Is there any way to suspend/resume a process from kernel mode?

.

Maxim
Tue Apr 19 20:48:14 CDT 2005

You can only suspend threads, not processes.

SuspendThread is an unsafe API. If the thread holds some locks in user
mode - you can cause a deadlock.

Why do you need this?

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Marius Negrutiu" <negrutiu@as.ro> wrote in message
news:OoRQR9MRFHA.3584@TK2MSFTNGP10.phx.gbl...
> .

Marius
Wed Apr 20 06:34:09 CDT 2005

I've used PsSetCreateProcessNotifyRoutine() to register a callback that
is triggered every time a process is created.
Within that callback I need to immediately suspend certain processes,
wait for some user-mode events, and then resume them.

The DDK says that the callback routine is called "just after the initial
thread is created within the newly created process".
I'm wondering if at that moment that initial thread has ever been in a
running state (scheduled by the dispatcher) or is a "virgin" thread. In
that case it would be safe to suspend it.

Do you think it'll work? (cause I'll try it anyway ;)

Thanx for answering!
Marius.

GianLuca
Sun Jun 12 03:35:02 CDT 2005

Hi Marius,

I've to do the same thinghs, PsSetCreateProcessNotifyRoutine() -> Suspend
all process's threads -> resume them
but when I attempt to open the process threads, I've got a
STATUS_INVALID_PARAMETER, but if I try to do the same thinghs when the
process is full running, the code works fine.
I thinghs that the thread is locked or in a startup state and the system
isn't able to view it through the SuspendThread an so on.
You have found a solution or a workaround?
I've search'ed in Internet but with no answer :((

Thank's

"Marius Negrutiu" wrote:

> I've used PsSetCreateProcessNotifyRoutine() to register a callback that
> is triggered every time a process is created.
> Within that callback I need to immediately suspend certain processes,
> wait for some user-mode events, and then resume them.
>
> The DDK says that the callback routine is called "just after the initial
> thread is created within the newly created process".
> I'm wondering if at that moment that initial thread has ever been in a
> running state (scheduled by the dispatcher) or is a "virgin" thread. In
> that case it would be safe to suspend it.
>
> Do you think it'll work? (cause I'll try it anyway ;)
>
> Thanx for answering!
> Marius.
>