Home/ Questions/Q 726233
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T06:25:43+00:00

I’d like to detect when someone terminates a suspended debugged process without informing the

  • 0

I’d like to detect when someone terminates a suspended debugged process without informing the debugger. (For example, get to a breakpoint in a console app, and close the app’s console window.) The process goes into a zombie-like state and cannot be interacted with further until the debugger releases its hold.

This state appears to set the PROCESS_EXTENDED_BASIC_INFORMATION::IsProcessDeleting flag when gathering information on the process via NtQueryInformationProcess, but both the flag, structure, and function are effectively undocumented and marked “do not use” on MSDN.

Is testing this flag reliable? Is there a better, “official” API I can use?

(Yes, I know IsProcessDeleting is also set when the process is (surprise, surprise) shutting down normally. This is not a problem from my perspective.)

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Nope, not that I can see. NtQueryInformationProcess isn’t going away anytime soon though, if that function was removed hundreds of apps would be broken by it.

    • 0