[{"data":1,"prerenderedAt":79},["ShallowReactive",2],{"page-\u002Fsystem\u002Fwindows\u002Fcsrss客户端与服务器运行时子系统":3},{"id":4,"title":5,"body":6,"description":66,"extension":67,"meta":68,"navigation":74,"path":75,"seo":76,"stem":77,"__hash__":78},"content\u002Fsystem\u002Fwindows\u002Fcsrss客户端与服务器运行时子系统.md","Csrss客户端与服务器运行时子系统",{"type":7,"value":8,"toc":61},"minimark",[9,18,21,25,58],[10,11,12,13,17],"p",{},"如果你的工作是 Windows 内核架构、进程管理，甚至安全对抗（比如 EDR 绕过、Rootkit 隐藏）的笔记或系列文章，",[14,15,16],"code",{},"csrss.exe"," 是离不开的",[10,19,20],{},"Client Server Runtime Subsystem（客户端\u002F服务器运行时子系统），是用户态最高的长官，windows的用户态分为两个部分，csrss.exe负责管理环境，内核负责的底层调度。",[22,23,24],"h2",{"id":24},"它的工作",[26,27,28,43,52],"ol",{},[29,30,31,35,36,39,40,42],"li",{},[32,33,34],"strong",{},"进程与线程的“接生婆”","：",[14,37,38],{},"CreateProcess"," 表面上是你调用的，但底层实际上是内核通知 ",[14,41,16],{}," 来完成进程控制块（EPROCESS）的初始化和销毁。没有它，谁也别想启动。",[29,44,45,48,49,51],{},[32,46,47],{},"控制台（Console）的唯一主人","：你平时打开的 CMD 窗口，所有字符的渲染、键盘鼠标输入的捕获，底层全是 ",[14,50,16],{}," 在处理。",[29,53,54,57],{},[32,55,56],{},"进程通信（IPC）与关机管理","：它维护着系统级的全局句柄，并且在系统关机时，负责通知所有进程安全退出。",[10,59,60],{},"它是免死的，如果有恶意软件通过内核驱动想要杀死他，系统会直接触发CRITICAL_PROCESS_DIED蓝屏。正常情况下csrss.exe的父进程是smss.exe会话管理器，很多病毒会伪造csrss.exe的子进程，或者自己伪造成csrss，甚至跨会话注入，因为安全软件默认对它有极大的信任。",{"title":62,"searchDepth":63,"depth":63,"links":64},"",2,[65],{"id":24,"depth":63,"text":24},"如果你的工作是 Windows 内核架构、进程管理，甚至安全对抗（比如 EDR 绕过、Rootkit 隐藏）的笔记或系列文章，csrss.exe 是离不开的","md",{"date":69,"tags":70},"2026-08-21",[71,72,73],"windows","csrss","system",true,"\u002Fsystem\u002Fwindows\u002Fcsrss客户端与服务器运行时子系统",{"description":66},"system\u002Fwindows\u002Fcsrss客户端与服务器运行时子系统","zN9aEthtv4mIqZyyWz5ye5JmyRpZr-8bvJl5avCeHXo",1792775418003]