Created
October 8, 2017 16:31
-
-
Save AxDSan/8bd82b34dffb803f78bae08c86ddf977 to your computer and use it in GitHub Desktop.
Suspend Processes
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#include <windows.h> | |
#include <iostream> | |
#include <WinBase.h> | |
#include <TlHelp32.h> | |
#include <tchar.h> | |
#include <cstring> | |
#include <string> | |
bool Suspended = false; | |
bool Found = false; | |
BOOL SuspendProcess(DWORD ProcessId, bool Suspend); | |
DWORD FindProcessId(const std::wstring& processName); | |
void SuspendDelay(); | |
DWORD ProcPID; | |
//SuspendThread(GetCurrentThreadId(), true); //suspend thread | |
//SuspendThread(GetCurrentThreadId(), false); //resume thread | |
using namespace std; | |
int main(int argc, char* argv[]) | |
{ | |
string ProcName; | |
cout << "Please Input your process name: "; | |
cin >> ProcName; | |
for (;;) | |
{ | |
std::wstring wStrProcName; | |
wStrProcName.assign(ProcName.begin(), ProcName.end()); | |
ProcPID = FindProcessId(wStrProcName); | |
system("color 0c"); | |
cout << "[!] Waiting..." << endl; | |
system("cls"); | |
if (ProcPID == 0) | |
{ | |
//Keep Looking... | |
}else{ | |
cout << "[+] Process Found: " << ProcPID << endl; | |
break; | |
} | |
} | |
//SuspendDelay(); | |
cout << "[+] Suspending Process..." << endl; | |
SuspendProcess(ProcPID, 1); | |
cout << "[+] Process Should now be suspended!" << endl; | |
cout << "[+] Proceed with Debugging" << endl; | |
system("PAUSE"); | |
return 0; | |
} | |
BOOL SuspendProcess(DWORD ProcessId, bool Suspend) | |
{ | |
HANDLE snHandle = NULL; | |
BOOL rvBool = FALSE; | |
THREADENTRY32 te32 = { 0 }; | |
snHandle = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); | |
if (snHandle == INVALID_HANDLE_VALUE) return (FALSE); | |
te32.dwSize = sizeof(THREADENTRY32); | |
if (Thread32First(snHandle, &te32)) | |
{ | |
do | |
{ | |
if (te32.th32OwnerProcessID == ProcessId) | |
{ | |
HANDLE hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te32.th32ThreadID); | |
if (Suspend == false) | |
{ | |
if (Suspended)ResumeThread(hThread); | |
} | |
else | |
{ | |
SuspendThread(hThread); | |
Suspended = true; | |
} | |
CloseHandle(hThread); | |
} | |
} while (Thread32Next(snHandle, &te32)); | |
rvBool = TRUE; | |
} | |
else | |
rvBool = FALSE; | |
CloseHandle(snHandle); | |
return (rvBool); | |
} | |
DWORD FindProcessId(const std::wstring& processName) | |
{ | |
PROCESSENTRY32 processInfo; | |
processInfo.dwSize = sizeof(processInfo); | |
HANDLE processesSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); | |
if (processesSnapshot == INVALID_HANDLE_VALUE) | |
return 0; | |
Process32First(processesSnapshot, &processInfo); | |
if (!processName.compare(processInfo.szExeFile)) | |
{ | |
CloseHandle(processesSnapshot); | |
return processInfo.th32ProcessID; | |
} | |
while (Process32Next(processesSnapshot, &processInfo)) | |
{ | |
if (!processName.compare(processInfo.szExeFile)) | |
{ | |
CloseHandle(processesSnapshot); | |
return processInfo.th32ProcessID; | |
} | |
} | |
CloseHandle(processesSnapshot); | |
return 0; | |
} | |
void SuspendDelay() | |
{ | |
cout << "[+] Adding a 3 Second Delay..." << endl; | |
Sleep(3000); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment