NTSTATUS
NtTerminateProcess(
    __in_opt HANDLE ProcessHandle,
    __in NTSTATUS ExitStatus
    )

/*++

Routine Description:

    This function causes the specified process and all of
    its threads to terminate.

Arguments:

    ProcessHandle - Supplies a handle to the process to terminate.

    ExitStatus - Supplies the exit status associated with the process.

Return Value:

    NTSTATUS - Status of operation

--*/

{

    PETHREAD Thread, Self;
    PEPROCESS Process;
    PEPROCESS CurrentProcess;
    NTSTATUS st;
    BOOLEAN ProcessHandleSpecified;
    PAGED_CODE();
    //得到当前线程
    Self = PsGetCurrentThread();
    //根据当前线程得到当前进程
    CurrentProcess = PsGetCurrentProcessByThread (Self);

    //利用ARGUMENT_PRESENT宏对句柄是否为空进行了判断
    if (ARGUMENT_PRESENT (ProcessHandle)) {
        ProcessHandleSpecified = TRUE;
    } else {
        ProcessHandleSpecified = FALSE;
        //为空得到当前的进程句柄
        ProcessHandle = NtCurrentProcess();
    }

    //通过句柄得到进程对象
    st = ObReferenceObjectByHandle (ProcessHandle,
                                    PROCESS_TERMINATE,
                                    PsProcessType,
                                    KeGetPreviousModeByThread(&Self->Tcb),
                                    &Process,
                                    NULL);

    if (!NT_SUCCESS (st)) {
        return(st);
    }
    //判断是否为临界进程
    if (Process->Flags & PS_PROCESS_FLAGS_BREAK_ON_TERMINATION) {
        //导致蓝屏
        PspCatchCriticalBreak ("Terminating critical process 0x%p (%s)\n",
                               Process,
                               Process->ImageFileName);
    }

    //
    // Acquire rundown protection just so we can give the right errors
    //
    //锁住进程
    if (!ExAcquireRundownProtection (&Process->RundownProtect)) {
        //锁住进程失败，减少引用次数
        ObDereferenceObject (Process);
        return STATUS_PROCESS_IS_TERMINATING;
    }

    //
    // Mark process as deleting except for the obscure delete self case.
    //

    if (ProcessHandleSpecified) {
        PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_PROCESS_DELETE);
    }

    st = STATUS_NOTHING_TO_TERMINATE;

    //遍历进程的线程链表
    for (Thread = PsGetNextProcessThread (Process, NULL);
         Thread != NULL;
         Thread = PsGetNextProcessThread (Process, Thread)) {
        //至少有一个线程
        st = STATUS_SUCCESS;
        //确保线程不是本线程
        if (Thread != Self) {
            //结束线程
            PspTerminateThreadByPointer (Thread, ExitStatus, FALSE);
        }
    }

    //解锁进程
    ExReleaseRundownProtection (&Process->RundownProtect);

    //如果进程是当前进程
    if (Process == CurrentProcess) {
        //并且句柄不为空
        if (ProcessHandleSpecified) {

            ObDereferenceObject (Process);

            //
            // Never Returns
            //
            //结束自己
            PspTerminateThreadByPointer (Self, ExitStatus, TRUE);
        }
    } else if (ExitStatus == DBG_TERMINATE_PROCESS) {
        //进程处于调试状态
        //去除Debugger的DebugPort字段对调试对象的引用,并将其设置为NULL。
        DbgkClearProcessDebugObject (Process, NULL);
    }

    //
    // If there are no threads in this process then clear out its handle table.
    // Do the same for processes being debugged. This is so a process can never lock itself into the system
    // by debugging itself or have a handle open to itself.
    //
    if (st == STATUS_NOTHING_TO_TERMINATE || (Process->DebugPort != NULL && ProcessHandleSpecified)) {
        ObClearProcessHandleTable (Process);
        st = STATUS_SUCCESS;
    }
    //减少引用次数
    ObDereferenceObject(Process);

    return st;
}

NTSTATUS
PspTerminateThreadByPointer(
    IN PETHREAD Thread,
    IN NTSTATUS ExitStatus,
    IN BOOLEAN DirectTerminate
    )

/*++

Routine Description:

    This function causes the specified thread to terminate.

Arguments:

    ThreadHandle - Supplies a referenced pointer to the thread to terminate.

    ExitStatus - Supplies the exit status associated with the thread.

    DirectTerminate - TRUE is its ok to exit without queing an APC, FALSE otherwise

--*/

{
    NTSTATUS Status;
    PKAPC    ExitApc=NULL;
    ULONG    OldMask;

    PAGED_CODE();

    //判断是否为临界线程
    if (Thread->CrossThreadFlags
    & PS_CROSS_THREAD_FLAGS_BREAK_ON_TERMINATION) {
      //导致蓝屏
      PspCatchCriticalBreak("Terminating critical thread 0x%p (in %s)\n",
                Thread,
                THREAD_TO_PROCESS(Thread)->ImageFileName);
    }

    //结束线程本身
    if (DirectTerminate && Thread == PsGetCurrentThread()) {
        //判断当前中断级是否小于APC
        ASSERT (KeGetCurrentIrql() < APC_LEVEL);

        //设置结束标志
        PS_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_TERMINATED);
 
        //直接结束线程本身(自杀)
        PspExitThread (ExitStatus);

        //
        // Never Returns
        //

    } else {
        //
        // Cross thread deletion of system threads won't work.
        //线程是系统线程则不会继续执行
        if (IS_SYSTEM_THREAD (Thread)) {
            return STATUS_ACCESS_DENIED;
        }

        Status = STATUS_SUCCESS;

        while (1) {
            //申请APC
            ExitApc = (PKAPC) ExAllocatePoolWithTag (NonPagedPool,
                                                     sizeof(KAPC),
                                                     'xEsP');
            if (ExitApc != NULL) {
                break;
            }

            //延迟继续申请
            KeDelayExecutionThread(KernelMode, FALSE, &ShortTime);
        }

        //
        // Mark the thread as terminating and call the exit function.
        //设置结束标志
        OldMask = PS_TEST_SET_BITS (&Thread->CrossThreadFlags, PS_CROSS_THREAD_FLAGS_TERMINATED);

        //
        // If we are the first to set the terminating flag then queue the APC
        //

        if ((OldMask & PS_CROSS_THREAD_FLAGS_TERMINATED) == 0) {
            //初始化内核APC去结束线程
            KeInitializeApc (ExitApc,
                             PsGetKernelThread (Thread),
                             OriginalApcEnvironment,
                             PsExitSpecialApc,
                             PspExitApcRundown,
                             PspExitNormalApc,
                             KernelMode,
                             ULongToPtr (ExitStatus));
            //插入APC队列
            if (!KeInsertQueueApc (ExitApc, ExitApc, NULL, 2)) {
                //已经在队列中
                // If APC queuing is disabled then the thread is exiting anyway
                //
                ExFreePool (ExitApc);
                Status = STATUS_UNSUCCESSFUL;
            } else {
                //
                // We queued the APC to the thread. Wake up the thread if it was suspended.
                //
                KeForceResumeThread (&Thread->Tcb);

            }
        } else {
            ExFreePool (ExitApc);
        }
    }

    return Status;
}