Suspend Process

The freeze-a-process trick from the debug API. DebugActiveProcess attaches your program as the target's debugger, which immediately suspends every thread in the target; the first WaitForDebugEvent returns the initial suspend event, and from then on the target simply sits frozen - no one is pumping its debug events, so nothing resumes it. When this program exits (or calls DebugActiveProcessStop), Windows detaches and the target continues where it left off. It is the 9x-era equivalent of "pause this app"; modern code would normally use NtSuspendProcess/thread suspension instead, but this remains a neat demonstration of what debugger attachment actually does.

#include <windows.h>
#include <stdio.h>

int main()
{
    DEBUG_EVENT DE;
    long ProcID;
    char CmdLine [257];

    printf("%s\n","Process Termination using DebugActiveProcess");
    printf("Process ID: ");

    gets(CmdLine);
    ProcID = atof(CmdLine);

    if(DebugActiveProcess(ProcID) == 0)
    {
        printf("%s\n","Error - couldn't attach to process.");
    }
    else {
        printf("%s\n","Attached to process - suspending ...");
        WaitForDebugEvent(&DE, 0);
        printf("Suspended. Press enter to finish (both apps will end) ... ");
        gets(CmdLine);
    }

    WaitForDebugEvent(&DE, INFINITE);
    return TRUE;
}

It is the sibling of the Kill Process article - same attach mechanism, different outcome: there the attach/teardown cycle ends the target, here the target survives the session frozen and unfrozen. As with that snippet, replace gets with fgets before building on a modern toolchain.