The ZwTerminateProcess routine terminates a process and all of its threads.
NTSYSAPI NTSTATUS ZwTerminateProcess( HANDLE ProcessHandle, NTSTATUS ExitStatus );
A handle to the process object that represents the process to be terminated.
An NTSTATUS value that the operating system uses as the final status for the process and each of its threads.
ZwTerminateProcess returns STATUS_SUCCESS if the operation succeeds. Additional return values include:
||The specified handle is not a process handle.|
||The specified handle is not valid.|
||The driver cannot access the specified process object.|
||The specified process is already terminating.|
If the caller specifies the current process in the ProcessHandle parameter, ZwTerminateProcess does not return.
To obtain a process handle that a driver can specify for the ProcessHandle parameter, the driver can call ZwOpenProcess. The handle must be a kernel handle, a handle that can only be accessed in kernel mode. A handle is a kernel handle if it is created with the OBJ_KERNEL_HANDLE flag. For more info see InitializeObjectAttributes.
Drivers must not specify the current process if resources have not been freed from the kernel stack, because the operating system will not unwind the kernel stack for the calling thread.
|Minimum supported client||Available starting with Windows 2000.|
|Header||ntddk.h (include Ntddk.h)|
|DDI compliance rules||PowerIrpDDis, HwStorPortProhibitedDDIs|
Send feedback about: