Anatomy of the thread suspension mechanism in Windows

Windows NT constantly uses the terms “user mode” and “kernel mode” when discussing the architecture of the OS, so you should determine what it means. This article is divided into separate sections. The first section will discuss the user mode, and the second section will discuss the kernel mode. In both sections, the issue of the suspension and resumption of process flows is discussed.

The second section shows examples of pausing / resuming the process from kernel mode, as well as an explanation of how NtSuspendProcess / NtSuspendThread / NtResumeProcess / NtResumeThread really works in the kernel.

This article is full of detailed descriptions of various methods and fragments. This article is not about how the system call works and how the kernel processes them, it’s about suspending the processes and how the mechanism works.

More.