all what i need is suspend all ntdll.dll what loaded in in someprogram.exe
there some example where script suspend ThreadId maybe anyone know how to get all ntdll.dll TID's and use suspend all of them
?
there too good scripts but i cant build one working dont have enought expi
https://www.autohotkey.com/boards/viewtopic.php?t=19323&p=93131
.
example image
- image.png (20.26 KiB) Viewed 231 times
SuspendThread(1112)
SuspendThread(ThreadID)
{
if !(hThread := DllCall("OpenThread", "uint", 0x0002, "int", 0, "uint", ThreadID, "ptr"))
return "Error in OpenThread"
if (DllCall("SuspendThread", "ptr", hThread) = -1)
return "Error in SuspendThread", DllCall("CloseHandle", "ptr", hThread)
return true, DllCall("CloseHandle", "ptr", hThread)
}
ResumeThread(1112)
ResumeThread(ThreadID)
{
if !(hThread := DllCall("OpenThread", "uint", 0x0002, "int", 0, "uint", ThreadID, "ptr"))
return "Error in OpenThread"
if (DllCall("ResumeThread", "ptr", hThread) = -1)
return "Error in ResumeThread", DllCall("CloseHandle", "ptr", hThread)
return true, DllCall("CloseHandle", "ptr", hThread)
}