https://github.com/sunsetmkt/emergencyshutdown
Emergency Shutdown for Windows.
https://github.com/sunsetmkt/emergencyshutdown
cpp ntdll ntshutdownsystem shutdown visual-studio windows
Last synced: 9 months ago
JSON representation
Emergency Shutdown for Windows.
- Host: GitHub
- URL: https://github.com/sunsetmkt/emergencyshutdown
- Owner: SunsetMkt
- License: gpl-3.0
- Created: 2025-03-05T05:00:17.000Z (over 1 year ago)
- Default Branch: main
- Last Pushed: 2025-03-06T02:04:34.000Z (over 1 year ago)
- Last Synced: 2025-09-24T05:49:59.414Z (9 months ago)
- Topics: cpp, ntdll, ntshutdownsystem, shutdown, visual-studio, windows
- Language: C++
- Homepage:
- Size: 33.2 KB
- Stars: 4
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# EmergencyShutdown
Emergency Shutdown for Windows.
## Warning
Emergency Shutdown powers off the system almost immediately without notifying other applications, which may cause instability and data loss.
## Usage
```plain
Usage: EmergencyShutdown [/r | /s] [/t seconds]
/r : Reboot the system
/s : Shutdown the system
/t seconds : Set a countdown before executing (default 0)
This program will shutdown or reboot the system immediately by
calling the NtShutdownSystem function without notifying other
applications, which may cause instability and data loss.
```
Rename the executable to `ShutdownImmediatelyDangerously.exe` or `RebootImmediatelyDangerously.exe` and run it will shutdown or reboot the system immediately.
## Background
[Reference](https://www.codeproject.com/Articles/34194/Performing-emergency-shutdowns)
Many of the Nt/Zw functions inside the Windows kernel are documented, but some are not. The `NtShutdownSystem` function is documented pretty well [here](http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Hardware/NtShutdownSystem.html) at [NTInternals](http://undocumented.ntinternals.net/). The `NtSetSystemPowerState` function, however, is not.
At the final stages of the Windows shutdown process, `NtShutdownSystem` is called. It is responsible for shutting down all drivers, flushing Registry hives and the disc cache, clearing the page file, etc. After doing so, it calls the `NtSetSystemPowerState` function.
`NtSetSystemPowerState` then causes all plug-and-play devices to be shut down and the system to be either halted, powered off, or rebooted.
However, calling these two functions without notifying the system first is extremely dangerous, and may cause instability in the system.
There're reports saying that `NtSetSystemPowerState` does not work in some cases, so this program will use `NtShutdownSystem` instead.
## Thanks to
- [bormaxi8080/windows-force-reboot](https://github.com/bormaxi8080/windows-force-reboot)
- [ChatGPT](https://chatgpt.com/)