ConHost process remains with ping -t in EchoCon #406

Closed
opened 2026-01-30 21:51:05 +00:00 by claunia · 9 comments
Owner

Originally created by @Biswa96 on GitHub (Oct 8, 2018).

  • Windows build number: 10.0.18247.1001

  • What I did: Open the EchoCon.cpp file > Edit the command string as ping -t localhost and set INFINITE time in WaitForSingleObject() > Compile it > Run EchoCon.exe > Press Ctrl+C after some pings > See task manger ASAP! Two process remains one ConHost.exe and another Ping.exe. These two processes are killed automatically after some seconds.

  • Question: Is this an expected behavior? Isn't the child process terminated automatically with the parent process?

  • Bonus question: The blog shows demo with WriteFile(hIn,..) & EchoCon has WriteFile(hOut,...). How can I mix them? For example, the child process will be only cmd.exe without any other parameter.

Originally created by @Biswa96 on GitHub (Oct 8, 2018). * Windows build number: 10.0.18247.1001 * What I did: Open the EchoCon.cpp file > Edit the command string as `ping -t localhost` and set `INFINITE` time in `WaitForSingleObject()` > Compile it > Run EchoCon.exe > Press Ctrl+C after some pings > See task manger ASAP! Two process remains one `ConHost.exe` and another `Ping.exe`. These two processes are killed automatically after some seconds. * Question: Is this an _expected behavior_? Isn't the child process terminated automatically with the parent process? * Bonus question: The blog shows demo with `WriteFile(hIn,..)` & EchoCon has `WriteFile(hOut,...)`. How can I mix them? For example, the child process will be only `cmd.exe` without any other parameter.
claunia added the Issue-QuestionProduct-Conpty labels 2026-01-30 21:51:05 +00:00
Author
Owner

@zadjii-msft commented on GitHub (Oct 8, 2018):

I believe that's by design, yes. The pseudoconsole is supposed to act just like conhost would.
When ping.exe exits, the last process attached to the console is gone, and now the console no longer has any clients. At this point, the console willl close itself down. The same behavior can be seen by using the run box (Win+R) to launch ping -t localhost then pressing ctrl+c in that window.

The hOut that's getting written to in EchoCon is the terminal console window's stdout, not the pseudoconsole's stdout. I don't think it's possible to seamlessly connect a pseudoconsole straight to a console window, nor would I think you would want to. That would basically just be a console with extra steps involved :)

@zadjii-msft commented on GitHub (Oct 8, 2018): I believe that's by design, yes. The pseudoconsole is supposed to act just like conhost would. When ping.exe exits, the last process attached to the console is gone, and now the console no longer has any clients. At this point, the console willl close itself down. The same behavior can be seen by using the run box (Win+R) to launch `ping -t localhost` then pressing ctrl+c in that window. The hOut that's getting written to in EchoCon is the terminal console window's stdout, not the pseudoconsole's stdout. I don't think it's possible to seamlessly connect a pseudoconsole straight to a console window, nor would I think you would want to. That would basically just be a console with extra steps involved :)
Author
Owner

@Biswa96 commented on GitHub (Oct 8, 2018):

I don't think it's possible to seamlessly connect a pseudoconsole straight to a console window, nor would I think you would want to.

So the ConPty model isn't as same as Unix pty model. Am I right?

Shouldn't the child process be aware of that the parent process is terminated?

@Biswa96 commented on GitHub (Oct 8, 2018): > I don't think it's possible to seamlessly connect a pseudoconsole straight to a console window, nor would I think you would want to. So the ConPty model isn't as same as [Unix pty model](http://rachid.koucha.free.fr/tech_corner/pty_pdip.html). Am I right? Shouldn't the child process be aware of that the parent process is terminated?
Author
Owner

@zadjii-msft commented on GitHub (Oct 8, 2018):

I think there's a miscommunication somewhere

Ping is the child process here, and the parent is the terminal process, EchoCon. If echocon exits, the "master" side of the pseudoconsole has been broken. Unlike linux, this also causes the pseudoconsole to close. This is because the pseudoconsoles aren't files in the global scope like they are on *nix, they're objects within the terminal (parent) process's scope. If the parent goes away, then there's no one left to know that there's an orphaned child process.

When the pseudoconsole's "master" side is broken, it closes all of it's children in just the same way that pressing the X on a conhost window would.

@zadjii-msft commented on GitHub (Oct 8, 2018): I think there's a miscommunication somewhere Ping is the child process here, and the parent is the terminal process, EchoCon. If echocon exits, the "master" side of the pseudoconsole has been broken. Unlike linux, this also causes the pseudoconsole to close. This is because the pseudoconsoles aren't files in the global scope like they are on *nix, they're objects within the terminal (parent) process's scope. If the parent goes away, then there's no one left to know that there's an orphaned child process. When the pseudoconsole's "master" side is broken, it closes all of it's children in just the same way that pressing the X on a conhost window would.
Author
Owner

@Biswa96 commented on GitHub (Nov 19, 2018):

@zadjii-msft ClosePseudoConsole() hasn't return value in Win build 18282.

@Biswa96 commented on GitHub (Nov 19, 2018): @zadjii-msft `ClosePseudoConsole()` hasn't return value in Win build 18282.
Author
Owner

@zadjii-msft commented on GitHub (Nov 19, 2018):

Yep, that's by design. Is there a particular reason you're looking for a return value?

@zadjii-msft commented on GitHub (Nov 19, 2018): Yep, that's by design. Is there a particular reason you're looking for a return value?
Author
Owner

@Biswa96 commented on GitHub (Nov 19, 2018):

@zadjii-msft Docs has return value in definition written by @miniksa. Yes, I want to check if it closed or not. I think two possible values 1. NtClose() ---> NTSTATUS ---> GetLastError() 2. NtTerminateProcess() ---> uExitCode.

@Biswa96 commented on GitHub (Nov 19, 2018): @zadjii-msft Docs has return value [in definition](https://docs.microsoft.com/en-us/windows/console/closepseudoconsole) written by @miniksa. Yes, I want to check if it closed or not. I think two possible values 1. NtClose() ---> NTSTATUS ---> GetLastError() 2. NtTerminateProcess() ---> uExitCode.
Author
Owner

@zadjii-msft commented on GitHub (Nov 19, 2018):

Ah. That's a docs bug. That should be void.

There's a few things that all go on during ClosePseudoConsole, it didn't make sense to return only the first result or the last result. I remember quite a bit of debate about the signature of that function during API review. I've submitted a PR to fix that.

@zadjii-msft commented on GitHub (Nov 19, 2018): Ah. That's a docs bug. That should be `void`. There's a few things that all go on during ClosePseudoConsole, it didn't make sense to return only the first result or the last result. I remember quite a bit of debate about the signature of that function during API review. I've submitted a PR to fix that.
Author
Owner

@Biswa96 commented on GitHub (Jan 25, 2019):

I get BSOD using some ConDrv and LxCore internals. How can I report this here? I can provide a PoC.

@Biswa96 commented on GitHub (Jan 25, 2019): I get BSOD using some ConDrv and LxCore internals. How can I report this here? I can provide a PoC.
Author
Owner

@DHowett-MSFT commented on GitHub (Jan 25, 2019):

@biswa96 Please direct any OS-level crash reports and minidumps to secure@microsoft.com.

To quote the WSL issue guidance,

Ideally, please configure your machine to capture minidumps, repro the issue, and send the minidump from "C:\Windows\minidump".

If you mention the Console or WSL team in the e-mail body, it should get to the right place.

@DHowett-MSFT commented on GitHub (Jan 25, 2019): @biswa96 Please direct any OS-level crash reports and minidumps to `secure@microsoft.com`. To quote the WSL issue guidance, > Ideally, please [configure your machine to capture minidumps](https://support.microsoft.com/en-us/help/315263/how-to-read-the-small-memory-dump-file-that-is-created-by-windows-if-a), repro the issue, and send the minidump from "C:\Windows\minidump\". If you mention the Console or WSL team in the e-mail body, it should get to the right place.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#406