4

unfortunatly, when you listen to WM_QUERYENDSESSION, you do not get the information if the user has requested a reboot or a shutdown. This is really bad design, but it's the way Windows is, so I was thinking of hooking the call to NTShutdownSystem, which gets a parameter telling the system to perform a reboot or to shutdown.

The question is: how can this actually be achieved in C#? I want to get some kind of hook that I can use to determine the parameters passed to NTShutdownSystem, and then save that information. After that, I want to call the "real" NTShutdownSystem the way it was intended by the user.

Do you have any sample code illustrating this?

Erik
  • 2,316
  • 9
  • 36
  • 58
  • I like this question, I had to do something similar a few months ago and in essence gave up :/ Would be very interested in the answer – M Afifi May 30 '12 at 11:07
  • Do you know if the method is called by the user process? Given the name of the function I am leaning towards no? – M Afifi May 30 '12 at 11:09

1 Answers1

1

The reason why WM_QUERYENDSESSION does not give a shutdown reason is that the user may just be logging out at that time, rather than shutting down the system.

This generally falls under the category of kernel level hooking and has generally not been considered a good thing as it can influence stability of the system. Most of them are written in C or C++, and generally have to go to a lot of effort to perform the hook across all the programs that are executing - e.g. hooking the routines at program load-time.

This is not a trivial, but there are some frameworks that have been written to help with trying to hook routines like this using managed code (e.g. C#)

The next question to ask is why do you care?

edit NTShutdownSystem is invoked very late in the shutdown process - at that point you probably have no UI and no way of doing anything. I would recommend intercepting ExitWindowsEx, InitiateShutdown, InitiateSystemShutdown and InitiateSystemShutdownEx - I don't know if some of them are called by the other, but you should probably only record the reason and then react to the reason in the WM_QUERYENDSESSION code of your standard app.

Anya Shenanigans
  • 91,618
  • 3
  • 107
  • 122
  • 1
    Hi,I do get the notification from WM_QUERYENDSESSION if the user logs off (the system sets a value in lparam)or does a shutdown, but when a shutdown is performed, I do not get if the system is rebooted or completely shutdown. I definitely need to know it because I do run a shutdown script that needs to behave differently depending ig the user does a shutdown or reboot. – Erik May 30 '12 at 12:08
  • If you want the information, you will have to hook the routine. I don't have any example code as hooking is a non-trivial task, nost of which is scaffolding. – Anya Shenanigans May 30 '12 at 13:18
  • One final thing - the invocation of NTShutdownSystem happens incredibly late in the shutdown process - you're probably not going to have any UI left. You may be better off intercepting ExitWindowsEx or InitiateShutdown or it's ilk – Anya Shenanigans May 30 '12 at 13:33