Get an Exclusive Process Handler

Question

I am writing an application in C # and C ++ / CLI and I have code that pauses processes. However, I want them not to be suspended by another process (e.g. Process Explorer). Is it possible to get an exclusive process descriptor or in some way block other applications from performing this operation? And if so, how?

Answer 1

this cannot be done from user mode.

any process that has SE_DEBUG_PRIVILEGE, included in the token, can open the process / thread handler with all access (only if it is not protected by the process).

ObRegisterCallbacks /. , deny handle open remove PROCESS_SUSPEND_RESUME, THREAD_SUSPEND_RESUME THREAD_RESUME from DesiredAccess OB_PRE_CREATE_HANDLE_INFORMATION. api PsResumeProcess.

. OBJ_EXCLUSIVE OBJECT_ATTRIBUTES ( 3- / - ZwOpenProcess), , OBJ_EXCLUSIVE , . STATUS_INVALID_PARAMETER , STATUS_ACCESS_DENIED. OBJ_EXCLUSIVE - ( , csrss.exe, , )

Answer 2

NtResumeProcess NtResumeThread, NTDLL. , , , , - STATUS_ACCESS_DENIED NTSTATUS, .

- . - ObRegisterCallbacks, PROCESS_SUSPEND_RESUME , .

, , . , Microsoft API-, MS Detours. ObRegisterCallbacks , , ( , ).

.