MFC任务管理器task manager----进程的挂起与恢复--NtSuspendProcess&&NtResumeProcess

http://hi.baidu.com/xbbsh/blog/item/b73d3125462201084c088db1.html

--------------------------------------------------

MFC任务管理器task manager----进程的挂起与恢复--NtSuspendProcess&&NtResumeProcess
2009-08-11 1:13

.h

pubilc:

typedef DWORD (WINAPI *NtSuspendProcess)(HANDLE ProcessHandle);
typedef DWORD (WINAPI *NtResumeProcess)(HANDLE hProcess);

NtSuspendProcess m_NtSuspendProcess;
NtResumeProcess m_NtResumeProcess;

.cpp:

void CPage2::OnBnClickedResume()
{
// TODO: 在此添加控件通知处理程序代码
int nIdx=m_list2.GetNextItem(-1,LVNI_SELECTED);
CString process=m_list2.GetItemText(nIdx,1);

DWORD processID= _ttol(process.GetBuffer(0));

HANDLE hProcess = OpenProcess( PROCESS_SUSPEND_RESUME ,//暂停时用这个（P.._S.._R..）标志
FALSE, (DWORD)processID );
if (hProcess)
{
HMODULE h_module=LoadLibrary(L"ntdll.dll");
m_NtResumeProcess=(NtResumeProcess)GetProcAddress(h_module,"NtResumeProcess");
m_NtResumeProcess(hProcess);
}
}

太晚了 睡觉睡觉。。。。。。。

--------------------------------------------------

.h

#pragma once

#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

#include <string>
#include <tchar.h>

//#include <ntifs.h>
#include <Psapi.h>
#pragma comment (lib,"Psapi.lib")

void ErrorExit(LPTSTR lpszFunction);

//--------------------------------------------------
// for cpu 暂停

//方法1 不可关闭本程序,否则进程会退出
long DbgUiConnectToDbg_ntdll();

//long (*DbgUiConnectToDbg)();//这样会报重复定义
long DbgUiDebugActiveProcess_ntdll(HANDLE ProcessHandle);//暂停
long DbgUiStopDebugging_ntdll(HANDLE ProcessHandle);//恢复

//方法2 可关闭本程序
DWORD NtSuspendProcess_ntdll(HANDLE hProcess);//暂停
DWORD NtResumeProcess_ntdll(HANDLE hProcess);//恢复

//要先调用这个
void LoadNtDllFun();

//--------------------------------------------------

class win_proc_public
{
public:
win_proc_public(void);
~win_proc_public(void);
public:

std::string GetExeFullName(HANDLE hProcess)
{
std::string r = "";

//HANDLE hProcess = 0;
char lpImageFileName[2049] = {0};
DWORD nSize = 2048;

//hProcess = getm
DWORD len = GetProcessImageFileName(hProcess, lpImageFileName, nSize);

if (len < 1)
{
//不能直接退出,因为有些权限是得不到的
//ErrorExit("GetExeFullName: ");
}

//len = GetModuleFileNameEx(hProcess, lpImageFileName, nSize);

r = lpImageFileName;
r = DosDevicePath2LogicalPath(r.c_str());

return r;
}//

//将 "\Device\HarddiskVolume2" 等转换为 "D:\"
//DosDevicePath2LogicalPath代码摘自：ms-help://MS.MSDNQTR.v80.chs/MS.MSDN.v80/MS.WIN32COM.v10.en/fileio/fs/obtaining_a_file_name_from_a_file_handle.htm
std::string DosDevicePath2LogicalPath(LPCTSTR lpszDosPath)
{
std::string strResult = "";

// Translate path with device name to drive letters.
TCHAR szTemp[MAX_PATH];
szTemp[0] = '\0';

if ( lpszDosPath==NULL || !GetLogicalDriveStrings(_countof(szTemp)-1, szTemp) )
{
return strResult;
}

TCHAR szName[MAX_PATH];
TCHAR szDrive[3] = TEXT(" :");
BOOL bFound = FALSE;
TCHAR* p = szTemp;

do{
// Copy the drive letter to the template string
*szDrive = *p;

// Look up each device name
if ( QueryDosDevice(szDrive, szName, _countof(szName)) )
{
UINT uNameLen = (UINT)_tcslen(szName);

if (uNameLen < MAX_PATH)
{
bFound = _tcsnicmp(lpszDosPath, szName, uNameLen) == 0;

if ( bFound )
{
// Reconstruct pszFilename using szTemp
// Replace device path with DOS path
TCHAR szTempFile[MAX_PATH];
_stprintf(szTempFile, TEXT("%s%s"), szDrive, lpszDosPath+uNameLen);
strResult = szTempFile;
}
}
}
// Go to the next NULL character.
while (*p++);
} while (!bFound && *p); // end of string

return strResult;
}//

void mainaaa()
{
GetProcessList( );
}

BOOL GetProcessList( )
{
HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;
DWORD dwPriorityClass;

hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if( hProcessSnap == INVALID_HANDLE_VALUE )
{
return( FALSE );
}

pe32.dwSize = sizeof( PROCESSENTRY32 );

if( !Process32First( hProcessSnap, &pe32 ) )
{
CloseHandle( hProcessSnap );
return( FALSE );
}

do
{
printf( "\n\n"
"=====================================================" );
printf( "\nPROCESS NAME: %5s", pe32.szExeFile);
printf( "\n"
"-----------------------------------------------------" );

dwPriorityClass = 0;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID );
//hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, pe32.th32ProcessID );
if( hProcess == NULL )
{
printf("erro");
}
else
{
dwPriorityClass = GetPriorityClass( hProcess );
if( !dwPriorityClass )
printf("erro");

//--------------------------------------------------
//clq add 程序全路径

//char szFilePath[256] = {0};
////HANDLE hProcess=OpenProcess(PROCESS_QUERY_INFORMATION,FALSE,pe32.th32ProcessID);
//if ( GetProcessImageFileName(hProcess,szFilePath,MAX_PATH)!=0 )
//{
// //mystring strFilePath = CCommon::DosDevicePath2LogicalPath(szFilePath);
//}

std::string exename = GetExeFullName(hProcess);
printf( "\n path = %s", exename.c_str() );
//--------------------------------------------------

// CloseHandle( hProcess );
}

printf( "\n process ID = %d", pe32.th32ProcessID );
printf( "\n thread count = %d", pe32.cntThreads );
printf( "\n parent process ID = %d", pe32.th32ParentProcessID );
printf( "\n Priority Base = %d", pe32.pcPriClassBase );
if( dwPriorityClass )
printf( "\n Priority Class = %d", dwPriorityClass );

} while( Process32Next( hProcessSnap, &pe32 ) );

CloseHandle( hProcessSnap );
return( TRUE );

}//

public:
static void test1()
{
win_proc_public proc;
proc.mainaaa();

test2(4008);
}//

static void test2(DWORD pid)
{

HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
//if (!GetProcessTimes(hProcess, &creation_time, &exit_time, &kernel_time, &user_time))
//{
// return -1;
//}

if (hProcess == NULL) return;

LoadNtDllFun();
//DbgUiConnectToDbg_ntdll();
//long r = DbgUiDebugActiveProcess_ntdll(hProcess);//暂停//调用后不能停止程序否则被停止的程序会被强制退出(相当于调试器停止?)

//::Sleep(5*60*1000);

//r = DbgUiStopDebugging_ntdll(hProcess);//恢复运行

NtSuspendProcess_ntdll(hProcess);//暂停
NtResumeProcess_ntdll(hProcess);//恢复

}//
};
--------------------------------------------------

.cpp

#include "win_proc_public.h"

win_proc_public::win_proc_public(void)
{
}

win_proc_public::~win_proc_public(void)
{
}

//--------------------------------------------------
// for cpu 暂停

//方法1
long (__stdcall *DbgUiConnectToDbg_p)();//在 .h 这样会报重复定义
long (__stdcall *DbgUiDebugActiveProcess_p)(HANDLE ProcessHandle);//暂停
long (__stdcall *DbgUiStopDebugging_p)(HANDLE ProcessHandle);//恢复
//方法2
//NtResumeProcess
DWORD (WINAPI *NtResumeProcess_p)(HANDLE hProcess);//暂停
DWORD (WINAPI *NtSuspendProcess_p)(HANDLE hProcess);//恢复

void LoadNtDllFun()
{
HMODULE dllhandle;
//dwret:dword;
//ProcessHandle: dword;
//begin
dllhandle = LoadLibrary("ntdll.dll");
if (dllhandle != 0 )
{
DbgUiConnectToDbg_p = (long (__stdcall *)()) GetProcAddress(dllhandle, "DbgUiConnectToDbg");
DbgUiDebugActiveProcess_p = (long (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "DbgUiDebugActiveProcess");
DbgUiStopDebugging_p = (long (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "DbgUiStopDebugging");

//MyDbgUiConnectToDbg;
//ProcessHandle:=OpenProcess(process_all_access, False, findprocess("winlogon.exe"));
////messagebox(0,pchar(inttohex(ProcessHandle,8)),"aa",0);
//dwret:=MyDbgUiDebugActiveProcess(ProcessHandle);
//if dwret<>0 then messagebox(0,pchar("保护失败"),"提示",0) else
//messagebox(0,pchar("保护成功，来结束我吧！"),"提示",0)

NtResumeProcess_p = (DWORD (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "NtResumeProcess");
NtSuspendProcess_p = (DWORD (__stdcall *)(HANDLE))GetProcAddress(dllhandle, "NtSuspendProcess");

}

//CloseHandle(dllhandle);
}//

long DbgUiConnectToDbg_ntdll()
{
return DbgUiConnectToDbg_p();
}//

long DbgUiDebugActiveProcess_ntdll(HANDLE ProcessHandle)
{
return DbgUiDebugActiveProcess_p(ProcessHandle);
}//

long DbgUiStopDebugging_ntdll(HANDLE ProcessHandle)
{
return DbgUiStopDebugging_p(ProcessHandle);
}//

DWORD NtResumeProcess_ntdll(HANDLE hProcess)//暂停
{
return NtResumeProcess_p(hProcess);
}

DWORD NtSuspendProcess_ntdll(HANDLE hProcess)//恢复
{
return NtSuspendProcess_p(hProcess);
}

/*
这个据说也成
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID );
if (hProcess)
{
HINSTANCE h_module = LoadLibrary(“ntdll.dll”);
NtProcess mProcess = (NtProcess)GetProcAddress(h_module, “NtResumeProcess”); //NtResumeProcess NtSuspendProcess
mProcess(hProcess);
}
其中processID为进程PID号码
休眠还是恢复，随你选择
*/
http://www.cnblogs.com/-clq/archive/2012/03/15/2397533.html