Page 1 of 1

suspend process thread

Posted: 13 Jun 2021, 08:50
by sveetass
hi i have process(application) like example someprogram.exe
all what i need is suspend all ntdll.dll what loaded in in someprogram.exe
there some example where script suspend ThreadId maybe anyone know how to get all ntdll.dll TID's and use suspend all of them
?
there too good scripts but i cant build one working dont have enought expi
https://www.autohotkey.com/boards/viewtopic.php?t=19323&p=93131
.
example image
image.png
image.png (20.26 KiB) Viewed 296 times

SuspendThread(1112)

SuspendThread(ThreadID)
{
if !(hThread := DllCall("OpenThread", "uint", 0x0002, "int", 0, "uint", ThreadID, "ptr"))
return "Error in OpenThread"
if (DllCall("SuspendThread", "ptr", hThread) = -1)
return "Error in SuspendThread", DllCall("CloseHandle", "ptr", hThread)
return true, DllCall("CloseHandle", "ptr", hThread)
}


ResumeThread(1112)
ResumeThread(ThreadID)
{
if !(hThread := DllCall("OpenThread", "uint", 0x0002, "int", 0, "uint", ThreadID, "ptr"))
return "Error in OpenThread"
if (DllCall("ResumeThread", "ptr", hThread) = -1)
return "Error in ResumeThread", DllCall("CloseHandle", "ptr", hThread)
return true, DllCall("CloseHandle", "ptr", hThread)
}