Prevent SuspendThread API

Question

Hi.
I'm making a anti cheat for a game, and there's a cheater injector that have the option of "Suspend", analysing, it uses SuspendThread API.
How can i prevent it from suspend my app?

Answer 1

Hi,
As far as I know, a thread cannot prevent itself from been suspended by SuspendThread API, but, here is a walk-around solution: we can start a new thread, the new thread will check whether the target thread has been suspended every fixed interval, if the target thread was suspended, we can stop the game process or even terminate the game process, so that the cheater will not take effect.

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

Answer 2

Hi,
As far as I know, a thread cannot prevent itself from been suspended by SuspendThread API, but, here is a walk-around solution: we can start a new thread, the new thread will check whether the target thread has been suspended every fixed interval, if the target thread was suspended, we can stop the game process or even terminate the game process, so that the cheater will not take effect.

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

I already tried this.

On Form_Load

Dim t As Thread = New Thread(New ThreadStart(AddressOf Verify))

t.Start()

Sub Verify()

While True

MsgBox("a")

End While

End Sub

I did just to se if the SuspendThread stops all threads and it stoped the Verify() too.

Answer 3

Hi,
Do you mean the cheater stops all threads of your game process?

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

Answer 4

Hi,
Do you mean the cheater stops all threads of your game process?

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

No, no.

The anti cheat works on background (but it can be seen by the Process List of the cheat) and the cheat have a option to select the process in it Process List and then "Suspend" the process.

Taking a look on a debugger it calls the SuspendThread API and then my routins are stopped and he can use the cheat.

Answer 5

Hi,
Yes, this API is mostly used in debuggers, my idea is that we can start another working thread (or even a new process) to detect your game thread status, if the cheater suspend your game thread, the new thread can resume the game thread, or exit the game. is it acceptable to you?

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

Answer 6

Hi,
Yes, this API is mostly used in debuggers, my idea is that we can start another working thread (or even a new process) to detect your game thread status, if the cheater suspend your game thread, the new thread can resume the game thread, or exit the game. is it acceptable to you?

Thanks,
Eric

---

Please remember to mark helpful replies as answers and unmark them if they provide no help.

I tried do this by Process.WorkingSet(), but sometimes returns the same amount of memory. Do you have an idea on how do this?