CODEWITHSUNDEEP
c#multithreadingprocess
John Smith
John Smith

Reputation: 505

Is processes threads (or whole process) suspended

I would like to check if the processes' threads (the whole process) are suspended. I'm obtaining each process thread by this code:

var threads = Proc.Threads;
for (int x = 0; x < threads.Count; x++) {
var thread = threads[x];

However System.Diagnostics.ThreadState doesn't contain Suspended, but System.Threading.ThreadState does. How do I convert System.Diagnostics.ThreadState to System.Threading.ThreadState, or is it some other method to check it? I'm not trying to suspend/resume them, just I want to know how Process hacker/Process explorer does that.

Upvotes: 5

Views: 2268

Answers (4)

Nikhil Dinesh
Nikhil Dinesh

Reputation: 3409

This will help someone.

        Process proc = Process.GetProcessById(31448);
        if(proc.Threads[0].WaitReason == ThreadWaitReason.Suspended)
        {
            //process is suspended
        }

Upvotes: 3

Damiano Di Vincenzo
Damiano Di Vincenzo

Reputation: 39

You could improperly use SuspendThread or Wow64SuspendThread to find out if it was suspended, then use ResumeThread to restore the situation.

SuspendThread return: "If the function succeeds, the return value is the thread's previous suspend count;"

Declarations:

    [Flags] public enum ThreadAccess : int {
        TERMINATE = (0x0001),
        SUSPEND_RESUME = (0x0002),
        GET_CONTEXT = (0x0008),
        SET_CONTEXT = (0x0010),
        SET_INFORMATION = (0x0020),
        QUERY_INFORMATION = (0x0040),
        SET_THREAD_TOKEN = (0x0080),
        IMPERSONATE = (0x0100),
        DIRECT_IMPERSONATION = (0x0200)}

    [DllImport("kernel32.dll")]
        static extern IntPtr OpenThread(
        ThreadAccess dwDesiredAccess,
        bool bInheritHandle,
        uint dwThreadId);

    [DllImport("kernel32.dll")]
        static extern uint SuspendThread(IntPtr hThread);

    [DllImport("kernel32.dll")]
        static extern int ResumeThread(IntPtr hThread);

    [DllImport("kernel32", CharSet = CharSet.Auto, SetLastError = true)] 
        static extern bool CloseHandle(IntPtr handle);

(Wow64SuspendThread link hidden because i need 10 reputation to put over 2 links = ht.tps://msdn.microsoft.com/it-it/library/windows/desktop/ms687400(v=vs.85).aspx)

Upvotes: 0

Matthew Watson
Matthew Watson

Reputation: 109567

An operating system thread isn't the same as a .Net thread. Process.Threads returns OS threads, each of which may or may not correspond to a .Net thread.

You can look at ProcessThread.WaitReason, but it doesn't correspond to .Net wait states

Upvotes: 2

Hans Passant
Hans Passant

Reputation: 941455

Microsoft made a big mistake in .NET version 1.0, they added the Thread.Suspend() and Resume() methods. Those methods were widely abused, programmers used them to implement thread synchronization. For which they are entirely inappropriate. Problem was that it usually worked. But call Suspend() at an unlucky time and you'll freeze a thread while it is buried inside a Windows call, holding a global lock. And causing the entire program to deadlock.

It was not the only design mistake they made, the Synchronized method on the collection classes was quite a disaster as well. Widely misinterpreted as "returns a thread-safe collection".

Live and learn, this all got fixed in .NET 2.0. One big overhaul was that a Thread may not necessarily be an operating system thread anymore, that never actually got implemented. But explains why there are two ThreadState enumerations, one for Thread (the .NET version) and another for ProcessThread (the operating system version). And they closed the loophole on programmers abusing Suspend/Resume, the methods were declared obsolete. And they closed the backdoor as well, you can't find out from ProcessThread that a thread is suspended.

Feature, not a bug. Don't make the same mistake, knowing that a thread is suspended is useless knowledge, it may well not be suspended anymore a microsecond later.

Upvotes: 7

Related Questions