hello
the program give below display the information of process and threads that started in the system, i want to suspend the thread of process that is recently started is functio is available bu i dotknow how to use it or may beother function available to suspend thread if any oneknows then plz reply me how to suspend current opened thread
bye
/*http://msdn2.microsoft.com/En-US/library/ms684847.aspx
* Process ad Thread functions
*/
using
System;using
System.Collections.Generic;using
System.Text;using
System.Management;using
System.Runtime.InteropServices;using
System.Threading;namespace
ThreadStartDemo{
class Program{
/* [DllImport("Kernel32.dll")]static extern Boolean Sleep(UInt32 duration);*/
int state; ManagementClass TClass; ManagementObject TInstance; ManagementClass PClass; ManagementObject PInstance; int processid = 0; int Tprocessid = 0; void Run(){
WqlEventQuery q = new WqlEventQuery();q.EventClassName =
"Win32_ThreadStartTrace"; ManagementEventWatcher w = new ManagementEventWatcher(q);w.EventArrived +=
new EventArrivedEventHandler(this.ThreadEventArrived); WqlEventQuery qT = new WqlEventQuery();qT.EventClassName =
"Win32_ProcessStartTrace"; ManagementEventWatcher wT = new ManagementEventWatcher(q);wT.EventArrived +=
new EventArrivedEventHandler(this.ProcessEventArrived);w.Start();
wT.Start();
}
public void ProcessEventArrived(object sender, EventArrivedEventArgs e){
PClass =
new ManagementClass("Win32_Process");PInstance = PClass.CreateInstance();
int a = 0; foreach (PropertyData pd in e.NewEvent.Properties){
if (a == 2){
//retriving id of Started process.processid = (
int)pd.Value; Console.WriteLine("{0} = {1}",pd.Name,pd.Value); break;}
a++;
}
}
public void ThreadEventArrived(object sender, EventArrivedEventArgs e){
TClass =
new ManagementClass("Win32_Thread");TInstance = TClass.CreateInstance();
state = (
int) TInstance.GetPropertyValue("ThreadState"); Console.WriteLine("\n\n"); int a = 0; foreach(PropertyData pd in e.NewEvent.Properties){
if (a == 0){
Tprocessid = (
int)pd.Value; Console.WriteLine("{0} = {1}", pd.Name, pd.Value); break;}
}
//compare the started process id and started thread process id // and state of thread then sleep the process if(processid == Tprocessid && state == 0){
/* Method is:DWORD WINAPI SuspendThread(
HANDLE hThread
);
problem: how to use in program
*
TInstance.InvokeMethod("SuspendThread");*/
// Sleep(2000);}
}
static void Main(string[] args){
Program ev = new Program();ev.Run();
Console.ReadLine();}
}
}
AlanPosted Jun 29, 2007, 7:17 AM
As the CurrentThread property is static you don't actually need a Thread instance to do this.
AlanPosted Jun 29, 2007, 7:00 AM
I don't know whether this will work or not as it returns a pseudo-handle but try passing to SuspendThread() the handle obtained from another API function, GetCurrentThread, whose P/Invoke signature is:
[DllImport("kernel32.dll")]
static extern IntPtr GetCurrentThread();
and which can be called with:
IntPtr hThread = GetCurrentThread();
diya sherPosted Jun 27, 2007, 7:09 AM
System;hello
i used the suspendthread() method but this program is still not responding because the handle and state property doesnot return any value, i want to suspend thread when it is its initial state that is 0 but this program still not working plz check the code and reply me
thanks alot
bye
using
using System.Collections.Generic;
using System.Text;
using System.Management;
using System.Runtime.InteropServices;
namespace
SuspendDemo{
class Program
{
[DllImport("kernel32.dll")]
static extern uint SuspendThread(IntPtr hThread); object tProcessID = 0, processid = 0;
void CallEvent()
{
WqlEventQuery processQuery = new WqlEventQuery();
processQuery.EventClassName = "Win32_ProcessStartTrace";
ManagementEventWatcher processWatcher = new ManagementEventWatcher(processQuery);
processWatcher.EventArrived +=
new EventArrivedEventHandler(this.ProcessArrived); WqlEventQuery threadQuery = new WqlEventQuery();threadQuery.EventClassName =
"Win32_ThreadStartTrace"; ManagementEventWatcher threadWatcher = new ManagementEventWatcher(threadQuery);threadWatcher.EventArrived +=
new EventArrivedEventHandler(this.ThreadArrived);processWatcher.Start();
threadWatcher.Start();
}
public void ProcessArrived(object sender, EventArrivedEventArgs e){
int count = 0; foreach (PropertyData pd in e.NewEvent.Properties){
if (count == 2){
Console.WriteLine("process {0} = {1}", pd.Name, pd.Value);processid = pd.Value;
Console.WriteLine("local processid={0}", processid);}
count++;
break;}
}
public void ThreadArrived(object sender, EventArrivedEventArgs e){
int count = 0; object state; string temp; ManagementClass mc = new ManagementClass("Win32_Thread"); ManagementObject TInstance = mc.CreateInstance(); foreach (PropertyData pd in e.NewEvent.Properties){
if (count == 0){
tProcessID = pd.Value;
Console.WriteLine("thread {0} = {1}", pd.Name, pd.Value);state = TInstance.GetPropertyValue(
"ThreadState");temp = (
string)TInstance.GetPropertyValue("Handle"); Console.WriteLine("state= {0}", state); if (state.Equals(0) && processid.Equals(tProcessID)){
IntPtr hThread = new IntPtr(Int32.Parse(temp));SuspendThread(hThread);
}
}
// break;}
}
static void Main(string[] args){
Program p = new Program();p.CallEvent();
Console.ReadLine();}
}
}
AlanPosted Jun 24, 2007, 11:57 AM
[DllImport("kernel32.dll")]
static extern uint SuspendThread(IntPtr hThread);
You then need to get a handle to the TInstance thread which is contained in the Handle property of the WMI class, Win32_Thread. Curiously, this handle is returned as a string and so needs to be parsed to an Int32 (assuming a 32 bit system) and then used in the IntPtr constructor:
string temp = (string) TInstance.GetPropertyValue("Handle");
IntPtr hThread = new IntPtr(Int32.Parse(temp));
You can then call the API function with this line:
SuspendThread(hThread);
Incidentally, you can't use TInstance.InvokeMethod() here, as SuspendThread() is not a Win32_Thread method.