Suspend and resume a process

Functions used in Ntdll

Typedef DWORD (winapi * pfsuspendprocess) (handle hprocess );
Typedef DWORD (winapi * pfresumeprocess) (handle hprocess );

Int main (INT argc, char * argv [])
{
Pfsuspendprocess suspendprocess;
Pfresumeprocess resumeprocess;

If (argc! = 2 ){
Printf ("/nparameter not enough !!! /Nusage: % s process-ID/N ", argv [0]);
Return 0;
}

Hmodule hntdlllib = loadlibrary ("NTDLL. dll ");

Suspendprocess = (pfsuspendprocess) getprocaddress (hntdlllib, "zwsuspendprocess ");
Resumeprocess = (pfresumeprocess) getprocaddress (hntdlllib, "zwresumeprocess ");

If (suspendprocess ){
Handle hprocess = OpenProcess (process_all_access, false, atoi (argv [1]);

Suspendprocess (hprocess );

Printf ("press any key to resume process ...");
GETC (stdin );

Resumeprocess (hprocess );

Closehandle (hprocess );
}
Freelibrary (hntdlllib );

GETC (stdin );
Return 0;
}