[Flags]
    public enum ThreadAccess : int
    {
      TERMINATE = (0×0001),
      SUSPEND_RESUME = (0×0002),
      GET_CONTEXT = (0×0008),
      SET_CONTEXT = (0×0010),
      SET_INFORMATION = (0×0020),
      QUERY_INFORMATION = (0×0040),
      SET_THREAD_TOKEN = (0×0080),
      IMPERSONATE = (0×0100),
      DIRECT_IMPERSONATION = (0×0200)
    }


    [DllImport("kernel32.dll")]
    static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);
    [DllImport("kernel32.dll")]
    static extern uint SuspendThread(IntPtr hThread);
    [DllImport("kernel32.dll")]
    static extern int ResumeThread(IntPtr hThread);


 


    private void SuspendProcess(int PID)
    {
      Process proc = Process.GetProcessById(PID);


      if (proc.ProcessName == string.Empty)
        return;


      foreach (ProcessThread pT in proc.Threads)
      {
        IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);


        if (pOpenThread == IntPtr.Zero)
        {
          break;
        }


        SuspendThread(pOpenThread);
      }
    }


    public void ResumeProcess(int PID)
    {
      Process proc = Process.GetProcessById(PID);


      if (proc.ProcessName == string.Empty)
        return;


      foreach (ProcessThread pT in proc.Threads)
      {
        IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);


        if (pOpenThread == IntPtr.Zero)
        {
          break;
        }


        ResumeThread(pOpenThread);
      }
    }

历史博文

标签:, ,
十月 22, 2009 at 2:40 上午 by yippee 12 次
Category: Info
Tags: , ,