Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to suspend/resume a process in Windows?

In Unix we can suspend a process execution temporarily and resume it with signals SIGSTOP and SIGCONT. How can I suspend a single-threaded process in Windows without programming ?

like image 445
Michael Avatar asked Jun 13 '12 07:06

Michael


People also ask

How do you pause a resume process?

All you have to do is find the PID (Process ID) and using ps or ps aux command, and then pause it, finally resume it using kill command.

How do I pause an EXE file?

Execution of a batch script can also be paused by pressing CTRL-S (or the Pause|Break key) on the keyboard, this also works for pausing a single command such as a long DIR /s listing.

How do I pause a process monitor?

Start the process monitor capture by clicking the icon of the magnifying glass. Perform your one last mouse click to reproduce the problem, wait for the problem to be fully reproduced, and then quickly. . . Click the icon of the magnifying glass again to stop the Procmon capture.


1 Answers

You can't do it from the command line, you have to write some code (I assume you're not just looking for an utility otherwise Super User may be a better place to ask). I also assume your application has all the required permissions to do it (examples are without any error checking).

Hard Way

First get all the threads of a given process then call the SuspendThread function to stop each one (and ResumeThread to resume). It works but some applications may crash or hung because a thread may be stopped in any point and the order of suspend/resume is unpredictable (for example this may cause a dead lock). For a single threaded application this may not be an issue.

void suspend(DWORD processId) {     HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);      THREADENTRY32 threadEntry;      threadEntry.dwSize = sizeof(THREADENTRY32);      Thread32First(hThreadSnapshot, &threadEntry);      do     {         if (threadEntry.th32OwnerProcessID == processId)         {             HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE,                 threadEntry.th32ThreadID);                          SuspendThread(hThread);             CloseHandle(hThread);         }     } while (Thread32Next(hThreadSnapshot, &threadEntry));      CloseHandle(hThreadSnapshot); } 

Please note that this function is even too much naive, to resume threads you should skip threads that was suspended and it's easy to cause a dead-lock because of suspend/resume order. For single threaded applications it's prolix but it works.

Undocumented way

Starting from Windows XP there is the NtSuspendProcess but it's undocumented. Read this post for a code example (reference for undocumented functions: news://comp.os.ms-windows.programmer.win32).

typedef LONG (NTAPI *NtSuspendProcess)(IN HANDLE ProcessHandle);  void suspend(DWORD processId) {     HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId));      NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(         GetModuleHandle("ntdll"), "NtSuspendProcess");      pfnNtSuspendProcess(processHandle);     CloseHandle(processHandle); } 

"Debugger" Way

To suspend a program is what usually a debugger does, to do it you can use the DebugActiveProcess function. It'll suspend the process execution (with all threads all together). To resume you may use DebugActiveProcessStop.

This function lets you stop a process (given its Process ID), syntax is very simple: just pass the ID of the process you want to stop et-voila. If you'll make a command line application you'll need to keep its instance running to keep the process suspended (or it'll be terminated). See the Remarks section on MSDN for details.

void suspend(DWORD processId) {     DebugActiveProcess(processId); } 

From Command Line

As I said Windows command line has not any utility to do that but you can invoke a Windows API function from PowerShell. First install Invoke-WindowsApi script then you can write this:

Invoke-WindowsApi "kernel32" ([bool]) "DebugActiveProcess" @([int]) @(process_id_here) 

Of course if you need it often you can make an alias for that.

like image 80
Adriano Repetti Avatar answered Sep 23 '22 10:09

Adriano Repetti