added detection for suspended processes

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3137 21ef857c-d57f-4fe0-8362-d861dc6d29cd

2.x/trunk/ProcessHacker/include/phapp.h

@@ -166,6 +166,10 @@ VOID PhSelectAndEnsureVisibleProcessNode(
 
 // support
 
+BOOLEAN PhGetProcessIsSuspended(
+    __in PSYSTEM_PROCESS_INFORMATION Process
+    );
+
 typedef enum _PH_KNOWN_PROCESS_TYPE
 {
     UnknownProcessType,

2.x/trunk/ProcessHacker/include/providers.h

@@ -69,6 +69,7 @@ typedef struct _PH_PROCESS_ITEM
     ULONG IsInSignificantJob : 1;
     ULONG IsPacked : 1;
     ULONG IsPosix : 1;
+    ULONG IsSuspended : 1;
     ULONG IsWow64 : 1;
 
     // Misc.

2.x/trunk/ProcessHacker/procprv.c

@@ -1326,13 +1326,26 @@ VOID PhProcessProviderUpdate(
                 if (NT_SUCCESS(PhGetProcessIsBeingDebugged(
                     processItem->QueryHandle,
                     &isBeingDebugged
-                    )) && !!processItem->IsBeingDebugged != !!isBeingDebugged)
+                    )) && processItem->IsBeingDebugged != isBeingDebugged)
                 {
                     processItem->IsBeingDebugged = isBeingDebugged;
                     modified = TRUE;
                 }
             }
 
+            // Suspended
+            {
+                BOOLEAN isSuspended;
+
+                isSuspended = PhGetProcessIsSuspended(process);
+
+                if (processItem->IsSuspended != isSuspended)
+                {
+                    processItem->IsSuspended = isSuspended;
+                    modified = TRUE;
+                }
+            }
+
             if (modified)
             {
                 PhInvokeCallback(&PhProcessModifiedEvent, processItem);

2.x/trunk/ProcessHacker/proctree.c

@@ -542,6 +542,8 @@ BOOLEAN NTAPI PhpProcessTreeListCallback(
                 ; // Dummy
             else if (PhCsUseColorDebuggedProcesses && processItem->IsBeingDebugged)
                 getNodeColor->BackColor = PhCsColorDebuggedProcesses;
+            else if (PhCsUseColorSuspended && processItem->IsSuspended)
+                getNodeColor->BackColor = PhCsColorSuspended;
             else if (PhCsUseColorElevatedProcesses && processItem->IsElevated)
                 getNodeColor->BackColor = PhCsColorElevatedProcesses;
             else if (PhCsUseColorPosixProcesses && processItem->IsPosix)

2.x/trunk/ProcessHacker/support.c

@@ -24,6 +24,24 @@
 #include <settings.h>
 #include <wtsapi32.h>
 
+BOOLEAN PhGetProcessIsSuspended(
+    __in PSYSTEM_PROCESS_INFORMATION Process
+    )
+{
+    ULONG i;
+
+    for (i = 0; i < Process->NumberOfThreads; i++)
+    {
+        if (
+            Process->Threads[i].ThreadState != Waiting ||
+            Process->Threads[i].WaitReason != Suspended
+            )
+            return FALSE;
+    }
+
+    return Process->NumberOfThreads != 0;
+}
+
 NTSTATUS PhGetProcessKnownType(
     __in HANDLE ProcessHandle,
     __out PPH_KNOWN_PROCESS_TYPE KnownProcessType