#ifndef _NTPSAPI_H
//
// Threads
//
#if (PHNT_MODE != PHNT_MODE_KERNEL)
/**
* Suspends the specified thread.
*
* \param ThreadHandle A handle to the thread to be suspended.
* \param PreviousSuspendCount Optional. A pointer to a variable that receives the thread's previous suspend count.
* \return NTSTATUS Successful or errant status.
* \remarks Increments suspension through PsSuspendThread, using THREAD_SUSPEND_RESUME (0x2). PreviousSuspendCount is an
* optional 4-byte output reporting the count before this operation. Balance the count with resume calls; do
* not assume a successful call is a safe application-level pause point or that one resume removes multiple
* suspensions.
*/
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
NtSuspendThread(
_In_ HANDLE ThreadHandle,
_Out_opt_ PULONG PreviousSuspendCount
);
View code on GitHub#ifndef _NTZWAPI_H
_Kernel_entry_
NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSuspendThread(
_In_ HANDLE ThreadHandle,
_Out_opt_ PULONG PreviousSuspendCount
);
View code on GitHubSuspends a thread.
ThreadHandle - a handle to a thread granting THREAD_SUSPEND_RESUME access.PreviousSuspendCount - an optional pointer to a variable that receives the previous value of the suspension counter of the thread.Suspend count for ThreadHandle thread before function call.