Kernel32 does not contain a method named 'OpenThread'

268 views Asked by At

I am trying to write a Suspend-Process Function in Powershell 5 and the error I get is Method invocation failed because [Kernel32] does not contain a method named 'OpenThread' The Powershell code follows

 #Thread Access Constants

$TERMINATE             = 0x0001 
$SUSPEND_RESUME        = 0x0002
$GET_CONTEXT           = 0x0008
$SET_CONTEXT           = 0x0010
$SET_INFORMATION       = 0x0020
$QUERY_INFORMATION     = 0x0040
$SET_THREAD_TOKEN      = 0x0080  
$IMPERSONATE           = 0x0100
$DIRECT_IMPERSONATION  = 0x0200

Add-Type -TypeDefinition @"
    using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
public static class Kernel32
{
    [DllImport("kernel32.dll",SetLastError=true)]
    public static extern int SuspendThread(IntPtr hThread);

    [DllImport("kernel32.dll",SetLastError=true)]
    public static extern int ResumeThread(IntPtr hThread);

    [DllImport("kernel32.dll", SetLastError=true)]
    public static extern bool CloseHandle(IntPtr hHandle);

    [DllImport("kernel32.dll", SetLastError = true)]
    public static extern IntPtr OpenThread(uint dwDesiredAccess, bool       bInheritHandle, uint dwThreadId);

   }

"@

$hProcess = Get-Process -Name Notepad 
ForEach($ProcessThread in $hProcess.Threads){

 $hThread = [Kernel32]::OpenThread($SUSPEND_RESUME , $False, $ProcessThread.ID)
  if ($hThread -ne [IntPtr]::Zero) {
   [Kernel32]::SuspendThread($hThread)
   [Kernel32]::CloseHandle($hThread)
  }

}
0

There are 0 answers