如何抓住神秘的进程杀手？
我们有一位客户抱怨产品在正常运行 2-5 分钟后不断崩溃。 经过几天的猜测，我们得出了以下结论：
当进程终止而不留下任何痕迹（事件日志/故障转储）时，有两个选项：
1.我们自己的进程正在调用TerminateProcess()
2. 别人正在杀死我们。
要捕获自杀式调用堆栈（情况 1），您只需运行“Adplus -crash -CTCFG …”
唉，这并没有帮助解决我们的客户问题。
我们开始对客户耳语：“也许有人正在杀死我们，也许是病毒什么的……？！”。
客户对此表示怀疑（“幽灵/病毒/守护进程？”），但就在我们被赶出去之前，系统管理员的一些坦白拯救了我们。 他想起了他们定期运行的一个脚本来监控我们的流程。 该脚本错误地认为我们被挂起并强制终止进程（耶！）。
现在问题来了：
下次，我们需要一个工具或技术来捕获谁正在杀死我们的进程？ （我知道有一些黑客工具可以避免被杀死，但我只想记录连环杀手进程 PID/NAME 是什么。）
他们有任何官方/非黑客方法可以做到这一点吗？
We had this customer complaining out product was constantly crashing after running fine for 2-5 minutes. It took few days of guessing, but we came to the following conclusion:
When the process is terminating without leaving any traces (event logs/crash dumps) there are two options:
1. Our own process is calling TerminateProcess()
2. Someone else is killing us.
To catch a suicidal callstack (case 1) you just need to run "Adplus -crash -CTCFG …"
Alas, this didn’t help to resolve our customer situation.
We started to whisper to our customer ears, “Maybe someone is killing us, maybe a virus or something… ?!”.
The customer was skeptic (“ghosts / viruses / daemons?”), but just before getting ourselves kicked out, we were saved by some Sysadmin confession.
He was reminded of a script they were periodically running monitoring our process. That script was wrongly thinking we are hanged and forced a process termination (Yack!).
Now comes the question:
For next time, we want a tool or a technique to catch who is killing our process?
(I know there are some hacker tools to avoid getting killed, but I just want to log what’s the serial killer process PID/NAME.)
Are they any official/non-hacker ways to-do that?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您需要在系统调用上安装一个钩子。 您也可以阻止这些电话。 不完全确定这是否是一种非黑客方式:)
You need to install a hook on system calls. you can also block these calls. Not entirely sure if its a non-hacker way :)
如果我是你，我会记录应用程序的每次启动。 流氓工具可能会定期杀死您的应用程序，如果您看到您的应用程序每 10 分钟或 10 秒（或任何设置的值）启动一次，它会让您大吃一惊。
据我所知，除了 跟踪系统调用 和它非常hacky，但它应该可以开箱即用。
I would log every start of the application, if I were You. The rogue tool probably killed Your application in regular periods and it would raise Your eyebrow if You would see a start of Your app every 10 minutes or 10 seconds (or whatever it was set to).
As far as I know there is no silver bullet for this problem apart from something like tracking system calls and it's pretty hacky, but it should do the trick out-of-the-box.