Suspend vs Freeze #1854
-
|
What's the difference between Suspend I see is from |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 3 replies
-
What does PhFreezeProcess call instead of NtSuspendProcess? |
Beta Was this translation helpful? Give feedback.
-
Sure, but also, what's the difference between the two states? For example, a suspended process is a process whose threads are in wait status and the wait reason is suspended. What is a frozen process? |
Beta Was this translation helpful? Give feedback.
-
|
Freezing is a stronger version of suspension that cannot be undone via resuming (only thawing). Effectively, when a process is frozen, it adds an additional (permanent) +1 to the suspension counter of each thread. The current implementation of If you're interested in more details, I have a repository about this topic. It is slightly outdated (doesn't cover freeze-bypassing threads, for instance) but can still shed some light on the topic. |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot, the answer is perfectly clear and that repo is exactly the source of information anyone should ever need. |
Beta Was this translation helpful? Give feedback.
Freezing is a stronger version of suspension that cannot be undone via resuming (only thawing). Effectively, when a process is frozen, it adds an additional (permanent) +1 to the suspension counter of each thread. The current implementation of
PhFreezeProcessuses state change objects, so it performs freezing, not suspension.If you're interested in more details, I have a repository about this topic. It is slightly outdated (doesn't cover freeze-bypassing threads, for instance) but can still shed some light on the topic.