How will you kill a process WITHOUT using any API ?

Sep 19, 2013 at 2:52pm
closed account (3hMz8vqX)
Hi all,
i have a small question!
How will you kill a process WITHOUT using any API ?

Is there a way???
Sep 19, 2013 at 3:09pm
Sep 19, 2013 at 4:20pm
That doesn't work for another process.
Sep 19, 2013 at 5:19pm
Without any API your program doesn't (and, in some environments, cannot) know about other processes.
Sep 19, 2013 at 5:31pm
closed account (Dy7SLyTq)
Without any API your program doesn't (and, in some environments, cannot) know about other processes

how does that work? because couldnt Aravind333 write exactly the same code that the api used? i know that it is unlikely, and i would suggest an api, but just asking for clarification
Sep 19, 2013 at 5:57pm
The API eventually invokes kernel-level calls that a user-level program wouldn't be able to run. See a book on OS design for more information.
Sep 19, 2013 at 7:15pm
He could write exactly the same code the API used, but it would just be using more APIs. Eventually you would get to APIs you can't even use without the OS' help because the OS has your program in a slightly sandboxed environment.

So no, he couldn't. If he did, it wouldn't work.
Sep 19, 2013 at 7:57pm
To close\terminate a program you can either use kernel level calls such as ZwTeminateProcess or you can go all rogue and mov a value into eax then call KiFastSystemCall or X86SwitchTo64BitMode that way you invoke a direct contact directly into borders of Ring2.

Or you can try to process injection, then call a exit() from that process memory therefore terminating the process as a whole. This can be effective but if the process blocks process injection, you can load a DLL via registry, in which can it would bypass the proactives of the process.
Sep 20, 2013 at 4:19am
try this

ExitProcess();

Topic archived. No new replies allowed.