uSuspendResumeProcess

unit uSuspendResumeProcess;

interface

uses
  Windows, SysUtils, Classes, Controls, Forms, StdCtrls;

type
  TForm1 = class(TForm)
    Suspend: TButton;
    Resume: TButton;
    PID: TEdit;
    procedure SuspendClick(Sender: TObject);
    procedure ResumeClick(Sender: TObject);
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

const
  NTDLL = 'ntdll.dll';
  PROCESS_SUSPEND_RESUME = $0800;
  SE_DEBUG_PRIVILEGE = 20;

function NtSuspendProcess(pid: THandle): HRESULT; stdcall; external NTDLL;
function NtResumeProcess(pid: THandle): HRESULT; stdcall; external NTDLL;
function RtlAdjustPrivilege(Privilege: ULONG; Enable: BOOL; CurrentThread: BOOL;
  out OldPrivilege: BOOL): ULONG; stdcall; external NTDLL;

procedure Pause(Flag: Boolean; PID: Cardinal);
var
  hProcess: THandle;
begin
  hProcess := OpenProcess(PROCESS_SUSPEND_RESUME, False, PID);
  try
    if Flag then
      NtSuspendProcess(hProcess)
    else
      NtResumeProcess(hProcess);
  finally
    CloseHandle(hProcess);
  end;
end;

procedure TForm1.SuspendClick(Sender: TObject);
begin
  Pause(True, StrToIntDef(pid.Text, 0));
end;

procedure TForm1.ResumeClick(Sender: TObject);
begin
  Pause(False, StrToIntDef(pid.Text, 0));
end;

var
  OldPrivilege: BOOL;
initialization
  RtlAdjustPrivilege(SE_DEBUG_PRIVILEGE, True, False, OldPrivilege);
end.