System-Wide Injection Portable-Executable (SwiPE)

IsCriticalProcess()

Example Code

function IsCriticalProcess(const hProcess: THandle;
                                bCritical: PBOOL): BOOL; stdcall;

// Determines whether a process is considered "critical" or not
// Terminating a critical process may result in a system BSOD
// Csrss, Winlogon, WinInit etc. are "critical" processes
// Windows will force a break on termination and bugcheck (BSOD)
// Windows 8.1/Windows Server 2012 R2 offers kernel32!IsProcessCritical() but does not support anything below
// This API works on all Windows OS variants from XP on

var
 bCritical: BOOL;
begin
 if not IsCriticalProcess(GetCurrentProcess(), @bCritical) then
 MessageBoxW(0, 'Failed to open process', nil, MB_ICONERROR)
else
 MessageBoxW(0, PWChar(Format('Critical Process: %s', [BoolToStr(bCritical, True)])), 'Critical Process?', MB_ICONINFORMATION);
end;