Windows in how to determine whether a process is terminated by other processes, or their normal exit-CodePudding

Windows in how to determine whether a process is terminated by other processes, or their normal exit
To solve, thank you!

CodePudding user response:

If it is normal, it must be the main thread execution returns, everything is very natural,

If be end, R3 layer can inject global HOOK NTDLL TerminateProcess, R0 layer can HOOK SSDT NtTerminateProcess, to monitor, which process do

If you don't care about who the killer is, can the inline to determine the main thread to return to position,

CodePudding user response:

You need to look at this, although it is in English, but really useful,
https://techibee.com/sysadmins/find-out-who-killed-a-process-in-windows/2286