How to check if process is suspended? - process

Question

Following code does not compile because my Delphi 7 complains about undeclared identifier PSYSTEM_THREAD = ^SYSTEM_THREAD. What UNIT am I missing from USES clause? ......................................................................................................................................................
unit Unit1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;
type
TForm1 = class(TForm)
Button1: TButton;
private
{ Private declarations }
public
{ Public declarations }
end;
type
PSYSTEM_THREAD = ^SYSTEM_THREAD
var
Form1: TForm1;
function NtQuerySystemInformation(SystemInformationClass:DWORD; SystemInformation:pointer; SystemInformationLength:DWORD; ReturnLength:PDWORD):cardinal; stdcall; external 'ntdll';
implementation
{$R *.dfm}
function IsThreadSuspended:Boolean;
var spi:PSYSTEM_PROCESS_INFORMATION;
crt:PSYSTEM_PROCESS_INFORMATION;
PThreadInfo:PSYSTEM_THREAD;
Size:DWORD;
j:Integer;
LastProcess:Boolean;
begin
Result:=False; // Default result, will be also returned if any error arises.
// If process ID is 0 then we use current process ID
If AProcessID=0 then AProcessID:=GetCurrentProcessId;
if (NtQuerySystemInformation(5,nil,0,#Size)=STATUS_INFO_LENGTH_MISMATCH) and (Size>0) then
begin
GetMem(spi,Size);
try
if NtQuerySystemInformation(5,spi,Size,#Size)=0 then
begin
crt:=spi;
LastProcess:=False;
While not LastProcess do
begin
LastProcess:=crt^.NextEntryOffset = 0;
if crt^.ProcessID=AProcessID then
begin
for j := 0 to crt^.NumberOfThreads-1 do
begin
PThreadInfo:=PSYSTEM_THREAD(#crt^.ThreadInfo[j]);
if PThreadInfo^.UniqueThread = AThreadID then
begin
if PThreadInfo^.WaitReason = 5 then Exit(True) // the thread is suspended
else Exit(False); // the thread is not suspended
Break;
end;
end;
Break;
end;
crt := Pointer(DWORD(crt) + crt^.NextEntryOffset);
end;
end else Exit; // failed listing processes!
finally
FreeMem(spi);
end;
end
else Exit; // failed listing processes!
end;
end.

Answer 1

Declaration
type
PSYSTEM_THREADS = ^SYSTEM_THREADS;
SYSTEM_THREADS = packed record
KernelTime: LARGE_INTEGER;
UserTime: LARGE_INTEGER;
CreateTime: LARGE_INTEGER;
WaitTime: ULONG;
StartAddress: Pointer;
UniqueProcess: DWORD;
UniqueThread: DWORD;
Priority: Integer;
BasePriority: Integer;
ContextSwitchCount: ULONG;
State: Longint;
WaitReason: Longint;
end;
type
PSYSTEM_PROCESS_INFORMATION = ^SYSTEM_PROCESS_INFORMATION;
SYSTEM_PROCESS_INFORMATION = packed record
NextOffset: ULONG;
ThreadCount: ULONG;
Reserved1: array [0..5] of ULONG;
CreateTime: FILETIME;
UserTime: FILETIME;
KernelTime: FILETIME;
ModuleNameLength: WORD;
ModuleNameMaxLength: WORD;
ModuleName: PWideChar;
BasePriority: ULONG;
ProcessID: ULONG;
InheritedFromUniqueProcessID: ULONG;
HandleCount: ULONG;
Reserved2 : array[0..1] of ULONG;
PeakVirtualSize : ULONG;
VirtualSize : ULONG;
PageFaultCount : ULONG;
PeakWorkingSetSize : ULONG;
WorkingSetSize : ULONG;
QuotaPeakPagedPoolUsage : ULONG;
QuotaPagedPoolUsage : ULONG;
QuotaPeakNonPagedPoolUsage : ULONG;
QuotaNonPagedPoolUsage : ULONG;
PageFileUsage : ULONG;
PeakPageFileUsage : ULONG;
PrivatePageCount : ULONG;
ReadOperationCount : LARGE_INTEGER;
WriteOperationCount : LARGE_INTEGER;
OtherOperationCount : LARGE_INTEGER;
ReadTransferCount : LARGE_INTEGER;
WriteTransferCount : LARGE_INTEGER;
OtherTransferCount : LARGE_INTEGER;
ThreadInfo: array [0..0] of SYSTEM_THREADS;
end;
function NtQuerySystemInformation(SystemInformationClass:DWORD; SystemInformation:pointer; SystemInformationLength:DWORD; ReturnLength:PDWORD):cardinal; stdcall; external 'ntdll';
Function
function IsProcessSuspended(PID:Cardinal):Boolean;
var spi:PSYSTEM_PROCESS_INFORMATION;
crt:PSYSTEM_PROCESS_INFORMATION;
PThreadInfo:PSYSTEM_THREADS;
Size:DWORD;
LastProcess:Boolean;
const
STATUS_INFO_LENGTH_MISMATCH = $C0000004;
begin
Result:=False;
if (NtQuerySystemInformation(5,nil,0,#Size)=STATUS_INFO_LENGTH_MISMATCH) and (Size>0) then
begin
GetMem(spi,Size);
try
if NtQuerySystemInformation(5,spi,Size,#Size)=0 then
begin
crt:=spi;
LastProcess:=False;
While LastProcess=false do
begin
LastProcess:=crt^.NextOffset=0;
if crt^.ProcessID=PID then
begin
PThreadInfo:=PSYSTEM_THREADS(#crt^.ThreadInfo[0]); //check only main thread
if PThreadInfo^.WaitReason=5 then Result:=True else Result:=False;
Break;
end;
crt:=Pointer(DWORD(crt)+crt^.NextOffset);
end;
end
else Exit; // failed listing processes!
finally
FreeMem(spi);
end;
end
else Exit; // failed listing processes!
end;