c++ - 如何查找进程是否挂起？

Question

我正在使用此代码暂停进程。我在这里找到它 http://www.codeproject.com/KB/threads/pausep.aspx

BOOL SuspendResumeThreadList(DWORD dwOwnerPID, bool bResumeThread) 
{ 
    HANDLE        hThreadSnap = NULL; 
    BOOL          bRet        = FALSE; 
    THREADENTRY32 te32        = {0}; 

    hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); 
    if (hThreadSnap == INVALID_HANDLE_VALUE) 
        return (FALSE); 

    te32.dwSize = sizeof(THREADENTRY32); 

    if (Thread32First(hThreadSnap, &te32)) 
    { 
        do 
        { 
            if (te32.th32OwnerProcessID == dwOwnerPID) 
            {
                HANDLE hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, te32.th32ThreadID);
                if (bResumeThread)
                {
                    //cout << _T("Resuming Thread 0x") << cout.setf( ios_base::hex ) << te32.th32ThreadID << '\n';
                    ResumeThread(hThread);
                }
                else
                {
                    //cout << _T("Suspending Thread 0x") << cout.setf( ios_base::hex ) << te32.th32ThreadID << '\n';
                    SuspendThread(hThread);
                }
                CloseHandle(hThread);
            } 
        }
        while (Thread32Next(hThreadSnap, &te32)); 
        bRet = TRUE; 
    } 
    else 
        bRet = FALSE;   
    CloseHandle (hThreadSnap); 
    return (bRet); 
} 

现在我想要一种方法来查找进程是否已挂起？？？请帮助我。

Answer 1

如果我没记错的话你可以使用NtQuerySystemInformation以此目的。使用 NtQuerySystemInformation，您可以通过遍历 SYSTEM_PROCESS_INFORMATION 数组并查找目标进程的 PID 来获取 SYSTEM_PROCESS_INFORMATION 结构。您可以在 Wine 资源中找到 SYSTEM_PROCESS_INFORMATION 的详细描述 here .获得进程信息结构后，只需查看 SYSTEM_THREAD_INFORMATION 即可检查线程状态。有关结构和枚举的更多详细信息，请参阅 Wine 资源。