Click here to Skip to main content
16,016,925 members
Articles / Desktop Programming / Win32

Performing emergency shutdowns

Rate me:
Please Sign up or sign in to vote.
4.42/5 (10 votes)
16 Mar 2009CPOL2 min read 52.7K   1.4K   14   7
How to quickly shutdown/poweroff in emergency situations.

Demo_Executable

Introduction

Sometimes an application just needs to quickly shutdown Windows. Unfortunately, there is no well-documented method to do this, and Microsoft does not support it. In fact, neither do I. However, I am presenting two methods to do so just as a mere idea.

Disclaimer: I am not responsible for any unwanted behavior of this program. If your computer doesn't start up again afterwards, it is not my fault. The program is presented merely as a "proof of concept".

Background

Many of the Nt/Zw functions inside the Windows kernel are documented, but some are not. The NtShutdownSystem function is documented pretty well here at NTInternals. The NtSetSystemPowerState function, however, is not.

At the final stages of the Windows shutdown process, NtShutdownSystem is called. It is responsible for shutting down all drivers, flushing Registry hives and the disc cache, clearing the page file, etc. After doing so, it calls the NtSetSystemPowerState function.

NtSetSystemPowerState then causes all plug-and-play devices to be shut down and the system to be either halted, powered off, or rebooted.

However, calling these two functions without notifying the system first is extremely dangerous, and may cause instability in the system.

Using the code

Both NtShutdownSystem and NtSetSystemPowerState are inside NTDLL.DLL, which is why we have to load it first. We also have to enable the SE_SHUTDOWN_NAME privilege in order to call it:

C++
OpenProcessToken(GetCurrentProcess(),TOKEN_QUERY|TOKEN_ADJUST_PRIVILEGES, &hToken);
LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, FALSE, &tkp, 0, NULL, 0);
CloseHandle(hToken); 

hNTDLL = LoadLibrary("NTDLL.DLL");

After doing so, we obtain the functions:

C++
typedef DWORD (WINAPI* lpNtShutdownSystem)(SHUTDOWN_ACTION Action);
lpNtShutdownSystem NtShutdownSystem = 
   (lpNtShutdownSystem)GetProcAddress(hNTDLL, "NtShutdownSystem");

typedef DWORD (WINAPI* lpNtSetSystemPowerState)(
IN POWER_ACTION SystemAction,IN SYSTEM_POWER_STATE MinSystemState,IN ULONG Flags);
lpNtSetSystemPowerState NtSetSystemPowerState =
   (lpNtSetSystemPowerState)GetProcAddress(hNTDLL, "NtSetSystemPowerState");

As the typedefs show, NtShutdownSystem requires a SHUTDOWN_ACTION parameter, which is documented here. The three options, ShutdownNoReboot, ShutdownReboot, and ShutdownPowerOff are self-explanatory.

NtSetSystemPowerState is a bit more complicated. Microsoft makes it a bit easier for us by documenting all three parameters. The first two, POWER_ACTION and SYSTEM_POWER_STATE, are documented well. The third, flags, is simply the reason for shutdown, which is also documented here on MSDN.

Calling the actual functions is rather simple:

void CEmergency_ShutdownDlg::OnShutdown() 
{
    if (NtShutdownSystem)
    {
        DWORD returnval = NtShutdownSystem(ShutdownPowerOff);
        if (returnval != 0) FormatNtMessage(returnval);
    }
}

void CEmergency_ShutdownDlg::OnPowerdown() 
{
    if (NtSetSystemPowerState)
    {
        DWORD returnval = NtSetSystemPowerState(
            PowerActionShutdownOff,
            PowerSystemShutdown,
            SHTDN_REASON_MAJOR_OTHER | 
                       SHTDN_REASON_MINOR_OTHER | 
                       SHTDN_REASON_FLAG_PLANNED
            );
        if (returnval != 0) FormatNtMessage(returnval);
    }
}

FormatNtMessage is simply a specialized function to display an error, given an NTSTATUS error code. It uses the FormatMessage function.

Points of interest

Only one point of interest: save all un-saved work before executing any one of the functions, or else it'd be rather interesting what happens to them.

History

I probably won't be updating this, unless there is a critical flaw anywhere in the code.

  • v1.0 - March 16, 2009.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)


Written By
Canada Canada
Just another programmer trying to make the world a better place.

Comments and Discussions

 
QuestionLOL Pin
Member 85161347-Apr-12 15:50
Member 85161347-Apr-12 15:50 
QuestionJust saying hi Pin
Member 964871818-Feb-12 22:43
Member 964871818-Feb-12 22:43 
Generalvery specialized, but useful Pin
volatileMike19-Mar-09 9:12
volatileMike19-Mar-09 9:12 
GeneralMy vote of 1 Pin
poltrone17-Mar-09 6:33
poltrone17-Mar-09 6:33 
to advise the usage of these functions is just stupid!
GeneralRe: My vote of 1 Pin
hxhl9517-Mar-09 6:47
hxhl9517-Mar-09 6:47 
GeneralRe: My vote of 1 Pin
Fahad Sadah24-Mar-09 6:43
Fahad Sadah24-Mar-09 6:43 
JokeMy PC doesn't start anymore… PinPopular
Hamed Ebrahimmalek16-Mar-09 21:51
Hamed Ebrahimmalek16-Mar-09 21:51 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.