I am trying to write a Suspend-Process Function in Powershell 5 and the error I get is Method invocation failed because [Kernel32] does not contain a method named 'OpenThread' The Powershell code follows
#Thread Access Constants
$TERMINATE = 0x0001
$SUSPEND_RESUME = 0x0002
$GET_CONTEXT = 0x0008
$SET_CONTEXT = 0x0010
$SET_INFORMATION = 0x0020
$QUERY_INFORMATION = 0x0040
$SET_THREAD_TOKEN = 0x0080
$IMPERSONATE = 0x0100
$DIRECT_IMPERSONATION = 0x0200
Add-Type -TypeDefinition @"
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
public static class Kernel32
{
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int SuspendThread(IntPtr hThread);
[DllImport("kernel32.dll",SetLastError=true)]
public static extern int ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool CloseHandle(IntPtr hHandle);
[DllImport("kernel32.dll", SetLastError = true)]
public static extern IntPtr OpenThread(uint dwDesiredAccess, bool bInheritHandle, uint dwThreadId);
}
"@
$hProcess = Get-Process -Name Notepad
ForEach($ProcessThread in $hProcess.Threads){
$hThread = [Kernel32]::OpenThread($SUSPEND_RESUME , $False, $ProcessThread.ID)
if ($hThread -ne [IntPtr]::Zero) {
[Kernel32]::SuspendThread($hThread)
[Kernel32]::CloseHandle($hThread)
}
}