How does Windows kill a process, exactly?

Question

I'm unfamiliar with how processes are killed in Windows. In Linux, a "warm" kill sends a signal (15) which the process can handle by instantiating a signal handler. A cold kill is signal (9) which the OS handles by killing the process forcefully.

How can I "kill" a process in Windows? How is it handled by OS and by the process? What actions does OS perform? Is there a cross-platform way of responding to a kill/close request?

Solution

"End Task" (and taskkill) appears to post a WM_CLOSE message to the program's windows. (The same is done when you click the × "Close" button.) If the program does not exit in some time, user gets prompted to end the program forcefully.

"Kill Process" and taskkill /f use TerminateProcess().

• How To Terminate an Application "Cleanly" in Win32

Comments

[user1686]

For readers: Signal 15 is SIGTERM, 9 is SIGKILL.

[Oliver]

Please accept an answer, if your question has been answered.

[Philip]

+1, WM_CLOSE sent to app; after X time ask user to force kill, Windows removes the process from the scheduler, closes all handles (which can trip up the process if the kernel is processing one of those handles), then reclaims the memory space (this is the really short version of the process).

[user1686]

The third way is ntsd -p <pid> -c q, which uses the ntsd debugger; I'm not sure what happens when a program is killed that way. (pokes @Chris)

[user3531602]

what happens if the program doesn't have a window?

[user1686]

@IttayD: Then there's no entry in Task Manager to use "End Task" on :) I just tried taskkill and it replies with: "This process can only be terminated forcefully ( with /F option )." So yeah, the only choice left is TerminateProcess().

[user1686]

@IttayD: Note that on Windows, services (daemons) are written differently from user applications; they can receive status queries and control requests from Service Manager, so a graceful stop is possible.