[pr0t0typ3]

1. Don't flame I know that I posted some code with a similar point some days ago.
   


2. I found this when I did some research about undocumented Functions in the ntdll Library
   


3. It is shorter then the other code.
   


4. Enjoy, give Credits and don't leech.
   

Code

Module NTSuspendProcess
#Region "APIs"
    <DllImport("ntdll.dll")> _
    Private Function NtSuspendProcess(ByVal hHandle As IntPtr) As Boolean
    End Function
    <DllImport("ntdll.dll")> _
    Private Function NtResumeProcess(ByVal hHandle As IntPtr) As Boolean
    End Function
#End Region
    Public Function SuspendProcess(ByVal ID As Integer) As Boolean
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Return NtSuspendProcess(p.Handle)
        Catch ex As Exception
            Return False
        End Try
    End Function
    Public Function ResumeProcess(ByVal ID As Integer) As Boolean
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Return NtResumeProcess(p.Handle)
        Catch ex As Exception
            Return False
        End Try
    End Function
End Module

[Navigator]

ntdll.dll is part of the Native API, not Windows API.

[pr0t0typ3]

ntdll.dll is part of the Native API, not Windows API.

Yeah my misstake. Thank you.

[njq8]

work on vista 32bit ^^

thanks very nice code

[Neroxan]

tehee... You .net kids really should look @ some of the vb6 runpe's every now and then. Nice cluebat for those who werent aware of it though.

[affixiate]

tehee... You .net kids really should look @ some of the vb6 runpe's every now and then. Nice cluebat for those who werent aware of it though.

It really depends how you design it. I use the native functions for my C# RunPE.

It's quicker to call the ntdll import since most of the Windows APIs call something in ntdll to do the work. However, it also is uncertain. Microsoft explicitly tells you not to use many of the undocumented functions because they are well, undocumented, and can be altered at anytime.

Anyway, pr0t0typ3, solid work. If I could give rep here, I would give you some green apples.

[d3c0mpil3r]

Don't worry affixiate, +repped him from yours and my side :)
affixiate (Click to View)Gave you too :)