RtlSetProcessIsCritical is yet another undocumented function hidden in the Windows kernel. It is one of the few which do not have a kernel32 equivalent. However, Microsoft has a good reason to not document this function - it should not be used in any application for any purpose whatsoever. I simply cannot imagine a circumstance where this function would actually come in useful. Thus:
Disclaimer: I am not responsible for any side-effects of calling this function on your computer. It may cause extreme system instability. The example is only presented as "proof-of-concept".
RtlSetProcessIsCritical does is set your process to a system critical status. This means that the process is now "critical" to the running of Windows, which also means that on termination of your process, Windows itself terminates as well. When a system critical process ends/terminates, the stop code is
CRITICAL_PROCESS_DIED (0xEF) for process exiting, and
CRITICAL_OBJECT_TERMINATION (0xF4) if the process was abnormally terminated. Although this can, technically, be used to "protect" a process against people terminating it, I recommend you find other methods of doing so, because if a user terminates a critical process by accident or a process crashes when it is critical, the system will crash instantly as well. This would be highly annoying to users.
This type of behavior can also be seen in processes such as winlogon.exe, csrss.exe, services.exe, smss.exe, and lsass.exe. All of these processes are known to call
Whether a process is critical or not can be obtained using a call to
ZwQueryProcessInformation with the class
ProcessBreakOnTermination (0x1D). Also, this function is only available in NTDLL versions 5.1 and higher.
Using the Code
The function definition for
RtlSetProcessIsCritical is as follows:
This means that calling
RtlSetProcessIsCritical(TRUE, NULL, FALSE) would make a process critical, while another call to
RtlSetProcessIsCritical(FALSE, NULL, FALSE) would return the process to normal. When critical status is set, termination or ending of the process in any way will usually cause either a BSOD (if BSOD-ing is enabled), or will cause the system to reboot itself.
Obtaining this function from the kernel is simple. First, we define a prototype of the function:
typedef long ( WINAPI *RtlSetProcessIsCritical ) (
IN BOOLEAN bNew,
OUT BOOLEAN *pbOld,
IN BOOLEAN bNeedScb );
Then, we obtain an open handle to NTDLL.DLL in order to obtain the function using
HANDLE ntdll = LoadLibrary("ntdll.dll");
SetCriticalProcess = (RtlSetProcessIsCritical)
After this, we can simply call
SetCriticalProcess with the appropriate parameters.
A more detailed and commented example is in the Example.zip download.
Note: The use of this function requires the
SE_DEBUG_NAME privilege in the calling process. This can easily be obtained using AdjustTokenPrivileges, and an example of this can be seen in the example source code.
Points of Interest
I'm not sure about other compilers, but on my rather old MSVC++ 6.0 compiler, I get an error stating "The value of ESP was not properly saved across a function call...", and the program also crashes before exiting under the default Release mode. If you change the optimizations to Disable (Debug), these problems go away. I'm guessing some of VC++ 6.0's optimizations don't work properly.
I probably won't be updating this, unless there is a critical flaw anywhere in the code.
- v1.0 - October 30th, 2009