Skip to content

Kill Process

A C console utility that attaches to a running process by PID using DebugActiveProcess and terminates it.

Published Mar 15, 1996

The debug API is an old trick for killing processes you do not own in the normal sense: DebugActiveProcess attaches your program as the debugger of the target, which suspends it, and once attached the target can be ended through the debug event loop. This snippet asks for a PID on the command line, attaches, and waits on the first debug event (the initial suspend) before returning - at which point the attach/teardown has done its work. It requires the target to be debuggable (not protected, same or lower integrity) and is best understood as a curiosity/utility from the Windows 9x era rather than a production kill mechanism; modern code should prefer OpenProcess(PROCESS_TERMINATE) + TerminateProcess.

#include <windows.h>
#include <stdio.h>

int main(int argc, char *argv[])
{
    DEBUG_EVENT DE;
    long ProcID;
    char CmdLine[257];

    printf("%s\n","Process Termination using DebugActiveProcess");
    printf("Process ID: ");

    gets(CmdLine);
    ProcID = atof(CmdLine);

    if ( DebugActiveProcess(ProcID) == 0 )
    {
        printf("%s\n","Error - couldn't attach to process.");
    }
    else {
        printf("%s\n","Attached to process - terminating ...");
    }

    WaitForDebugEvent(&DE, 0);
    return TRUE;
}

Note the use of gets, which is unsafe and removed from modern standard libraries - replace with fgets(CmdLine, sizeof(CmdLine), stdin) if you build this today.

An unhandled error has occurred. Reload 🗙