Question

I am creating a child process with creatprocess api.And i created a jobobject and assigned this child process to jobobject.
Now, if i kill my parent process, child process terminates too.But if i suspend parent process, child process doesn’t suspend and continue execution.
is there any option to suspend child process, when parent process is suspended?

Delphi Code which i have used for creating a process

Function ExecuteProcess(EXE : String) : THandle;

Var
SI      : TStartupInfo;
PI      : TProcessInformation;
Begin
  Result := INVALID_HANDLE_VALUE;
  FillChar(SI,SizeOf(SI),0);
  SI.cb := SizeOf(SI);
  If 
    CreateProcess(nil,PChar('.\'+EXE),nil,nil,False,CREATE_SUSPENDED,
     nil,nil,SI,PI) Then 
   Begin
    ResumeThread(PI.hThread);
    CloseHandle(PI.hThread);
    Result := PI.hProcess;
   End
  Else ShowMessage('CreateProcess failed: '+
                   SysErrorMessage(GetLastError));
End;

Answer 1

From the Windows API perspective, there’s no such thing as suspending a process. Only threads can be suspended, but there are no parent-child relationships between threads. Since there are no “child threads,” there is no automatic mechanism for suspending them when the parent is suspended. (You can create a process suspended, but that’s because when it’s first created, there’s only one thread, and it is created suspended.)

If you want to suspend all the threads of the child process, then enumerate them and suspend them the same way you suspend the threads of the parent process.

You might also try the undocumented NtSuspendProcess function, as mentioned in Windows: Atomically suspend an entire process?