This is Wolferajd's Typepad Profile.
Join Typepad and start following Wolferajd's activity
Join Now!
Already a member? Sign In
Recent Activity
Romulo: If it comes to csrss.exe, if you view this "user mode" application, you'll see that the thread cdd.dll is running in special mode, which does not allow you to view stacks. also, it is good to note that csrss.exe is a kernel of Win32 mode, thus' it's hang WILL hang all other applications that are not using Native code (while, I hope all here know Native code uses only kernel-mode programs in Windows). This leads me to say that both csrss.exe and winlogon.exe are in-fact kernel-mode programs, which execute lots of code in kernel-mode, but they have also major user-mode part in the same process. Besides, the csrss.exe "cannot be run in Win32 mode" while, winlogon.exe can do this. :) Besides, hung of winlogon.exe doesn't give bad things (try suspend the process, which I did offen). Conclusion: winlogon.exe is hybrid user-mode process (major part in user-mode, only some calls to kernel-mode), you can even kill it and smss.exe or csrss.exe (not sure which one) will simply terminate all process in your session and reconnect you to new session, destroying previous one. csrss.exe is hybrid kernel-mode process (major part in kernel-mode, mainly for "Canonical display driver" running inside csrss.exe (not to mention the csrss.exe itself is just a kernel-mode loader for JUST DLLs that run, the csrss.exe thread itself does not exist in csrss.exe) The fact you see the process outside of SYSTEM process, does not mean they are user-mode yet. Ofcourse, I am not sure of what I written here, I am pretty much sure that csrss.exe, smss.exe, wininit.exe (Vista), and subsystem programs (optional) all run in KERNEL-MODE, even tho' they are not in SYSTEM(4) process. While csrss.exe and winlogon.exe are exactly at the "border" of kernel-mode, user-mode. (Don't know about services.exe, it runs in early time, but I think it's hybrid too (mostly in user-mode tho'))
Wolferajd is now following The Typepad Team
Jan 1, 2011