What is the difference between closing the application and ending the process from the task manager?

Question

What is the difference between killing an application using the close button and ending the process from the task manager?

I am aware that clicking the close button puts the WM_CLOSE message in the message queue, but I do not know what happens when we kill a process from the task manager (or any similar application, such as Killbox or Process Explorer).

Answer 1

When you click the "X" button in the title bar of the application window, it sends a WM_CLOSE message to the window. This is an "elegant" shutdown - the application processes the message, processes any necessary cleaning tasks, and may even refuse to complete it if it so desires (returning zero in response to the message). WM_CLOSE - just a request for the completion of a window or application; the window will not be destroyed until the application itself calls the DestroyWindow function.

When you click the "End task" button in the task manager, Windows will first try to send the application (if it is a GUI application) a WM_CLOSE message. In other words, at first it asks beautifully and gives the application the opportunity to terminate itself cleanly. ^*

If you cannot close the response to this initial WM_CLOSE message, the task manager will monitor the call to the TerminateProcess function. This feature is slightly different because it forces the application process and all its threads to terminate without requesting application permission. This is a very harsh method of closing something and should be used as a last resort - for example, when the application freezes and no longer responds to messages.

TerminateProcess is a very low-level function that essentially interrupts the user part of the process from memory, causing it to unconditionally terminate. Calling TerminateProcess circumvents such subtleties as tight notifications and DLL_PROCESS_DETACH . Your application has no way to refuse to close, and there is no way to catch / block / intercept calls on TerminateProcess . All user-mode codes in the process simply stop working forever. This is a very unclean closing procedure, which is somewhat reminiscent of pushing a computer plug from a wall.

_{^* Please note that this is only the case if you use the "Applications" tab of the task manager to kill the application. If you use the Processes tab, this step is skipped, and the TerminateProcess function is called immediately. This difference is reflected in the title of the corresponding buttons. On the "Applications" tab, the button has the value "Ultimate Task"; for the Processes tab, the button is designated as "End Process".}

Answer 2

Killing a process with WM_CLOSE simply signals the process with a message and allows the target to process the message and exit gracefully. Alternatively, the process may not exit its WM_CLOSE handler.

Killing a process using task manager will do this with TerminateProcess, which is much more severe:

The TerminateProcess function is used for an unconditional exit process. The state of global data supported by dynamic link libraries (DLLs) can be compromised if TerminateProcess is used than ExitProcess .

This function stops the execution of all threads within the process and requires cancellation of all pending I / O. A completed process cannot exit until all pending I / O are completed or canceled. When a process terminates, its kernel object is not destroyed until all processes that have open handles for the process have released these handles.

TerminateProcess is asynchronous; he initiates completion and returns immediately. If you need to be sure that the process is complete, call the WaitForSingleObject function with the process handle. The process cannot prevent ends.

Answer 3

If you close the application using the close button, you allow the application to perform the necessary closing tasks, if any. If you kill the process from the task manager, there is no possibility for the application to complete these tasks, you simply terminate the application without informing.