C＃中的挂起过程

  • Z时代
  • 2024-01-10
  • 分类：问答

如何在C＃中挂起整个流程（就像单击“挂起”时的Process Explorer一样）。

我正在使用Process.Start启动Process，并且在某个事件中，我想暂停该进程以便能够对其进行“快照”进行一些调查。

回答：

这是我的建议：

 [Flags]
    public enum ThreadAccess : int
    {
      TERMINATE = (0x0001),
      SUSPEND_RESUME = (0x0002),
      GET_CONTEXT = (0x0008),
      SET_CONTEXT = (0x0010),
      SET_INFORMATION = (0x0020),
      QUERY_INFORMATION = (0x0040),
      SET_THREAD_TOKEN = (0x0080),
      IMPERSONATE = (0x0100),
      DIRECT_IMPERSONATION = (0x0200)
    }
    [DllImport("kernel32.dll")]
    static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);
    [DllImport("kernel32.dll")]
    static extern uint SuspendThread(IntPtr hThread);
    [DllImport("kernel32.dll")]
    static extern int ResumeThread(IntPtr hThread);
    [DllImport("kernel32", CharSet = CharSet.Auto,SetLastError = true)]
    static extern bool CloseHandle(IntPtr handle);
private static void SuspendProcess(int pid)
{
  var process = Process.GetProcessById(pid); // throws exception if process does not exist
  foreach (ProcessThread pT in process.Threads)
  {
    IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);
    if (pOpenThread == IntPtr.Zero)
    {
      continue;
    }
    SuspendThread(pOpenThread);
    CloseHandle(pOpenThread);
  }
}
public static void ResumeProcess(int pid)
{
  var process = Process.GetProcessById(pid);
  if (process.ProcessName == string.Empty)
    return;
  foreach (ProcessThread pT in process.Threads)
  {
    IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);
    if (pOpenThread == IntPtr.Zero)
    {
      continue;
    }
    var suspendCount = 0;
    do
    {
      suspendCount = ResumeThread(pOpenThread);
    } while (suspendCount > 0);
    CloseHandle(pOpenThread);
  }
}

以上是 C＃中的挂起过程 的全部内容， 来源链接： utcz.com/qa/399061.html

回到顶部