List of unkillable process names in the Windows XP source code.

BOOL CProcPage::IsSystemProcess(DWORD pid, CProcInfo * pProcInfo)
{
    // We don't allow the following set of critical system processes to be terminated,
    // since the system would bugcheck immediately, no matter who you are.
 
    static const LPCTSTR apszCantKill[] =
    {
        TEXT("csrss.exe"), TEXT("winlogon.exe"), TEXT("smss.exe"), TEXT("services.exe"), TEXT("lsass.exe")
    };
 
    // if they pass in a pProcInfo we'll use it, otherwise find it ourselves
    if (!pProcInfo)
        pProcInfo = FindProcInArrayByPID(m_pProcArray, pid);
    if (!pProcInfo)
        return FALSE;
 
    for (int i = 0; i < ARRAYSIZE(apszCantKill); ++i)
    {
        if (0 == lstrcmpi(pProcInfo->m_pszImageName, apszCantKill[i]))
        {
            TCHAR szTitle[MAX_PATH];
            TCHAR szBody[MAX_PATH];
 
            if (0 != LoadString(g_hInstance, IDS_CANTKILL, szTitle, ARRAYSIZE(szTitle)) &&
                0 != LoadString(g_hInstance, IDS_KILLSYS,  szBody,  ARRAYSIZE(szBody)))
            {
                MessageBox(m_hPage, szBody, szTitle, MB_ICONEXCLAMATION | MB_OK);
            }
            return TRUE;
        }
    }
    return FALSE;
}

/*++ KillProcess
 
Routine Description:
 
    Kills a process 
 
Arguments:
 
    pid - process Id of process to kill
 
Return Value:
 
Revision History:
 
      Nov-22-95 Davepl  Created
 
--*/
 
BOOL CProcPage::KillProcess(DWORD pid, BOOL bBatchKill)
{
    DWORD dwError = ERROR_SUCCESS;
 
    //
    // Special-case killing WOW tasks
    //
 
    CProcInfo * pProcInfo;
    pProcInfo = FindProcInArrayByPID(m_pProcArray, pid);
 
    if (NULL == pProcInfo)
        return FALSE;
 
    if (IsSystemProcess(pid, pProcInfo))
        return FALSE;
 
    // Grab info from pProcInfo (because once we call QuickConfirm(), the
    // pProcInfo pointer may be invalid)
    INT_PTR fWowTask = pProcInfo->IsWowTask();
#if defined (_WIN64)
#else
    DWORD dwRealPID = pProcInfo->GetRealPID();
    WORD hTaskWow = pProcInfo->m_htaskWow;
#endif
 
    // OK so far, now confirm that the user really wants to do this.
 
    if (!bBatchKill && (IDYES != QuickConfirm(IDS_WARNING, IDS_KILL)))
    {
        return FALSE;
    }
 
    // We can't use this pointer after QuickConfirm() is called.
    // NULL it out to prevent subtle bugs.
    pProcInfo = NULL;
 
 
    if (fWowTask) {
 
#if defined (_WIN64)
        return FALSE;
#else
        return VDMTerminateTaskWOW(dwRealPID, hTaskWow);
#endif
    }
 
    //
    // If possible, enable the Debug privilege. This allows us to kill
    // processes not owned by the current user, including processes
    // running in other TS sessions.
    //
    // Alternatively, we could first open the process for WRITE_DAC,
    // grant ourselves PROCESS_TERMINATE access, and then reopen the
    // process to kill it.
    //
    CPrivilegeEnable privilege(SE_DEBUG_NAME);
 
    HANDLE hProcess = OpenProcess( PROCESS_TERMINATE, FALSE, pid );
    if (hProcess) 
    {
        if (FALSE == TerminateProcess( hProcess, 1 )) 
        {
            dwError = GetLastError();
            dprintf(TEXT("Can't terminate process: %08x\n"), dwError);
        }
        else
        {
            TimerEvent();
        }
        CloseHandle( hProcess );
    }
    else
    {
        dwError = GetLastError();
    }
 
    if (ERROR_SUCCESS != dwError)
    {
        DisplayFailureMsg(m_hPage, IDS_CANTKILL, dwError);
        return FALSE;
    }
    else
    {
        return TRUE;
    }
 
}

/*++ CProcPage::GetSelectedProcess
 
Routine Description:
 
    Returns the CProcInfo * of the currently selected process
 
Arguments:
 
Return Value:
 
    CProcInfo * on success, NULL on error or nothing selected
 
Revision History:
 
      Nov-22-95 Davepl  Created
 
--*/
 
CProcInfo * CProcPage::GetSelectedProcess()
{
    HWND hTaskList = GetDlgItem(m_hPage, IDC_PROCLIST);
    INT iItem = ListView_GetNextItem(hTaskList, -1, LVNI_SELECTED);
 
    CProcInfo * pProc;
 
    if (-1 != iItem)
    {
        LV_ITEM lvitem = { LVIF_PARAM };
        lvitem.iItem = iItem;
 
        if (ListView_GetItem(hTaskList, &lvitem))
        {
            pProc = (CProcInfo *) (lvitem.lParam);
        }
        else
        {
            pProc = NULL;
        }
    }
    else
    {
        pProc = NULL;
    }
 
    return pProc;
}