如何在 Windows 下暂停/恢复任何外部进程？

How to pause / resume any external process under Windows?

提问by MechanTOurS

I am looking for different ways to pause and resume programmatically a particular process via its process ID under Windows XP.

我正在寻找在 Windows XP 下通过其进程 ID 以编程方式暂停和恢复特定进程的不同方法。

Process suspend/resume tooldoes it with SuspendThread/ ResumeThreadbut warns about multi-threaded programs and deadlock problems.

进程挂起/恢复工具使用SuspendThread/ 来完成，ResumeThread但会警告多线程程序和死锁问题。

PsSuspendlooks okay, but I wonder if it does anything special about deadlocks or uses another method?

PsSuspend看起来不错，但我想知道它是否对死锁有什么特别之处或使用了其他方法？

Prefered languages : C++ / Python

首选语言：C++/Python

回答by bk1e

If you "debug the debugger" (for instance, using logger.exeto trace all API calls made by windbg.exe), it appears that the debugger uses SuspendThread()/ResumeThread()to suspend all of the threads in the process being debugged.

如果您“调试调试器”（例如，logger.exe用于跟踪由 进行的所有 API 调用windbg.exe），调试器似乎使用SuspendThread()/ResumeThread()来挂起正在调试的进程中的所有线程。

PsSuspend may use a different way of suspending processes (I'm not sure), but it is still possible to hang other processes: if the process you're suspending is holding a shared synchronization object that is needed by another process, you may block that other process from making any progress. If both programs are well-written, they should recover when you resume the one that you suspended, but not all programs are well-written. And if this causes your program that is doing the suspending to hang, then you have a deadlock.

PsSuspend 可能使用不同的挂起进程的方式（我不确定），但仍然有可能挂起其他进程：如果您挂起的进程持有另一个进程需要的共享同步对象，您可能会阻塞其他过程不会取得任何进展。如果两个程序都写得很好，当你恢复你挂起的那个时，它们应该会恢复，但并不是所有的程序都写得很好。如果这导致正在执行挂起的程序挂起，那么您就会陷入僵局。

回答by Highmastdon

I'm not sure if this does the job, but with ProcessExplorer from MS Systernals you can suspend a process.

我不确定这是否可以完成这项工作，但是使用 MS Systernals 的 ProcessExplorer，您可以暂停进程。

It's been said here: https://superuser.com/a/155263and I found it there too.

这里有人说过：https: //superuser.com/a/155263，我也在那里找到了。

回答by Hanan N.

read hereand you also have psutil for python that you can use it like that:

在这里阅读，你也有 python 的 psutil，你可以这样使用它：

>>> import psutil
>>> pid = 7012
>>> p = psutil.Process(pid)
>>> p.suspend()
>>> p.resume()

回答by Wis

So, after I found about UniversalPauseButton, Googling for this ("windows SIGSTOP"), getting this question as the first search result (thanks Ilia K. your commentdid its job), and reading the answers, I went back to checkout the code.

所以，在我发现UniversalPauseButton 之后，谷歌搜索这个（“windows SIGSTOP”），把这个问题作为第一个搜索结果（感谢 Ilia K。你的评论完成了它的工作），并阅读了答案，我回去检查代码.

Apparently, it uses undocumented NT kernel and Win32 APIs _NtSuspendProcess, _NtResumeProcessand _HungWindowFromGhostWindow.

显然，它使用未公开的 NT 内核和 Win32 API _NtSuspendProcess，_NtResumeProcess并且_HungWindowFromGhostWindow.

PsSuspend, the utility you mentioned and linked to probably uses these APIs, I couldn't verify this, the source code isn't supplied, only executables and a EULA, you can probably figure that out by disassembling the binary but it's against the EULA.

PsSuspend，您提到并链接到的实用程序可能使用这些 API，我无法验证这一点，未提供源代码，只有可执行文件和 EULA，您可能可以通过反汇编二进制文件来解决这个问题，但它违反 EULA .

so, to answer your specific question, checkout UniversalPauseButton's main.cpp, basicallyyou call _NtSuspendProcess(ProcessHandle)and _NtResumeProcess(ProcessHandle), ProcessHandlebeing the handle of the process you want to pause or resume.

因此，要回答您的具体问题，请查看UniversalPauseButton的主要内容。cpp，基本上你调用_NtSuspendProcess(ProcessHandle)and _NtResumeProcess(ProcessHandle)，ProcessHandle作为你想要暂停或恢复的进程的句柄。

回答by MechanTOurS

I tested http://www.codeproject.com/KB/threads/pausep.aspxon few softwares:

我在几个软件上测试了http://www.codeproject.com/KB/threads/pausep.aspx：

it works fine.

它工作正常。

PsSuspend and Pausep are two valid options.

PsSuspend 和 Pausep 是两个有效的选项。

回答by Andre

I think there is a good reason why there is no SuspendProcess() function in Windows. Having such a function opens the door for an unstable system. You shall not suspend a process unless you created that process yourself. If you wrote that process yourself, you could use an event (see ::SetEvent() etc. in MSDN) or another kind of messaging to trigger a pause command in the process.

我认为 Windows 中没有 SuspendProcess() 函数是有充分理由的。拥有这样的功能为不稳定的系统打开了大门。除非您自己创建了该流程，否则您不得暂停该流程。如果您自己编写该流程，则可以使用事件（请参阅 MSDN 中的 ::SetEvent() 等）或其他类型的消息来触发流程中的暂停命令。