[HN Gopher] Windows' Undocumented "Emergency Restart"
___________________________________________________________________
Windows' Undocumented "Emergency Restart"
Author : jonathantf2
Score : 95 points
Date : 2022-07-05 15:40 UTC (7 hours ago)
(HTM) web link (old.reddit.com)
(TXT) w3m dump (old.reddit.com)
| dend wrote:
| Indeed the feature is undocumented, but it's been known for some
| time - its goal is to mimic as much as possible the reset button,
| for those situations when your computer freezes up to a point
| where Ctrl+Alt+Del works, but literally no other process
| responds. Think "Background process locked up my OS, and I can't
| do anything short of unplugging the computer." Especially helpful
| on a laptop where the physical reset button is not available.
| malfist wrote:
| I wonder why microsoft never implemented the Magic SysRq keys
| like linux: https://en.wikipedia.org/wiki/Magic_SysRq_key
|
| It'd let you safely shutdown when the computer is locked up
| otherwise.
| kllrnohj wrote:
| The times my Linux installs have locked up, those keys never
| worked.
| malfist wrote:
| They always worked for me, but it's been a long time since
| linux has locked up on me.
| pengaru wrote:
| They may be disabled by distros to enhance security against
| physical access attacks.
|
| It can also be challenging to actually input a magic-sysrq
| combo on many modern keyboards where sysrq isn't its own
| key, if it's labeled at all as some Fn-key contortion.
| nyanpasu64 wrote:
| Personally I value being able to trigger oomkiller early
| when a process is eating up RAM, and being able to
| SIGKILL kwin_x11 on Nvidia or whatever other process is
| wedging Linux shutdown, instead of waiting multiple
| minutes for systemd to give up waiting and SIGKILL it
| directly. In terms of physical access attacks, it's just
| as viable and far more powerful to add a keylogger to my
| keyboard or Linux distro, or pull and image my hard
| drive, than to _gasp_ kill processes or sync filesystem
| data to disk, oh the horror!
| pengaru wrote:
| WRT the physical security argument in favor of disabling
| sysrq, my assumption is it's more aimed towards defeating
| quick-n-dirty mischief style abuse.
|
| Ages ago I worked with a small team of young sysadmins
| who would often cause trouble for one another abusing
| things like sysrq, or poorly configured XFree86 instances
| without DontZap enabled (ctrl-alt-backspace termination,
| to a shell when startx/xinit is being used). Most of the
| time nothing malicious was actually done. But when you
| return to your screen-locked X desktop to find a
| fullscreen VC with a root shell blinking back at you and
| an empty history, guess what you'll at least have on the
| back of your mind for the rest of the workday?
| picsao wrote:
| notriddle wrote:
| That's what Ctrl-Alt-Del is for.
|
| They aren't _exactly_ the same thing, I suppose, but there 's
| enough functional overlap that if you already have one, it's
| hard to justify adding another. You don't want too many of
| these "escape sequences", because every kernel-side keyboard
| interrupt becomes a thing that:
|
| * Userland doesn't get to use that keyboard shortcut any
| more.
|
| * Someone might accidentally trigger, and if they don't know
| what's going on, they become stuck.
|
| * It's another thing that anyone building a captive kiosk has
| to know how to disable.
| forgotpwd16 wrote:
| What always found impressive on Windows is C-A-Del will always
| work.
| hammyhavoc wrote:
| I can name hundreds of occasions from first-hand experience
| where it hasn't worked in the past 26 years for me on a
| variety of machines in various environments.
| beebmam wrote:
| Blue screen of death, for example.
| memcg wrote:
| Me too.
| nyanpasu64 wrote:
| One prominent example I've seen multiple times, is hanging
| in the shutdown screen where no text appears under the
| spinning dots, and Ctrl-Alt-Del does nothing.
| jkingsman wrote:
| Ctrl+Alt+Del invokes WinLogon, the highest priority process,
| that then delivers the task manager. I believe this is a
| kernel invocation, so regardless of user land dysfunction, it
| will always work. Tthis is possibly attributable as much to
| convenience as it is to security -- the Secure Attention
| Sequence[1] is intended as a login-spoofind protection which
| will suspend other tasks (like a spoofed login screen) before
| continuing forward with user auth.
|
| [1]: https://en.wikipedia.org/wiki/Secure_attention_key
| rzzzt wrote:
| A group policy can be enabled on most variants of Windows
| (dating back to around NT 4 or Windows 2000, I think) to
| start with a dialog saying "Press Ctrl-Alt-Delete to
| begin", and pretty much nothing else, exactly for the
| reasons you describe.
| WorldMaker wrote:
| Though Microsoft's current security recommendation is
| against setting that policy for accessibility reasons.
| [0]
|
| Windows since 8 has worked on hardening/strengthening the
| "Secure Desktop" that login flows (and UAC prompts)
| happen on so that as much as possible malware shouldn't
| be able to run in those sandboxes.
|
| [0] https://docs.microsoft.com/en-
| us/windows/security/threat-pro...
| AllegedAlec wrote:
| So what if the keypresses never get registered?
| theevilsharpie wrote:
| > I believe this is a kernel invocation, so regardless of
| user land dysfunction, it will always work.
|
| It may always work from the kernel's standpoint, but this
| doesn't necessarily make it usable.
|
| Anything that blocks the display of WinLogon (e.g., the GPU
| has crashed and is unresponsive) would render this
| emergency restart mechanism unusable, and typically,
| situations like this are usually the only time I would need
| such a feature.
| [deleted]
| robonerd wrote:
| > _Especially helpful on a laptop where the physical reset
| button is not available._
|
| Are there any where holding the power button for 10-15 seconds
| doesn't work? This has always been a reliable technique for me,
| when using linux on numerous different laptops from different
| manufacturers.
| Kwpolska wrote:
| Remote access?
| WorldMaker wrote:
| BIOS issues? Though Ctrl+Alt+Delete might not work with a
| BIOS acting up either.
| kkfx wrote:
| That's ACPI shutdown, not OS-specific but motherboard
| specific AFAIK, it should work an all ACPI compliant
| systems...
| netsharc wrote:
| Indeed. And afaik, the specs say hold it for 4 seconds
| mrtesthah wrote:
| Sounds like the Windows equivalent of shutdown -r now
| kevinoid wrote:
| Perhaps a closer analog would be halt(8) with the -q (BSD) or
| -f (Linux) option to avoid calling init(8):
|
| https://man.openbsd.org/halt
|
| https://manpages.debian.org/halt
| chasil wrote:
| On my RHEL systems:
|
| -f / --force : "Force immediate halt, power-off, or reboot.
| When specified once, this results in an immediate but clean
| shutdown by the system manager. When specified twice, this
| results in an immediate shutdown without contacting the
| system manager."
|
| "...all processes will be killed forcibly and all file
| systems are unmounted or remounted read-only. This is hence a
| drastic but relatively safe option to request an immediate
| reboot. If --force is specified twice for these operations,
| they will be executed immediately without terminating any
| processes or unmounting any file systems. Warning: specifying
| --force twice with any of these operations might result in
| data loss."
| mrtesthah wrote:
| Yes, that's what I was thinking of.
| gruez wrote:
| No, not really, from the OP
|
| >After a bit of testing with Restart-Computer and shutdown /r
| /f, I've found that no officially-documented shutdown command
| or function comes close in speed -- they both take a fair bit
| of time to work, and importantly, they both register in the
| Event Log as a clean shutdown. So what's going on here?
|
| IME shutdown -r now definitely takes it sweet time (ie. getting
| stuck on "A stop job is running ..."
| mrtesthah wrote:
| It's pretty quick on macOS.
| robonerd wrote:
| > _(ie. getting stuck on "A stop job is running ..." _
|
| Trying to unmount a manually mounted network drive after
| already taking down the network... very frustrating. Seeing
| the time remaining counter jump from 30 seconds to 2+ minutes
| after the first 30 seconds passes is rage inducing. Do I
| really need to read the jargon dense documentation for a damn
| init system to get my computer to behave in a sensible way?
| Thanks Lennart.
| memcg wrote:
| Sysinternal's "pskill csrss" used to be my last resort to
| reboot remote or local desktops and VMs. Saved my ass many
| times.
| forgotpwd16 wrote:
| This is a normal reboot. If anything seems more like a reboot
| issued via magic system request.
| dinom wrote:
| Agreed, seems to be exactly this.
|
| https://www.kernel.org/doc/html/latest/admin-
| guide/sysrq.htm...
|
| echo 1 > /proc/sys/kernel/sysrq # enable sysrq
|
| echo o > /proc/sysrq-trigger # immediately power off
| schroeding wrote:
| Besides the mentioned NtSetSystemPowerState function, which this
| feature calls, there are also other undocumented API functions
| that allow to shutdown / restart the sytem immediately, like
| NtRaiseHardError (which allows to cause a bluescreen-like unclean
| shutdown with normal user permissions as a fun side-effect).
| kozak wrote:
| Equivalent of the old good double-press of Ctrl-Alt-Del that we
| used to have in Windows 9x?
| UI_at_80x24 wrote:
| Ctl+Alt+Del has been a BIOS designated interrupt for REBOOT
| since the DOS 3 (or even before, but that's the edge of my
| memory) days.
|
| Win9x "tried" to intercept it; but was never 100% successful.
| krylon wrote:
| Do I understand this correctly as being the software equivalent
| of pushing the reset button? Or am I missing something?
|
| I wonder what the history behind this feature is.
| omoikane wrote:
| Top comment has a link to more details. Apparently it's
| NtSetSystemPowerState from ntdll.
|
| https://www.codeproject.com/Articles/34194/Performing-emerge...
___________________________________________________________________
(page generated 2022-07-05 23:02 UTC)