We don't display ads so we rely on your Bitcoin donations to 1KWEk9QaiJb2NwP5YFmR24LyUBa4JyuKqZ
Post date: Feb 8, 2010 11:33:53 AM
Sometimes, it may not be possible to start a process in suspended state for editing [CreateProcessA with PROCESS_SUSPENDED parameter] and it may be necessary to suspend an already running process. Code is also included for resuming a suspended process.
Coder: steve10120
Resume Process:
Function ResumeProcess(ProcessID: DWORD): Boolean;var  Snapshot,cThr: DWORD;  ThrHandle: THandle;  Thread:TThreadEntry32;begin  Result := False;  cThr := GetCurrentThreadId;  Snapshot := CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);  if Snapshot <> INVALID_HANDLE_VALUE then   begin    Thread.dwSize := SizeOf(TThreadEntry32);    if Thread32First(Snapshot, Thread) then     repeat      if (Thread.th32ThreadID <> cThr) and (Thread.th32OwnerProcessID = ProcessID) then       begin        ThrHandle := OpenThread(THREAD_ALL_ACCESS, false, Thread.th32ThreadID);        if ThrHandle = 0 then Exit;        ResumeThread(ThrHandle);        CloseHandle(ThrHandle);       end;     until not Thread32Next(Snapshot, Thread);     Result := CloseHandle(Snapshot);    end;end;Suspend Process:
function SuspendProcess(PID:DWORD):Boolean;varhSnap:  THandle;THR32:  THREADENTRY32;hOpen:  THandle;begin  Result := FALSE;  hSnap := CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);  if hSnap <> INVALID_HANDLE_VALUE then  begin    THR32.dwSize := SizeOf(THR32);    Thread32First(hSnap, THR32);    repeat      if THR32.th32OwnerProcessID = PID then      begin        hOpen := OpenThread($0002, FALSE, THR32.th32ThreadID);        if hOpen <> INVALID_HANDLE_VALUE then        begin          Result := TRUE;          SuspendThread(hOpen);          CloseHandle(hOpen);        end;      end;    until Thread32Next(hSnap, THR32) = FALSE;    CloseHandle(hSnap);  end;end;