4

I am creating a child process with creatprocess api.And i created a jobobject and assigned this child process to jobobject.
Now, if i kill my parent process, child process terminates too.But if i suspend parent process, child process doesn't suspend and continue execution.
is there any option to suspend child process, when parent process is suspended?

Delphi Code which i have used for creating a process

Function ExecuteProcess(EXE : String) : THandle;

Var
SI      : TStartupInfo;
PI      : TProcessInformation;
Begin
  Result := INVALID_HANDLE_VALUE;
  FillChar(SI,SizeOf(SI),0);
  SI.cb := SizeOf(SI);
  If 
    CreateProcess(nil,PChar('.\'+EXE),nil,nil,False,CREATE_SUSPENDED,
     nil,nil,SI,PI) Then 
   Begin
    ResumeThread(PI.hThread);
    CloseHandle(PI.hThread);
    Result := PI.hProcess;
   End
  Else ShowMessage('CreateProcess failed: '+
                   SysErrorMessage(GetLastError));
End;
galove
  • 43
  • 3
  • 3
    Welcome to Stack Overflow. You really shouldn't be suspending anything once it's begun running. Unless a thread is suspending *itself*, you don't really know whether the thread is in a condition where it's safe to suspend it. It could be in the middle of IO operations, or it might hold a lock on the memory manager, for example. Whatever problem you're trying to solve, I advise you to find a different solution. If you can describe your problem, you could post about it here on Stack Overflow. – Rob Kennedy Jan 11 '12 at 22:22
  • Hi. My problem is, i have developed a security application and this application doing some operations with hardware and if something is wrong it is terminating the processes it has created. My problem is, if i suspend the main process using process explorer, the processes which i have created continues execution and my main application losing control on them. I can not do security controls. And the child processes are not developed by me, i dont have source code of them. – galove Jan 12 '12 at 06:54
  • I meant for you to describe your problem in a new question post. I don't understand your problem, though. You haven't told why you're suspending processes in the first place. – Rob Kennedy Jan 12 '12 at 12:56

1 Answers1

4

From the Windows API perspective, there's no such thing as suspending a process. Only threads can be suspended, but there are no parent-child relationships between threads. Since there are no "child threads," there is no automatic mechanism for suspending them when the parent is suspended. (You can create a process suspended, but that's because when it's first created, there's only one thread, and it is created suspended.)

If you want to suspend all the threads of the child process, then enumerate them and suspend them the same way you suspend the threads of the parent process.

You might also try the undocumented NtSuspendProcess function, as mentioned in Windows: Atomically suspend an entire process?

Community
  • 1
  • 1
Rob Kennedy
  • 161,384
  • 21
  • 275
  • 467
  • Thanks but, how internet explorer doing this operation? I have opened 3 browsers and 2 tabs inside of them. If i suspend the first created browser with process explorer, all of them suspends. Are new opened browsers threads of the main browser? – galove Jan 12 '12 at 07:02
  • Yes, I believe so. Can't you confirm that with Process Explorer? When you open a new tab or window, do you get another process entry or not? – Rob Kennedy Jan 12 '12 at 12:52
  • if i open a new windows, i see new process under main processes. and if i suspend the main process all windows suspend.screenshot : http://s8.postimage.org/mjxu9ff11/image.jpg – galove Jan 12 '12 at 14:38
  • Your screen shot doesn't indicate that anything is suspended. Perhaps the children just communicate with the parent, and when the parent is nonresponsive (due to being suspended), the children block waiting for a response. – Rob Kennedy Jan 12 '12 at 14:44
  • so do i. i think these processes communicate each other. thanks. – galove Jan 12 '12 at 14:47