Function ResumeProcessLoop

WSASS.cpp:182–221

}

void ResumeProcessLoop(DWORD pid) 
{
    // Load ntdll.dll
    HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll");
    if (!hNtdll) {
        std::cerr << "Failed to load ntdll.dll\n";
        return;
    }
    // Get the address of NtResumeProcess
    pNtResumeProcess NtResumeProcess = (pNtResumeProcess)GetProcAddress(hNtdll, "NtResumeProcess");
    if (!NtResumeProcess) 
    {
        std::cerr << "Failed to get NtResumeProcess address\n";
        return;
    }
    // Open the process with minimal required access
    HANDLE hProcess = OpenProcess(PROCESS_SUSPEND_RESUME, FALSE, pid);
    if (!hProcess) 
    {
        std::cerr << "Failed to open process with PROCESS_SUSPEND_RESUME. Error: " << GetLastError() << "\n";
        return;
    }
    // Loop 10 times and call NtResumeProcess
    for (int i = 0; i < 10; ++i)
    {
        Sleep(1000); // Optional: small delay between calls
        NTSTATUS status = NtResumeProcess(hProcess);
        if (status != 0) {
            std::cerr << "NtResumeProcess failed at iteration " << i << " with status: 0x" << std::hex << status << "\n";
        }
        else 
        {
            std::cout << "Iteration " << i << ": Process resumed successfully.\n";
            break;
        }
        // end loop
    }

    CloseHandle(hProcess);
}

BOOL DumpRun(std::wstring werPath, DWORD targetPID, DWORD targetTID)
{