挂起进程

main.cpp

#include <iostream>
#include <stdio.h>
#include <Windows.h>
#include <TlHelp32.h>

void suspend(DWORD processId)
{
    HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);

    THREADENTRY32 threadEntry;
    threadEntry.dwSize = sizeof(THREADENTRY32);

    Thread32First(hThreadSnapshot, &threadEntry);

    do
    {
        if (threadEntry.th32OwnerProcessID == processId)
        {
            HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE,
                threadEntry.th32ThreadID);

            SuspendThread(hThread);
            CloseHandle(hThread);
        }
    } while (Thread32Next(hThreadSnapshot, &threadEntry));

    CloseHandle(hThreadSnapshot);
}

int main(int argc, char* argv[])
{
    if (argc != 2) 
    {
        std::cout << "argc != 2 \n";
        std::cout << "Usage: SuspendProcess 1222 \n";
        return -1;
    }
    int pid;
    sscanf_s(argv[1], "%d", &pid);
    suspend(pid);
    return 0;
}