NtSuspendProcess

File Name: NtSuspendProcess
File Submitter: joakim
File Submitted: 14 Aug 2012
File Updated: 14 Aug 2012
File Category: Tools

A simpel program using native api in ntdll.dll that can suspend/resume a given process by specifying its PID or name.

Examples:

Suspend process with ID 2366:

NtSuspendProcess.exe -pid 2366



Suspend all processes with name notepad.exe:

NtSuspendProcess.exe -name notepad.exe



Resume process with ID 2366:

NtSuspendProcess.exe -rpid 2366



Resume all suspended processes with name notepad.exe:

NtSuspendProcess.exe -rname notepad.exe

Also a nice and simple example of how to use some powerfull native api's, even in a scripting language like AutoIt.

Click here to download this file

Please include a description on why the general public would need/want to suspend a process using your tool. As your description stands I'm not sure the users who are not Coders/IT.somthing will know what to do with your prog.
thanks!


ps. should proably be noted that you need admin rights to use on processes you don't own. currently the program does not force admin and runs with the current users rights.

I usually use this procedere:

When I change privileges, I save the current ones.
After doing the work, I restore the saved privileges.

In the au3 I saw that you do not restore.

A glitch or intended?

Peter

Please include a description on why the general public would need/want to suspend a process using your tool. As your description stands I'm not sure the users who are not Coders/IT.somthing will know what to do with your prog.
thanks!

You are right, it is not obvious what the tool actually does. I kind of assumed the audience was coders/techies, and actually only thought of one particular usage when making it (the 72 hour limit thread). Here's some text taken from another site http://www.codeproje...end-resume-tool ;
You have a time-consuming operation, e.g. a big build, and want to pause it for doing something quickly and resuming it after doing this

• You have some P2P software or download running and want to pause and resume it without reconnecting and want to browse some pages quickly
• A program starts a disk trashing operation and you want to send and e-mail
• A program starts working in a way it shouldn't for just a moment and you want to attach a debugger to it
• You have a buggy process running and want to kill it fast

From the description of PsSuspend, which is similar, we can read this;
which is desirable in cases where a process is consuming a resource (e.g. network, CPU or disk) that you want to allow different processes to use. Rather than kill the process that's consuming the resource, suspending permits you to let it continue operation at some later point in time.

ps. should proably be noted that you need admin rights to use on processes you don't own. currently the program does not force admin and runs with the current users rights.

That's fixed in the new version.

I usually use this procedere:

When I change privileges, I save the current ones.
After doing the work, I restore the saved privileges.

In the au3 I saw that you do not restore.

A glitch or intended?

I agree with your logic. However this program add this privilege only to the current process, and because of that, the newly added privilege is also automatically removed when the process terminates. Since it is a simpel console application I don't think it is necessary to worry about restoring privileges for the process. So the answer is intended.

In the new version I added option to resume processes, as well as specifying the target by either process name or process ID.

Thank you joakim, very useful tool for my console collection.
Just did some quick successful tests under win7x64.

Maybe you could add a timer for suspending a running process?
Something like " NtSuspendProcess.exe -name -t30 notepad.exe"
...were "-t" is optional and parm is set in seconds?

I think I leave the application as it is now. It is open source so you can easily add such an option. But if you have problems, let me know, and I'll look at it.