进程的挂起代码,C代码库,德仔网

代码语言
代码分类
【C】进程的挂起
作者:dezai / 发布于2014/1/23/ 513
*++
Module Name:
NtSuspendProcess.cpp
Abstract:
This utility [Suspend|Resume] processes.
Author:
Michael Wookey 6-Jun-2003 ([email]ntutils@wookey.org[/email])
Notes:
NtSuspendProcess.exe [Suspend|Resume] pid
Compiler:
VC7
Build:
cl NtSuspendProcess.cpp
// Add Unicode Suppert, [2/23/2010 dnybz([email]cnfreebsd@163.com[/email])]
--*/
#define STRICT
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdlib.h>
#include <stdio.h>
#include <tchar.h>
//
// The native functions exported from ntdll.
//
typedef LONG ( NTAPI *_NtSuspendProcess )( IN HANDLE ProcessHandle );
typedef LONG ( NTAPI *_NtResumeProcess )( IN HANDLE ProcessHandle );
bool EnableDebugPrivilege() 
{ 
HANDLE hToken; 
LUID sedebugnameValue; 
TOKEN_PRIVILEGES tkp; 
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{ 
 return  FALSE; 
} 
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
{ 
 CloseHandle(hToken); 
 return false; 
} 
tkp.PrivilegeCount = 1; 
tkp.Privileges[0].Luid = sedebugnameValue; 
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
{ 
 CloseHandle(hToken); 
 return false; 
} 
return true; 
}
int _tmain( int argc, _TCHAR* argv[] )
{
HANDLE ProcessHandle = 0;
_NtSuspendProcess NtSuspendProcess = 0;
_NtResumeProcess NtResumeProcess = 0;
//
// Make sure we have enough arguments.
//
if( 3 > argc )
{
 printf( "usage [Suspend|Resume] pid\n" );
 return 0;
}
//
// Obtain our function imports.
//
NtSuspendProcess = (_NtSuspendProcess)
 GetProcAddress( GetModuleHandle( _T("ntdll") ), "NtSuspendProcess" );
NtResumeProcess = (_NtResumeProcess)
 GetProcAddress( GetModuleHandle( _T("ntdll") ), "NtResumeProcess" );
//
// Attempt to open the target process.
//
EnableDebugPrivilege();
ProcessHandle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, _tstoi( argv[2] ));
//
// Suspend or Resume the process. Note that these alter the process'
// suspend count, so freezing the process twice will require thawing
// the process twice to restore.
//
if( ! ProcessHandle )
{
 printf( "Unable to open process id %d\n", _tstoi( argv[2] ));
}
else
{
 if( ! lstrcmpi( argv[1], _T("Suspend") ))
 {
  if( NtSuspendProcess )
  {
  NtSuspendProcess( ProcessHandle );
  }
 }
 else if( ! lstrcmpi( argv[1], _T("Resume") ))
 {
  if( NtResumeProcess )
  {
  NtResumeProcess( ProcessHandle );
  }
 }
 else
 {
  printf( "usage [Suspend|Resume] pid\n" );
 }
}
//
// Close our process handle.
//
if( ProcessHandle )
{
 CloseHandle( ProcessHandle );
}
return 0;
}
/* EOF */
试试其它关键字
　进程挂起　
同语言下
可能有用的
dezai贡献的其它代码(1065)