StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>You can try to use the following code. It uses the undocumented functions <code>NtSuspendProcess</code> and <code>NtResumeProcess</code>. I've tried it on Windows 7 64-bit from the 32-bit application built in Delphi 2009 and it works for me. Note that these functions are undocumented thus can be removed from future versions of Windows.</p> <p><em><strong>Update</em></strong></p> <p>The <code>SuspendProcess</code> and <code>ResumeProcess</code> wrappers from the following code are now functions and returns True if succeed, False otherwise.</p> <pre><code>type NTSTATUS = LongInt; TProcFunction = function(ProcHandle: THandle): NTSTATUS; stdcall; const STATUS_SUCCESS = $00000000; PROCESS_SUSPEND_RESUME = $0800; function SuspendProcess(const PID: DWORD): Boolean; var LibHandle: THandle; ProcHandle: THandle; NtSuspendProcess: TProcFunction; begin Result := False; LibHandle := SafeLoadLibrary('ntdll.dll'); if LibHandle <> 0 then try @NtSuspendProcess := GetProcAddress(LibHandle, 'NtSuspendProcess'); if @NtSuspendProcess <> nil then begin ProcHandle := OpenProcess(PROCESS_SUSPEND_RESUME, False, PID); if ProcHandle <> 0 then try Result := NtSuspendProcess(ProcHandle) = STATUS_SUCCESS; finally CloseHandle(ProcHandle); end; end; finally FreeLibrary(LibHandle); end; end; function ResumeProcess(const PID: DWORD): Boolean; var LibHandle: THandle; ProcHandle: THandle; NtResumeProcess: TProcFunction; begin Result := False; LibHandle := SafeLoadLibrary('ntdll.dll'); if LibHandle <> 0 then try @NtResumeProcess := GetProcAddress(LibHandle, 'NtResumeProcess'); if @NtResumeProcess <> nil then begin ProcHandle := OpenProcess(PROCESS_SUSPEND_RESUME, False, PID); if ProcHandle <> 0 then try Result := NtResumeProcess(ProcHandle) = STATUS_SUCCESS; finally CloseHandle(ProcHandle); end; end; finally FreeLibrary(LibHandle); end; end; </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload