| 172 | } |
| 173 | |
| 174 | BOOLEAN PauseResumeThreadList( BOOL bResumeThread ) |
| 175 | { |
| 176 | if (g_hProcess == NULL) |
| 177 | return FALSE; |
| 178 | |
| 179 | NTSTATUS status = STATUS_SUCCESS; |
| 180 | ULONG bufferSize = 0x4000; |
| 181 | DWORD ProcessId = GetProcessId( g_hProcess ); |
| 182 | PVOID SystemProcessInfo = malloc( bufferSize ); |
| 183 | if (!SystemProcessInfo) |
| 184 | { |
| 185 | #ifdef _DEBUG |
| 186 | PrintOut( _T( "[PauseResumeThreadList]: Couldn't allocate system process info buffer!" ) ); |
| 187 | #endif |
| 188 | return FALSE; |
| 189 | } |
| 190 | |
| 191 | while (TRUE) |
| 192 | { |
| 193 | status = ntdll::NtQuerySystemInformation( SystemProcessInformation, SystemProcessInfo, bufferSize, &bufferSize ); |
| 194 | if (status == STATUS_BUFFER_TOO_SMALL || status == STATUS_INFO_LENGTH_MISMATCH) |
| 195 | { |
| 196 | if (SystemProcessInfo) |
| 197 | free( SystemProcessInfo ); |
| 198 | SystemProcessInfo = malloc( bufferSize * 2 ); |
| 199 | if (!SystemProcessInfo) |
| 200 | { |
| 201 | #ifdef _DEBUG |
| 202 | PrintOut( _T( "[PauseResumeThreadList]: Couldn't allocate system process info buffer!" ) ); |
| 203 | #endif |
| 204 | return FALSE; |
| 205 | } |
| 206 | } |
| 207 | else |
| 208 | { |
| 209 | break; |
| 210 | } |
| 211 | } |
| 212 | |
| 213 | if (!NT_SUCCESS( status )) |
| 214 | { |
| 215 | if (SystemProcessInfo) |
| 216 | free( SystemProcessInfo ); |
| 217 | #ifdef _DEBUG |
| 218 | PrintOut( _T( "[PauseResumeThreadList]: NtQuerySystemInformation failed with status 0x%08X" ), status ); |
| 219 | #endif |
| 220 | return FALSE; |
| 221 | } |
| 222 | |
| 223 | PSYSTEM_PROCESS_INFORMATION process; |
| 224 | PSYSTEM_THREAD_INFORMATION threads; |
| 225 | ULONG numberOfThreads; |
| 226 | |
| 227 | process = PROCESS_INFORMATION_FIRST_PROCESS( SystemProcessInfo ); |
| 228 | do |
| 229 | { |
| 230 | if (process->UniqueProcessId == (HANDLE)ProcessId) |
| 231 | break; |
no test coverage detected