Kaynak Kodu C Suspend/resume a process using Windows Kernel driver (PsSuspendProcess)

Osderda · 21 Haz 2023

Kernel process suspend, kernel process resume,SuspendProcess,ResumeProcess

Windows Kernel sürücüsü kullanarak bir süreci askıya alma/uyandırma.
-
Suspend/resume a process using the Windows Kernel driver.

API:

extern "C" NTSTATUS PsResumeProcess(_In_ PEPROCESS Process);

extern "C" NTSTATUS PsSuspendProcess(_In_ PEPROCESS Process);

Example Using:

SUSPEND:

NTSTATUS status;
PEPROCESS process;

status = PsLookupProcessByProcessId((HANDLE)sex->process_id, &process);
if (!NT_SUCCESS(status))
{
    return status;
}

status = PsSuspendProcess(process);
ObDereferenceObject(process);

--

RESUME:

NTSTATUS status;
PEPROCESS process;

status = PsLookupProcessByProcessId((HANDLE)sex->process_id, &process);
if (!NT_SUCCESS(status))
{
    return status;
}

status = PsResumeProcess(process);
ObDereferenceObject(process);