[Autogenerated] So what are the differences between exit
process and terminate process first?
It's important to say what is not different.
What is exactly the same in whatever way a process terminates,
whether a good way or bad way, whatever that way might be,
there's nothing that's going to leak beyond the lifetime of the process,
which means that the colonel guarantees that all the
memory allocated will be released,
the private memory of course and all the handles in the
handle table are going to be closed.
This is guaranteed regardless of how the process ends its life.
Specifically exit process can only be called by one of the threads
inside that process and this causes an orderly shutdown of the process
and by orderly I mean that all the dealers in the process get notified
using their DLL main fund that they're about to be unloaded from the
process and so they have the chance to perform any kind of clean up or
whatever they need to do such as write something too low close some
files, whatever they need to do,
they get a chance to do that before the process finally terminates
with the terminate process called on the other hand,
this can be done by any thread theoretically.
Usually it's done from a threat outside the process and its
purpose is to kill the process right here right now.
And so in this case,
assuming this success sys assuming the threat gets a powerful enough
handled to do that as we've seen in the demonstration,
then the process dies immediately and the dealer main
functions of all the DLS currently loaded into in the
process are not going to be executed,
which means that you might lose some data as DLS are
not able to perform proper cleanup.
It's not about freeing memory or anything like that
because that's going to happen anyway,
but it's about certain operations they might want to do such as write something
to a file and if they don't close the handle appropriately,
you might get some data loss because the file has not
been properly flashed and so on.
So obviously this is supposed to be a last resort kind of thing.
And sometimes we do use that if you look at task manager,
there's the end task baton in the detailed stuff that's exactly what it does.
It tries to open the handle with the process,
terminate access mass to the process and if successful cause the
terminate process API here's the deal main function.
This is the kind of the skeleton of a deal main function.
Any DLL can write the deal main function is very
similar to the classic main function, but it is for the L.
S.
One of the differences is that it's being called multiple
times in the lifetime of the process.
And so when the DLL is initially loaded into a process,
the DLL process attached reason is the one that's going to be
used and this is the opportunity of the dealer to perform any
kind of needed initialization.
In fact,
this is the only case where the returned value of DLL main
makes or matters at all if it returns true,
it means successful initialization.
If it returns false, it means unsuccessful initialization,
the dealer will be unloaded from the process and if we're
talking about implicit linking here, then the process itself will then _____.
The opposite of process attach is process detach.
This is exactly the thing that doesn't happen when terminate
process is successfully invoked on the process.
There are two other reasons for deal meant to be called.
This is when the threat gets created and destroyed,
which is something we'll discuss in the future course,
once we look at threats in more detail,
but this is the main difference here in terms of
terminal process versus exit process.