January 21, 2006

When does a program terminate?

This simple question isn´t so simple as it seems to be!

In the Win32-Documentation you can find the following:
How Processes are Terminated

A process executes until one of the following events occurs:

How Processes are Terminated
A process executes until one of the following events occurs:

  • Any thread of the process calls the ExitProcess function.
  • The primary thread of the process returns.
  • The last thread of the process terminates.
  • Any thread calls the TerminateProcess function with a handle to the process.
  • For console processes, the default console control handler calls ExitProcess when the console receives a CTRL+C or CTRL+BREAK signal.
  • The user shuts down the system or logs off.

And this list is wrong. Do you see the wrong point??? It is The primary thread of the process returns
This is simply wrong. You can prove it if you write a simple test-application:

  #include <windows.h> 

#include <tchar.h> #pragma comment(linker, "/entry:myMain") DWORD WINAPI MyThread2(LPVOID) { TCHAR szText[] = _T("I am in Thread 2!n"); while(1) { Sleep(1000); DWORD dwWritten; WriteConsole(GetStdHandle(STD_OUTPUT_HANDLE), szText, _tcslen(szText), &dwWritten, NULL); } return 0; } int WINAPI myMain() { DWORD dwThreadId; CloseHandle(CreateThread(NULL, 0, MyThread2, NULL, 0, &dwThreadId)); return 0; }

The program will run forever, even if the “primary thread” has returned (or you can also call “ExitThread”).

You need to remember: The documentation talks about Win32-API. If you write a program which uses the CRT (C-Runtime), then it will terminate if you return from ”_tmain”... but not because the WinAPI terminates your process, instead the CRT calls ExitProcess and does not return from the entry-thread.

After digging a bit in the source, in found no hint that the OS is doing anything special with the “initial-thread” (the entry-thread is so called in comments in the source) expect it uses it to start the entry-point. If the entry-points returns, the _BaseProcessStart function will just call “ExitThread”. And in ExitThread there is only a query for “ThreadAmILastThread”. And only if this is the last thread, ExitThread calls ExitProcess.

So the WinAPI-Documentation is wrong about: “The process will terminate if the primary thread of the process returns.
This is only the case if you use the CRT. It would be great if MS could add a comment about this behaviour in the documentation!


Posted 1 year, 11 months ago on January 21, 2006
The trackback url for this post is http://blog.kalmbachnet.de/bblog/trackback.php/65/

Re: When does a program terminate?
Execution hungs at ExitThread (I reversed code you wrote using SoftIce). But MS wrote one interesting thing in it's documentation about ExitThread: "If the thread is the last thread in the process when this function is called, the thread's process is also terminated.". So this is the answer why process is still alive.
Posted 1 year, 11 months ago by Scherbina Vladimir • • wwwReply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/358/
Re: When does a program terminate?
I know why the process is still running... but I just wanted to show, that the documentation is wrong... But I donīt understand yor first sentence...
Posted 1 year, 11 months ago by Jochen Kalmbach • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/360/
Re: When does a program terminate?
My first sentence mean, that I compiled your code and debugged it using SoftIce to see what's goin on after myMain() returnes.
Posted 1 year, 11 months ago by Scherbina Vladimir • • wwwReply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/361/
Re: When does a program terminate?
The thread justs exists... the references are removed and the stack is freed. ExitThread does nothing special with the "initial-thread". I donīt understand what you are seeing (expect for memory which is not used anymore). The thread is completely removed from the system. You will never find any references to it.
Posted 1 year, 11 months ago by Jochen Kalmbach • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/362/
Re: When does a program terminate?
Correct. Here is the code of kernel32.dll: 7C816D4C FF55 08 CALL DWORD PTR SS:[EBP+8] ; calling myMain in our case 7C816D4F 50 PUSH EAX 7C816D50 E8 545FFFFF CALL kernel32.ExitThread ; calling ExitThread. Inside ExitThread you see the folloding code: 7C80CCFE FF15 6C14807C CALL DWORD PTR DS:[] 7C80CD04 FF75 08 PUSH DWORD PTR SS:[EBP+8] 7C80CD07 E8 96FD0000 CALL kernel32.ExitProcess The call ntdll.NtTerminateThread does not return control untill you have running threads in your application, if you don't have them, all is ok, and kernel32.ExitProcess is invoked to terminate process. Exactly as documentation states: "If the thread is the last thread in the process when this function is called, the thread's process is also terminated.".
Posted 1 year, 11 months ago by Scherbina Vladimir • • wwwReply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/363/
Re: When does a program terminate?
YOur observation is incorrect. The ExitProcess function is called from the second thread! not the initial-thread! "TerminateThread" never returns! The "initial-thread" is really terminated and you will find no reference to it! Depending on the result of "NtQueryInformationThread" with "ThreadAmILastThread" ExitThread either calls TerminateThread or ExitProcess... but this is done from the context of the last thread! Not the initial-thread!
Posted 1 year, 11 months ago by Jochen Kalmbach • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/364/
Re: When does a program terminate?
Seems like this text area does not suport formatting :(. Let's place points over "i": initial thread is myMain function, correct ? Have you debugged where control is passed after "RETN" in myMain ? XP SP2 then calls ExitThread. While second thread continues execution.
Posted 1 year, 11 months ago by Scherbina Vladimir • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/365/
Re: When does a program terminate?
Yes... Every Thread that returns will call "ExitThread" (regardless of initial or other threads). And thats also the reason why the WinAPI does not distungish between the "initial" and other threads. And thatīs the reason why the docu is wrong with "The primary thread of the process returns"...
Posted 1 year, 11 months ago by Jochen Kalmbach • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/366/
Re: When does a program terminate?
When is a process running? Certainly not upon CreateProcess returning.
Posted 1 year, 11 months ago by Okko Willeboordse • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/368/
Re: When does a program terminate?
This is detailed answerd in "Microsoft Windows Internals, 4th Edition": http://www.sysinternals.com/Windowsinternals.html
Posted 1 year, 11 months ago by Jochen Kalmbach • • • Reply
Comment Trackback URL : http://blog.kalmbachnet.de/bblog/trackback.php/65/369/

Comments have now been turned off for this post