How to force a power down?

[Decipher]

I've been troubleshooting my machine hanging intermediately after windows starts shutting down and I know that the source of the problem can be quite hard to determine. But before someone attempts to assit me with troubleshooting my machine or pointing to other forums remember thats not what I asked.

Shutdown(12) Forces Windows to shutdown

Question:

How to force the machine to power down A.K.A holding down the power button.

I've written a little script using some snippets I found on the forums to help those troubleshooting their own machines:

--Shutdown Assistant--

expandcollapse popup

#NoTrayIcon
#include <Misc.au3>
If _Singleton("ShutdownAssitant", 1) = 0 Then Exit

$WM_QUERYENDSESSION = 0x11
Local $sSystem = "[System Process],System,smss.exe,csrss.exe,winlogon.exe,services.exe,lsass.exe,svchost.exe,explorer.exe,uphclean.exe,wmiprvse.exe"
Local $aSystem = StringSplit($sSystem,",", 1)

GUIRegisterMsg($WM_QUERYENDSESSION, "ForceShutdown")
GUICreate("Shutdown Assistant")
GUISetState(@SW_HIDE)

; set highest notification level
If Not _SetProcessShutdownParameters(0xFFF) Then ; MSDN says maximum is 0x4FF, but it worked for me
    If Not _SetProcessShutdownParameters(0x4FF) Then ; MSDN says this is reserved for System, but worked for me
        _SetProcessShutdownParameters(0x3FF) ; highest not reserved number, if everything else does not work
    EndIf
EndIf

Global $b_ShutdownInitiated = False

While ($b_ShutdownInitiated == False)
   sleep(10)
WEnd

Func TerminateSession()
   Local $list = ProcessList()
   For $i = 1 To $list[0][0]
       if Not IsSystem($list[$i][0], $list[$i][1]) Then ProcessClose($list[$i][0])
   Next
EndFunc

Func IsSystem($sProcess, $iPID)
      For $i = 1 To $aSystem[0] Step 1
         If $sProcess == $aSystem[$i] Or $iPID == @AutoItPID  Then Return True
      Next
EndFunc

Func ForceShutdown($hWndGUI, $MsgID, $WParam, $LParam)
    $b_ShutdownInitiated = True
    TerminateSession()
    Return True
EndFunc

Func _SetProcessShutdownParameters($dwLevel, $dwFlags=0)
    ; http://msdn.microsoft.com/en-us/library/ms686227%28VS.85%29.aspx
    ; Prog@ndy
    Local $aResult = DllCall("Kernel32.dll", "int", "SetProcessShutdownParameters", "dword", $dwLevel, "dword", $dwFlags)
    If @error Then Return SetError(1,0,0)
    Return $aResult[0]
EndFunc

It can be used to determine if a non system service process is causing the hang up.

*Edit I realize that this probably won't work if something such as AV is causing the issue

Edited April 2, 2013 by Decipher

[guinness]

I don't think Windows would have an API function to force-ably power off the machine, since they warn holding the power button is a big "no no".

[Decipher]

Thanks for the reply and I have presumed this however with the newly found extensibilliy AutoIt has to offer....

[guinness]

Thanks for the reply and I have presumed this however with the newly found extensibilliy AutoIt has to offer....

AutoIt is primarily just a wrapper for the Win32 API functions.

[Decipher]

Yes, but could a driver not be implemented to do such a thing? Windows of course can determine if a user has pressed the power button so I see as it being possible to simulate the button being pressed just not easily. Its a long shot I know but I had to ask.

Edited April 2, 2013 by Decipher

[KaFu]

I think ShutDown() is based on ExitWindowsEx, and I guess that's as much as you get. I would assume that holding the power button down will trigger a power-event on a much lower level (BIOS, directly / physically on the MoBo?).

[Decipher]

Bare with me for a moment while I theorize. The VMware or VirtualBox technology can terminate a session forcibly(kill the process). Boot loaders such as Grub and SysLinux can start windows along with drivers that can emulate devices such as CDROM/Floppies such as Firadisk used to install windows from a USB using an ISO. Is it not possible to have a subsystem load a windows installation and terminate it as a process, kill the kernel then shutdown the system? Yes, when Windows shutdowns it send a signal to the board which in turn flips the switch but unless unplugged power still remains to the board, no? Okay that said if the signal was sent to power down what would prevent it from doing so? <-- I don't mean windows I mean hardware.... There is a signal that the windows kernel knows about and if windows is hanging then its not being sent or else I wouldn't be here. Please do correct me if I'm wrong.

Edited April 2, 2013 by Decipher

[KaFu]

I found this article http://stackoverflow.com/questions/15636059/instant-power-off-programatically

Give it a try, my computer just takes too long to reboot for me to test it ...

WARNING: Might result in loss of data! Be sure to have any unsaved work saved and all unused processes closed before running the code!

Edit: Spelling

expandcollapse popup

; You can use ExitWindowsEx with EWX_POWEROFF and EWX_FORCE flags set..
; http://stackoverflow.com/questions/15636059/instant-power-off-programatically
; ExitWindowsEx(EWX_SHUTDOWN or EWX_FORCE, 0);

; ExitWindowsEx function
; http://msdn.microsoft.com/en-us/library/windows/desktop/aa376868(v=vs.85).aspx

; DllCall("user32.dll", "int", "ExitWindowsEx", "uint", BitOR(0x00000001, 0x00000004), "dword", 0)

#cs
Private Const EWX_LOGOFF As Long = 0
Private Const EWX_SHUTDOWN As Long = 1
Private Const EWX_REBOOT As Long = 2
Private Const EWX_POWEROFF As Long = 8
Private Const EWX_FORCE As Long = 4
Private Const EWX_FORCEIFHUNG As Long = 16
#ce

; To shut down or restart the system, the calling process must use the AdjustTokenPrivileges function to enable the SE_SHUTDOWN_NAME privilege.

#RequireAdmin ; for this example to have sense

#include <SecurityConstants.au3>
#include <Security.au3>
#include <WinAPI.au3>

Local $hToken = _Security__OpenProcessToken(_WinAPI_GetCurrentProcess(), $TOKEN_ALL_ACCESS)
If $hToken Then
; $hToken it this process' token with $TOKEN_ALL_ACCESS access
; Enable SeDebugPrivilege for this token
If _Security__SetPrivilege($hToken, $SE_SHUTDOWN_NAME, True) Then
;... Do whatever with this token now and here...
; MsgBox(262144, "TokenPrivileges", $SE_SHUTDOWN_NAME & " enabled!")

DllCall("user32.dll", "int", "ExitWindowsEx", "uint", BitOR(0x00000001, 0x00000004), "dword", 0)

; Disable
_Security__SetPrivilege($hToken, $SE_SHUTDOWN_NAME, False)
; MsgBox(262144, "TokenPrivileges", $SE_SHUTDOWN_NAME & " disabled!")
EndIf
; Close handle when done
_WinAPI_CloseHandle($hToken)
EndIf

Edited April 2, 2013 by KaFu

[Decipher]

The screen went black but the mouse was still visible and active with the power on... At this point I think I may have faulty hardware attached preventing my machine from powering off. I think that you may have just provided the signal I mentioned above but I would like a definite answer or solution.

*Edit - I'm asking for to much. Thanks everyone.

Edited April 2, 2013 by Decipher

[aleph01]

How to force a power down? Unless the system is completely unresponsive, I've never had a failure to power down immediately on a Windows box using the shutdown command with the /f and /t xx switches. Example: shutdown /s /f /t 00. Will this not work for you?

[guinness]

Decipher is talking about a 'hard reset'.

[KaFu]

Emergency shutdown with power off using an undocumented API call (the hard way ), here ya go...

WARNING: Might result in loss of data! Be sure to have any unsaved work saved and all unused processes closed before running the code!

#include <SecurityConstants.au3>
#include <Security.au3>
#include <WinAPI.au3>

; At the final stages of the Windows shutdown process, NtShutdownSystem is called. It is responsible for shutting down all drivers, flushing Registry hives and the disc cache, clearing the page file, etc. After doing so, it calls the NtSetSystemPowerState function.
; NtSetSystemPowerState then causes all plug-and-play devices to be shut down and the system to be either halted, powered off, or rebooted.

_NtShutdownSystem()

Func _NtShutdownSystem($iShutdown_Action = 2)
    ; by KaFu, visit http://funk.eu
    ; Undocumented API call found at http://forums.codeguru.com/showthread.php?188554-Emergency-shutdown
    ; According to "Windows NT/2000 Native API Reference" by Gary Nebbet, this function does not notify services and user applications before it shuts down the system.
    ; http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Hardware/NtShutdownSystem.html
    ; http://www.codeproject.com/Articles/34194/Performing-emergency-shutdowns

    Local Const $ShutdownNoReboot = 0
    Local Const $ShutdownReboot = 1
    Local Const $ShutdownPowerOff = 2

    Local $hToken = _Security__OpenProcessToken(_WinAPI_GetCurrentProcess(), $TOKEN_ALL_ACCESS)
    If $hToken Then
        If _Security__SetPrivilege($hToken, $SE_SHUTDOWN_NAME, True) Then
            DllCall("ntdll.dll", "none", "NtShutdownSystem", "int", $iShutdown_Action)
            Return 1
        Else
            MsgBox(16 + 262144, "NtShutdownSystem - Error", "Could not obtain SE_SHUTDOWN_NAME privilege.")
        EndIf
        _WinAPI_CloseHandle($hToken)
    EndIf
    Return 0
EndFunc   ;==>_NtShutdownSystem

#include <SecurityConstants.au3>
#include <Security.au3>
#include <WinAPI.au3>

; At the final stages of the Windows shutdown process, NtShutdownSystem is called. It is responsible for shutting down all drivers, flushing Registry hives and the disc cache, clearing the page file, etc. After doing so, it calls the NtSetSystemPowerState function.
; NtSetSystemPowerState then causes all plug-and-play devices to be shut down and the system to be either halted, powered off, or rebooted.

_NtSetSystemPowerState_PowerOff()

Func _NtSetSystemPowerState_PowerOff()
    ; by KaFu, visit http://funk.eu
    ; http://www.codeproject.com/Articles/34194/Performing-emergency-shutdowns

    Local $hToken = _Security__OpenProcessToken(_WinAPI_GetCurrentProcess(), $TOKEN_ALL_ACCESS)
    If $hToken Then
        If _Security__SetPrivilege($hToken, $SE_SHUTDOWN_NAME, True) Then
            ; POWER_ACTION enumeration
            ; http://msdn.microsoft.com/en-us/library/aa373145%28v=vs.85%29.aspx
            ; PowerActionShutdownOff = 6

            ; SYSTEM_POWER_STATE enumeration
            ; http://msdn.microsoft.com/en-us/library/aa373227%28v=vs.85%29.aspx
            ; PowerSystemShutdown    = 6

            ; System Shutdown Reason Codes
            ; http://msdn.microsoft.com/en-us/library/aa376885%28VS.85%29.aspx

            DllCall("ntdll.dll", "dword", "NtSetSystemPowerState", "dword", 6, "dword", 6, "ulong", 0x80000000)
            Return 1
        Else
            MsgBox(16 + 262144, "NtShutdownSystem - Error", "Could not obtain SE_SHUTDOWN_NAME privilege.")
        EndIf
        _WinAPI_CloseHandle($hToken)
    EndIf
    Return 0
EndFunc   ;==>_NtSetSystemPowerState_PowerOff

Edit #1: This codeproject article contains an even more "direct" way, NtSetSystemPowerState... he does not recommend using any of these functions, neither do I! Bad usage might corrupt your system, you've been warned...

Edit #2: Tested both functions, the first works on my VM-XP and Win7, the second (even more direct) function does not seem to work on the VM, but does power down my physical computer instantly (Win7)...

Edit #3: Updated function, the forum ate the characters...

Edited April 5, 2013 by KaFu

[Decipher]

KaFu,

As this code does absolutely nothing when I run it then is it safe to assume that I have a hardware defect?

Post Script:

Yes, I included WinAPI.au3. I figured that you left it out intentionally.

Edit - I forgot to thank you for your research into this. Thanks

I attempted this on my actual machine - Win XP Home SP3 - if anyone else wants to give it a shot. I however would not unless I had saved a copy of my system registry hives using ERUNT or something similar and had tools available to restore the state of the machine even if the partition tables become corrupt because I'm thinking that they could if certain processes are running. I also replaced ntdll.dll with a new copy.

Anonymous

Edited April 5, 2013 by Decipher

[guinness]

I ran it in VirtualBox with XP SP3 to no avail. There wasn't even a message box of an error.

[Decipher]

Well, I think thats good news with confidence that KaFu can fix it and I can continue to practice bricking my machine.

[guinness]

Yes, I included WinAPI.au3. I figured that you left it out intentionally.

Where have you been? This is a documented Forum issue, not KaFu being difficult.

[Decipher]

I thought that he may have left it out so noobs couldn't brick their comps.

Edited April 5, 2013 by Decipher

[guinness]

Okay. Well now you're aware.

[KaFu]

That damn bug ... maybe the forum ate one or two relevant characters too? We first example worked in all instances for me. Maybe it's related to a MoBo power feature not being present / enabled? An idea would be to x-check the BIOS power management settings.

[Decipher]

KaFu,

Will do and thanks for tha quick update bro.

*Edit -

I tried _NtSetSystemPowerState_PowerOff() first which did nothing then I tried the other which did appear at first to have done nothing but was still running. I terminated the script and attempted to run it again and the system won't allow it which is what I think should be happening but without the inevitable shutdown part.

Edited April 5, 2013 by Decipher