Windows 挂起进程
A thread can suspend and resume the execution of another thread. While a thread is suspended, it is not scheduled for time on the processor.
If a thread is created in a suspended state (with the CREATE_SUSPENDED flag), it does not begin to execute until another thread calls the ResumeThread function with a handle to the suspended thread. This can be useful for initializing the thread's state before it begins to execute. Suspending a thread at creation can be useful for one-time synchronization, because this ensures that the suspended thread will execute the starting point of its code when you call ResumeThread.
The SuspendThread function is not intended to be used for thread synchronization because it does not control the point in the code at which the thread's execution is suspended. This function is primarily designed for use by debuggers.
A thread can temporarily yield its execution for a specified interval by calling the Sleep or SleepEx functions This is useful particularly in cases where the thread responds to user interaction, because it can delay execution long enough to allow users to observe the results of their actions. During the sleep interval, the thread is not scheduled for time on the processor.
The SwitchToThread function is similar to Sleep and SleepEx, except that you cannot specify the interval. SwitchToThread allows the thread to give up its time slice.
https://docs.microsoft.com/zh-cn/windows/win32/procthread/suspending-thread-execution
两个 API 函数
How to suspend/resume a process in Windows?
You can't do it from the command line, you have to write some code (I assume you're not just looking for an utility otherwise Super User may be a better place to ask). I also assume your application has all the required permissions to do it (examples are without any error checking).
Hard Way
First get all the threads of a given process then call the SuspendThread
function to stop each one (and ResumeThread
to resume). It works but some applications may crash or hung because a thread may be stopped in any point and the order of suspend/resume is unpredictable (for example this may cause a dead lock). For a single threaded application this may not be an issue.
void suspend(DWORD processId)
{
HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 threadEntry;
threadEntry.dwSize = sizeof(THREADENTRY32);
Thread32First(hThreadSnapshot, &threadEntry);
do
{
if (threadEntry.th32OwnerProcessID == processId)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE,
threadEntry.th32ThreadID);
SuspendThread(hThread);
CloseHandle(hThread);
}
} while (Thread32Next(hThreadSnapshot, &threadEntry));
CloseHandle(hThreadSnapshot);
}
Please note that this function is even too much naive, to resume threads you should skip threads that was suspended and it's easy to cause a dead-lock because of suspend/resume order. For single threaded applications it's prolix but it works.
Undocumented way
Starting from Windows XP there is the NtSuspendProcess
but it's undocumented. Read this post for a code example (reference for undocumented functions: news://comp.os.ms-windows.programmer.win32).
typedef LONG (NTAPI *NtSuspendProcess)(IN HANDLE ProcessHandle);
void suspend(DWORD processId)
{
HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId));
NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(
GetModuleHandle("ntdll"), "NtSuspendProcess");
pfnNtSuspendProcess(processHandle);
CloseHandle(processHandle);
}
"Debugger" Way
To suspend a program is what usually a debugger does, to do it you can use the DebugActiveProcess
function. It'll suspend the process execution (with all threads all together). To resume you may use DebugActiveProcessStop
.
This function lets you stop a process (given its Process ID), syntax is very simple: just pass the ID of the process you want to stop et-voila. If you'll make a command line application you'll need to keep its instance running to keep the process suspended (or it'll be terminated). See the Remarks section on MSDN for details.
void suspend(DWORD processId)
{
DebugActiveProcess(processId);
}
From Command Line
As I said Windows command line has not any utility to do that but you can invoke a Windows API function from PowerShell. First install Invoke-WindowsApi script then you can write this:
Invoke-WindowsApi "kernel32" ([bool]) "DebugActiveProcess" @([int]) @(process_id_here)
Of course if you need it often you can make an alias
for that.
Windows 挂起进程的更多相关文章
- windows核心编程---第六章 线程的调度
每个线程都有一个CONTEXT结构,保存在线程内核对象中.大约每隔20ms windows就会查看所有当前存在的线程内核对象.并在可调度的线程内核对象中选择一个,将其保存在CONTEXT结构的值载入c ...
- 正确处理Windows电源事件
简介为系统挂起与恢复而进行的应用准备步骤 曾几何时,当您正要通过应用提交或发布一些重要数据时,突然遇到一些急事需要处理,而且会耽误很长时间.当您完成任务回到电脑前时,发现电脑已经自动进入 了挂起状态, ...
- Windows用户模式下注入方式总结
注入技术在病毒木马.游戏.打补丁等编程中应用很广泛,学习该技术不仅能帮助理解Windows工作原理,还能对病毒木马技术手段有更加深刻的理解,下面我们了解下各种注入方式吧. 一.DLL注入 在注入技术中 ...
- windows cmd下如何暂停(挂起)运行中的进程
在Linux下做开发时,我们都熟知Ctrl+Z的指令,作用就是把当前运行的程序转到后台,暂停执行,等到合适的时候再使用fg指令把这个程序调出来再次执行.这功能也不常用,但有时候还挺必要. 那么wind ...
- 《windows核心编程系列 》六谈谈线程调度、优先级和关联性
线程调度.优先级和关联性 每个线程都有一个CONTEXT结构,保存在线程内核对象中.大约每隔20ms windows就会查看所有当前存在的线程内核对象.并在可调度的线程内核对象中选择一个,将其保存在C ...
- ring3 x32挂起进程注入原理.
目录 一丶挂起进程注入简介与前言 二丶ShellCode核心讲解. 2.1 保存Contex.EIP 2.2 DLL路径重定位 2.3 LoadLibrary的重定位 三丶 全部C++代码.拷贝即可使 ...
- windows内核代码之进程操作
[toc] 一丶简介 整理一下windows内核中.常用的代码.这里只整理下进程的相关代码. 二丶 windows内核之遍历进程 内核中记录进程的结构体是EPROCESS结构.所以只需要遍历这个结构即 ...
- Ring3挂起进程,跟恢复进程.
目录 Ring3挂起进程,跟恢复进程. 一丶简介 二丶代码 Ring3挂起进程,跟恢复进程. 一丶简介 有时候我们做对抗的时候可能会遇到.一个进程常常操作我们.但是我们 可以通过挂起进程来挂起它让它无 ...
- 线程操作与进程挂起(Windows核心编程)
0x01 线程挂起与切换 对于挂起进程,挂起线程则比较简单,利用 ResumeThread 与 SuspendThread 即可,当线挂起时线程用户状态下的一切操作都会暂停 #include < ...
随机推荐
- springboot + aop + Lua分布式限流的最佳实践
整理了一些Java方面的架构.面试资料(微服务.集群.分布式.中间件等),有需要的小伙伴可以关注公众号[程序员内点事],无套路自行领取 一.什么是限流?为什么要限流? 不知道大家有没有做过帝都的地铁, ...
- 3NF的无损连接和保持函数依赖的分解、BCNF的无损连接的分解
首先,需要了解3NF.BCNF范式的要求. 3NF:不存在非主属性对码的传递函数依赖或部分函数依赖. 如AB-C,A->C 码为(A,B),A,B是主属性,C是非主属性,C部分函数依赖于码,即 ...
- Linux系统:Centos7下搭建PostgreSQL关系型数据库
本文源码:GitHub·点这里 || GitEE·点这里 一.PostgreSQL简介 1.数据库简介 PostgreSQL是一个功能强大的开源数据库系统,具有可靠性.稳定性.数据一致性等特点,且可以 ...
- PHP中涉及文件路径的讨论
#1 $_SERVER中的PHP_SELF,当前执行脚本的文件名,与 document root 有关.例如,在地址为 http://example.com/test.php/foo.bar 的脚本中 ...
- "二号标题"组件:<h2> —— 快应用组件库H-UI
 <import name="h2" src="../Common/ui/h-ui/text/c_h2"></import> < ...
- template_homepage
homepage用到的方法 使用 {% for ... in ...%} 加 {% endfor %} 实现循环结构 举例: {% for post in posts %} <p style ...
- NumPy学习1:基本概念
NumPy的数组类被称作 ndarray .通常被称作数组.注意numpy.array和标准Python库类array.array并不相同,后者只处理一维数组和提供少量功能.更多重要ndarray对象 ...
- canal使用记录
canal是阿里巴巴的来源项目.我们可以通过配置binlog实现数据库监控,得到数据库表或者数据的更新信息.参考我的文档前先去官网看下,可能已经支持更高版本的MySQL了 1. 查看官方开源项目 ht ...
- Pytest系列(20)- allure结合pytest,allure.step()、allure.attach的详细使用
如果你还想从头学起Pytest,可以看看这个系列的文章哦! https://www.cnblogs.com/poloyy/category/1690628.html 前言 allure除了支持pyte ...
- Dijkstra学习总结
啥叫堆 可以看一下这个 https://www.cnblogs.com/xiugeng/p/9645972.html#_label0普通Dijkstra可以看一下 https://blog.csdn. ...