Ways for an unmanaged Windows process to crash?

Question

I am trying to understand the ways in which an unmanaged user-mode Windows process can "crash" (which is really too much of a catch-all term).

Here are the ways I know of so far:

• Unhandled Structured Exception
  • Default UnhandledExceptionFilter: postmortem debugger in pre-Vista; WerFault in Vista+
  • Custom UnhandledExceptionFilter: may do whatever it likes, including exiting quietly?
• "Hard" crash (not sure if there's a technical term for this)
  • E.g. hitting the stack overflow guard page while handling a stack overflow: the OS simply makes the process disappear without a trace?
• "Normal" exit:
  • E.g. where the language provides its own error handling mechanism that makes a fatal crash look to the OS like the application has shut down normally.

Is this roughly right? Are there any other ways for a user-mode Windows process to die?

Ameeameer

I'm not sure what you mean by "crash", but external forces can also kill your process (i.e. TerminateProcess). This is different from what people typically mean by "crash" as your process doesn't get any kind of chance to handle it. – Specious

@Specious agreed. To give you a better feel of what I mean, this was prompted when I was experimenting with Windows Error Reporting and found that even when WER is disabled, a program can still crash with a different error message, via UnhandledExceptionFilter->NtRaiseHardError, which shows something like this: i.imgur.com/fBsTI.png – Ameeameer

Answer 1

• Unhandled exception - this is usually what people would call "crash"
• Exception with corrupted stack - if the stack is corrupted and the exception chain cannot be walked, the process is silently killed.
• Explicit termination
  • From another process (e.g. TaskManager, kill.exe) calling TerminateProcess,
  • C/C++ runtime fatal error, /GS stack cookie corruption, etc.
• Attaching a debugger and quiting the debugger without detaching
• Console application will terminate if you kill the corresponding conhost.exe process

Julius

What about WOW32 when running on x64? Can that be killed? :) – Fondea