We have a driver which can install hooks into process’s ntdll functions. It attaches to the process, injects our dll there and creates a thread using injected function, which is responsible for installing and uninstalling hooks. It works good, hooks doesn’t break process execution and when the time for uninstall is come, hooks are releasing gracefully, original functions turns back into it’s natural state. The problem is that somehow some processes are suspended into DeepFreeze state, so when driver creating a new thread to uninstall hooks, process are still suspended and thread unable to start.
I tried to resume this processes using Process Explorer - Windows freezes it back instantly. I tried to set thread’s high priority, tried to resume process/thread manually using PsResumeProcess/NtResumeThread - nothing works. I’ve read that in Windows 10 Microsoft announced a new feature - suspending processes to save energy, energy saving properties was disabled. However, if I manually suspend process with hooks, I can resume it without any problem. We can move code which installs hooks in the kernel, but this is not preferable option.
The main target processes which couldn’t be resumed are Winstore.App, Microsoft.Photos and Microsoft Edge.
Any thoughts what is it and what can help?
Ok, I found a half-solution for my problem. That annoying processes was UWP processes which has “very suspended state”. I haven’t found how to resume it yet, but I found how to detect them and avoid installing hooks. Using this function I can see if current process is UWP process and reject hook installing.
As stated in this doc, uwp app shall listen OnSuspend event and manage opened handles when it fires, but it seems impossible to me to listen this managed event from unmanaged code in mapped-by-hand dll.
Have there any undocumented field in peb, which flags process is UWP process?