Re: Preventing task manager from closing my application.

From:

"David Ching" <dc@remove-this.dcsoft.com>

Newsgroups:

microsoft.public.vc.mfc

Date:

Mon, 14 May 2007 05:00:31 GMT

Message-ID:

<P1S1i.2610$y_7.686@newssvr27.news.prodigy.net>

"Joseph M. Newcomer" <newcomer@flounder.com> wrote in message
news:a4pf43d4mg5b37n1v7s88792ctdi4ds0nj@4ax.com...

Do you know if API Hooking works in Vista? I would be very suspicious of
this.
What does API hooking have to do with blocking TerminateProcess?

It sure does work on Vista, with the caveat that your app can't hook one
that has higher priviledge than yours (UAC).

The idea is to hook TerminateProcess() globally, so that your hook is called
whenever any app, including Task Manager, calls TerminateProcess(), and you
can examine the parameters and decide whether or not to block the
TerminateProcess() by not chaining the hook.

I recommend MadCodeHook instead of MS Detours, as it is much cheaper and
works in situations that Detours doesn't (i.e. you can hook apps that are
already running), and it has useful utility functions that the author
obviously knows how people are using his library and not some research
people that tend not to be all that practical.

-- David