MFC任务管理器task manager----进程的挂起与恢复--NtSuspendProcess&&NtResumeProcess
http://hi.baidu.com/xbbsh/blog/item/b73d3125462201084c088db1.html
--------------------------------------------------
.h
pubilc:
typedef DWORD (WINAPI *NtSuspendProcess)(HANDLE ProcessHandle);
typedef DWORD (WINAPI *NtResumeProcess)(HANDLE hProcess);
NtSuspendProcess m_NtSuspendProcess;
NtResumeProcess m_NtResumeProcess;
.cpp:
void CPage2::OnBnClickedResume()
{
// TODO: 在此添加控件通知处理程序代码
int nIdx=m_list2.GetNextItem(-1,LVNI_SELECTED);
CString process=m_list2.GetItemText(nIdx,1);
DWORD processID= _ttol(process.GetBuffer(0));
HANDLE hProcess = OpenProcess( PROCESS_SUSPEND_RESUME ,//暂停时用这个（P.._S.._R..）标志
FALSE, (DWORD)processID );
if (hProcess)
{
HMODULE h_module=LoadLibrary(L"ntdll.dll");
m_NtResumeProcess=(NtResumeProcess)GetProcAddress(h_module,"NtResumeProcess");
m_NtResumeProcess(hProcess);
}
}
太晚了 睡觉睡觉。。。。。。。
--------------------------------------------------
.h
#pragma once
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>
#include <string>
#include <tchar.h>
//#include <ntifs.h>
#include <Psapi.h>
#pragma comment (lib,"Psapi.lib")
void ErrorExit(LPTSTR lpszFunction);
//--------------------------------------------------
// for cpu 暂停
//方法1 不可关闭本程序,否则进程会退出
long DbgUiConnectToDbg_ntdll();
//long (*DbgUiConnectToDbg)();//这样会报重复定义
long DbgUiDebugActiveProcess_ntdll(HANDLE ProcessHandle);//暂停
long DbgUiStopDebugging_ntdll(HANDLE ProcessHandle);//恢复
//方法2 可关闭本程序
DWORD NtSuspendProcess_ntdll(HANDLE hProcess);//暂停
DWORD NtResumeProcess_ntdll(HANDLE hProcess);//恢复
//要先调用这个
void LoadNtDllFun();
//--------------------------------------------------
class win_proc_public
{
public:
win_proc_public(void);
~win_proc_public(void);
public:
std::string GetExeFullName(HANDLE hProcess)
{
std::string r = "";
//HANDLE hProcess = 0;
char lpImageFileName[2049] = {0};
DWORD nSize = 2048;
//hProcess = getm
DWORD len = GetProcessImageFileName(hProcess, lpImageFileName, nSize);
if (len < 1)
{
//不能直接退出,因为有些权限是得不到的
//ErrorExit("GetExeFullName: ");
}
//len = GetModuleFileNameEx(hProcess, lpImageFileName, nSize);
r = lpImageFileName;
r = DosDevicePath2LogicalPath(r.c_str());
return r;
}//
//将 "\Device\HarddiskVolume2" 等转换为 "D:\"
//DosDevicePath2LogicalPath代码摘自：ms-help://MS.MSDNQTR.v80.chs/MS.MSDN.v80/MS.WIN32COM.v10.en/fileio/fs/obtaining_a_file_name_from_a_file_handle.htm
std::string DosDevicePath2LogicalPath(LPCTSTR lpszDosPath)
{
std::string strResult = "";
// Translate path with device name to drive letters.
TCHAR szTemp[MAX_PATH];
szTemp[0] = '\0';
if ( lpszDosPath==NULL || !GetLogicalDriveStrings(_countof(szTemp)-1, szTemp) )
{
return strResult;
}
TCHAR szName[MAX_PATH];
TCHAR szDrive[3] = TEXT(" :");
BOOL bFound = FALSE;
TCHAR* p = szTemp;
do{
// Copy the drive letter to the template string
*szDrive = *p;
// Look up each device name
if ( QueryDosDevice(szDrive, szName, _countof(szName)) )
{
UINT uNameLen = (UINT)_tcslen(szName);
if (uNameLen < MAX_PATH)
{
bFound = _tcsnicmp(lpszDosPath, szName, uNameLen) == 0;
if ( bFound )
{
// Reconstruct pszFilename using szTemp
// Replace device path with DOS path
TCHAR szTempFile[MAX_PATH];
_stprintf(szTempFile, TEXT("%s%s"), szDrive, lpszDosPath+uNameLen);
strResult = szTempFile;
}
}
}
// Go to the next NULL character.
while (*p++);
} while (!bFound && *p); // end of string
return strResult;
}//
void mainaaa()
{
GetProcessList( );
}
BOOL GetProcessList( )
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
DWORD dwPriorityClass;
hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if( hProcessSnap == INVALID_HANDLE_VALUE )
{
return( FALSE );
}
pe32.dwSize = sizeof( PROCESSENTRY32 );
if( !Process32First( hProcessSnap, &pe32 ) )
{
CloseHandle( hProcessSnap );
return( FALSE );
}
do
{
printf( "\n\n"
"=====================================================" );
printf( "\nPROCESS NAME: %5s", pe32.szExeFile);
printf( "\n"
"-----------------------------------------------------" );
dwPriorityClass = 0;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );
//hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pe32.th32ProcessID );
if( hProcess == NULL )
{
printf("erro");
}
else
{
dwPriorityClass = GetPriorityClass( hProcess );
if( !dwPriorityClass )
printf("erro");
//--------------------------------------------------
//clq add 程序全路径
//char szFilePath[256] = {0};
////HANDLE hProcess=OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,pe32.th32ProcessID);
//if ( GetProcessImageFileName(hProcess,szFilePath,MAX_PATH)!=0 )
//{
// //mystring strFilePath = CCommon::DosDevicePath2LogicalPath(szFilePath);
//}
std::string exename = GetExeFullName(hProcess);
printf( "\n path = %s", exename.c_str() );
//--------------------------------------------------
// CloseHandle( hProcess );
}
printf( "\n process ID = %d", pe32.th32ProcessID );
printf( "\n thread count = %d", pe32.cntThreads );
printf( "\n parent process ID = %d", pe32.th32ParentProcessID );
printf( "\n Priority Base = %d", pe32.pcPriClassBase );
if( dwPriorityClass )
printf( "\n Priority Class = %d", dwPriorityClass );
} while( Process32Next( hProcessSnap, &pe32 ) );
CloseHandle( hProcessSnap );
return( TRUE );
}//
public:
static void test1()
{
win_proc_public proc;
proc.mainaaa();
test2(4008);
}//
static void test2(DWORD pid)
{
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
//if (!GetProcessTimes(hProcess, &creation_time, &exit_time, &kernel_time, &user_time))
//{
// return -1;
//}
if (hProcess == NULL) return;
LoadNtDllFun();
//DbgUiConnectToDbg_ntdll();
//long r = DbgUiDebugActiveProcess_ntdll(hProcess);//暂停//调用后不能停止程序否则被停止的程序会被强制退出(相当于调试器停止?)
//::Sleep(5*60*1000);
//r = DbgUiStopDebugging_ntdll(hProcess);//恢复运行
NtSuspendProcess_ntdll(hProcess);//暂停
NtResumeProcess_ntdll(hProcess);//恢复
}//
};
--------------------------------------------------
.cpp
#include "win_proc_public.h"
win_proc_public::win_proc_public(void)
{
}
win_proc_public::~win_proc_public(void)
{
}
//--------------------------------------------------
// for cpu 暂停
//方法1
long (__stdcall *DbgUiConnectToDbg_p)();//在 .h 这样会报重复定义
long (__stdcall *DbgUiDebugActiveProcess_p)(HANDLE ProcessHandle);//暂停
long (__stdcall *DbgUiStopDebugging_p)(HANDLE ProcessHandle);//恢复
//方法2
//NtResumeProcess
DWORD (WINAPI *NtResumeProcess_p)(HANDLE hProcess);//暂停
DWORD (WINAPI *NtSuspendProcess_p)(HANDLE hProcess);//恢复
void LoadNtDllFun()
{
HMODULE dllhandle;
//dwret:dword;
//ProcessHandle: dword;
//begin
dllhandle = LoadLibrary("ntdll.dll");
if (dllhandle != 0 )
{
DbgUiConnectToDbg_p = (long (__stdcall *)()) GetProcAddress(dllhandle, "DbgUiConnectToDbg");
DbgUiDebugActiveProcess_p = (long (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "DbgUiDebugActiveProcess");
DbgUiStopDebugging_p = (long (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "DbgUiStopDebugging");
//MyDbgUiConnectToDbg;
//ProcessHandle:=OpenProcess(process_all_access, False, findprocess("winlogon.exe"));
////messagebox(0,pchar(inttohex(ProcessHandle,8)),"aa",0);
//dwret:=MyDbgUiDebugActiveProcess(ProcessHandle);
//if dwret<>0 then messagebox(0,pchar("保护失败"),"提示",0) else
//messagebox(0,pchar("保护成功，来结束我吧！"),"提示",0)
NtResumeProcess_p = (DWORD (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "NtResumeProcess");
NtSuspendProcess_p = (DWORD (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "NtSuspendProcess");
}
//CloseHandle(dllhandle);
}//
long DbgUiConnectToDbg_ntdll()
{
return DbgUiConnectToDbg_p();
}//
long DbgUiDebugActiveProcess_ntdll(HANDLE ProcessHandle)
{
return DbgUiDebugActiveProcess_p(ProcessHandle);
}//
long DbgUiStopDebugging_ntdll(HANDLE ProcessHandle)
{
return DbgUiStopDebugging_p(ProcessHandle);
}//
DWORD NtResumeProcess_ntdll(HANDLE hProcess)//暂停
{
return NtResumeProcess_p(hProcess);
}
DWORD NtSuspendProcess_ntdll(HANDLE hProcess)//恢复
{
return NtSuspendProcess_p(hProcess);
}
/*
这个据说也成
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID );
if (hProcess)
{
HINSTANCE h_module = LoadLibrary(“ntdll.dll”);
NtProcess mProcess = (NtProcess)GetProcAddress(h_module, “NtResumeProcess”); //NtResumeProcess NtSuspendProcess
mProcess(hProcess);
}
其中processID为进程PID号码
休眠还是恢复，随你选择
*/
http://www.cnblogs.com/-clq/archive/2012/03/15/2397533.html
