进程挂起

#include<stdio.h>
#include<windows.h>


int main()
{
    char szBuffer[256] = {0};
    char szHandle[8] = {0};

    SECURITY_ATTRIBUTES ie_sa_p;
    ie_sa_p.nLength = sizeof(ie_sa_p);
    ie_sa_p.lpSecurityDescriptor = NULL;
    ie_sa_p.bInheritHandle = TRUE;

    SECURITY_ATTRIBUTES ie_sa_t;
    ie_sa_t.nLength = sizeof(ie_sa_t);
    ie_sa_t.lpSecurityDescriptor = NULL;
    ie_sa_t.bInheritHandle = TRUE;


    STARTUPINFO ie_si = {0};
    PROCESS_INFORMATION ie_pi;
    ie_si.cb = sizeof(ie_si);

    TCHAR szCmdline[] =TEXT("c://program files//internet explorer//iexplore.exe");                                
    CreateProcess(NULL, szCmdline, &ie_sa_p, &ie_sa_t, TRUE, CREATE_NEW_CONSOLE, NULL,NULL, &ie_si, &ie_pi);
        //组织命令行参数                                
    sprintf(szHandle,"%x %x",ie_pi.hProcess,ie_pi.hThread);                                
    sprintf(szBuffer,"C:/z1.exe %s",szHandle);                                
                                    
    //定义创建进程需要用的结构体                                
    STARTUPINFO si = {0};                                   
    PROCESS_INFORMATION pi;                                
    si.cb = sizeof(si);                                
                                    
    //创建子进程                                
    BOOL res = CreateProcess(                                
        NULL,                             
        szBuffer,                             
        NULL,                    //是否继承进程句柄 
        NULL,                    //是否继承主线程句柄
        TRUE,                             
        NULL,                             
        NULL,                             
        NULL, &si, &pi);                             
                                    

}

#include<stdio.h>
#include<windows.h>


int main(int argc, char* argv[])w
{
    DWORD dwProcessHandle = -1;                        
DWORD dwThreadHandle = -1;                        
char szBuffer[256] = {0};                        
                        
                        
memcpy(szBuffer,argv[1],8);                        
sscanf(szBuffer,"%x",&dwProcessHandle);                        
                        
memset(szBuffer,0,256);                        
memcpy(szBuffer,argv[2],8);                        
sscanf(szBuffer,"%x",&dwThreadHandle);                        
                        
printf("获取IE进程、主线程句柄
");                        
Sleep(2000);                        
//挂起主线程                        
printf("挂起主线程
");                        
::SuspendThread((HANDLE)dwThreadHandle);                        
                        
Sleep(5000);                        
                        
//恢复主线程                        
::ResumeThread((HANDLE)dwThreadHandle);                        
printf("恢复主线程
");                        
                        
Sleep(5000);                        
                        
//关闭ID进程                        
::TerminateProcess((HANDLE)dwProcessHandle,1);                        
::WaitForSingleObject((HANDLE)dwProcessHandle, INFINITE);                        
                        
printf("ID进程已经关闭.....
");                        
                        
                        
}

                
    char szBuffer[256] = {0};            
                
    GetCurrentDirectory(256,szBuffer);            
                

以上获取当前目录

                    
    STARTUPINFO ie_si = {0};                   
    PROCESS_INFORMATION ie_pi;                
    ie_si.cb = sizeof(ie_si);                
                    
    TCHAR szBuffer[256] = "C:\notepad.exe";                
    CreateProcess(                
        NULL,                              
        szBuffer,                            
        NULL,             
        NULL,              
        FALSE,                               
        CREATE_SUSPENDED,                 
        NULL,                                
        NULL,                                
        &ie_si,                              
        &ie_pi                              
        );            
                    
    //恢复执行                
    ResumeThread(ie_pi.hThread);                

                            
                            
    2、以挂起的方式创建进程，获取进程的ImageBase和AddressOfEntryPoint                        
                            
    STARTUPINFO ie_si = {0};                           
    PROCESS_INFORMATION ie_pi;                        
    ie_si.cb = sizeof(ie_si);                        
                            
    //以挂起的方式创建进程                        
    TCHAR szBuffer[256] = "C:\ipmsg.exe";                        
    CreateProcess(                        
        NULL,                    // name of executable module                    
        szBuffer,                // command line string                    
        NULL,                      // SD
        NULL,                       // SD            
        FALSE,                   // handle inheritance option                    
        CREATE_SUSPENDED,          // creation flags                  
        NULL,                    // new environment block                    
        NULL,                    // current directory name                    
        &ie_si,                  // startup information                    
        &ie_pi                   // process information                    
        );                    
                            
                            
    CONTEXT contx;                          
    contx.ContextFlags = CONTEXT_FULL;                          
                            
                            
    GetThreadContext(ie_pi.hThread, &contx);                        
                            
    //获取入口点                        
    DWORD dwEntryPoint = contx.Eax;                        
                            
    //获取ImageBase                        
    char* baseAddress = (CHAR *) contx.Ebx+8;                        
                            
    memset(szBuffer,0,256);                        
                            
    ReadProcessMemory(ie_pi.hProcess,baseAddress,szBuffer,4,NULL);                        
                            
                            
    ResumeThread(ie_pi.hThread);