I am using ObCallbackTest to protect process from killing.
In my test, process that is in protected list can’t be terminated in TaskManager on Tab “details” (get access deny), BUT in “Process” Tab, it does not work.
Is any bug exist in this example?
if yes, how can fix it.
My OS is Win10X64.
tanks for any suggestion
This example has a debug output. Attach a debugger or use DebugView to obtain debug output and find what is going on. Probably you need to look for THREAD_SET_CONTEXT flag in DesiredAccess.
The task manager on a modern Windows versions uses several different
approaches to kill process, not only TerminateProcess. For example, it may
duplicate a handles of a process with a DUPLICATE_CLOSE_SOURCE flag.
Your callbacks must also filter these flags.
I mean a PROCESS_DUP_HANDLE access right for a process.
tanks for yours replays.
I filter these flags, but it doesn’t work.
When you use the Applications (Win7) or Processes Tab, Task Manager sends WM_CLOSE message to your GUI Window. If you then exit in response to that, no Ob filter’s going to prevent you from that 
–
Best regards,
Alex Ionescu