Click here to Skip to main content
Click here to Skip to main content

Win32 process suspend/resume tool

, 3 Oct 2002 CPOL
Rate this:
Please Sign up or sign in to vote.
A small handy command line tool for suspending/resuming the running of entire processes on Windows

Why pause and resume processes?

Anyone using the Windows NT product line (Windows 2000 and Windows XP) must have used the task manager utility. This utility, activated by pressing CTRL+SHIFT+ESC, brings up a list of the active processes and allows you several actions for controlling them: starting new processes, stopping processes and setting their priority. When you have some process that is taking a lot of resources (normally CPU time), you can easily assign it the lowest priority and the system will take care of assigning only the remaining resources or the "idle time" on the machine.

Well, a feature I always missed from Windows and present on other operating systems is the ability of pausing and resuming a process. Some daily situations you could face where this feature would be useful (actually, the ones I use it for):

  • You have a time-consuming operation, e.g. a big build, and want to pause it for doing something quickly and resuming it after doing this
  • You have some P2P software or download running and want to pause and resume it without reconnecting and want to browse some pages quickly
  • A program starts a disk trashing operation and you want to send and e-mail
  • A program starts working in a way it shouldn't for just a moment and you want to attach a debugger to it
  • You have a buggy process running and want to kill it fast

How it is done

The main problem is: there is no SuspendProcess API function. And there is no documented or safe way of doing this.

The only simple way of doing this is via SuspendThread/ResumeThread. This pair of API functions allows you to suspend and resume a thread. More than that, for the sake of safety, they maintain an internal "suspend count'. Each time you call SuspendThread, it increments this counter. ResumeThread, on the other hand, decreases this counter. If this was not done this way, the caller of SuspendThread would have no way of knowing how to restore the original state of the thread. Calling ResumeThread after calling SuspendThread effectively restores the original thread's state.

Knowing this, it is very straightforward suspending a process: it is just a matter of listing all the threads on a process, opening a handle for each of them and calling SuspendThread. The resuming is done the same way.

The ToolHelp32 API has functions for easily listing threads and processes on a system. Actually, there are two functions that do this on my code that were shamelessly borrowed from MSDN samples.

So, I wrote this little command line utility (I have an idea for integrating it with the task manager, but I have not the time for doing it right now).

How to use it

I suggest you to put the executable anywhere on the PATH. The Windows directory would be fine. Always compile this program without DLL dependencies on the CRT, so the program will start faster. You could be starting this program under very adverse conditions, so looking for a MSVCRT*.DLL and loading it could make a huge difference in the startup time.

As with most command line tools, it is meant to be used from the command prompt, by clicking on the "Command Prompt" shortcut or opening Start/Run and executing cmd.exe. The usage for the program is very simple:

pausep PID [/r]

If you type only pausep without arguments, the program will display its usage and a list of running processes and their PID. If you type pausep PID, the program will call SuspendThread on all the process's threads. This will suspend the threads or increment their suspend count. If you pass the "/r" argument, the program will do the opposite action, i.e., resuming the thread. Note that if you pausep the same process 3 times without resuming, you will need to use pausep /r it for 3 times too.

The risks with this approach

Not all programs are well written. Not all programs are made to be suspended, specially the multithreaded ones. Programs that implement timeouts may behave abnormally if you pause and resume them. When you pause and resume threads in an arbitrary order, like with this utility, you can create deadlocks.

So, only use this program when you know what you are doing.

The standard disclaimer

As I said before, this is not the safest tool in the world. Use it at your own risk: if you use it, you can loose data, profit, have hardware problems, cause radioactive contamination and start a world war. But, for me, it works fine and never had a problem.

Well, the code in this article is free for you to use any way you want. If you improve it, drop me a note, so I can keep the code in sync. If you make money with this code, you are a genius! You deserve the money. Just remember to send me a "thank you" and give me some tips. I will not reject any money you send me too.

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

Daniel Turini
CEO
Brazil Brazil
I develop software since I was 11. In the past 20 years, I developed software and used very different machines and languages, since Z80 based ones (ZX81, MSX) to mainframe computers. I still have passion for ASM, though no use for it anymore.
Professionally, I developed systems for managing very large databases, mainly on Sybase and SQL Server. Most of the solutions I write are for the financial market, focused on credit systems.
To date, I learned about 20 computer languages. As the moment, I'm in love with C# and the .NET framework, although I only can say I’m very proficient at C#, VB.NET(I’m not proud of this), T/SQL, C++ and libraries like ATL and STL.
I hate doing user interfaces, whether Web based or not, and I’m quite good at doing server side work and reusable components.
I’m the technical architect and one of the authors of Crivo, the most successful automated credit and risk assessment system available in Brazil.

Comments and Discussions

 
SuggestionEasier Approach PinmemberMember 803644620-Apr-12 22:31 
GeneralThank You Pinmemberkazemtnt10-May-11 2:11 
Generalanother api PinmemberMember 248805611-Jan-10 21:26 
GeneralThank you! PinmemberPaganBBD15-Apr-08 3:48 
QuestionHow to query for a process's state Pinmemberopen_mind_core27-Mar-08 8:02 
GeneralJust wanted to say PinmemberBrowner87!19-Nov-07 14:29 
Just wanted to say you're a genius! I've been trying forever to do this in VB6 and it seems to be impossible. I used the code to hack an irritating program that resists having it's process ended (it auto-restatrs) but can't detect a suspend! I used this code with a VB app that calls your app with the processes PID as an argument and the program suspends! Thought I'd post the code in case anyone wants it! Thanx again!
 
Make sure you add a .RES file with pausep.exe in it in a 'folder' called EXES and make it resource number 101
[Put in a module]
Option Explicit
 
Private Declare Function CloseHandle Lib "kernel32.dll" (ByVal Handle As Long) As Long
Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccessas As Long, ByVal bInheritHandle As Long, ByVal dwProcId As Long) As Long
Private Declare Function EnumProcesses Lib "PSAPI.DLL" (ByRef lpidProcess As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long
Private Declare Function GetModuleFileNameExA Lib "PSAPI.DLL" (ByVal hProcess As Long, ByVal hModule As Long, ByVal ModuleName As String, ByVal nSize As Long) As Long
Private Declare Function EnumProcessModules Lib "PSAPI.DLL" (ByVal hProcess As Long, ByRef lphModule As Long, ByVal cb As Long, ByRef cbNeeded As Long) As Long
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByVal lpBuffer As Long, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal lpDst As Long, ByVal lpSrc As Long, ByVal ByteLen As Long)
 
Private Declare Function SetThreadAffinityMask Lib "kernel32.dll" (ByVal hThread As Long, ByVal dwThreadAffinityMask As Long) As Long
 
Private Declare Function GetProcessAffinityMask Lib "kernel32.dll" (ByVal hProcess As Long, ByRef lpProcessAffinityMask As Long, ByRef SystemAffinityMask As Long) As Boolean
 
Private Declare Function GetCurrentProcess Lib "kernel32.dll" () As Long
Private Declare Function SetProcessAffinityMask Lib "kernel32.dll" (ByVal hProcess As Long, ByRef dwProcessAffinityMask As Long) As Long
 
Private Const PROCESS_QUERY_INFORMATION As Long = 1024
Private Const PROCESS_VM_READ As Long = 16
Private Const MAX_PATH As Long = 260
 
Public Function GetProcessByName(ByVal EXEName As String) As Long
Dim cb As Long
Dim cbNeeded As Long
Dim NumElements As Long
Dim ProcessIDs() As Long
Dim cbNeeded2 As Long
Dim NumElements2 As Long
Dim Modules(1 To 200) As Long
Dim ModuleName As String
Dim hProcess As Long
Dim i As Long
Dim PIDs() As Long
ReDim PIDs(0)
cb = 8
cbNeeded = 192 '96
Do While cb <= cbNeeded
cb = cb * 2
ReDim ProcessIDs(cb / 4) As Long
EnumProcesses ProcessIDs(1), cb, cbNeeded
Loop 'While ProcessIDs(1) <> 0
NumElements = cbNeeded / 4
For i = 1 To NumElements
hProcess = OpenProcess(PROCESS_QUERY_INFORMATION Or PROCESS_VM_READ, 0, ProcessIDs(i))
If hProcess <> 0 Then
If EnumProcessModules(hProcess, Modules(1), 200, cbNeeded2) <> 0 Then
ModuleName = Space(MAX_PATH)
'Debug.Print Left$(ModuleName, GetModuleFileNameExA(hProcess, Modules(1), ModuleName, 500))
If (InStr(1, Left$(ModuleName, GetModuleFileNameExA(hProcess, Modules(1), ModuleName, 500)), EXEName, vbTextCompare) > 0) Then
ReDim Preserve PIDs(UBound(PIDs) + 1)
PIDs(UBound(PIDs)) = hProcess 'ProcessIDs(i)
GetProcessByName = ProcessIDs(i) 'hProcess
Exit Function
End If
End If
End If
CloseHandle hProcess
Next
GetProcessByName = PIDs(UBound(PIDs))
End Function
 

Private Sub Main()
Dim PID As Long
PID = GetProcessByName("xxxxxxxxxx.exe")
If Len(Dir(App.Path & "\pausep.exe")) <= 0 Then
Dim k As Long, e() As Byte
e = LoadResData(101, "EXES")
k = FreeFile
Open App.Path & "\pausep.exe" For Binary Access Write Lock Read As k
Put k, , e
Close k
End If
Shell App.Path & "\pausep.exe " & PID
Do
On Error Resume Next
Kill App.Path & "\pausep.exe"
DoEvents
Loop Until Len(Dir(App.Path & "\pausep.exe")) <= 0
MsgBox "Done!"
End Sub

 
I have not failed 1000 times, I have successfully identified 1000 ways that will not work! Poke tongue | ;-P
 

-- modified at 20:35 Monday 19th November, 2007
GeneralMemory Leak Pinmemberkeremsback17-Nov-06 4:36 
GeneralProcess checkpointing PinmemberReal_Jeezy5-Nov-06 4:49 
GeneralI like it... PinmemberSlsa749-Oct-05 9:09 
GeneralToolHelp PinmemberB.Alas3-May-05 8:27 
GeneralHelp!!! Pinmemberjean_ni7-Apr-04 6:50 
GeneralRe: Help!!! PinmemberMsftone26-Jan-06 23:11 
QuestionHow to suspend/resume process on Win95? Pinmembertigra_woo12-Feb-04 15:17 
AnswerRe: How to suspend/resume process on Win95? PinmemberDaniel Turini13-Feb-04 0:53 
GeneralRe: How to suspend/resume process on Win95? Pinmembertigra_woo23-Feb-04 14:53 
GeneralRe: How to suspend/resume process on Win95? Pinmembermurray skuce20-Jun-04 4:57 
AnswerRe: How to suspend/resume process on Win95? PinmemberMember 803644620-Apr-12 22:37 
Generalaccess denied Pinmemberxuchangchang3-Feb-04 14:33 
GeneralWREY was kinda right PinmemberHockey23-Oct-02 22:31 
GeneralRe: WREY was kinda right Pinmember*42*8-Nov-11 14:11 
GeneralRisky, but useful too I guess PineditorNishant S4-Oct-02 23:06 
GeneralDoesn't do much. PinmemberWREY29-Sep-02 11:20 
GeneralRe: Doesn't do much. PinmemberDaniel Turini29-Sep-02 12:27 
GeneralRe: Doesn't do much. PinsitebuilderUwe Keim29-Sep-02 13:41 
GeneralRe: Doesn't do much. PinmemberWREY29-Sep-02 13:53 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web03 | 2.8.141015.1 | Last Updated 4 Oct 2002
Article Copyright 2002 by Daniel Turini
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid