From 45bbc86e3f265fca93536bbe9bb31a0cdee1cfc2 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Fri, 14 May 2010 08:02:18 +0000
Subject: [PATCH] added detection for suspended processes

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3137 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/ProcessHacker/include/phapp.h     |  4 ++++
 2.x/trunk/ProcessHacker/include/providers.h |  1 +
 2.x/trunk/ProcessHacker/procprv.c           | 15 ++++++++++++++-
 2.x/trunk/ProcessHacker/proctree.c          |  2 ++
 2.x/trunk/ProcessHacker/support.c           | 18 ++++++++++++++++++
 5 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/2.x/trunk/ProcessHacker/include/phapp.h b/2.x/trunk/ProcessHacker/include/phapp.h
index 411139631..2e8e8bee4 100644
--- a/2.x/trunk/ProcessHacker/include/phapp.h
+++ b/2.x/trunk/ProcessHacker/include/phapp.h
@@ -166,6 +166,10 @@ VOID PhSelectAndEnsureVisibleProcessNode(
 
 // support
 
+BOOLEAN PhGetProcessIsSuspended(
+    __in PSYSTEM_PROCESS_INFORMATION Process
+    );
+
 typedef enum _PH_KNOWN_PROCESS_TYPE
 {
     UnknownProcessType,
diff --git a/2.x/trunk/ProcessHacker/include/providers.h b/2.x/trunk/ProcessHacker/include/providers.h
index 3bba8678e..9bdb6828d 100644
--- a/2.x/trunk/ProcessHacker/include/providers.h
+++ b/2.x/trunk/ProcessHacker/include/providers.h
@@ -69,6 +69,7 @@ typedef struct _PH_PROCESS_ITEM
     ULONG IsInSignificantJob : 1;
     ULONG IsPacked : 1;
     ULONG IsPosix : 1;
+    ULONG IsSuspended : 1;
     ULONG IsWow64 : 1;
 
     // Misc.
diff --git a/2.x/trunk/ProcessHacker/procprv.c b/2.x/trunk/ProcessHacker/procprv.c
index 27a7bb1a8..681838db2 100644
--- a/2.x/trunk/ProcessHacker/procprv.c
+++ b/2.x/trunk/ProcessHacker/procprv.c
@@ -1326,13 +1326,26 @@ VOID PhProcessProviderUpdate(
                 if (NT_SUCCESS(PhGetProcessIsBeingDebugged(
                     processItem->QueryHandle,
                     &isBeingDebugged
-                    )) && !!processItem->IsBeingDebugged != !!isBeingDebugged)
+                    )) && processItem->IsBeingDebugged != isBeingDebugged)
                 {
                     processItem->IsBeingDebugged = isBeingDebugged;
                     modified = TRUE;
                 }
             }
 
+            // Suspended
+            {
+                BOOLEAN isSuspended;
+
+                isSuspended = PhGetProcessIsSuspended(process);
+
+                if (processItem->IsSuspended != isSuspended)
+                {
+                    processItem->IsSuspended = isSuspended;
+                    modified = TRUE;
+                }
+            }
+
             if (modified)
             {
                 PhInvokeCallback(&PhProcessModifiedEvent, processItem);
diff --git a/2.x/trunk/ProcessHacker/proctree.c b/2.x/trunk/ProcessHacker/proctree.c
index d353aeca7..5325267f5 100644
--- a/2.x/trunk/ProcessHacker/proctree.c
+++ b/2.x/trunk/ProcessHacker/proctree.c
@@ -542,6 +542,8 @@ BOOLEAN NTAPI PhpProcessTreeListCallback(
                 ; // Dummy
             else if (PhCsUseColorDebuggedProcesses && processItem->IsBeingDebugged)
                 getNodeColor->BackColor = PhCsColorDebuggedProcesses;
+            else if (PhCsUseColorSuspended && processItem->IsSuspended)
+                getNodeColor->BackColor = PhCsColorSuspended;
             else if (PhCsUseColorElevatedProcesses && processItem->IsElevated)
                 getNodeColor->BackColor = PhCsColorElevatedProcesses;
             else if (PhCsUseColorPosixProcesses && processItem->IsPosix)
diff --git a/2.x/trunk/ProcessHacker/support.c b/2.x/trunk/ProcessHacker/support.c
index 3cde871bf..2578ec859 100644
--- a/2.x/trunk/ProcessHacker/support.c
+++ b/2.x/trunk/ProcessHacker/support.c
@@ -24,6 +24,24 @@
 #include <settings.h>
 #include <wtsapi32.h>
 
+BOOLEAN PhGetProcessIsSuspended(
+    __in PSYSTEM_PROCESS_INFORMATION Process
+    )
+{
+    ULONG i;
+
+    for (i = 0; i < Process->NumberOfThreads; i++)
+    {
+        if (
+            Process->Threads[i].ThreadState != Waiting ||
+            Process->Threads[i].WaitReason != Suspended
+            )
+            return FALSE;
+    }
+
+    return Process->NumberOfThreads != 0;
+}
+
 NTSTATUS PhGetProcessKnownType(
     __in HANDLE ProcessHandle,
     __out PPH_KNOWN_PROCESS_TYPE KnownProcessType