NativeAPI悬浮过程

Question

我试图停止某些进程，我使用ntdll中的NativeAPI。我编写了一些C代码，它的工作原理：

typedef LONG(NTAPI* NtSuspendProcess)(IN HANDLE ProcessHandle);

UINT __stdcall Suspend(VOID* processId)
{
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)processId);

    NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(GetModuleHandle(L"ntdll"), "NtSuspendProcess");

    pfnNtSuspendProcess(processHandle);

    CloseHandle(processHandle);

    return 0;
}

UINT __stdcall Resume(VOID* processId)
{
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)processId);

    NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(
    GetModuleHandle(L"ntdll"), "NtResumeProcess");

    pfnNtSuspendProcess(processHandle);

    CloseHandle(processHandle);

    return 0;
}

但是，当我尝试使用MASM编写它时，我的过程并没有停止。我查了一下EAX和ECX，那里一切都很好。我叫GetLastError，有0，作为返回值。代码：

pauseProc proc pid:dword

push pid
push 0
push PROCESS_ALL_ACCESS
call OpenProcess@12

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorOpenProccess
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

mov processHandle, eax

push offset NtModuleNameWStr
call GetModuleHandleW@4

; call GetLastError

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorGetModuleHandle
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

push offset NtSuspendProcessAStr
push eax
call GetProcAddress@8

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorGetProcAddress
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

push processHandle
call CloseHandle@4

; pfnNtSuspendProcess
ret
pauseProc endp

关于康斯特斯：

STANDARD_RIGHTS_REQUIRED equ 000F0000h
SYNCHRONIZE              equ 00100000h
PROCESS_ALL_ACCESS      equ (STANDARD_RIGHTS_REQUIRED or SYNCHRONIZE or 0FFFFh)

我使用Windows 10，因为我们需要写0FFFF。适用于Windows 0FFFh之前的版本。为什么过程不停止？

Answer 1

;Process pause
pauseProc proc pid:dword

push pid
push 0
push PROCESS_ALL_ACCESS
call OpenProcess@12

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorOpenProccess
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

mov processHandle, eax

push offset NtModuleNameWStr
call GetModuleHandleW@4

; call GetLastError

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorGetModuleHandle
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

push offset NtSuspendProcessAStr
push eax
call GetProcAddress@8

.IF eax == 0
    PUSH MB_ICONERROR
    PUSH 0
    PUSH offset errorGetProcAddress
    PUSH 0
    CALL MessageBoxA@16 
.ENDIF

;Call NtSuspendProcess from dll
push processHandle
call eax

push processHandle
call CloseHandle@4

; pfnNtSuspendProcess
ret
pauseProc endp