.NET的键盘Hook管理类，用于禁用键盘输入和切换

一、MyHook帮助类

 此类需要编写指定屏蔽的按键，灵活性差。

using System;
using System.Runtime.InteropServices;
using System.Diagnostics;
using System.Windows.Forms;
using Microsoft.Win32;
 
namespace MyHookClass
{
    /// <summary>
    /// 类一
    /// </summary>
    public class MyHook
    {
        //消息函数的委托
        public delegate int HookProc(int nCode, int wParam, IntPtr lParam);
        static int hHook = 0;
        public const int WH_KEYBOARD_LL = 13;//底层键盘钩子
        static HookProc KeyBoardHookProcedure;
 
        //按键信息结构
        [StructLayout(LayoutKind.Sequential)]
 
        public class KeyBoardHookStruct
        {
            public int vkCode;
            public int scanCode;
            public int flags;
            public int time;
            public int dwExtraInfo;
        }
 
        //安装钩子
        [DllImport("user32.dll")]
        public static extern int SetWindowsHookEx(int idHook, HookProc lpfn, IntPtr hInstance, int threadId);
 
        //卸载钩子
        [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
        public static extern bool UnhookWindowsHookEx(int idHook);
 
        //下一个钩挂的函数
        [DllImport("user32.dll")]
        public static extern int CallNextHookEx(int idHook, int nCode, int wParam, IntPtr lParam);
 
        //返回当前线程 ID
        [DllImport("kernel32.dll")]
        public static extern int GetCurrentThreadId();
 
        //得到模块的句柄
        [DllImport("kernel32.dll")]
        public static extern IntPtr GetModuleHandle(string name);
 
        //安装钩子
        public static void InsertHook()
        {
            if (hHook == 0)
            {
                KeyBoardHookProcedure = new HookProc(KeyBoardHookProc);
                hHook = SetWindowsHookEx(WH_KEYBOARD_LL,
                          KeyBoardHookProcedure,
                        GetModuleHandle(Process.GetCurrentProcess().MainModule.ModuleName), 0);
                if (hHook == 0)
                {
                    UnHook();
                    throw new Exception("设置Hook失败!");
                }
                else
                {
                    RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System", true);
                    if (key == null)//如果该项不存在的话，则创建该项
                        key = Registry.CurrentUser.CreateSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System");
                    key.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
                    //key.SetValue("DisableLockWorkstation", 1, RegistryValueKind.DWord);
                    key.Close();
                }
            }
        }
 
        //卸载钩子
        public static void UnHook()
        {
            bool retKeyboard = true;
            if (hHook != 0)
            {
                retKeyboard = UnhookWindowsHookEx(hHook);
                hHook = 0;
            }
            //if (!retKeyboard) throw new Exception("卸载Hook失败!");
            RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System", true);
            if (key != null)
            {
                key.DeleteValue("DisableTaskMgr", false);
                //key.DeleteValue("DisableLockWorkstation", false);
                key.Close();
            }
        }
 
        //按键消息的处理函数
        public static int KeyBoardHookProc(int nCode, int wParam, IntPtr lParam)
        {
            if (nCode >= 0)
            {
                KeyBoardHookStruct kbh = (KeyBoardHookStruct)Marshal.PtrToStructure(lParam, typeof(KeyBoardHookStruct));
                //添加自己的判断语句，如果符合要求的按键，就 return 1; 
                //没有判断直接 return 1;那么就屏蔽所有按键除了ctrl+alt+del
                //屏蔽Ctrl+Esc
                if (kbh.vkCode == (int)Keys.Delete && (int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Alt)      //截获Ctrl+Alt+Delete
                {
                    PubLibrary.WriteErrLog("1.拦截信息：Ctrl+Alt+Delete");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Escape)
                {
                    PubLibrary.WriteErrLog("2.拦截信息：Escape");
                    return 1;
                }
                if (kbh.vkCode == 91) // 截获左win(开始菜单键) 
                {
                    PubLibrary.WriteErrLog("3.拦截信息：截获左win");
                    return 1;
                }
 
                if (kbh.vkCode == 92)// 截获右win 
                {
                    PubLibrary.WriteErrLog("4.拦截信息：截获右win");
                    return 1;
                }
 
                //if (kbh.vkCode == (int)Keys.L)
                //{
                //    PubLibrary.WriteErrLog("5.拦截信息：L");
                //    return 1;
                //}
 
                if (kbh.vkCode == (int)Keys.Alt)
                {
                    PubLibrary.WriteErrLog("6.拦截信息：Alt");
                    return 1;
                }
                if ((int)Control.ModifierKeys == (int)Keys.Alt) //截获alt
                {
                    PubLibrary.WriteErrLog("7.拦截信息：Alt");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Escape && (int)Control.ModifierKeys == (int)Keys.Control) //截获Ctrl+Esc 
                {
                    PubLibrary.WriteErrLog("8.拦截信息：Ctrl+Esc");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Escape && (int)Control.ModifierKeys == (int)Keys.Alt) //截获Alt+Esc 
                {
                    PubLibrary.WriteErrLog("9.拦截信息：Alt+Esc");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.F4 && (int)Control.ModifierKeys == (int)Keys.Alt) //截获alt+f4 
                {
                    PubLibrary.WriteErrLog("10.拦截信息：F4+Alt");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Tab && (int)Control.ModifierKeys == (int)Keys.Alt) //截获alt+tab
                {
                    PubLibrary.WriteErrLog("10.拦截信息：alt+tab");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Escape && (int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Shift) //截获Ctrl+Shift+Esc
                {
                    PubLibrary.WriteErrLog("11.拦截信息：Ctrl+Shift+Esc");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Space && (int)Control.ModifierKeys == (int)Keys.Alt) //截获alt+空格 
                {
                    PubLibrary.WriteErrLog("12.拦截信息：alt+空格");
                    return 1;
                }
 
                if (kbh.vkCode == 241) //截获F1 
                {
                    PubLibrary.WriteErrLog("13.拦截信息：F1");
                    return 1;
                }
 
                if ((int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Alt + (int)Keys.Delete)      //截获Ctrl+Alt+Delete 
                {
                    PubLibrary.WriteErrLog("14.拦截信息：Ctrl+Alt+Delete");
                    return 1;
                }
 
                if ((int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Shift) //截获Ctrl+Shift 
                {
                    PubLibrary.WriteErrLog("15.拦截信息：Ctrl+Shift");
                    return 1;
                }
 
                if (kbh.vkCode == (int)Keys.Space && (int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Alt) //截获Ctrl+Alt+空格 
                {
                    PubLibrary.WriteErrLog("16.拦截信息：Ctrl+Alt+空格");
                    return 1;
                }
            }
 
            return CallNextHookEx(hHook, nCode, wParam, lParam);
        }
    }
}
 

二、KeyboardHookLib帮助类

using System;
using System.Runtime.InteropServices;
using System.Diagnostics;
using Microsoft.Win32;
 
namespace VendorSoftwareReleaseLW.Class
{
    /// <summary>
    /// 键盘Hook管理类
    /// </summary>
    public class KeyboardHookLib
    {
        private const int WH_KEYBOARD_LL = 13; //键盘
 
        //键盘处理事件委托 ,当捕获键盘输入时调用定义该委托的方法.
        private delegate int HookHandle(int nCode, int wParam, IntPtr lParam);
 
        //客户端键盘处理事件
        public delegate void ProcessKeyHandle(HookStruct param, out bool handle);
 
        //接收SetWindowsHookEx返回值
        private static int _hHookValue = 0;
 
        //勾子程序处理事件
        private HookHandle _KeyBoardHookProcedure;
 
        //Hook结构
        [StructLayout(LayoutKind.Sequential)]
        public class HookStruct
        {
            public int vkCode;
            public int scanCode;
            public int flags;
            public int time;
            public int dwExtraInfo;
        }
 
        //设置钩子
        [DllImport("user32.dll")]
        private static extern int SetWindowsHookEx(int idHook, HookHandle lpfn, IntPtr hInstance, int threadId);
 
        //取消钩子
        [DllImport("user32.dll", CharSet = CharSet.Auto, CallingConvention = CallingConvention.StdCall)]
        private static extern bool UnhookWindowsHookEx(int idHook);
 
        //调用下一个钩子
        [DllImport("user32.dll")]
        private static extern int CallNextHookEx(int idHook, int nCode, int wParam, IntPtr lParam);
 
        //获取当前线程ID
        [DllImport("kernel32.dll")]
        private static extern int GetCurrentThreadId();
 
        //Gets the main module for the associated process.
        [DllImport("kernel32.dll")]
        private static extern IntPtr GetModuleHandle(string name);
 
        private IntPtr _hookWindowPtr = IntPtr.Zero;
 
        //构造器
        public KeyboardHookLib() { }
 
        //外部调用的键盘处理事件
        private static ProcessKeyHandle _clientMethod = null;
 
        /// <summary>
        /// 安装勾子
        /// </summary>
        /// <param name="hookProcess">外部调用的键盘处理事件</param>
        public void InstallHook(ProcessKeyHandle clientMethod)
        {
            _clientMethod = clientMethod;
 
            // 安装键盘钩子
            if (_hHookValue == 0)
            {
                _KeyBoardHookProcedure = new HookHandle(OnHookProc);
 
                _hookWindowPtr = GetModuleHandle(Process.GetCurrentProcess().MainModule.ModuleName);
 
                //************************************ 
                //键盘线程钩子 
                //SetWindowsHookEx( 2,KeyboardHookProcedure, IntPtr.Zero, GetCurrentThreadId()); //GetCurrentThreadId()为要监视的线程ID,你完全可以自己写个方法获取QQ的线程哦 
                //键盘全局钩子,需要引用空间(using System.Reflection;) 
                //SetWindowsHookEx( 13,KeyboardHookProcedure,Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]),0); 
                // 
                //关于SetWindowsHookEx (int idHook, HookProc lpfn, IntPtr hInstance, int threadId)函数将钩子加入到钩子链表中，说明一下四个参数： 
                //idHook 钩子类型，即确定钩子监听何种消息，上面的代码中设为2，即监听键盘消息并且是线程钩子，如果是全局钩子监听键盘消息应设为13， 
                //线程钩子监听鼠标消息设为7，全局钩子监听鼠标消息设为14。 
                // 
                //lpfn 钩子子程的地址指针。如果dwThreadId参数为0 或是一个由别的进程创建的线程的标识，lpfn必须指向DLL中的钩子子程。 除此以外，lpfn可 
                //以指向当前进程的一段钩子子程代码。钩子函数的入口地址，当钩子钩到任何消息后便调用这个函数。 
                // 
                //hInstance应用程序实例的句柄。标识包含lpfn所指的子程的DLL。如果threadId 标识当前进程创建的一个线程，而且子程代码位于当前 
                //进程，hInstance必须为NULL。可以很简单的设定其为本应用程序的实例句柄。 
                // 
                //threadedId 与安装的钩子子程相关联的线程的标识符。如果为0，钩子子程与所有的线程关联，即为全局钩子。 
                //************************************ 
 
                _hHookValue = SetWindowsHookEx(
                WH_KEYBOARD_LL,
                _KeyBoardHookProcedure,
                _hookWindowPtr,
                0);
 
                //如果设置钩子失败.
                if (_hHookValue == 0)
                {
 
                    UninstallHook();
                }
                else
                {
                    RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System", true);
                    if (key == null)//如果该项不存在的话，则创建该项
                        key = Registry.CurrentUser.CreateSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System");
                    key.SetValue("DisableTaskMgr", 1, RegistryValueKind.DWord);
                    //key.SetValue("DisableLockWorkstation", 1, RegistryValueKind.DWord);
                    key.Close();
                }
 
            }
        }
 
        //取消钩子事件
        public void UninstallHook()
        {
            if (_hHookValue != 0)
            {
                bool ret = UnhookWindowsHookEx(_hHookValue);
                if (ret) _hHookValue = 0;
            }
 
            RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Policies\System", true);
            if (key != null)
            {
                key.DeleteValue("DisableTaskMgr", false);
                //key.DeleteValue("DisableLockWorkstation", false);
                key.Close();
            }
        }
 
        //钩子事件内部调用,调用_clientMethod方法转发到客户端应用。
        private static int OnHookProc(int nCode, int wParam, IntPtr lParam)
        {
            if (nCode >= 0)
            {
                //转换结构
                HookStruct hookStruct = (HookStruct)Marshal.PtrToStructure(lParam, typeof(HookStruct));
 
                if (_clientMethod != null)
                {
                    bool handle = false;
                    //调用客户提供的事件处理程序。
                    _clientMethod(hookStruct, out handle);
                    if (handle) return 1; //1:表示拦截键盘,return 退出
                }
            }
            return CallNextHookEx(_hHookValue, nCode, wParam, lParam);
        }
    }
}

三、在WinForm中的使用

using Newtonsoft.Json;
using System;
using System.Collections.Generic;
using System.Data;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
using MyHookClass;
using KeyboardHookLibClass;
 
namespace TestForm
{
    public partial class LoginForm : Form
    {
        DateTime _dtNow;
 
        [DllImport("user32.dll")]
        private static extern IntPtr GetForegroundWindow();
        [DllImport("user32.dll")]
        private static extern bool SetForegroundWindow(IntPtr hWnd);
        [DllImport("user32.dll")]
        private static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
        [DllImport("user32.dll")]
        public static extern bool SetWindowPos(IntPtr hWnd, int hWndInsertAfter, int X, int Y, int cx, int cy, int uFlags);
        [DllImport("user32.dll")]
        public static extern bool IsWindowVisible(IntPtr hWnd);
 
        //勾子管理类
        private KeyboardHookLib _keyboardHook = null;
 
        public delegate void ForegroundWin();
 
        private void LoginForm_Load(object sender, EventArgs e)
        {
            SetHook();
 
            Thread threadForeground = new Thread(ShowWindowAsync);
            //threadForeground.IsBackground = true;
            threadForeground.Start();
        }
 
        private void txt_KeyDown(object sender, KeyEventArgs e)
        {
            _dtNow = DateTime.Now;
        }
 
        private void txt_KeyUp(object sender, KeyEventArgs e)
        {
            if (e.KeyCode != Keys.Enter)
            {
                DateTime dtTemp = DateTime.Now;
                TimeSpan ts = dtTemp.Subtract(_dtNow);
                if (ts.Milliseconds > 65)
                {
                    //setTool("错误：禁止手工输入！", "N");
                    txt.Text = "";//清空
                }
            }
        }
 
        private void txtID_KeyPress(object sender, KeyPressEventArgs e)
        {
            if (e.KeyChar == 13)
            {
                //做些操作
                ClearHook();
            }
        }
 
        public static void SetWindowPos(IntPtr hWnd)
        {
            //0x0010为不激活窗口，这个比较关键
            SetWindowPos(hWnd, -1, 0, 0, 0, 0, 0x0001 | 0x0002 | 0x0010);// 0x001 | 0x002 | 0x0010| 0x040
            
        }
 
        private void ShowWindowAsync()
        {
            while (true)
            {
                //高版本的这里可以直接使用Action，更简化一些
                //ForegroundWin d = new ForegroundWin(action);
                //this.Invoke(d);
                Action a = new Action(() => { action(); });
                Thread.Sleep(100);//这个时间间隔，用户基本感觉不出有切换窗体
            }
        }
 
        void action()
        {
            IntPtr hWnd = this.Handle;
            if (hWnd != IntPtr.Zero || GetForegroundWindow() != hWnd)
            {
                //选中当前的句柄窗口
                SetWindowPos(hWnd);
                //SendKeys.SendWait(" ");
            }
        }
 
        private void ClearHook() 
        {
            //取消勾子
            if (_keyboardHook != null) _keyboardHook.UninstallHook();
 
            //MyHook.UnHook();
 
            //ProcessMgr.ResumeWinlogon();
        }
 
        private void SetHook() 
        {
            //安装勾子
            _keyboardHook = new KeyboardHookLib();
            _keyboardHook.InstallHook(this.OnKeyPress);
            //MyHook.InsertHook();
 
            //ProcessMgr.SuspendWinlogon();
        }
 
        /// <summary>
        /// 客户端键盘捕捉事件.
        /// </summary>
        /// <param name="hookStruct">由Hook程序发送的按键信息</param>
        /// <param name="handle">是否拦截</param>
        public void OnKeyPress(KeyboardHookLib.HookStruct hookStruct, out bool handle)
        {
            handle = false; //预设不拦截任何键
 
            if (hookStruct.vkCode == 91) // 截获左win(开始菜单键)
            {
                handle = true;
            }
 
            if (hookStruct.vkCode == 92)// 截获右win
            {
                handle = true;
            }
 
            if ((int)Control.ModifierKeys == (int)Keys.Alt) //截获alt
            {
                handle = true;
            }
 
            //截获Ctrl+Esc
            if (hookStruct.vkCode == (int)Keys.Escape && (int)Control.ModifierKeys == (int)Keys.Control)
            {
                handle = true;
            }
 
            //截获alt+f4
            if (hookStruct.vkCode == (int)Keys.F4 && (int)Control.ModifierKeys == (int)Keys.Alt)
            {
                handle = true;
            }
 
            //截获alt+tab
            if (hookStruct.vkCode == (int)Keys.Tab && (int)Control.ModifierKeys == (int)Keys.Alt)
            {
                handle = true;
            }
 
            //截获alt+tab
            if (hookStruct.vkCode == (int)Keys.Escape && (int)Control.ModifierKeys == (int)Keys.Alt)
            {
                handle = true;
            }
 
            //截获F1
            if (hookStruct.vkCode == (int)Keys.F1)
            {
                handle = true;
            }
 
            //截获Ctrl+Alt+Delete
            if ((int)Control.ModifierKeys == (int)Keys.Control + (int)Keys.Alt + (int)Keys.Delete)
            {
                handle = true;
            }
 
            //如果键A~Z
            if (hookStruct.vkCode >= (int)Keys.A && hookStruct.vkCode <= (int)Keys.Z)
            {
                //挡掉B键
                if (hookStruct.vkCode == (int)Keys.B)
                    hookStruct.vkCode = (int)Keys.None; //设键为0
 
                handle = true;
            }
 
            Keys key = (Keys)hookStruct.vkCode;
            PubLibrary.WriteErrLog("你按下:" + (key == Keys.None ? "" : key.ToString()));
        }
    }
}

四、其他类

using System;
using System.Runtime.InteropServices;
 
namespace ShareToolClass
{
    public class ShareTool : IDisposable
    {
        [DllImport("advapi32.dll", SetLastError = true)]
        static extern bool LogonUser(string pszUsername, string pszDomain, string pszPassword,
            int dwLogonType, int dwLogonProvider, ref IntPtr phToken);
 
        // closes open handes returned by LogonUser       
        [DllImport("kernel32.dll", CharSet = CharSet.Auto)]
        extern static bool CloseHandle(IntPtr handle);
 
        [DllImport("Advapi32.DLL")]
        static extern bool ImpersonateLoggedOnUser(IntPtr hToken);
 
        [DllImport("Advapi32.DLL")]
        static extern bool RevertToSelf();
        const int LOGON32_PROVIDER_DEFAULT = 0;
        const int LOGON32_LOGON_NEWCREDENTIALS = 9;
        const int LOGON32_LOGON_INTERACTIVE = 2;
        private bool disposed;
 
        public ShareTool(string username, string password, string ip)
        {
            // initialize tokens       
            IntPtr pExistingTokenHandle = new IntPtr(0);
            IntPtr pDuplicateTokenHandle = new IntPtr(0);
 
            try
            {
                // get handle to token       
                bool bImpersonated = LogonUser(username, ip, password,
                    LOGON32_LOGON_NEWCREDENTIALS, LOGON32_PROVIDER_DEFAULT, ref pExistingTokenHandle);
 
                if (bImpersonated)
                {
                    if (!ImpersonateLoggedOnUser(pExistingTokenHandle))
                    {
                        int nErrorCode = Marshal.GetLastWin32Error();
                        throw new Exception("ImpersonateLoggedOnUser error;Code=" + nErrorCode);
                    }
                }
                else
                {
                    int nErrorCode = Marshal.GetLastWin32Error();
                    throw new Exception("LogonUser error;Code=" + nErrorCode);
                }
            }
            finally
            {
                // close handle(s)       
                if (pExistingTokenHandle != IntPtr.Zero)
                    CloseHandle(pExistingTokenHandle);
                if (pDuplicateTokenHandle != IntPtr.Zero)
                    CloseHandle(pDuplicateTokenHandle);
            }
        }
 
        protected virtual void Dispose(bool disposing)
        {
            if (!disposed)
            {
                RevertToSelf();
                disposed = true;
            }
        }
 
        public void Dispose()
        {
            Dispose(true);
        }
    }
}

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
 
namespace ProcessMgrClass
{
    class ProcessMgr
    {
        /// <summary>
        /// The process-specific access rights.
        /// </summary>
        [Flags]
        public enum ProcessAccess : uint
        {
            /// <summary>
            /// Required to terminate a process using TerminateProcess.
            /// </summary>
            Terminate = 0x1,
 
            /// <summary>
            /// Required to create a thread.
            /// </summary>
            CreateThread = 0x2,
 
            /// <summary>
            /// Undocumented.
            /// </summary>
            SetSessionId = 0x4,
 
            /// <summary>
            /// Required to perform an operation on the address space of a process (see VirtualProtectEx and WriteProcessMemory).
            /// </summary>
            VmOperation = 0x8,
 
            /// <summary>
            /// Required to read memory in a process using ReadProcessMemory.
            /// </summary>
            VmRead = 0x10,
 
            /// <summary>
            /// Required to write to memory in a process using WriteProcessMemory.
            /// </summary>
            VmWrite = 0x20,
 
            /// <summary>
            /// Required to duplicate a handle using DuplicateHandle.
            /// </summary>
            DupHandle = 0x40,
 
            /// <summary>
            /// Required to create a process.
            /// </summary>
            CreateProcess = 0x80,
 
            /// <summary>
            /// Required to set memory limits using SetProcessWorkingSetSize.
            /// </summary>
            SetQuota = 0x100,
 
            /// <summary>
            /// Required to set certain information about a process, such as its priority class (see SetPriorityClass).
            /// </summary>
            SetInformation = 0x200,
 
            /// <summary>
            /// Required to retrieve certain information about a process, such as its token, exit code, and priority class (see OpenProcessToken, GetExitCodeProcess, GetPriorityClass, and IsProcessInJob).
            /// </summary>
            QueryInformation = 0x400,
 
            /// <summary>
            /// Undocumented.
            /// </summary>
            SetPort = 0x800,
 
            /// <summary>
            /// Required to suspend or resume a process.
            /// </summary>
            SuspendResume = 0x800,
 
            /// <summary>
            /// Required to retrieve certain information about a process (see QueryFullProcessImageName). A handle that has the PROCESS_QUERY_INFORMATION access right is automatically granted PROCESS_QUERY_LIMITED_INFORMATION.
            /// </summary>
            QueryLimitedInformation = 0x1000,
 
            /// <summary>
            /// Required to wait for the process to terminate using the wait functions.
            /// </summary>
            Synchronize = 0x100000
        }
 
        [DllImport("ntdll.dll")]
        private static extern uint NtResumeProcess([In] IntPtr processHandle);
 
        [DllImport("ntdll.dll")]
        private static extern uint NtSuspendProcess([In] IntPtr processHandle);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        private static extern IntPtr OpenProcess(
        ProcessAccess desiredAccess,
        bool inheritHandle,
        int processId);
 
        [DllImport("kernel32.dll", SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        private static extern bool CloseHandle([In] IntPtr handle);
 
        public static void SuspendProcess(int processId)
        {
            IntPtr hProc = IntPtr.Zero;
            try
            {
                // Gets the handle to the Process
                hProc = OpenProcess(ProcessAccess.SuspendResume, false, processId);
                if (hProc != IntPtr.Zero)
                    NtSuspendProcess(hProc);
            }
            finally
            {
                // Don't forget to close handle you created.
                if (hProc != IntPtr.Zero)
                    CloseHandle(hProc);
            }
        }
        public static void ResumeProcess(int processId)
        {
            IntPtr hProc = IntPtr.Zero;
            try
            {
                // Gets the handle to the Process
                hProc = OpenProcess(ProcessAccess.SuspendResume, false, processId);
                if (hProc != IntPtr.Zero)
                    NtResumeProcess(hProc);
            }
            finally
            {
                // Don't forget to close handle you created.
                if (hProc != IntPtr.Zero)
                    CloseHandle(hProc);
            }
        }
 
        public static void SuspendWinlogon()
        {
            Process[] processes = Process.GetProcesses();
            foreach (Process process in processes)
            {
                if (process.ProcessName == "winlogon")
                {
                    SuspendProcess(process.Id);
                }
            }
        }
 
        public static void ResumeWinlogon()
        {
            Process[] processes = Process.GetProcesses();
            foreach (Process process in processes)
            {
                Console.WriteLine(process.ProcessName);
                if (process.ProcessName == "winlogon")
                {
                    ResumeProcess(process.Id);
                }
            }
        }
    }
}