Suspend Process in C#

Question

How do I suspend a whole process (like the Process Explorer does when I click Suspend) in C#.

I'm starting the Process with Process.Start, and on a certain event, I want to suspend the process to be able to do some investigation on a "snapshot" of it.

Answer 1

Here's my suggestion:

 [Flags]     public enum ThreadAccess : int     {       TERMINATE = (0x0001),       SUSPEND_RESUME = (0x0002),       GET_CONTEXT = (0x0008),       SET_CONTEXT = (0x0010),       SET_INFORMATION = (0x0020),       QUERY_INFORMATION = (0x0040),       SET_THREAD_TOKEN = (0x0080),       IMPERSONATE = (0x0100),       DIRECT_IMPERSONATION = (0x0200)     }      [DllImport("kernel32.dll")]     static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);     [DllImport("kernel32.dll")]     static extern uint SuspendThread(IntPtr hThread);     [DllImport("kernel32.dll")]     static extern int ResumeThread(IntPtr hThread);     [DllImport("kernel32", CharSet = CharSet.Auto,SetLastError = true)]     static extern bool CloseHandle(IntPtr handle);   private static void SuspendProcess(int pid) {   var process = Process.GetProcessById(pid); // throws exception if process does not exist    foreach (ProcessThread pT in process.Threads)   {     IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);      if (pOpenThread == IntPtr.Zero)     {       continue;     }      SuspendThread(pOpenThread);      CloseHandle(pOpenThread);   } }  public static void ResumeProcess(int pid) {   var process = Process.GetProcessById(pid);    if (process.ProcessName == string.Empty)     return;    foreach (ProcessThread pT in process.Threads)   {     IntPtr pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)pT.Id);      if (pOpenThread == IntPtr.Zero)     {       continue;     }      var suspendCount = 0;     do     {       suspendCount = ResumeThread(pOpenThread);     } while (suspendCount > 0);      CloseHandle(pOpenThread);   } } 

Answer 2

Thanks to Magnus

After including the Flags, I modified the code a bit to be an extension method in my project. I could now use

var process = Process.GetProcessById(param.PId); process.Suspend(); 

Here is the code for those who might be interested.

public static class ProcessExtension {     [DllImport("kernel32.dll")]     static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);     [DllImport("kernel32.dll")]     static extern uint SuspendThread(IntPtr hThread);     [DllImport("kernel32.dll")]     static extern int ResumeThread(IntPtr hThread);      public static void Suspend(this Process process)     {         foreach (ProcessThread thread in process.Threads)         {             var pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)thread.Id);             if (pOpenThread == IntPtr.Zero)             {                 break;             }             SuspendThread(pOpenThread);         }     }     public static void Resume(this Process process)     {         foreach (ProcessThread thread in process.Threads)         {             var pOpenThread = OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)thread.Id);             if (pOpenThread == IntPtr.Zero)             {                 break;             }             ResumeThread(pOpenThread);         }     } } 

I have a utility done which I use to generally suspend/kill/list a process. Full source is on Git