typedef DWORD (WINAPI *NtSuspendThread)(HANDLE hThread,OUT PULONG PreviousSuspendCount OPTIONAL);
typedef DWORD (WINAPI *NtResumeThread)(HANDLE hThread,OUT PULONG PreviousSuspendCount OPTIONAL);
int i=0;
DWORD MayId = GetCurrentThreadId();
HANDLE hThread[1024] = {0};
NtResumeThread MyResThread = (NtResumeThread)GetProcAddress(GetModuleHandle(L"ntdll.dll"),"NtResumeThread");
NtSuspendThread MySusThread = (NtSuspendThread)GetProcAddress(GetModuleHandle(L"ntdll.dll"),"NtSuspendThread");
NTQUERYSYSTEMINFORMATION NtQSIM = (NTQUERYSYSTEMINFORMATION)GetProcAddress(GetModuleHandle(L"ntdll.dll"),"ZwQuerySystemInformation");
status = NtQSIM(SystemProcessInformation,NULL,0,&retlen);
pbuf = VirtualAlloc(NULL,retlen,MEM_COMMIT,PAGE_READWRITE);
if(pbuf == NULL)
return FALSE;
truelen = retlen;
status= NtQSIM(SystemProcessInformation,pbuf,truelen,&retlen); //枚举进程线程
buf=pbuf;
IsBreak = FALSE;
do
{
pSysProcess=(PSYSTEM_PROCESSES)buf;
if(pSysProcess->ProcessId == GetCurrentProcessId())
{
pSysThread=pSysProcess->Threads;
for ( i=0;i<pSysProcess->ThreadCount;i++)
{
if((DWORD)pSysThread->ClientID.UniqueThread != MayId) //不是当前线程
{
hThread[i] = OpenThread(THREAD_ALL_ACCESS,FALSE,(DWORD)pSysThread->ClientID.UniqueThread);
MySusThread(hThread[i],NULL);
pSysThread++;
}
}
IsBreak = TRUE; //这里是控制外面的循环是否退出 不然找到了还继续循环浪费时间
}
if (pSysProcess->NextEntryDelta==0 || IsBreak)
{
break;
}
buf = (PVOID)((DWORD)buf + pSysProcess->NextEntryDelta);
} while (1);
VirtualFree(pbuf,truelen,NULL);
for(int j=0;j <= i;j++)
{
MyResThread(hThread[j],NULL);
CloseHandle(hThread[j]);
}
