如何制作一个在 Windows 中无法被杀死的程序？
我们正在制作一个供公司内部使用的 Jabber 客户端，并且我们需要以某种方式捕获用户试图终止程序的时刻，以实际重新启动它，或者只是让用户无法终止客户端。
这可能吗？
我们的 Jabber 客户端将用 C# 编写。
我将如何实现这一目标？
We are making a Jabber client for our internal use in our company and somehow we need to catch the moment when the user tries to kill the program to actually restart it or just make impossible for the user to kill the client.
Is this possible?
Our Jabber client will be written in C#.
How would I go about accomplishing this?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（19）
我同意这是一个糟糕的想法。
话虽如此，您还是要创建两个程序（可能是Windows 服务）。 两个程序都会互相监控并作为客户端运行。 您需要两个进程都可以访问的共享内存，以同步哪个客户端处理传入请求。
I agree that this is an awful idea.
Having said that, you'd create two programs (probably windows services). Both programs would monitor each other as well as functioning as the client. You would need shared memory that both processes could access to synch which client processes incoming requests.
转到操作并创建一个表单关闭事件，然后在 c# 中输入 e.cancel = true;
go to actions and make a form closing event and in c# type e.cancel = true;
除非您真的在编写病毒，否则您应该能够阻止他们通过权限杀死进程的能力。 假设他们都是域用户，而您是管理员。
我想在某些情况下您会想要这样做。 您不希望用户制造安全漏洞。 我无法退出或更改工作计算机上诺顿端点的任何设置，而且它还没有困扰我。
但是，如果所有用户都是其计算机上的管理员，并且您希望使其无法关闭，并且可能无法在安全状态下启动和删除......那么您会问：“我如何编写恶意软件？”
Unless you're really writing a virus, you should be able to block their ability to kill the process with permissions. Assuming they are all domain users and you are the admin.
I guess there would be a few cases where you would want to do this. You don't want users making security vulnerabilities. I can't exit or change any settings of Norton endpoint on my work computer, and it hasn't bothered me yet.
But if all the users are admins on their machines, and you want to make it impossible to close, and presumably impossible to start in safe made and remove... then you're asking: "How do I write malware?"
你所要求的意义远远超出了你被要求完成的事情。 例如，如果无法杀死进程，Windows如何正常关闭？
我不认识你的老板，所以你必须自己衡量他们的理解程度。 如果用户/经理问我这个问题，我将不得不更深入地探究以找出他们的真正含义。 我怀疑您的用户希望默认关闭行为最小化到系统托盘而不是退出程序（类似于大多数即时消息客户端），而不是根本无法关闭程序。
What you are asking for has implications far beyond what you are being asked to accomplish. For example, if the process cannot be killed, how can Windows shut down normally?
I don't know your boss, so you will have to gauge their level of understanding for yourself. If a user/manager asked me for this, I would have to probe deeper to find what they really mean. My suspicion is that your users want the default close behavior to minimize to the system tray rather than exit the program, similar to most instant message clients, rather then not be able to ever close the program at all.
首先我要说，这是一个可怕的想法。
但是...如果你必须这样做，我看到恶意软件和垃圾邮件猎手这样做的方式是创建 3 个正在运行的进程，一个是主进程，另外两个将监视并重新启动任何被杀死的进程。 对于普通用户来说，同时杀死 3 个进程是非常困难的。
let me first say, this is a horrible idea.
but...if you must do it, the way I see malicious software and spam hounds do it is to create 3 running processes, one is the main process and the other two will monitor and restart any killed process. it's very difficult for the average user to kill 3 processes simultaneously.
听起来像病毒。
Sounds like a virus.
由于这是内部的，因此您可以创建一个单独的 Windows 服务来监视活动进程。 如果您的 jabber 客户端进程不存在，您可以重新启动它。
然后使用权限阻止他们访问 Windows 服务以将其禁用。
Since this is internal, you could create a separate windows service that monitors the active processes. If the process of your jabber client isn't there, you could just relaunch it.
Then use permissions to keep them from accessing the Windows Service to disable it.
我认为你应该去问需求设计师他们所说的不可能“杀死”的应用程序是什么意思。 他们用“杀”字来表达什么意思？
该需求非常模糊，我会与需求设计者/老板交谈以更好地了解他们想要什么。
I think you should go ask the requirement designer what they mean by app that is impossible to "kill." What are they getting at with the word "kill"?
The requirement is ambiguous enough that I'd go talk to the requirement designer/boss to get a better idea of what they want.
这不仅听起来像是一个坏主意（这对您的用户来说是一种侮辱），而且您将无法阻止用户终止进程本身。
您必须运行两个单独的进程 - 一个用于运行应用程序，第二个用于监视第一个进程并在必要时重新启动它。
Not only does this sound like a bad idea (it is abusive to your users) but you will not be able to prevent users from killing the process itself.
You would have to run two separate processes - one to run the application and a second one to monitor the first one and restart it if necessary.
你不能。 你可以让它变得更难，但并非不可能。 请参阅程序和用户之间的军备竞赛。
You can't. You can make it harder, but not impossible. See The arms race between programs and users.
您必须减少他们的用户权限，直到他们无法终止进程为止。
You'll have to reduce their user rights until they can't kill processes.
使用 Windows 服务控制它。 用 C# 很容易做到。 锁定权限以停止服务。
注意：我认为“这是不可能/可怕/邪恶”的答案可能没有抓住你的要点。 一项服务是专门为“继续前进”而设计的，这正是您所要求的。
Control it with a Windows Service. Easy to do in C#. Lock down permissions to stop the service.
Note: I think the answers of "this is impossible/horrible/evil" are perhaps missing your point. A service is specifically designed 'keep going', which is what you're asking about.
更重要的是，当 Miranda 和 Pidgin 等优秀客户端已经存在时，为什么还要重写 jabber 客户端呢？ 如果用于日志记录，您可以轻松地在 Jabber 服务器上进行服务器端操作，而不需要依赖客户端。
如果是为了阻止其他 IM 服务，强大的防火墙规则将有助于阻止这种情况（但它不会阻止超级天才通过 https 代理 AIM+Gtalk 到他们的家庭服务器）。
More importantly, WHY are you rewriting a jabber client when so many good ones, like Miranda and Pidgin already exist? If it's for logging, you can easily do that server side on your Jabber server, and not rely on the clients.
If it's to prevent other IM services, robust firewall rules will help stop that (but it won't prevent it from the super geniuses who'll proxy AIM+Gtalk over https to their home servers).
您可以使用处理程序捕获大多数信号，SIGKILL 除外。
您可以创建一个看门狗窗口进程，在应用程序终止时重新生成应用程序。
如果您愿意，您可以将此进程命名为听起来非常无害的名称，例如“sysmon”，这样它看起来就不会那么粗略。
我确实希望这是工作的要求，而不是你导致人类垮台的方式。
You can catch most signals with handlers, except for SIGKILL.
You can create a watch dog windows process that respawns your application in the event it's terminated.
If you want, you can name this process something very innocuous sounding like "sysmon" so it doesn't look as sketchy.
I do hope this is a requirement for work, and not your way to bringing about the downfall of man.
听起来您可以访问 jabber 客户端。 您可以让它轮询到一个单独的位置及其状态和启动时间吗？ 你并没有禁用杀死它的能力……但至少你可以跟踪它并从那里做出反应。
sounds like you have access to the jabber client. Can you make it poll to a separate location with it's status and startup time? You aren't disabling the ability to kill it... but at least you can track it and respond from there.
这不应该由您的桌面组控制吗？ 我们在一些信息亭中设有 PC，允许员工检查个人电子邮件和其他内容（Gmail、Yahoo、Hotmail 等），并且这些 PC 上的用户权限不允许用户终止进程。
如果 IE 锁定有点烦人，但我可以理解其中的原因。
Shouldn't this be controlled by your desktop group? We have PCs in a few kiosks that allow associates to check personal e-mail and stuff (Gmail, Yahoo, Hotmail, etc...), and the user permissions on those PCs will not allow users to kill processes.
Kind of annoying if IE locks up, but I can understand the reasoning.
听起来像是这个的情况
Sounds like a case of this
承诺暂停那些杀死您的
流量记录器Jabber 客户端的用户吗？Promise to suspend the users who kill your
traffic loggerJabber client?