如何在 Windows 中暂停/恢复进程？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/11010165/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to suspend/resume a process in Windows?
提问by Michael
In Unix we can suspend a process execution temporarily and resume it with signals SIGSTOPand SIGCONT. How can I suspend a single-threaded process in Windows without programming ?
在 Unix 中，我们可以暂时暂停进程执行并使用信号SIGSTOP和恢复它SIGCONT。如何在不编程的情况下暂停 Windows 中的单线程进程？
回答by Adriano Repetti
You can't do it from the command line, you have to write some code (I assume you're not just looking for an utility otherwise Super User may be a better place to ask). I also assume your application has all the required permissions to do it (examples are without any error checking).
您不能从命令行执行此操作，您必须编写一些代码（我假设您不只是在寻找实用程序，否则超级用户可能是一个更好的提问地点）。我还假设您的应用程序具有执行此操作所需的所有权限（示例没有任何错误检查）。
Hard Way
艰辛的道路
First get all the threads of a given process then call the SuspendThreadfunction to stop each one (and ResumeThreadto resume). It works but some applications may crash or hung because a thread may be stopped in any point and the order of suspend/resume is unpredictable (for example this may cause a dead lock). For a single threaded application this may not be an issue.
首先获取给定进程的所有线程，然后调用该SuspendThread函数来停止每个线程（并ResumeThread恢复）。它可以工作，但某些应用程序可能会崩溃或挂起，因为线程可能会在任何时候停止并且挂起/恢复的顺序是不可预测的（例如这可能会导致死锁）。对于单线程应用程序，这可能不是问题。
void suspend(DWORD processId)
{
HANDLE hThreadSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
THREADENTRY32 threadEntry;
threadEntry.dwSize = sizeof(THREADENTRY32);
Thread32First(hThreadSnapshot, &threadEntry);
do
{
if (threadEntry.th32OwnerProcessID == processId)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, FALSE,
threadEntry.th32ThreadID);
SuspendThread(hThread);
CloseHandle(hThread);
}
} while (Thread32Next(hThreadSnapshot, &threadEntry));
CloseHandle(hThreadSnapshot);
}
Please note that this function is even too much naive, to resume threads you should skip threads that was suspended and it's easy to cause a dead-lock because of suspend/resume order. For single threaded applications it's prolix but it works.
请注意，这个函数太天真了，要恢复线程你应该跳过被挂起的线程，因为挂起/恢复顺序很容易导致死锁。对于单线程应用程序，它很冗长，但它有效。
Undocumented way
无证方式
Starting from Windows XP there is the NtSuspendProcessbut it's undocumented. Read this postfor a code example (reference for undocumented functions: news://comp.os.ms-windows.programmer.win32).
从 Windows XP 开始，存在NtSuspendProcess但未记录的. 阅读这篇文章以获取代码示例（未记录函数的参考：news://comp.os.ms-windows.programmer.win32）。
typedef LONG (NTAPI *NtSuspendProcess)(IN HANDLE ProcessHandle);
void suspend(DWORD processId)
{
HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId));
NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(
GetModuleHandle("ntdll"), "NtSuspendProcess");
pfnNtSuspendProcess(processHandle);
CloseHandle(processHandle);
}
"Debugger" Way
“调试器”方式
To suspend a program is what usually a debugger does, to do it you can use the DebugActiveProcessfunction. It'll suspend the process execution (with all threads all together). To resume you may use DebugActiveProcessStop.
挂起程序通常是调试器所做的，为此您可以使用该DebugActiveProcess函数。它将暂停进程执行（所有线程都在一起）。要恢复，您可以使用DebugActiveProcessStop.
This function lets you stop a process (given its Process ID), syntax is very simple: just pass the ID of the process you want to stop et-voila. If you'll make a command line application you'll need to keep its instance running to keep the process suspended (or it'll be terminated). See the Remarkssection on MSDN for details.
这个函数让你停止一个进程（给定它的进程 ID），语法非常简单：只需传递你想要停止的进程的 ID 等等。如果您要创建命令行应用程序，则需要保持其实例运行以保持进程挂起（否则将被终止）。有关详细信息，请参阅MSDN 上的备注部分。
void suspend(DWORD processId)
{
DebugActiveProcess(processId);
}
From Command Line
从命令行
As I said Windows command line has not any utility to do that but you can invoke a Windows API function from PowerShell. First install Invoke-WindowsApiscript then you can write this:
正如我所说，Windows 命令行没有任何实用程序可以执行此操作，但您可以从 PowerShell 调用 Windows API 函数。首先安装Invoke-WindowsApi脚本，然后你可以这样写：
Invoke-WindowsApi "kernel32" ([bool]) "DebugActiveProcess" @([int]) @(process_id_here)
Of course if you need it often you can make an aliasfor that.
当然，如果你经常需要它，你可以alias为此做一个。
回答by Sigroad
Without any external tool you can simply accomplish this on Windows 7 or 8, by opening up the Resource monitor and on the CPU or Overview tab right clicking on the process and selecting Suspend Process. The Resource monitor can be started from the Performance tab of the Task manager.
无需任何外部工具，您只需在 Windows 7 或 8 上完成此操作，方法是打开资源监视器并在 CPU 或概览选项卡上右键单击进程并选择Suspend Process。资源监视器可以从任务管理器的性能选项卡启动。
回答by Zordey
I use (a very old) process explorer from SysInternals (procexp.exe). It is a replacement / addition to the standard Task manager, you can suspend a process from there.
我使用来自 SysInternals (procexp.exe) 的（一个非常古老的）进程资源管理器。它是标准任务管理器的替代/补充，您可以从那里暂停进程。
Edit: Microsoft has bought over SysInternals, url: procExp.exe
编辑：微软已经收购了SysInternals，网址：procExp.exe
Other than that you can set the process priority to low so that it does not get in the way of other processes, but this will not suspend the process.
除此之外，您可以将进程优先级设置为低，这样它就不会妨碍其他进程，但这不会挂起进程。
回答by AlexeyDaryin
PsSuspendcommand line utility from SysInternalssuite. It suspends / resumes a process by its id.
套件中的 PsSuspend命令行实用程序SysInternals。它通过其 id 挂起/恢复进程。
回答by shivesh suman
Well, Process Explorer has a suspend option. You can right click a process in the process column and select suspend. Once you are ready to resume it again right click and this time select resume. Process Explorer can be obtained from here:
好吧，Process Explorer 有一个挂起选项。您可以右键单击进程列中的进程并选择挂起。一旦你准备好再次恢复它，右键单击，这次选择恢复。Process Explorer 可以从这里获得：
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
回答by Stijn Bousard
PsSuspend, as mentioned by Vadzim, even suspends/resumes a process by its name, not only by pid.
PsSuspend，如提及Vadzim，甚至，挂起/它的名字恢复的过程，不仅PID。
I use both PsSuspend and PsList(another tool from the PsTools suite) in a simple toggle script for the OneDrive process: if I need more bandwidth, I suspend the OneDrive sync, afterwards I resume the process by issuing the same mini script:
我在 OneDrive 进程的简单切换脚本中同时使用 PsSuspend 和PsList（PsTools 套件中的另一个工具）：如果我需要更多带宽，我会暂停 OneDrive 同步，然后我通过发出相同的迷你脚本恢复进程：
PsList -d onedrive|find/i "suspend" && PsSuspend -r onedrive || PsSuspend onedrive
PsSuspendcommand line utility from SysInternalssuite. It suspends / resumes a process by its id.
套件中的 PsSuspend命令行实用程序SysInternals。它通过其 id 挂起/恢复进程。
回答by coltonon
#pragma comment(lib,"ntdll.lib")
EXTERN_C NTSTATUS NTAPI NtSuspendProcess(IN HANDLE ProcessHandle);
void SuspendSelf(){
NtSuspendProcess(GetCurrentProcess());
}
ntdll contains the exported function NtSuspendProcess, pass the handle to a process to do the trick.
ntdll 包含导出的函数 NtSuspendProcess，将句柄传递给进程来执行此操作。
