Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the difference between closing an application and ending the process from Task Manager?

What is the difference between killing an application using the close button and ending the process from the Task Manager?

I am aware of the fact that hitting the close button posts a WM_CLOSE message in the message queue, but I don't know what happens when we kill a process from Task Manager (or any similar application like Killbox or Process Explorer).

like image 955
user1232138 Avatar asked May 26 '12 09:05

user1232138


People also ask

What happens if you end process in Task Manager?

While stopping a process using the Task Manager will most likely stabilize your computer, ending a process can completely close an application or crash your computer, and you could lose any unsaved data. It's always recommended to save your data before killing a process, if possible.

What does it mean to end process tree in Task Manager?

End Process Tree: will end/kill/close the current application plus all related service and applications it is using.

What is the difference between end task and end process tree?

If you want to end a single process, click the process that you want to end, and then click End Task. If you want to end a process and all processes directly or indirectly related to it, right-click the process that you want to end, and then click End Process Tree.


2 Answers

When you click the "X" button in the title bar of an application's window, that sends the window a WM_CLOSE message. This is a "graceful" shutdown—the application processes the message, handles any necessary cleanup tasks, and can even refuse to shut down if it so desires (by returning zero in response to the message). WM_CLOSE is simply a request that the window or application terminate; the window is not destroyed until the application itself calls the DestroyWindow function.

When you press the "End Task" button in Task Manager, Windows will first try to send the application (if it is a GUI application) a WM_CLOSE message. In other words, it first asks nicely and gives the app a chance to terminate itself cleanly.*

If you fail to close in response to that initial WM_CLOSE message, the Task Manager will follow up by calling the TerminateProcess function. This function is a little bit different because it forcefully terminates the application's process and all of its threads without asking for permission from the app. This is a very harsh method of closing something, and should be used as a last resort—such as when an application is hung and is no longer responding to messages.

TerminateProcess is a very low-level function that essentially rips the user-mode part of a process from memory, forcing it to terminate unconditionally. Calling TerminateProcess bypasses such niceties as close notifications and DLL_PROCESS_DETACH. Your application does not have the ability to refuse to close, and there is no way to catch/trap/hook calls to TerminateProcess. All user-mode code in the process simply stops running for good. This is a very unclean shut down procedure, somewhat akin to jerking the computer's power plug out of the wall.

* Note that this only true if you use the "Applications" tab of Task Manager to kill the application. If you use the "Processes" tab, this step is skipped and the TerminateProcess function is called immediately. This distinction is reflected in the caption on the respective buttons. For the "Applications" tab, the button is lableled "End Task"; for the "Processes" tab, the button is labeled "End Process".

like image 96
Cody Gray Avatar answered Sep 25 '22 00:09

Cody Gray


Killing the process with WM_CLOSE simply signals the process with the message and allows the target to handle the message and exit gracefully. Alternatively, the process could choose not to exit in its WM_CLOSE handler.

Killing the process via task manager will do so with TerminateProcess which is far harsher:

The TerminateProcess function is used to unconditionally cause a process to exit. The state of global data maintained by dynamic-link libraries (DLLs) may be compromised if TerminateProcess is used rather than ExitProcess.

This function stops execution of all threads within the process and requests cancellation of all pending I/O. The terminated process cannot exit until all pending I/O has been completed or canceled. When a process terminates, its kernel object is not destroyed until all processes that have open handles to the process have released those handles.

TerminateProcess is asynchronous; it initiates termination and returns immediately. If you need to be sure the process has terminated, call the WaitForSingleObject function with a handle to the process. A process cannot prevent itself from being terminated.

like image 38
Mike Kwan Avatar answered Sep 26 '22 00:09

Mike Kwan