I looked up the source code of the functions like CreateProcess
and CreateThreade
from kernel32
. For example, CreateThread@kernel32
leads into kernelbase.dll
and ends with a call to NtCreateThreadEx
.
I cannot see any calls to CsrClientCallServer
in that function, There are only few checks and a call to RtlActivateActivationContextEx
. I wonder if those calls are necessary for a process to function
I looked up in the ntdll
there is no function with the name CsrClientCallServer
. However there are functions like NtConnectPort
and so on, to use the LPC mechanism.
I assume CsrClientCallServer
was built on top of the functions like NtConnectPort
, NtReplyPort
with some specific parameters.
My question is: is it necessary to notify csrss about the created thread from user mode?
It is unclear to me from wininternals and other books should this be done or not, for the thread of the existing process. I tried to create the thread using old NtCreateThread
on win10 and it works fine, without any notifications via LPC But will the same code work on xp for example?