Suspend Process in C#

Question

How do I suspend a whole process (like the Process Explorer does when I click Suspend) in C#.

I'm starting the Process with Process.Start, and on a certain event, I want to suspend the process to be able to do some investigation on a "snapshot" of it.

Answer 1

A detailed solution using Win32 p/invoke, can be found on CodeProject.

Answer 2

See this CodeProject article for the win32 basics : http://www.codeproject.com/KB/threads/pausep.aspx. This sample code makes use of the ToolHelp32 library from the SDK, so I would recommend turning this sample code into an unmanaged C++/CLI library with a simple interface like "SuspendProcess(uint processID).

Process.Start will return you a Process object, from which you can get the process id, and then pass this to your new library based on the above.

Dave

Answer 3

Here's my suggestion:

 [Flags]
    public enum ThreadAccess : int
    {
      TERMINATE = (0x0001),
      SUSPEND_RESUME = (0x0002),
      GET_CONTEXT = (0x0008),
      SET_CONTEXT = (0x0010),
      SET_INFORMATION = (0x0020),
      QUERY_INFORMATION = (0x0040),
      SET_THREAD_TOKEN = (0x0080),
      IMPERSONATE = (0x0100),
      DIRECT_IMPERSONATION = (0x0200)
    }

    [DllImport("kernel32.dll")]
    static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);
    [DllImport("kernel32.dll")]
    static extern uint SuspendThread(IntPtr hThread);
    [DllImport("kernel32.dll")]
    static extern int ResumeThread(IntPtr hThread);



    private void SuspendProcess(int PID)
    {
      Process proc = Process.GetProcessById(PID);

      if (proc.ProcessName == string.Empty)
        return;

      foreach (ProcessThread pT in proc.Threads)
      {
        IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);

        if (pOpenThread == IntPtr.Zero)
        {
          break;
        }

        SuspendThread(pOpenThread);
      }
    }

    public void ResumeProcess(int PID)
    {
      Process proc = Process.GetProcessById(PID);

      if (proc.ProcessName == string.Empty)
        return;

      foreach (ProcessThread pT in proc.Threads)
      {
        IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);

        if (pOpenThread == IntPtr.Zero)
        {
          break;
        }

        ResumeThread(pOpenThread);
      }
    }

Answer 4

So really, what the other answer's are showing is suspending thread's in the process, there is no way to really suspend the process (i.e. in one call)....

A bit of a different solution would be to actually debug the target process which you are starting, see Mike Stall's blog for some advice how to implement this from a managed context.

If you implement a debugger, you will be able to scan memory or what other snap-shotting you would like.

However, I would like to point out, that technically, there is now way to really do this. Even if you do debugbreak a target debuggee process, another process on your system may inject a thread and will be given some ability to execute code regardless of the state of the target process (even let's say if it's hit a breakpoint due to an access violation), if you have all thread's suspended up to a super high suspend count, are currently at a break point in the main process thread and any other such presumed-frozen status, it is still possible for the system to inject another thread into that process and execute some instructions. You could also go through the trouble of modifying or replacing all of the entry point's the kernel usually calls and so on, but you've now entered the viscous arm's race of MALWARE ;)...

In any case, using the managed interfaces for debugging seems' a fair amount easier than p/invoke'ng a lot of native API call's which will do a poor job of emulating what you probably really want to be doing... using debug api's ;)