Question

我正在使用此代码暂停process.i在此处找到http://www.codeproject.com/KB/threads/pausep.aspx

BOOL SuspendResumeThreadList(DWORD dwOwnerPID, bool bResumeThread) 
{ 
    HANDLE        hThreadSnap = NULL; 
    BOOL          bRet        = FALSE; 
    THREADENTRY32 te32        = {0}; 

    hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); 
    if (hThreadSnap == INVALID_HANDLE_VALUE) 
        return (FALSE); 

    te32.dwSize = sizeof(THREADENTRY32); 

    if (Thread32First(hThreadSnap, &te32)) 
    { 
        do 
        { 
            if (te32.th32OwnerProcessID == dwOwnerPID) 
            {
                HANDLE hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te32.th32ThreadID);
                if (bResumeThread)
                {
                    //cout << _T("Resuming Thread 0x") << cout.setf( ios_base::hex ) << te32.th32ThreadID << '\n';
                    ResumeThread(hThread);
                }
                else
                {
                    //cout << _T("Suspending Thread 0x") << cout.setf( ios_base::hex ) << te32.th32ThreadID << '\n';
                    SuspendThread(hThread);
                }
                CloseHandle(hThread);
            } 
        }
        while (Thread32Next(hThreadSnap, &te32)); 
        bRet = TRUE; 
    } 
    else 
        bRet = FALSE;   
    CloseHandle (hThreadSnap); 
    return (bRet); 
}

现在我想要一种方法来查找进程是否暂停？请帮帮我。

Answer 1

如果我没记错，您可以使用NtQuerySystemInformation来达到此目的。使用NtQuerySystemInformation，您可以通过迭代SYSTEM_PROCESS_INFORMATION数组并查找目标进程的PID来获得SYSTEM_PROCESS_INFORMATION结构。您可以在Wine来源here中找到SYSTEM_PROCESS_INFORMATION的详细说明。获得流程信息结构后，只需查看SYSTEM_THREAD_INFORMATION，您可以在其中检查线程的状态。有关结构和枚举的更多详细信息，请查看Wine源。

如何查找进程是否被暂停？

1 个答案: