Changes on threads and threading system, in new Windows OS

Question

I looked up the source code of the functions like CreateProcess and CreateThreade from kernel32. For example, CreateThread@kernel32 leads into kernelbase.dll and ends with a call to NtCreateThreadEx.

I cannot see any calls to CsrClientCallServer in that function, There are only few checks and a call to RtlActivateActivationContextEx. I wonder if those calls are necessary for a process to function

I looked up in the ntdll there is no function with the name CsrClientCallServer. However there are functions like NtConnectPort and so on, to use the LPC mechanism.

I assume CsrClientCallServer was built on top of the functions like NtConnectPort, NtReplyPort with some specific parameters. My question is: is it necessary to notify csrss about the created thread from user mode?

It is unclear to me from wininternals and other books should this be done or not, for the thread of the existing process. I tried to create the thread using old NtCreateThread on win10 and it works fine, without any notifications via LPC But will the same code work on xp for example?

Answer 1

No. It is not necessary to create a connection with the CSRSS service in order for a process to function. The CSRSS server provides a few functionalities that are not needed for most processes, and therefore can be ignored unless it is requried in that specific process for any reason.

Since NT4, the main functionalities of CSRSS remained mostly the Windows Console GUI and other GUI related services Windows provides to GUI applications. If your process does not require those services it can silently ignore the existance of CSRSS.

Although I'm aware of it independently, this is also stated in wikipedia:

Client/Server Runtime Subsystem, or csrss.exe, is a component of the Windows NT family of operating systems that provides the user mode side of the Win32 subsystem and is included in Windows NT 4 and later. Because most of the Win32 subsystem operations have been moved to kernel mode drivers in Windows NT 4 and later, CSRSS is mainly responsible for Win32 console handling and GUI shutdown.

Additonally, there's a decent (see page 38) amount of documentation about CSRSS online.