I looked up the source code of the functions like
kernel32. For example,
CreateThread@kernel32 leads into
kernelbase.dll and ends with a call to
I cannot see any calls to
CsrClientCallServer in that function, There are only few checks and a call to
RtlActivateActivationContextEx. I wonder if those calls are necessary for a process to function
I looked up in the
ntdll there is no function with the name
CsrClientCallServer. However there are functions like
NtConnectPort and so on, to use the LPC mechanism.
CsrClientCallServer was built on top of the functions like
NtReplyPort with some specific parameters.
My question is: is it necessary to notify csrss about the created thread from user mode?
It is unclear to me from wininternals and other books should this be done or not, for the thread of the existing process. I tried to create the thread using old
NtCreateThread on win10 and it works fine, without any notifications via LPC But will the same code work on xp for example?