Click here to Skip to main content
Click here to Skip to main content

"Protecting" Your Process with RtlSetProcessIsCritical

, 6 Nov 2009 CPOL
Rate this:
Please Sign up or sign in to vote.
Escalating a process to system critical status using a Win32 kernel function
Example

Introduction

RtlSetProcessIsCritical is yet another undocumented function hidden in the Windows kernel. It is one of the few which do not have a kernel32 equivalent. However, Microsoft has a good reason to not document this function - it should not be used in any application for any purpose whatsoever. I simply cannot imagine a circumstance where this function would actually come in useful. Thus:

Disclaimer: I am not responsible for any side-effects of calling this function on your computer. It may cause extreme system instability. The example is only presented as "proof-of-concept".

Background

What RtlSetProcessIsCritical does is set your process to a system critical status. This means that the process is now "critical" to the running of Windows, which also means that on termination of your process, Windows itself terminates as well. When a system critical process ends/terminates, the stop code is CRITICAL_PROCESS_DIED (0xEF) for process exiting, and CRITICAL_OBJECT_TERMINATION (0xF4) if the process was abnormally terminated. Although this can, technically, be used to "protect" a process against people terminating it, I recommend you find other methods of doing so, because if a user terminates a critical process by accident or a process crashes when it is critical, the system will crash instantly as well. This would be highly annoying to users.

This type of behavior can also be seen in processes such as winlogon.exe, csrss.exe, services.exe, smss.exe, and lsass.exe. All of these processes are known to call RtlSetProcessIsCritical.

Whether a process is critical or not can be obtained using a call to ZwQueryProcessInformation with the class ProcessBreakOnTermination (0x1D). Also, this function is only available in NTDLL versions 5.1 and higher.

Using the Code

The function definition for RtlSetProcessIsCritical is as follows:

NTSTATUS 
RtlSetProcessIsCritical (
    BOOLEAN bNew,    	// new setting for process
    BOOLEAN *pbOld,    	// pointer which receives old setting (can be null)
    BOOLEAN bNeedScb);    	// need system critical breaks

This means that calling RtlSetProcessIsCritical(TRUE, NULL, FALSE) would make a process critical, while another call to RtlSetProcessIsCritical(FALSE, NULL, FALSE) would return the process to normal. When critical status is set, termination or ending of the process in any way will usually cause either a BSOD (if BSOD-ing is enabled), or will cause the system to reboot itself.

Obtaining this function from the kernel is simple. First, we define a prototype of the function:

typedef long ( WINAPI *RtlSetProcessIsCritical ) (
        IN BOOLEAN    bNew, 
        OUT BOOLEAN    *pbOld, 
        IN BOOLEAN    bNeedScb );

Then, we obtain an open handle to NTDLL.DLL in order to obtain the function using GetProcAddress:

HANDLE ntdll = LoadLibrary("ntdll.dll");
RtlSetProcessIsCritical SetCriticalProcess;

SetCriticalProcess = (RtlSetProcessIsCritical)
    GetProcAddress((HINSTANCE)ntdll, "RtlSetProcessIsCritical");

After this, we can simply call SetCriticalProcess with the appropriate parameters.

A more detailed and commented example is in the Example.zip download.

Note: The use of this function requires the SE_DEBUG_NAME privilege in the calling process. This can easily be obtained using AdjustTokenPrivileges, and an example of this can be seen in the example source code.

Points of Interest

I'm not sure about other compilers, but on my rather old MSVC++ 6.0 compiler, I get an error stating "The value of ESP was not properly saved across a function call...", and the program also crashes before exiting under the default Release mode. If you change the optimizations to Disable (Debug), these problems go away. I'm guessing some of VC++ 6.0's optimizations don't work properly.

History

I probably won't be updating this, unless there is a critical flaw anywhere in the code.

  • v1.0 - October 30th, 2009

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

hxhl95

Canada Canada
Just another programmer trying to make the world a better place.

Comments and Discussions

 
GeneralMy vote of 1 PinmemberMember-949016810-Oct-13 13:00 
Questionthis code can't work under windows 7, the current process can be killed by task management Pinmembercl606611-Aug-13 17:06 
AnswerAmazing Trick PinmemberEasyByTe14-Feb-13 0:27 
QuestionBSOD >.< Pinmemberlord4ev3r8-Feb-13 5:08 
QuestionAny other state that protects the process other than "critical"? Pinmemberjlkdaslkfjd11-Sep-10 23:48 
AnswerRe: Any other state that protects the process other than "critical"? Pinmemberhxhl9512-Sep-10 9:24 
Generalis it possible to export =>dotnet function Pinmembergillardg10-Jun-10 0:15 
GeneralThe value of ESP was not properly saved across a function call... PinmemberShao Voon Wong1-Nov-09 2:33 
GeneralRe: The value of ESP was not properly saved across a function call... Pinmemberhxhl951-Nov-09 7:17 
AnswerRe: The value of ESP was not properly saved across a function call... PinmemberGreMiGen5-Oct-10 22:12 
GeneralJust to highlight your point... PinmemberPeterMoon31-Oct-09 2:52 
Generalthnx PinmemberBartosz Wojcik31-Oct-09 0:39 
GeneralRe: thnx PinmemberMauro Leggieri31-Oct-09 12:47 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web03 | 2.8.141022.2 | Last Updated 6 Nov 2009
Article Copyright 2009 by hxhl95
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid