CSR_THREAD

The CSR_THREAD structure is what CSRSRV.DLL and the various server DLLs in the CSRSS.EXE server process use for representing a client thread.

Documentation Status

The CSR_THREAD structure is not documented. Neither is Microsoft known to have disclosed a C-language definition in any header from any publicly available kit for any sort of software development.

Type information for the CSR_THREAD is in public symbol files for CSRSS.EXE starting with Windows Vista. Earlier type information is known in a statically linked library, named GDISRVL.LIB, which Microsoft published with the Device Driver Kit (DDK) for Windows NT 3.51.

Members, but not types, are also listed by the !dso command as implemented in the USEREXTS and USERKDX debugger extensions from the DDK for Windows 2000.

Variability

Considering how little of anything to do with CSRSS is documented, the CSR_THREAD is surprisingly stable. Members are rearranged in the early versions and then a substantial withdrawal of thread-level functionality from CSRSS in and after version 4.0 saw the CSR_THREAD shrink, but the only change since has been one member’s removal. The following changes of size are known:

Layout

These sizes and the names and types in the table that follows are from type information in public symbol files (or such as would ordinarily be in public symbol files) for version 3.51 as an isolated case and for version 6.0 and higher. What’s known of Microsoft’s names and types for other versions is something of a guess, being inferred from what use CSRSRV is seen to make of the structure. Where use of a member corresponds closely with that of a version for which Microsoft’s symbols are available, it seems reasonable to suppose continuity. Some use, however, has no correspondence, the code having changed too much. Even where the use hasn’t changed, tracking it down exhaustively would be difficult, if not impossible, even with source code.

LARGE_INTEGER CreateTime;

LIST_ENTRY Link;

LIST_ENTRY HashLinks;

CLIENT_ID ClientId;

CSR_PROCESS *Process;

CSR_WAIT_BLOCK *WaitBlock;

CLIENT_ID ClientId;

HANDLE ThreadHandle;

ULONG Flags;

ULONG ReferenceCount;

LIST_ENTRY HashLinks;

LARGE_INTEGER CreateTime;

NTSTATUS ShutDownStatus;

PVOID ServerId;

PVOID ServerThread;

ULONG ImpersonateCount;

BOOLEAN ThreadConnected;

HANDLE ClientEventPairHandle;

HANDLE ClientSectionHandle;

CHAR *ClientSharedMemoryBase;

HANDLE ServerEventPairHandle;

HANDLE ServerSectionHandle;

HANDLE ServerThreadHandle;

CHAR *ServerSharedMemoryBase;

ULONG SharedMemorySize;

ULONG ImpersonateCount;

BOOLEAN ThreadConnected;

BOOLEAN Dying;

PVOID ServerDllPerThreadData [1];

No use is known of the Dying member even in the version for which type information shows it as defined.

Up to and including version 4.0, the CSR_THREAD is built in a memory block that continues with:

• as many ServerDllPerThreadData elements as there can be server DLLs;
• as much additional per-thread space as the server DLLs have collectively requested.

A server DLL requests per-thread space for all future processes by setting the wanted amount into the PerThreadDataLength member of the CSR_SERVER_DLL during initialisation. Each server DLL’s allowance is aligned up to 4 bytes in version 3.10 but 8 bytes in later versions. Each ServerDllPerThreadData element points to the allowance for the corresponding server DLL (or is NULL if the server DLL has no per-thread space).