com] On Behalf Of Skywing
Sent: Friday, June 19, 2009 12:49 AM
To: Windows File Systems Devs Interest List
Subject: RE: [ntfsd] Terminating a starting process
The address space will certainly be properly cleaned up. But there’s
again an increased chance that the app won’t handle the rug being
pulled out from under it very well.
-----Original Message-----
From: Ayush Gupta
> Sent: Thursday, June 18, 2009 11:27
> To: Windows File Systems Devs Interest List
> Subject: RE: [ntfsd] Terminating a starting process
>
>
> I would say that throwing “Access denied” is MUCH BETTER than silently
> getting terminated. IIRC, there if you call ZwTerminateProcess the
> address
> space does not get cleaned up properly or something like that.
>
> Regards,
> Ayush Gupta
>
> > -----Original Message-----
> > From: xxxxx@lists.osr.com [mailto:bounce-370358-
> > xxxxx@lists.osr.com] On Behalf Of Dmitry G
> > Sent: Thursday, June 18, 2009 11:33 PM
> > To: Windows File Systems Devs Interest List
> > Subject: Re:[ntfsd] Terminating a starting process
> >
> > Thanks for a quick reply!
> > 1. As for Vista SP1 and beyond I have tried this method and sometimes
> > it’s
> > even dirtier than ZwTerminateProcess() since the user-mode app throws
> a
> > message-box with “Access Denied”
> > 2. And what about XP?
> >
> > Thanks!
> >
> >
> > “Skywing” wrote in message
> > news:xxxxx@ntfsd…
> > For Vista SP1 and beyond, register a create process notify routine
> with
> > PsSetCreateProcessNotifyRoutineEx, and return a failure
> CreationStatus
> > from
> > the callback for a creation notification.
> >
> > - S
> >
> > -----Original Message-----
> > From: Dmitry G
> > Sent: Thursday, June 18, 2009 09:34
> > To: Windows File Systems Devs Interest List
> > Subject: [ntfsd] Terminating a starting process
> >
> >
> > Hello, FS gurus
> >
> > I know this issue had been talked about numerous times but still, I
> > suppose,
> > the exhaustive answer had never been given.
> >
> > How can a starting process be terminated?
> >
> > I tried these:
> >
> > 1. Terminating the child process in Create Process Notification
> CB
> > in
> > kernel mode filter driver by using ZwTerminateProcess().
> >
> > 2. Denying access to image files by blocking IRP_MJ_CREATE when
> > the
> > access requested included
> >
> > EXECUTE permission.
> >
> > These worked for me (with some exceptions though). Sometimes user-
> mode
> > apps
> > spawning new processes really do complain about their children being
> > killed
> > (hey, who can blame them?) showing angry message boxes. My question
> is:
> >
> > What is the cleanest and the most recommended/documented (or not so
> > well
> > documented) way to kill a starting process? Maybe the best way to
> > achieve
> > this goal is from a user-mode app/service? Am I missing anything?
> >
> > Regards,
> >
> > Dmitry.
> >
> >
> >
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule of debugging and file system seminars
> > (including our new fs mini-filter seminar) visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
> >
> >
> >
> > —
> > NTFSD is sponsored by OSR
> >
> > For our schedule of debugging and file system seminars
> > (including our new fs mini-filter seminar) visit:
> > http://www.osr.com/seminars
> >
> > To unsubscribe, visit the List Server section of OSR Online at
> > http://www.osronline.com/page.cfm?name=ListServer
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
Just few days back someone ask a question “how to secure its app from terminating”.
Now this post is “how to terminate a starting process”.
Just thinking what will happen if two software one each of above mentioned type exist in a system.
>What is the cleanest and the most recommended/documented (or not so well documented) way to kill a starting process? Maybe the best way to achieve this goal is from a user-mode app/service? Am I missing anything?
Instead of ZwTerminateProcess, try calling ExitProcess in the target process context. Its way better and will result in proper cleanup but than I have seen processes securing its address space and not allowing any other app to … .
Is it really a requirement for your software? What type of App is this, when will it start?
P.S.: Thought it may seem like a NTFSD thing but in proper sense its not.
Thanks,
Aditya
Thanks all for valuable inputs!
However, if I choose to do this in the context of a user mode process
(creator):
is it better to kill the child from the parent (with TerminateProcess)
or to make the
child “commit suicide” with ExitProcess?
Regards,
Dmitry
wrote in message news:xxxxx@ntfsd…
> Just few days back someone ask a question “how to secure its app from
> terminating”.
> Now this post is “how to terminate a starting process”.
>
> Just thinking what will happen if two software one each of above mentioned
> type exist in a system.
>
>>>What is the cleanest and the most recommended/documented (or not so well
>>>documented) way to kill a starting process? Maybe the best way to achieve
>>>this goal is from a user-mode app/service? Am I missing anything?
>
> Instead of ZwTerminateProcess, try calling ExitProcess in the target
> process context. Its way better and will result in proper cleanup but than
> I have seen processes securing its address space and not allowing any
> other app to … .
>
> Is it really a requirement for your software? What type of App is this,
> when will it start?
>
> P.S.: Thought it may seem like a NTFSD thing but in proper sense its not.
>
> Thanks,
> Aditya
>
One more question:
What about hooking NtCreateThread()?
I may return a fake success status and a fake thread handle to the calling
process.
Is that an option?
Regards,
Dmitry.
Disclaimer: I do know hooks are illegal, immoral and the fact hook writers
go straight to hell after putting their last semicolon is obvious to me (and
yes, hooks don’t work on Vista).
“Skywing” wrote in message news:xxxxx@ntfsd…
For Vista SP1 and beyond, register a create process notify routine with
PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus from
the callback for a creation notification.
- S
-----Original Message-----
From: Dmitry G
Sent: Thursday, June 18, 2009 09:34
To: Windows File Systems Devs Interest List
Subject: [ntfsd] Terminating a starting process
Hello, FS gurus
I know this issue had been talked about numerous times but still, I suppose,
the exhaustive answer had never been given.
How can a starting process be terminated?
I tried these:
1. Terminating the child process in Create Process Notification CB in
kernel mode filter driver by using ZwTerminateProcess().
2. Denying access to image files by blocking IRP_MJ_CREATE when the
access requested included
EXECUTE permission.
These worked for me (with some exceptions though). Sometimes user-mode apps
spawning new processes really do complain about their children being killed
(hey, who can blame them?) showing angry message boxes. My question is:
What is the cleanest and the most recommended/documented (or not so well
documented) way to kill a starting process? Maybe the best way to achieve
this goal is from a user-mode app/service? Am I missing anything?
Regards,
Dmitry.
—
NTFSD is sponsored by OSR
For our schedule of debugging and file system seminars
(including our new fs mini-filter seminar) visit:
http://www.osr.com/seminars
To unsubscribe, visit the List Server section of OSR Online at
http://www.osronline.com/page.cfm?name=ListServer
I don’t think you will accomplish anything with this. If you return a fake
thread handle most app’s will probably use it shortly with the result of
illegal handle. Unfortunately, there is no good way to do this.
–
Don Burn (MVP, Windows DDK)
Windows Filesystem and Driver Consulting
Website: http://www.windrvr.com
Blog: http://msmvps.com/blogs/WinDrvr
“Dmitry G” wrote in message news:xxxxx@ntfsd…
> One more question:
>
> What about hooking NtCreateThread()?
>
> I may return a fake success status and a fake thread handle to the calling
> process.
>
> Is that an option?
>
> Regards,
>
> Dmitry.
>
> Disclaimer: I do know hooks are illegal, immoral and the fact hook writers
> go straight to hell after putting their last semicolon is obvious to me
> (and yes, hooks don’t work on Vista).
>
>
>
> “Skywing” wrote in message
> news:xxxxx@ntfsd…
> For Vista SP1 and beyond, register a create process notify routine with
> PsSetCreateProcessNotifyRoutineEx, and return a failure CreationStatus
> from the callback for a creation notification.
>
> - S
>
> -----Original Message-----
> From: Dmitry G
> Sent: Thursday, June 18, 2009 09:34
> To: Windows File Systems Devs Interest List
> Subject: [ntfsd] Terminating a starting process
>
>
> Hello, FS gurus
>
> I know this issue had been talked about numerous times but still, I
> suppose,
> the exhaustive answer had never been given.
>
> How can a starting process be terminated?
>
> I tried these:
>
> 1. Terminating the child process in Create Process Notification CB in
> kernel mode filter driver by using ZwTerminateProcess().
>
> 2. Denying access to image files by blocking IRP_MJ_CREATE when the
> access requested included
>
> EXECUTE permission.
>
> These worked for me (with some exceptions though). Sometimes user-mode
> apps
> spawning new processes really do complain about their children being
> killed
> (hey, who can blame them?) showing angry message boxes. My question is:
>
> What is the cleanest and the most recommended/documented (or not so well
> documented) way to kill a starting process? Maybe the best way to achieve
> this goal is from a user-mode app/service? Am I missing anything?
>
> Regards,
>
> Dmitry.
>
>
>
>
> —
> NTFSD is sponsored by OSR
>
> For our schedule of debugging and file system seminars
> (including our new fs mini-filter seminar) visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>
>
>
>
> Information from ESET NOD32 Antivirus, version of virus
> signature database 4174 (20090620)
>
> The message was checked by ESET NOD32 Antivirus.
>
> http://www.eset.com
>
>
>
Information from ESET NOD32 Antivirus, version of virus signature database 4174 (20090620)
The message was checked by ESET NOD32 Antivirus.
http://www.eset.com
I think any way you slice it the program is going to be depending on functionality that is no longer existant. Even if you return him a valid thread handle to a fake thread you’ve created that does nothing, presumably the caller expects that thread to actually do something. And what it expects the thread to do is going to be different for every application. Short of RE’ing and doing a binary rewrite of every potential application you might be trying to block from creating child processes to ensure that it is able to gracefully proceed when this happens, I’m not sure there’s a good solution.
It’s kind of like saying “suppose I want to write nop instructions over some 100 bytes of an arbitrary application’s code. Is there a good way to do this so that the program can otherwise execute normally after I do this?”