CSR_PROCESS

The CSR_PROCESS structure is what CSRSRV.DLL and the various server DLLs in the CSRSS.EXE server process use for representing a client process.

Documentation Status

The CSR_PROCESS structure is not documented. Neither is Microsoft known to have published a C-language definition in any header from any software development kit.

Type information for the CSR_PROCESS is in public symbol files for CSRSS.EXE starting with Windows Vista. Earlier type information is known in a statically linked library, named GDISRVL.LIB, which Microsoft published with the Device Driver Kit (DDK) for Windows NT 3.51.

Members, but not types, are also listed by the !dso command as implemented in the USEREXTS and USERKDX debugger extensions from the DDK for Windows 2000.

Variability

Considering how little of anything to do with CSRSS is documented, the CSR_PROCESS is surprisingly stable. Tidying in the early versions and then the gradual withdrawal of functionality from CSRSS has seen the CSR_PROCESS shrink but it is very well settled since Windows 7. The following changes of size are known:

Layout

These sizes and the names and types in the table that follows are from type information in public symbol files (or such as would ordinarily be in public symbol files) for version 3.51 as an isolated case and for version 6.0 and higher. What’s known of Microsoft’s names and types for other versions is something of a guess, being inferred from what use CSRSRV is seen to make of the structure. Where use of a member corresponds closely with that of a version for which Microsoft’s symbols are available, it seems reasonable to suppose continuity. Some use, however, has no correspondence, the code having changed too much. Even where the use hasn’t changed, tracking it down exhaustively would be difficult, if not impossible, even with source code.

CLIENT_ID ClientId;

LIST_ENTRY ListLink;

CSR_PROCESS *Parent;

LIST_ENTRY ThreadList;

CSR_PROCESS *Parent;

CSR_NT_SESSION *NtSession;

ULONG ExpectedVersion;

HANDLE ClientPort;

CHAR *ClientViewBase;

CHAR *ClientViewBounds;

CLIENT_ID ClientId;

HANDLE ProcessHandle;

ULONG SequenceNumber;

ULONG Flags;

ULONG DebugFlags;

CLIENT_ID DebugUserInterface;

ULONG ReferenceCount;

ULONG ProcessGroupId;

ULONG ProcessGroupSequence;

ULONG fVDM;

ULONG ThreadCount;

UCHAR PriorityClass;

ULONG LastMessageSequence;

UCHAR Spare0;

UCHAR Spare1;

UCHAR Spare2;

ULONG Spare3;

ULONG NumOutstandingMessages;

ULONG ShutdownLevel;

ULONG ShutdownFlags;

LUID Luid;

PVOID ServerDllPerProcessData [ANYSIZE_ARRAY];

The CSR_PROCESS is built in a memory block that continues with:

• as many ServerDllPerProcessData elements as there can be server DLLs;
• as much additional per-process space as the server DLLs have collectively requested.

A server DLL requests per-process space for all future processes by setting the wanted amount into the PerProcessDataLength member of the CSR_SERVER_DLL during initialisation. Each server DLL’s allowance is aligned up to 4 bytes in version 3.10 but 8 bytes in all later versions. Each ServerDllPerProcessData element points to the allowance for the corresponding server DLL (or is NULL if the server DLL has no per-process space).